concourse-deployer 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9961c750811bf5c2b0be8ccb7903655c1597f00ad643c74b2a2b470a03cb2afc
-  data.tar.gz: 8e32bdeb837566cbc5478cc4c7c9464cd8edd1b6c68297e151828afe6c3df707
+  metadata.gz: 5185fe2d302bb24607cf55f54a04ba6add0733db5f9b0c6ee69603b19faab13d
+  data.tar.gz: 98149d8841e9da19424d99a112791eea552cb7b2994be99ceada2a5869c7e791
 SHA512:
-  metadata.gz: d8bb2e00967f3c3cbd284f35f34e6b59855c795916a6b85d581a42aca0448f494035bc5abb660e7edb7d11a251cc1de2212dc219fa32019e3c4afced43fb0563
-  data.tar.gz: 7457cb3e89f63f9b53b2afcbb98e08a70e7a7c936f98e86b0bb0acc76d9906249e9cc275ee0a36da4168b3185f4cad1f2f0fbace987a735a91971aac31663764
+  metadata.gz: a92e620f3eb30cef9ba6bfbd7a1f8e3cc4674a2ea22125490e2d733759b875deccc3cbb1da09b1a9ea491201de5d8d68743756c5002a21641905598a1827ef0d
+  data.tar.gz: 22248df1030c13eff79f96323633b29bacbf558489797303ae83fde0e9bd30199726441debc31c6aadb941dd63cc08178503091c606b048cc6d0c451f50c5b44

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog for `concourse-deployer`
 
+## v0.5.0 / 2020-03-29
+
+Features:
+
+- Concourse v6.0.0 support.
+
+
+## v0.4.0 / 2019-11-02
+
+Features:
+
+- use the limit-active-tasks container placement strategy
+
+Security:
+
+- do not create or use a local user if a main_team is defined; avoid having a username/password account that could be brute-forced
+
+
 ## v0.3.0 / 2019-02-16
 
 Features:

data/README.md

@@ -61,15 +61,15 @@ Concourse::Deployer.new.create_tasks!
 Available tasks:
 
 ``` sh
-rake bbl:gcp:init[gcp_project_id]      # initialize bosh-bootloader for GCP
-rake bbl:gcp:up                        # terraform your environment and deploy the bosh director
-rake bosh:deploy                       # deploy concourse
-rake bosh:init                         # prepare the concourse bosh deployment
-rake bosh:interpolate                  # view interpolated manifest
-rake bosh:update                       # macro task for all `update` subtasks
-rake bosh:update:concourse_deployment  # update the git submodule for concourse-bosh-deployment
-rake bosh:update:ubuntu_stemcell       # upload ubuntu stemcell to the director
-rake db:connect                        # connect to the postgres database
+rake bbl:gcp:init[gcp_project_id]                 # initialize bosh-bootloader for GCP
+rake bbl:gcp:up                                   # terraform your environment and deploy the bosh director
+rake bosh:deploy                                  # deploy concourse
+rake bosh:init                                    # prepare the concourse bosh deployment
+rake bosh:interpolate                             # view interpolated manifest
+rake bosh:update                                  # macro task for all `update` subtasks
+rake bosh:update:concourse_deployment[commitish]  # update the git submodule for concourse-bosh-deployment (default: master)
+rake bosh:update:ubuntu_stemcell                  # upload ubuntu stemcell to the director
+rake db:connect                                   # connect to the postgres database
 ```
 
 See full instructions below.
@@ -90,7 +90,7 @@ Files which contain sensitive data:
 You will see these files listed in `.gitattributes` invoking git-crypt for them.
 
 
-## Deploying to GCP
+## Deploy to GCP
 
 ### Step 0: create a GCP project, and create and config a Postgres database
 
@@ -241,7 +241,7 @@ This will:
 Note that you will need to type in your database password; this is located in `secrets.yml`.
 
 
-## Upgrading `bbl`
+## Upgrade `bbl`
 
 When a new version of bosh-bootloader comes out, just [download it](https://github.com/cloudfoundry/bosh-bootloader/releases) and make sure it's in your path as `bbl` (check by running `bbl -v`) and then:
 
@@ -254,7 +254,7 @@ $ rake bbl:gcp:up
 Make sure to commit into source control all the changes in your project directory (`bbl-state.json`, `vars/`, `bosh-deployment/`, etc.).
 
 
-## Upgrading `concourse-bosh-deployment`
+## Upgrade `concourse-bosh-deployment`
 
 If a new version of concourse comes out, and you'd like to upgrade, first read the [release notes for Concourse](https://concourse-ci.org/download.html) to check for any relevant breaking changes.
 
@@ -265,6 +265,12 @@ $ rake bosh:update:concourse_deployment
 $ rake bosh:deploy
 ```
 
+If you want to pin your concourse deployment to a specific version (or branch):
+
+``` sh
+$ rake bosh:update:concourse_deployment[v5.0.0]
+```
+
 Make sure you commit to source control the updated git submodule.
 
 
@@ -280,27 +286,9 @@ The gem is available as open source under the terms of the [MIT License](http://
 
 ## TODO
 
-- [ ] update windows stemcell
-- [ ] include windows worker in manifest
-- [ ] deploy windows ruby tools release to the windows vms
-- [x] +      x_frame_options: "SAMEORIGIN"
-- [x] +      container_placement_strategy: random
 - [ ] enable encryption https://concourse.ci/encryption.html
-- [x] allow scaling up/down by locally setting number of VMs (currently hardcoded in gem)
-- [x] start using https://github.com/dpb587/caddy-bosh-release instead of the letsencrypt rake tasks
-
-
-Things to follow up on:
-
-- [x] upgrading! ZOMG
 - [ ] consider swapping secrets-wizarding and rake task for deploy for a shell script that's user-modifiable
 - [ ] bbl feature for suspending/unsuspending the director VM?
 - [ ] stack driver add-on?
 - [ ] metrics? https://concourse-ci.org/metrics.html
 - [ ] credhub for credential management? https://concourse-ci.org/creds.html
-
-
-Things I'm not immediately planning to do but that might be nice:
-
-- [ ] ops file to make the cloud-config come in under default GCP quota
-- [ ] ops files for a few variations on size/cost tradeoffs

data/lib/concourse/deployer.rb

@@ -79,15 +79,6 @@ module Concourse
       ensure_in_envrc "BOSH_DEPLOYMENT", BOSH_DEPLOYMENT
 
       bosh_secrets do |v|
-        v["local_user"] = (v["local_user"] || {}).tap do |local_user|
-          local_user["username"] = "concourse"
-          local_user["password"] ||= if which "apg"
-                                       `apg -n1`.strip
-                                     else
-                                       prompt "Please enter a password"
-                                     end
-        end
-
         v["external_dns_name"] ||= prompt("Please enter a DNS name if you have one", bbl_external_ip)
 
         v["postgres_host"] ||= prompt("External postgres host IP")
@@ -116,6 +107,16 @@ module Concourse
             end
           end
         end
+        if v["main_team"].nil?
+          v["local_user"] = (v["local_user"] || {}).tap do |local_user|
+            local_user["username"] = "concourse"
+            local_user["password"] ||= if which "apg"
+                `apg -m32 -n1`.strip
+              else
+                prompt "Please enter a password"
+              end
+          end
+        end
       end
 
       ensure_file CONCOURSE_DEPLOYMENT_VARS do |f|
@@ -125,13 +126,14 @@ module Concourse
                   "web_vm_type" => "default",
                   "worker_vm_type" => "default", # "n1-standard-2"
                   "worker_ephemeral_disk" => "50GB_ephemeral_disk",
+                  "max-active-tasks-per-worker" => 4, # twice the vCPUs (?)
                 }.to_yaml)
       end
     end
 
-    def bosh_update_concourse_deployment(branch_or_tag)
-      branch_or_tag ||= "master"
-      ensure_git_submodule "https://github.com/concourse/concourse-bosh-deployment", branch_or_tag
+    def bosh_update_concourse_deployment(commitish)
+      commitish ||= "master"
+      ensure_git_submodule "https://github.com/concourse/concourse-bosh-deployment", commitish
     end
 
     def bosh_update_ubuntu_stemcell
@@ -180,18 +182,19 @@ module Concourse
         c << "-l ../versions.yml"
         c << "-l ../../#{BOSH_SECRETS}"
         c << "--vars-store ../../#{BOSH_VARS_STORE}"
-        c << "-o operations/basic-auth.yml"
+        c << "-o operations/basic-auth.yml" unless bosh_secrets["main_team"]
         c << "-o operations/web-network-extension.yml"
         c << "-o operations/external-postgres.yml"
         c << "-o operations/external-postgres-tls.yml"
         c << "-o operations/external-postgres-client-cert.yml"
         c << "-o operations/worker-ephemeral-disk.yml"
         c << "-o operations/x-frame-options-sameorigin.yml"
-        c << "-o operations/container-placement-strategy-random.yml"
+        c << "-o operations/container-placement-strategy-limit-active-tasks.yml"
         c << "-o operations/scale.yml"
         c << "-o ../../#{BOSH_OPERATIONS}" if File.exists?(BOSH_OPERATIONS)
         c << "-o operations/github-auth.yml" if bosh_secrets["github_client"]
         c << "--var network_name=default"
+        c << "--var azs=[z1]"
         c << "--var external_host='#{external_dns_name}'"
         c << "--var external_url='#{external_url}'"
         c << "--var deployment_name=#{BOSH_DEPLOYMENT}"
@@ -263,9 +266,9 @@ module Concourse
              ]
 
         namespace "update" do
-          desc "update the git submodule for concourse-bosh-deployment"
-          task "concourse_deployment", ["branch_or_tag"] do |t, args|
-            bosh_update_concourse_deployment args["branch_or_tag"]
+          desc "update the git submodule for concourse-bosh-deployment (default: master)"
+          task "concourse_deployment", ["commitish"] do |t, args|
+            bosh_update_concourse_deployment args["commitish"]
           end
 
           desc "upload ubuntu stemcell to the director"

data/lib/concourse/deployer/version.rb

@@ -1,5 +1,5 @@
 module Concourse
   class Deployer
-    VERSION = "0.3.0"
+    VERSION = "0.5.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: concourse-deployer
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Mike Dalessio
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-02-17 00:00:00.000000000 Z
+date: 2020-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: term-ansicolor
@@ -122,7 +122,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.1
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Rake tasks to help BOSH-deploy a Concourse CI environment.