Reload configuration as code via curl instead of cli (#145)

* Reload configuration as code via curl instead of cli

Signed-off-by: Sayali Gaikawad <[email protected]>

README.md

@@ -56,6 +56,12 @@ OpenSearch Continuous Integration is an open source CI system for OpenSearch and
 
  `npm run cdk deploy OpenSearch-CI-Config-Dev -- -c useSsl=false -c runWithOidc=false`
 
+1. Locate the secret manager arns in the ci-config-stack outputs for `CASC_RELOAD_TOKEN` and update the secret value ([see docs](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/put-secret-value.html)) with the password you want to use to reload jenkins configuration. _Do not enclose it in quotes_
+```
+$aws secretsmanager put-secret-value \
+--secret-id MyCASCreloadTokenSecretARN \
+--secret-string CascReloadToken
+```
 1. [Optional](#ssl-configuration) Configure the elements of the config stack for SSL configuration
 1. [Optional](#setup-openid-connect-oidc-via-federate) Configure the elements setting up oidc via federate
 1. Deploy the ci-stack, takes ~10 minutes to deploy (parameter values depend on step 2 and step 3)

lib/ci-config-stack.ts

@@ -25,6 +25,8 @@ export class CIConfigStack extends Stack {
 
  static readonly OIDC_CONFIGURATION_VALUE_SECRET_EXPORT_VALUE: string = 'OIDCConfigValueSecret';
 
+ static readonly CASC_RELOAD_TOKEN_SECRET_EXPORT_VALUE: string = 'casc';
+
  constructor(scope: Construct, id: string, props?: StackProps) {
  super(scope, id, props);
 
@@ -46,6 +48,9 @@ export class CIConfigStack extends Stack {
  const OIDCConfigValuesSecret = new Secret(this, 'OIDCConfigValues', {
  description: 'OIDC params in JSON format',
  });
+ const CascReloadTokenValuesSecret = new Secret(this, 'CascReloadTokenValue', {
+ description: 'Reload token (password) required for configuration as code plugin',
+ });
 
  new CfnOutput(this, 'certificateArnSecret', {
  value: arnSecret.secretArn,
@@ -76,5 +81,10 @@ export class CIConfigStack extends Stack {
  value: OIDCConfigValuesSecret.secretArn,
  exportName: CIConfigStack.OIDC_CONFIGURATION_VALUE_SECRET_EXPORT_VALUE,
  });
+
+ new CfnOutput(this, 'cascSecretValue', {
+ value: CascReloadTokenValuesSecret.secretArn,
+ exportName: CIConfigStack.CASC_RELOAD_TOKEN_SECRET_EXPORT_VALUE,
+ });
  }
 }

lib/ci-stack.ts

@@ -98,6 +98,7 @@ export class CIStack extends Stack {
  const importedRedirectUrlSecretBucketValue = Fn.importValue(`${CIConfigStack.REDIRECT_URL_SECRET_EXPORT_VALUE}`);
  const importedOidcConfigValuesSecretBucketValue = Fn.importValue(`${CIConfigStack.OIDC_CONFIGURATION_VALUE_SECRET_EXPORT_VALUE}`);
  const certificateArn = Secret.fromSecretCompleteArn(this, 'certificateArn', importedArnSecretBucketValue.toString());
+ const importedReloadPasswordSecretsArn = Fn.importValue(`${CIConfigStack.CASC_RELOAD_TOKEN_SECRET_EXPORT_VALUE}`);
  const listenerCertificate = ListenerCertificate.fromArn(certificateArn.secretValue.toString());
  const agentNode = new AgentNodes(this);
  const agentNodes: AgentNodeProps[] = [agentNode.AL2_X64, agentNode.AL2_X64_DOCKER_1, agentNode.AL2_ARM64, agentNode.AL2_ARM64_DOCKER_1,
@@ -109,6 +110,7 @@ export class CIStack extends Stack {
  efsSG: securityGroups.efsSG,
  dataRetention: props.dataRetention ?? false,
  envVarsFilePath: props.envVarsFilePath ?? '',
+ reloadPasswordSecretsArn: importedReloadPasswordSecretsArn.toString(),
  sslCertContentsArn: importedContentsSecretBucketValue.toString(),
  sslCertChainArn: importedContentsChainBucketValue.toString(),
  sslCertPrivateKeyContentsArn: importedCertSecretBucketValue.toString(),

lib/compute/jenkins-main-node.ts

@@ -60,6 +60,7 @@ export interface JenkinsMainNodeProps extends HttpConfigProps, OidcFederateProps
  readonly vpc: Vpc;
  readonly sg: SecurityGroup;
  readonly envVarsFilePath: string;
+ readonly reloadPasswordSecretsArn: string;
  readonly failOnCloudInitError?: boolean;
 }
 
@@ -144,6 +145,7 @@ export class JenkinsMainNode {
  props,
  props,
  jenkinsyaml,
+ props.reloadPasswordSecretsArn,
  this.EFS_ID,
  )),
  blockDevices: [{
@@ -222,7 +224,8 @@ export class JenkinsMainNode {
  }
 
  public static configElements(stackName: string, stackRegion: string, httpConfigProps: HttpConfigProps,
- oidcFederateProps: OidcFederateProps, dataRetentionProps : DataRetentionProps, jenkinsyaml: string, efsId?: string): InitElement[] {
+ oidcFederateProps: OidcFederateProps, dataRetentionProps : DataRetentionProps, jenkinsyaml: string,
+ reloadPasswordSecretsArn: string, efsId?: string): InitElement[] {
  return [
  InitPackage.yum('wget'),
  InitPackage.yum('openssl'),
@@ -365,15 +368,15 @@ export class JenkinsMainNode {
  : 'echo Data rentention is disabled, not mounting efs'),
 
  InitFile.fromFileInline('/docker-compose.yml', join(__dirname, '../../resources/docker-compose.yml')),
- InitCommand.shellCommand('systemctl start docker && docker-compose up -d'),
+
+ InitCommand.shellCommand('systemctl start docker &&'
+ + ` var=\`aws --region ${stackRegion} secretsmanager get-secret-value --secret-id ${reloadPasswordSecretsArn} --query SecretString --output text\` &&`
+ + ' yq -i \'.services.jenkins.environment[1] = "CASC_RELOAD_TOKEN=\'$var\'"\' docker-compose.yml &&'
+ + ' docker-compose up -d'),
 
  // Commands are fired one after the other but it does not wait for the command to complete.
  // Therefore, sleep 90 seconds to wait for jenkins to start
- InitCommand.shellCommand('sleep 90'),
-
- // Download jenkins-cli from the local machine
- InitCommand.shellCommand('until $(curl --output /dev/null --silent --head --fail http://localhost:8080); do sleep 5; done &&'
- + ' wget -O "jenkins-cli.jar" http://localhost:8080/jnlpJars/jenkins-cli.jar'),
+ InitCommand.shellCommand('sleep 60'),
 
  InitFile.fromFileInline('/initial_jenkins.yaml', jenkinsyaml),
 
@@ -390,8 +393,8 @@ export class JenkinsMainNode {
 
  // Reload configuration via Jenkins.yaml
  InitCommand.shellCommand('cp /initial_jenkins.yaml /var/lib/jenkins/jenkins.yaml &&'
- + ' java -jar /jenkins-cli.jar -s http://localhost:8080 reload-jcasc-configuration'),
-
+ + ` var=\`aws --region ${stackRegion} secretsmanager get-secret-value --secret-id ${reloadPasswordSecretsArn} --query SecretString --output text\` &&`
+ + ' curl -f -X POST "http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$var"'),
  ];
  }
 

resources/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3.8'
 services:
  jenkins:
  image: opensearchstaging/jenkins:2.332.3-lts-jdk8
- restart: on-failure 
+ restart: on-failure
  privileged: true
  tty: true
  user: root
@@ -12,6 +12,7 @@ services:
  container_name: jenkins
  environment:
  - JENKINS_JAVA_OPTS="-Xmx8g"
+ - CASC_RELOAD_TOKEN=reloadPasswordHere
  volumes:
  - /var/lib/jenkins:/var/jenkins_home
  deploy:

test/compute/jenkins-main-node.test.ts

@@ -21,11 +21,12 @@ describe('JenkinsMainNode Config Elements', () => {
  runWithOidc: true,
  }, {
  dataRetention: true,
- }, 'test/data/jenkins.yaml');
+ }, 'test/data/jenkins.yaml',
+ 'ARN:ABC');
 
  // THEN
  test('Config elements expected counts', async () => {
- expect(configElements.filter((e) => e.elementType === 'COMMAND')).toHaveLength(19);
+ expect(configElements.filter((e) => e.elementType === 'COMMAND')).toHaveLength(18);
  expect(configElements.filter((e) => e.elementType === 'PACKAGE')).toHaveLength(10);
  expect(configElements.filter((e) => e.elementType === 'FILE')).toHaveLength(4);
  });