-
Notifications
You must be signed in to change notification settings - Fork 519
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #634 from amazonlinux/codebuild-infra-containers
Add CodeBuild Infra containers supporting resources
- Loading branch information
Showing
9 changed files
with
331 additions
and
59 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,20 +1,50 @@ | ||
| # SHELL is bash, silly sh. | ||
| SHELL = bash | ||
| # DOCKERFILES are the detected container images that are being worked | ||
| # with. It is expected that NAME be part of the file name, as in | ||
| # Dockerfile.NAME, which is used throughout the infrastructure. | ||
| DOCKERFILES = $(filter-out %~,$(wildcard Dockerfile.*)) | ||
| # NAMES are the detected NAMES given the provided Dockerfiles. | ||
| NAMES = $(DOCKERFILES:Dockerfile.%=%) | ||
|
|
||
| # IMAGE_REPO_PREFIX is prepended to the image's tag. In the case of | ||
| # `push', the IMAGE_REPO_PREFIX provides the ECR repository URI prefix | ||
| # for each image. | ||
| IMAGE_REPO_PREFIX ?= infra/ | ||
| # IMAGE_TAG provides the registry/image-name:IMAGE_TAG portion of the | ||
| # URI tagged to images. | ||
| IMAGE_TAG ?= develop | ||
| # IMAGE_NAME is the name that the container image is tagged with. | ||
| IMAGE_NAME ?= $(IMAGE_REPO_PREFIX)$(NAME):$(IMAGE_TAG) | ||
| # ECR_URI_PREFIX is the ECR URI prefix based on the resolved builder | ||
| # image URI which, like other container images, is discoverable under | ||
| # its in-region SSM parameter - so we can lob off the builder part and | ||
| # use it as our model for the pushed repository name. | ||
| ECR_URI_PREFIX = $(shell aws ssm get-parameter --name /infra/container/infra/builder --query Parameter.Value --output text | sed 's/builder$$//') | ||
| # ECR_NAME_PREFIX provides a prefix to derive the ECR repository-name | ||
| # (the attribute) from the images' NAME - the infra/ prefix is | ||
| # conventional across automations' consumed images. | ||
| ECR_NAME_PREFIX ?= infra/ | ||
|
|
||
| .PHONY: force all release $(NAMES) | ||
| .DEFAULT: all | ||
| .PHONY: force all release $(NAMES) | ||
| force: | ||
|
|
||
| all : IMAGE_TAG ?= develop | ||
| all: $(NAMES) | ||
|
|
||
| release : IMAGE_TAG ?= latest | ||
| release: $(if $(NAME),$(NAME),$(NAMES)) | ||
| all: $(if $(NAME),$(NAME),$(NAMES)) | ||
|
|
||
| $(NAMES) : NAME = $@ | ||
| $(NAMES): force | ||
| @echo "Building container image for '$(NAME)'" | ||
| docker build -t $(IMAGE_NAME) -f Dockerfile.$(NAME) . | ||
|
|
||
| # Push images (must explicitly provide IMAGE_TAG=release to be pulled | ||
| # by consumers). | ||
| push: IMAGE_REPO_PREFIX = $(ECR_URI_PREFIX) | ||
| push: IMAGE_TAG = staging | ||
| push: all | ||
| @echo "Pushing container images with tag '$(IMAGE_TAG)'" | ||
| @echo "Images: $(foreach NAME,$(NAMES),$(IMAGE_NAME))" | ||
| @$(foreach NAME,$(NAMES),\ | ||
| echo "Pushing '$(NAME)' to '$(IMAGE_NAME)'" && \ | ||
| aws ecr describe-repositories --repository-names $(ECR_NAME_PREFIX)$(NAME) &> /dev/null \ | ||
| && docker push $(IMAGE_NAME) \ | ||
| || echo "Could not push $(NAME) to ECR repository as $(IMAGE_NAME)";) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,163 @@ | ||
| # stack: infra-container | ||
|
|
||
| AWSTemplateFormatVersion: "2010-09-09" | ||
|
|
||
| Description: >- | ||
| Infra's container images ECR repositories used in release automation. | ||
| Parameters: | ||
| SSMPathNamespace: | ||
| Type: String | ||
| Default: /infra/container | ||
| AllowedPattern: '^/.*[^/]$' | ||
| Description: > | ||
| Namespace under which SSM Parameters will be created for container images (should start but *not* end with '/') | ||
| Resources: | ||
| SDKx8664Repo: | ||
| Type: AWS::ECR::Repository | ||
| Metadata: | ||
| Source: extras/sdk-container | ||
| Properties: | ||
| RepositoryName: thar/sdk-x86_64 | ||
|
|
||
| SDKx8664Parameter: | ||
| Type: AWS::SSM::Parameter | ||
| Properties: | ||
| Name: !Sub "${SSMPathNamespace}/${SDKx8664Repo}" | ||
| Type: String | ||
| Value: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${SDKx8664Repo}" | ||
|
|
||
| SDKaarch64Repo: | ||
| Type: AWS::ECR::Repository | ||
| Metadata: | ||
| Source: extras/sdk-container | ||
| Properties: | ||
| RepositoryName: thar/sdk-aarch64 | ||
|
|
||
| SDKaarch64Parameter: | ||
| Type: AWS::SSM::Parameter | ||
| Properties: | ||
| Name: !Sub "${SSMPathNamespace}/${SDKaarch64Repo}" | ||
| Type: String | ||
| Value: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${SDKaarch64Repo}" | ||
|
|
||
| BuilderRepo: | ||
| Type: AWS::ECR::Repository | ||
| Metadata: | ||
| Source: tools/infra/container/Dockerfile.builder | ||
| Properties: | ||
| RepositoryName: infra/builder | ||
| RepositoryPolicyText: | ||
| Version: "2012-10-17" | ||
| Statement: | ||
| - Sid: "codeBuildPull" | ||
| Effect: Allow | ||
| Principal: | ||
| Service: "codebuild.amazonaws.com" | ||
| Action: | ||
| - "ecr:GetDownloadUrlForLayer" | ||
| - "ecr:BatchGetImage" | ||
| - "ecr:BatchCheckLayerAvailability" | ||
|
|
||
| BuilderParameter: | ||
| Type: AWS::SSM::Parameter | ||
| Properties: | ||
| Name: !Sub "${SSMPathNamespace}/${BuilderRepo}" | ||
| Type: String | ||
| Value: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${BuilderRepo}" | ||
|
|
||
| SigningRepo: | ||
| Type: AWS::ECR::Repository | ||
| Metadata: | ||
| Source: tools/infra/container/Dockerfile.signing | ||
| Properties: | ||
| RepositoryName: infra/signing | ||
| RepositoryPolicyText: | ||
| Version: "2012-10-17" | ||
| Statement: | ||
| - Sid: "codeBuildPull" | ||
| Effect: Allow | ||
| Principal: | ||
| Service: "codebuild.amazonaws.com" | ||
| Action: | ||
| - "ecr:GetDownloadUrlForLayer" | ||
| - "ecr:BatchGetImage" | ||
| - "ecr:BatchCheckLayerAvailability" | ||
|
|
||
| SigningParameter: | ||
| Type: AWS::SSM::Parameter | ||
| Properties: | ||
| Name: !Sub "${SSMPathNamespace}/${SigningRepo}" | ||
| Type: String | ||
| Value: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${SigningRepo}" | ||
|
|
||
| PullPolicy: | ||
| Type: AWS::IAM::ManagedPolicy | ||
| Properties: | ||
| ManagedPolicyName: pull | ||
| Path: !Sub "/${AWS::StackName}/" | ||
| PolicyDocument: | ||
| Version: '2012-10-17' | ||
| Statement: | ||
| - Sid: "imagePull" | ||
| Effect: Allow | ||
| Resource: | ||
| - !GetAtt BuilderRepo.Arn | ||
| - !GetAtt SigningRepo.Arn | ||
| - !GetAtt SDKx8664Repo.Arn | ||
| - !GetAtt SDKaarch64Repo.Arn | ||
| Action: | ||
| - "ecr:GetAuthorizationToken" | ||
| - "ecr:BatchCheckLayerAvailability" | ||
| - "ecr:GetDownloadUrlForLayer" | ||
| - "ecr:ListImages" | ||
| - "ecr:DescribeImages" | ||
| - "ecr:BatchGetImage" | ||
| - "ecr:ListTagsForResource" | ||
| - Sid: "imageResolve" | ||
| Effect: Allow | ||
| Resource: | ||
| - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/*" | ||
| Action: | ||
| - "ssm:GetParameter" | ||
| - "ssm:GetParameters" | ||
| - "ssm:GetParametersByPath" | ||
| - "ssm:DescribeParameters" | ||
|
|
||
| PushPolicy: | ||
| Type: AWS::IAM::ManagedPolicy | ||
| Properties: | ||
| ManagedPolicyName: push | ||
| Path: !Sub "/${AWS::StackName}/" | ||
| PolicyDocument: | ||
| Version: '2012-10-17' | ||
| Statement: | ||
| - Sid: "imagePush" | ||
| Effect: Allow | ||
| Resource: | ||
| - !GetAtt BuilderRepo.Arn | ||
| - !GetAtt SigningRepo.Arn | ||
| - !GetAtt SDKx8664Repo.Arn | ||
| - !GetAtt SDKaarch64Repo.Arn | ||
| Action: | ||
| - "ecr:GetAuthorizationToken" | ||
| - "ecr:BatchCheckLayerAvailability" | ||
| - "ecr:GetDownloadUrlForLayer" | ||
| - "ecr:DescribeImages" | ||
| - "ecr:BatchGetImage" | ||
| - "ecr:ListTagsForResource" | ||
| - "ecr:InitiateLayerUpload" | ||
| - "ecr:UploadLayerPart" | ||
| - "ecr:CompleteLayerUpload" | ||
| - "ecr:PutImage" | ||
|
|
||
| Outputs: | ||
| PullPolicy: | ||
| Export: | ||
| Name: !Sub "${AWS::StackName}-pull-policy" | ||
| Value: !Ref PullPolicy | ||
| PushPolicy: | ||
| Export: | ||
| Name: !Sub "${AWS::StackName}-push-policy" | ||
| Value: !Ref PushPolicy |
Oops, something went wrong.