ecs_deployer 0.1.10 → 0.1.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7389166ccf5aedfa60a4274b67ecc8e2a0e3faa7
-  data.tar.gz: 9c226a64f7c98e0cdba90a18e5256f948a7c69a0
+  metadata.gz: f39f6fb29ced22c5963b3de48db83c401289d556
+  data.tar.gz: 6088d0a59625590d39742ab54898427ca51150a7
 SHA512:
-  metadata.gz: 5a8af3bf684b549e10b389c413e6d6eb3b2c54f6747420f6604791b4a1a162601067efca5f2c4ea41f0c78bcec5c07674187eec1b215a8377a9276a3b42bd798
-  data.tar.gz: 93d9eb11c24d830b3cb7949e334f66f4b0f728afe152c9e5fb7861a9790f8b8428e76b2e66b97603984c44b612894d5ac23308361dd14227db5a2322aefba55a
+  metadata.gz: 33720d4303bc71e4b47ab5ee364513a323a3c847399e19ef3a6a734724a0d9bb43f193723e64b76516b81087e32a5c1f67524f7a92a853c2f82500abaf896371
+  data.tar.gz: adcea48cfb981cc8743105667bb48cdfb285e763ba84c40290d402c8aeb6283d296c0e86b14d69f41e57d7d9b53724c781bf0a3e163ef28828da75f91b5bcf62

data/README.md

@@ -1,6 +1,6 @@
 # EcsDeployer
 
-This package provides the service deployment function of ECS.
+This package provides service deployment function of ECS.
 
 ## Installation
 
@@ -22,7 +22,6 @@ Or install it yourself as:
 
 Write task definition in YAML format.
 For available parameters see [Task Definition Parameters](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html).
-The sample file is in `example/fixtures/task.yml`.
 
 ```
 container_definitions:
@@ -47,10 +46,53 @@ container_definitions:
 family: hello_world
 ```
 
-## Usage
+### Encrypt of environment variables
+
+`environment` parameter supports KMS encrypted values.
+Encrypted values must be enclosed in `${XXX}`.
+
+```
+- environment:
+  - name: MYSQL_ROOT_PASSWORD
+    value: ${fiSAIfIFxd...}
+```
+
+Values are decrypted when task is created.
+
+## Usage (API)
+
+This sample file is in `example/fixtures/task.yml`.
 
 ```
 ecs_deployer = EcsDeployer::Client.new
 ecs_deployer.register_task('development.yml')
 ecs_deployer.update_service('cluster', 'development')
 ```
+
+## Usage (CLI)
+
+### Register a new task
+
+```
+$ bundle exec ecs_deployer task-register --path=example/fixtures/task.yml
+```
+
+### Encrypt environment value
+
+```
+$ bundle exec ecs_deployer encrypt --master-key=master --value='test'
+Encrypted value: ${xxx}
+```
+
+### Decrypt encironment value
+
+```
+$ bundle exec ecs_deployer decrypt --value='${xxx}'
+Decrypted value: xxx
+```
+
+### Update a service
+
+```
+$ bundle exec ecs_deployer update-service --cluster=xxx --service=xxx --wait --timeout=600
+```

data/ecs_deployer.gemspec

@@ -34,6 +34,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "thor"
   spec.add_dependency "aws-sdk"
   spec.add_dependency "aws_config"
+  spec.add_dependency "json_spec"
   spec.add_development_dependency "bundler", "~> 1.14"
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "rspec", "~> 3.0"

data/example/sample.rb

@@ -1,8 +1,8 @@
 require 'bundler/setup'
 require 'ecs_deployer'
 
-task_path = File.expand_path('./fixtures/task.yml', File.dirname(File.realpath(__FILE__)))
+path = File.expand_path('../spec/fixtures/task.yml', File.dirname(File.realpath(__FILE__)))
 
 deployer = EcsDeployer::Client.new
-deployer.register_task(task_path)
+deployer.register_task(path)
 #deployer.update_service('sandbox', 'production')

data/lib/ecs_deployer.rb

@@ -7,6 +7,7 @@ module EcsDeployer
   class ServiceNotFoundError < EcsDeployer::Error; end
   class TaskNotFoundError < EcsDeployer::Error; end
   class TaskDefinitionValidateError < EcsDeployer::Error; end
+  class KmsEncryptError < EcsDeployer::Error; end
   class KmsDecryptError < EcsDeployer::Error; end
   class DeployTimeoutError < EcsDeployer::Error; end
 end

data/lib/ecs_deployer/cli.rb

@@ -2,9 +2,55 @@ require 'thor'
 
 module EcsDeployer
   class CLI < Thor
-    desc 'hello', 'world'
-    def update
-      puts 'hello'
+    class_option :profile, type: :string
+    class_option :region, type: :string
+
+    def initialize(*args)
+      super
+
+      aws_options = {}
+      aws_options[:profile] = options[:profile] if options[:profile]
+      aws_options[:region] = options[:region] if options[:region]
+
+      @deployer = EcsDeployer::Client.new(aws_options)
+    end
+
+    desc 'task_register', 'Create new task definition'
+    option :path, required: true
+    def task_register
+      path = File.expand_path(options[:path], Dir.pwd)
+      result = @deployer.register_task(path)
+
+      puts "Registered task: #{result}"
+    end
+
+    desc 'update_service', 'Update service difinition.'
+    option :cluster, required: true
+    option :service, required: true
+    option :wait, type: :boolean, default: true
+    option :timeout, type: :numeric, default: EcsDeployer::Client::DEPLOY_TIMEOUT
+    def update_service
+      result = @deployer.update_service(
+        options[:cluster],
+        options[:service],
+        options[:wait],
+        options[:timeout]
+      )
+
+      puts "Update service: #{result}"
+    end
+
+    desc 'encrypt', 'Encrypt value of argument with KMS.'
+    option :master_key, required: true
+    option :value, required: true
+    def encrypt
+      puts "Encrypted value: #{@deployer.encrypt(options[:master_key], options[:value])}"
+    end
+
+    desc 'encrypt', 'Decrypt value of argument with KMS.'
+    option :value, required: true
+    def decrypt
+      puts "Decrypted value: #{@deployer.decrypt(options[:value])}"
     end
   end
 end

data/lib/ecs_deployer/client.rb

@@ -6,26 +6,52 @@ require 'runtime_command'
 module EcsDeployer
   class Client
     PAULING_INTERVAL = 20
+    DEPLOY_TIMEOUT = 600
+    ENCRYPT_PATTERN = /^\${(.+)}$/
 
     attr_reader :cli
 
-    # @param [Hash] options
-    # @option options [String] :profile
-    # @option options [String] :region
+    # @param [Hash] aws_options
+    # @option aws_options [String] :profile
+    # @option aws_options [String] :region
     # @return [EcsDeployer::Client]
-    def initialize(options = {})
+    def initialize(aws_options = {})
       @command = RuntimeCommand::Builder.new
-      @family = ''
-      @revision = ''
-      @new_task_definition_arn = ''
-      @cli = Aws::ECS::Client.new(options)
-      @kms = Aws::KMS::Client.new(options)
+      @cli = Aws::ECS::Client.new(aws_options)
+      @kms = Aws::KMS::Client.new(aws_options)
+    end
+
+    # @param [String] mater_key
+    # @param [String] value
+    # @return [String]
+    def encrypt(master_key, value)
+      begin
+        encode = @kms.encrypt(key_id: "alias/#{master_key}", plaintext: value)
+        "${#{Base64.strict_encode64(encode.ciphertext_blob)}}"
+      rescue => e
+        raise KmsEncryptError.new(e.to_s)
+      end
+    end
+
+    # @param [String] value
+    # @return [String]
+    def decrypt(value)
+      if match = value.match(ENCRYPT_PATTERN)
+        begin
+          @kms.decrypt(ciphertext_blob: Base64.strict_decode64(match[1])).plaintext
+        rescue => e
+          raise KmsDecryptError.new(e.to_s)
+        end
+      else
+        raise KmsDecryptError.new('Encrypted string is invalid.')
+      end
     end
 
     # @param [String] path
     # @return [String]
     def register_task(path)
       raise IOError.new("File does not exist. [#{path}]") if !File.exist?(path)
+
       register_task_hash(YAML.load(File.read(path)))
     end
 
@@ -76,15 +102,17 @@ module EcsDeployer
     # @param [String] cluster
     # @param [String] service
     # @param [Fixnum] timeout
-    def update_service(cluster, service, wait = true, timeout = 600)
-      register_clone_task(cluster, service) if @new_task_definition_arn.empty?
+    # @return [String]
+    def update_service(cluster, service, wait = true, timeout = DEPLOY_TIMEOUT)
+      register_clone_task(cluster, service) if @new_task_definition_arn.nil?
 
-      @cli.update_service({
+      result = @cli.update_service({
         cluster: cluster,
         service: service,
         task_definition: @family + ':' + @revision.to_s
       })
       wait_for_deploy(cluster, service, timeout) if wait
+      result.service.service_arn
     end
 
     private
@@ -95,12 +123,8 @@ module EcsDeployer
         next unless container_definition.has_key?(:environment)
 
         container_definition[:environment].each do |environment|
-          if match = environment[:value].match(/^\${(.+)}$/)
-            begin
-              environment[:value] = @kms.decrypt(ciphertext_blob: Base64.strict_decode64(match[1])).plaintext
-            rescue => e
-              raise KmsDecryptError.new(e.to_s)
-            end
+          if match = environment[:value].match(ENCRYPT_PATTERN)
+            environment[:value] = decrypt(match[0])
           end
         end
       end

data/lib/ecs_deployer/version.rb

@@ -1,3 +1,3 @@
 module EcsDeployer
-  VERSION = "0.1.10"
+  VERSION = "0.1.11"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ecs_deployer
 version: !ruby/object:Gem::Version
-  version: 0.1.10
+  version: 0.1.11
 platform: ruby
 authors:
 - naomichi-y
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-03-10 00:00:00.000000000 Z
+date: 2017-03-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: runtime_command
@@ -80,6 +80,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: json_spec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -139,7 +153,6 @@ files:
 - bin/console
 - bin/setup
 - ecs_deployer.gemspec
-- example/fixtures/task.yml
 - example/sample.rb
 - exe/ecs_deployer
 - lib/ecs_deployer.rb

data/example/fixtures/task.yml

@@ -1,20 +0,0 @@
-container_definitions:
-- name: wordpress
-  links:
-  - mysql
-  image: wordpress
-  essential: true
-  port_mappings:
-  - container_port: 80
-    host_port: 80
-  memory: 500
-  cpu: 10
-- environment:
-  - name: MYSQL_ROOT_PASSWORD
-    value: password
-  name: mysql
-  image: mysql
-  cpu: 10
-  memory: 500
-  essential: true
-family: hello_world