Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update the aws elastic ci stack to v6.27.0 #2983

Merged
merged 1 commit into from
Sep 15, 2024
Merged

update the aws elastic ci stack to v6.27.0 #2983

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
160 changes: 133 additions & 27 deletions data/content/aws-stack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
AWSTemplateFormatVersion: "2010-09-09"
Description: "Buildkite stack v6.23.0"
Description: "Buildkite stack v6.27.0"

# The Buildkite Elastic CI Stack for AWS gives you a private,
# autoscaling Buildkite Agent cluster. Use it to parallelize
Expand All @@ -27,15 +27,23 @@ Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: Buildkite Configuration
default: Base Configuration
Parameters:
- BuildkiteAgentToken
- BuildkiteAgentTokenParameterStorePath
- BuildkiteAgentTokenParameterStoreKMSKey
- BuildkiteAgentToken
- BuildkiteQueue

- Label:
default: Advanced Buildkite Configuration
default: Signed Pipelines Configuration
Parameters:
- PipelineSigningKMSKeyId
- PipelineSigningKMSKeySpec
- PipelineSigningKMSAccess
- PipelineSigningVerificationFailureBehavior

- Label:
default: Advanced Configuration
Parameters:
- BuildkiteAgentRelease
- BuildkiteAgentTags
Expand Down Expand Up @@ -386,7 +394,7 @@ Parameters:
Default: 125

RootVolumeIops:
Description: If the `RootVolumeType` is io1 or io2, the number of IOPS to provision for the root volume
Description: If the `RootVolumeType` is gp3, io1, or io2, the number of IOPS to provision for the root volume
Type: Number
Default: 1000

Expand Down Expand Up @@ -568,6 +576,35 @@ Parameters:
Description: Optional - Customise the EC2 instance Name tag
Default: ""

PipelineSigningKMSKeyId:
Type: String
Description: Optional - Identifier of the KMS key used to sign and verify pipelines (Created if left blank and PipelineSigningKMSKeySpec is selected)
Default: ""

PipelineSigningKMSKeySpec:
Type: String
Description: The key spec for the KMS key used to sign and verify pipelines
AllowedValues:
- "ECC_NIST_P256"
- "none"
Default: "none"

PipelineSigningKMSAccess:
Type: String
Description: The access level for the KMS key used to sign and verify pipelines
AllowedValues:
- "sign-and-verify"
- "verify"
Default: "sign-and-verify"

PipelineSigningVerificationFailureBehavior:
Type: String
Description: The behavior when a job is received without a valid verifiable signature (without a signature, with an invalid signature, or with a signature that fails verification)
AllowedValues:
- "block"
- "warn"
Default: "block"

Rules:
HasToken:
Assertions:
Expand All @@ -582,6 +619,17 @@ Rules:
- !Ref BuildkiteAgentTokenParameterStorePath
- ""
AssertDescription: "You must provide BuildkiteAgentToken or BuildkiteAgentTokenParameterStorePath"
HasPipelineSigningKMSKey:
Assertions:
- Assert:
!Or
- !Equals
- !Ref PipelineSigningKMSKeyId
- ""
- !Equals
- !Ref PipelineSigningKMSKeySpec
- "none"
AssertDescription: "You must provide either provide a PipelineSigningKMSKeyId or select a PipelineSigningKMSKeySpec but not both"

Outputs:
VpcId:
Expand All @@ -602,6 +650,12 @@ Outputs:
Export:
Name: !Sub '${AWS::StackName}-ManagedSecretsLoggingBucket'

PipelineSigningKMSKey:
Value:
!If [ CreatePipelineSigningKMSKey, !Ref PipelineSigningKMSKey, "none" ]
Export:
Name: !Sub '${AWS::StackName}-PipelineSigningKMSKey'

AutoScalingGroupName:
Value: !Ref AgentAutoScaleGroup
Export:
Expand Down Expand Up @@ -685,6 +739,20 @@ Conditions:

UseCostAllocationTags:
!Equals [ !Ref EnableCostAllocationTags, "true" ]

UsePipelineSigningKMSKey:
!Not [ !Equals [ !Ref PipelineSigningKMSKeyId, "" ] ]

CreatePipelineSigningKMSKey:
!And
- !Equals [ !Ref PipelineSigningKMSKeyId, "" ]
- !Not [ !Equals [ !Ref PipelineSigningKMSKeySpec, "none" ] ]

HasPipelineSigningKMSKey:
!Or [ !Condition CreatePipelineSigningKMSKey, !Condition UsePipelineSigningKMSKey ]

HasSigningKMSAccessSignAndVerify:
!Equals [ !Ref PipelineSigningKMSAccess, "sign-and-verify" ]

HasKeyName:
!Not [ !Equals [ !Ref KeyName, "" ] ]
Expand Down Expand Up @@ -760,26 +828,26 @@ Mappings:

# Generated from Makefile via build/mappings.yml
AWSRegion2AMI:
us-east-1 : { linuxamd64: ami-09dce4453e68fc5cd, linuxarm64: ami-0100de0b1e920f43a, windows: ami-0461661ce536ba218 }
us-east-2 : { linuxamd64: ami-01cde7aaf362f4aae, linuxarm64: ami-0ab8f88ac8c2c8d30, windows: ami-0b7b91b74290a35e1 }
us-west-1 : { linuxamd64: ami-045c6cf6c0dd4a9e4, linuxarm64: ami-0d5aec634b234e2a2, windows: ami-034824341c9421171 }
us-west-2 : { linuxamd64: ami-09132553fcbda5aee, linuxarm64: ami-0fd1d63fc28576e60, windows: ami-0116268efe38d10ea }
af-south-1 : { linuxamd64: ami-09c9633cb3f5e6fc3, linuxarm64: ami-09ba6dd6ae16f3d50, windows: ami-0fb7a12b133324fe7 }
ap-east-1 : { linuxamd64: ami-02a5f01ef4759b1c8, linuxarm64: ami-0deee5536e9c6a921, windows: ami-0c0a16b6ab6ba6660 }
ap-south-1 : { linuxamd64: ami-0217aeaac4339e394, linuxarm64: ami-06f31d79b57c0dbbf, windows: ami-0d10933d7e9a73e9e }
ap-northeast-2 : { linuxamd64: ami-092d6af0904c034b4, linuxarm64: ami-04329b443681048cd, windows: ami-0d9e4a96c235911de }
ap-northeast-1 : { linuxamd64: ami-0593f6abedb12612b, linuxarm64: ami-019d0ac19de3be566, windows: ami-02e7907798fd7f610 }
ap-southeast-2 : { linuxamd64: ami-0cc25f9f626518d8f, linuxarm64: ami-0e45dfa046084a2d3, windows: ami-0170122288687202b }
ap-southeast-1 : { linuxamd64: ami-03de8f54bc57a1397, linuxarm64: ami-046f6c2468548ca1a, windows: ami-0320407754d0bc85c }
ca-central-1 : { linuxamd64: ami-066d74f4d940d276e, linuxarm64: ami-09ef4b6d5cdb0c2e9, windows: ami-0570c4a6bb33ba9d4 }
eu-central-1 : { linuxamd64: ami-09e9769fb4085b24f, linuxarm64: ami-00c97f86e923e1020, windows: ami-08f61f9105d9e8a58 }
eu-west-1 : { linuxamd64: ami-05e7c8d4ade2095f3, linuxarm64: ami-07dd06558ae7a536d, windows: ami-0c90c3038b518ac09 }
eu-west-2 : { linuxamd64: ami-03ec96deaf3c2f04b, linuxarm64: ami-093477938aa7559d8, windows: ami-0d26fa7d30160237a }
eu-south-1 : { linuxamd64: ami-05cb67bc084762468, linuxarm64: ami-0e815380647635c63, windows: ami-0cee7ea24afffe195 }
eu-west-3 : { linuxamd64: ami-01700752047bdb1b2, linuxarm64: ami-046d7376033a1af0e, windows: ami-0358e8f0b406f3442 }
eu-north-1 : { linuxamd64: ami-0d62d22eacdc93353, linuxarm64: ami-01adb2cc0dd49e999, windows: ami-050cbc763f520f830 }
me-south-1 : { linuxamd64: ami-012fbb242739a1f1a, linuxarm64: ami-08d934ccc6cddc763, windows: ami-009277c4bc01371da }
sa-east-1 : { linuxamd64: ami-05d829f95ceb5f292, linuxarm64: ami-00390af183eab4b74, windows: ami-08e8e717a53b6b2b5 }
us-east-1 : { linuxamd64: ami-0d870d6249c932e3f, linuxarm64: ami-0a3d7a30823a79bed, windows: ami-0cc1cf707c9bde297 }
us-east-2 : { linuxamd64: ami-0f3019cc4ae209e8d, linuxarm64: ami-06fbf388ceadee136, windows: ami-0cf377d071681be17 }
us-west-1 : { linuxamd64: ami-0bc45e1a1e3b81024, linuxarm64: ami-03ccc79e335ddfeb2, windows: ami-0bf3b5f6168efcd16 }
us-west-2 : { linuxamd64: ami-0fb582405657e5e7d, linuxarm64: ami-019482f9dad0e6c6c, windows: ami-01a7cfec21679fdc6 }
af-south-1 : { linuxamd64: ami-0472a3974f5fc2b3e, linuxarm64: ami-031d70266097ac913, windows: ami-0c9d2380139ca74ae }
ap-east-1 : { linuxamd64: ami-0d01d071f6cb4531f, linuxarm64: ami-076b30b50dd891795, windows: ami-0047ed2d7146a7bfd }
ap-south-1 : { linuxamd64: ami-03dcda51307fc8cb5, linuxarm64: ami-012d6489d7405cac9, windows: ami-075d2d36dfbf32867 }
ap-northeast-2 : { linuxamd64: ami-0f2d7daa735810eee, linuxarm64: ami-0a2cc2b93142ea24a, windows: ami-08cb758a9ddc43059 }
ap-northeast-1 : { linuxamd64: ami-04051311bdfde36f3, linuxarm64: ami-09e4f9370ec79c3ba, windows: ami-05b6ec0208eb2a58a }
ap-southeast-2 : { linuxamd64: ami-0dca9e865ae37c7ed, linuxarm64: ami-05d80d286a7bade59, windows: ami-0667ba4d9ff4dc9d7 }
ap-southeast-1 : { linuxamd64: ami-041a2f49842dfedd1, linuxarm64: ami-04b58654a0075cf44, windows: ami-012d7bd61f9b1d6b7 }
ca-central-1 : { linuxamd64: ami-00e53b8bc82f9c9db, linuxarm64: ami-0f16c32fb617d5a48, windows: ami-088bf9470ff92506c }
eu-central-1 : { linuxamd64: ami-05c5209917612c4ef, linuxarm64: ami-08bb74ee0e90d2670, windows: ami-06826a0d3b4c7e1ab }
eu-west-1 : { linuxamd64: ami-06274dc3861664987, linuxarm64: ami-07ccdfbf8eaa3c951, windows: ami-036f1d5605b9dbf1e }
eu-west-2 : { linuxamd64: ami-086942d9992b4e6d3, linuxarm64: ami-0008aaf782bc53012, windows: ami-0825cacfdb3a8dcd6 }
eu-south-1 : { linuxamd64: ami-0e482f53f6f51d3e3, linuxarm64: ami-08c23003032d5ca62, windows: ami-0cb004f172e2b7007 }
eu-west-3 : { linuxamd64: ami-087631959c2b65a0b, linuxarm64: ami-08216f2c9c2778a91, windows: ami-03f5013af4a1e133b }
eu-north-1 : { linuxamd64: ami-0d769ff12cca6d68d, linuxarm64: ami-06ad99587f4894bbd, windows: ami-0406a7b8f45352245 }
me-south-1 : { linuxamd64: ami-0b82f151c4fed9e4a, linuxarm64: ami-00b941cafd5b87c70, windows: ami-0bf6572cc349f9447 }
sa-east-1 : { linuxamd64: ami-09db409e3b9399d3b, linuxarm64: ami-002802cb7c79d6fd8, windows: ami-0d9f87a270ecf8c21 }

Resources:
Vpc:
Expand Down Expand Up @@ -891,6 +959,18 @@ Resources:
Name: !Sub "/${AWS::StackName}/buildkite/agent-token"
Type: String
Value: !Ref BuildkiteAgentToken

PipelineSigningKMSKey:
Type: AWS::KMS::Key
Condition: CreatePipelineSigningKMSKey
DeletionPolicy: Retain
Properties:
Description: Key used to sign and verify pipelines
KeySpec: !Ref PipelineSigningKMSKeySpec
KeyUsage: SIGN_VERIFY
Tags:
- Key: Name
Value: !Sub '${AWS::StackName}-PipelineSigningKey'

# Allow ec2 instances to assume a role and be granted the IAMPolicies
IAMInstanceProfile:
Expand Down Expand Up @@ -923,6 +1003,26 @@ Resources:
- !Ref 'AWS::NoValue'
- !Ref 'AWS::NoValue'
Policies:
- !If
- HasPipelineSigningKMSKey
- PolicyName: PipelineSigningKMSKeyAccess
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
!If
- HasSigningKMSAccessSignAndVerify
- - kms:Sign
- kms:Verify
- kms:GetPublicKey
- - kms:Verify
- kms:GetPublicKey
Resource: !If
- CreatePipelineSigningKMSKey
- !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${PipelineSigningKMSKey}
- !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${PipelineSigningKMSKeyId}
- !Ref 'AWS::NoValue'
- !If
- UseCustomerManagedKeyForParameterStore
- PolicyName: DecryptAgentToken
Expand Down Expand Up @@ -1237,7 +1337,7 @@ Resources:
powershell -file C:\buildkite-agent\bin\bk-configure-docker.ps1 >> C:\buildkite-agent\elastic-stack.log

$Env:BUILDKITE_STACK_NAME="${AWS::StackName}"
$Env:BUILDKITE_STACK_VERSION="v6.23.0"
$Env:BUILDKITE_STACK_VERSION="v6.27.0"
$Env:BUILDKITE_SCALE_IN_IDLE_PERIOD="${ScaleInIdlePeriod}"
$Env:BUILDKITE_SECRETS_BUCKET="${LocalSecretsBucket}"
$Env:BUILDKITE_SECRETS_BUCKET_REGION="${LocalSecretsBucketRegion}"
Expand All @@ -1251,6 +1351,8 @@ Resources:
$Env:BUILDKITE_QUEUE="${BuildkiteQueue}"
$Env:BUILDKITE_AGENT_ENABLE_GIT_MIRRORS="${BuildkiteAgentEnableGitMirrors}"
$Env:BUILDKITE_ELASTIC_BOOTSTRAP_SCRIPT="${BootstrapScriptUrl}"
$Env:BUILDKITE_AGENT_SIGNING_KMS_KEY="${PipelineSigningKMSKey}"
$Env:BUILDKITE_AGENT_SIGNING_FAILURE_BEHAVIOR="${PipelineSigningVerificationFailureBehavior}"
$Env:BUILDKITE_ENV_FILE_URL="${AgentEnvFileUrl}"
$Env:BUILDKITE_AUTHORIZED_USERS_URL="${AuthorizedUsersUrl}"
$Env:BUILDKITE_ECR_POLICY="${ECRAccessPolicy}"
Expand All @@ -1268,6 +1370,7 @@ Resources:
LocalSecretsBucket: !If [ CreateSecretsBucket, !Ref ManagedSecretsBucket, !Ref SecretsBucket ],
LocalSecretsBucketRegion: !If [ CreateSecretsBucket, !Ref "AWS::Region", !Ref SecretsBucketRegion ],
AgentTokenPath: !If [ UseCustomerManagedParameterPath, !Ref BuildkiteAgentTokenParameterStorePath, !Ref BuildkiteAgentTokenParameter ],
PipelineSigningKMSKey: !If [ CreatePipelineSigningKMSKey, !Ref PipelineSigningKMSKey, !Ref PipelineSigningKMSKeyId ],
}
- !Sub
- |
Expand Down Expand Up @@ -1296,7 +1399,7 @@ Resources:
Content-Type: text/x-shellscript; charset="us-ascii"
#!/bin/bash -v
BUILDKITE_STACK_NAME="${AWS::StackName}" \
BUILDKITE_STACK_VERSION="v6.23.0" \
BUILDKITE_STACK_VERSION="v6.27.0" \
BUILDKITE_SCALE_IN_IDLE_PERIOD="${ScaleInIdlePeriod}" \
BUILDKITE_SECRETS_BUCKET="${LocalSecretsBucket}" \
BUILDKITE_SECRETS_BUCKET_REGION="${LocalSecretsBucketRegion}" \
Expand All @@ -1308,6 +1411,8 @@ Resources:
BUILDKITE_AGENT_TRACING_BACKEND="${BuildkiteAgentTracingBackend}" \
BUILDKITE_AGENT_RELEASE="${BuildkiteAgentRelease}" \
BUILDKITE_AGENT_CANCEL_GRACE_PERIOD="${BuildkiteAgentCancelGracePeriod}" \
BUILDKITE_AGENT_SIGNING_KMS_KEY="${PipelineSigningKMSKey}" \
BUILDKITE_AGENT_SIGNING_FAILURE_BEHAVIOR="${PipelineSigningVerificationFailureBehavior}" \
BUILDKITE_QUEUE="${BuildkiteQueue}" \
BUILDKITE_AGENT_ENABLE_GIT_MIRRORS="${BuildkiteAgentEnableGitMirrors}" \
BUILDKITE_ELASTIC_BOOTSTRAP_SCRIPT="${BootstrapScriptUrl}" \
Expand All @@ -1330,6 +1435,7 @@ Resources:
LocalSecretsBucket: !If [ CreateSecretsBucket, !Ref ManagedSecretsBucket, !Ref SecretsBucket ],
LocalSecretsBucketRegion: !If [ CreateSecretsBucket, !Ref "AWS::Region", !Ref SecretsBucketRegion ],
AgentTokenPath: !If [ UseCustomerManagedParameterPath, !Ref BuildkiteAgentTokenParameterStorePath, !Ref BuildkiteAgentTokenParameter ],
PipelineSigningKMSKey: !If [ CreatePipelineSigningKMSKey, !Ref PipelineSigningKMSKey, !Ref PipelineSigningKMSKeyId ],
}

AgentAutoScaleGroup:
Expand Down
Loading