8000 chore: [SVLS-6279] a new publish_govcloud_layers.sh script · DataDog/datadog-lambda-extension@a02eb63 · GitHub
[go: up one dir, main page]
Skip to content

Commit a02eb63

Browse files
apiarian-datadogapiarian-datadog
committed
chore: [SVLS-6279] a new publish_govcloud_layers.sh script
1 parent cfcee90 commit a02eb63

File tree

4 files changed

+150
-47
lines changed

4 files changed

+150
-47
lines changed

‎.gitlab/scripts/publish_layer.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ fi
3535

3636

3737
LAYER_DIR=".layers"
38-
VALID_ACCOUNTS=("sandbox" "prod")
3938

4039
publish_layer() {
4140
region=$1

‎.gitlab/templates/pipeline.yaml.tpl

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -302,28 +302,35 @@ publish image ({{ $multi_arch_image_flavor.name }}):
302302

303303
{{ end }} # end multi_arch_image_flavors
304304

305-
layer bundle:
306-
stage: build
305+
{{ range $environment := (ds "environments").environments }}
306+
307+
{{ if eq $environment.name "prod" }}signed {{ end }}layer bundle:
308+
stage: {{ if eq $environment.name "prod }}sign{{ else }}build{{ end }}
307309
image: registry.ddbuild.io/images/docker:20.10
308310
tags: ["arch:amd64"]
311+
rules:
312+
- if: '"{{ $environment.name }}" =~ /^(sandbox|staging)/'
313+
- if: '$CI_COMMIT_TAG =~ /^v.*/'
309314
needs:
310315
{{ range (ds "flavors").flavors }}
311316
{{ if .needs_layer_publish }}
312-
- layer ({{ .name }})
317+
- {{ if eq $environment.name "prod" }}sign {{ end }}layer ({{ .name }})
313318
{{ end }} # end needs_layer_publish
314319
{{ end }} # end flavors
315320
dependencies:
316321
{{ range (ds "flavors").flavors }}
317322
{{ if .needs_layer_publish }}
318-
- layer ({{ .name }})
323+
- {{ if eq $environment.name "prod" }}sign {{ end }}layer ({{ .name }})
319324
{{ end }} # end needs_layer_publish
320325
{{ end }} # end flavors
321326
artifacts:
322327
expire_in: 1 hr
323328
paths:
324-
- datadog_extension-bundle-${CI_JOB_ID}/
325-
name: datadog_extension-bundle-${CI_JOB_ID}
329+
- datadog_extension-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}/
330+
name: datadog_extension-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
326331
script:
327-
- rm -rf datadog_extension-bundle-${CI_JOB_ID}
328-
- mkdir -p datadog_extension-bundle-${CI_JOB_ID}
329-
- cp .layers/datadog_extension-*.zip datadog_extension-bundle-${CI_JOB_ID}
332+
- rm -rf datadog_extension-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
333+
- mkdir -p datadog_extension-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
334+
- cp .layers/datadog_extension-*.zip datadog_extension-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
335+
336+
{{ end }} # end environments

‎scripts/publish_govcloud.sh

Lines changed: 0 additions & 37 deletions
This file was deleted.

‎scripts/publish_govcloud_layers.sh

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
#! /usr/bin/env bash
2+
3+
# Unless explicitly stated otherwise all files in this repository are licensed
4+
# under the Apache License Version 2.0.
5+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
6+
# Copyright 2025 Datadog, Inc.
7+
#
8+
# USAGE: download the layer bundle from the build pipeline in gitlab. Use the
9+
# Download button on the `layer bundle` job. This will be a zip file containing
10+
# all of the required layers. Run this script as follows:
11+
#
12+
# ENVIRONMENT=[us1-stagin-fed or us-fed] [WORKFLOW_LAYER_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud_layers.sh <layer-bundle.zip>
13+
14+
set -e
15+
16+
LAYER_PACKAGE=$1
17+
18+
if [ -z "$LAYER_PACKAGE" ]; then
19+
printf "[ERROR]: layer package not provided\n"
20+
exit 1
21+
fi
22+
23+
PACKAGE_NAME=$(basename "$LAYER_PACKAGE" .zip)
24+
25+
if [ -z "$ENVIRONMENT" ]; then
26+
printf "[ERROR]: ENVIRONMENT not specified\n"
27+
exit 1
28+
fi
29+
30+
if [ "$ENVIRONMENT" = "us1-staging-fed" ]; then
31+
AWS_VAULT_ROLE=sso-govcloud-us1-staging-fed-power-user
32+
33+
# this role looks like this in ~/.aws/config:
34+
# [profile sso-govcloud-us1-staging-fed-power-user]
35+
# sso_start_url=https://start.us-gov-home.awsapps.com/directory/d-9867188aeb
36+
# sso_account_id=553727695824
37+
# sso_role_name=power-user
38+
# sso_region=us-gov-west-1
39+
# region=us-gov-west-1
40+
41+
export ADD_PERMISSIONS=0
42+
export AUTOMATICALLY_BUMP_VERSION=1
43+
44+
if [[ ! "$PACKAGE_NAME" =~ ^datadog_extension-(signed-)?bundle-[0-9]+$ ]]; then
45+
echo "[ERROR]: Unexpected package name: $PACKAGE_NAME"
46+
exit 1
47+
fi
48+
49+
elif [ $ENVIRONMENT = "us1-fed" ]; then
50+
AWS_VAULT_ROLE=sso-govcloud-us1-fed-engineering
51+
52+
# this role looks like this in ~/.aws/config:
53+
# [profile sso-govcloud-us1-fed-engineering]
54+
# sso_start_url=https://start.us-gov-west-1.us-gov-home.awsapps.com/directory/d-98671fdc8b
55+
# sso_account_id=002406178527
56+
# sso_role_name=engineering
57+
# sso_region=us-gov-west-1
58+
# region=us-gov-west-1
59+
60+
export ADD_PERMISSIONS=1
61+
export AUTOMATICALLY_BUMP_VERSION=0
62+
63+
if [[ ! "$PACKAGE_NAME" =~ ^datadog_extension-signed-bundle-[0-9]+$ ]]; then
64+
echo "[ERROR]: Unexpected package name: $PACKAGE_NAME"
65+
exit 1
66+
fi
67+
68+
else
69+
printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed or us1-fed.\n"
70+
exit 1
71+
fi
72+
73+
TEMP_DIR=$(mktemp -d)
74+
unzip $LAYER_PACKAGE -d $TEMP_DIR
75+
cp -v $TEMP_DIR/$PACKAGE_NAME/*.zip .layers/
76+
77+
78+
AWS_VAULT_PREFIX="aws-vault exec $AWS_VAULT_ROLE --"
79+
80+
echo "Checking that you have access to the GovCloud AWS account"
81+
$AWS_VAULT_PREFIX aws sts get-caller-identity
82+
83+
84+
AVAILABLE_REGIONS=$($AWS_VAULT_PREFIX aws ec2 describe-regions | jq -r '.[] | .[] | .RegionName')
85+
86+
# Determine the target regions
87+
if [ -z "$REGIONS" ]; then
88+
echo "Region not specified, running for all available regions."
89+
REGIONS=$AVAILABLE_REGIONS
90+
else
91+
echo "Region specified: $REGIONS"
92+
if [[ ! "$AVAILABLE_REGIONS" == *"$REGIONS"* ]]; then
93+
echo "Could not find $REGIONS in available regions: $AVAILABLE_REGIONS"
94+
echo ""
95+
echo "EXITING SCRIPT."
96+
exit 1
97+
fi
98+
fi
99+
100+
declare -A flavors
101+
102+
flavors["amd64"]="arch=amd64 suffix=amd64 layer_name_base_suffix="
103+
flavors["arm64"]="arch=arm64 suffix=arm64 layer_name_base_suffix=-ARM"
104+
flavors["amd64-fips"]="arch=amd64 suffix=amd64-fips layer_name_base_suffix=-FIPS"
105+
flavors["arm64-fips"]="arch=arm64 suffix=arm64-fips layer_name_base_suffix=-FIPS-ARM"
106+
echo "$flavors"
107+
108+
109+
for region in $REGIONS
110+
do
111+
echo "Starting publishing layers for region $region..."
112+
113+
export REGION=$region
114+
115+
for flavor in "${!flavors[@]}"; do
116+
echo "Publishing $flavor"
117+
118+
IFS=' ' read -r -a values <<< "${flavors[$flavor]}"
119+
for value in "${values[@]}"; do
120+
case $value in
121+
arch=*) export ARCHITECTURE="${value#arch=}" ;;
122+
suffix=*) SUFFIX="${value#suffix=}" ;;
123+
layer_name_base_suffix=*) export LAYER_NAME_BASE_SUFFIX="${value#layer_name_base_suffix=}" ;;
124+
esac
125+
done
126+
127+
export LAYER_FILE="datadog_extension-$SUFFIX.zip"
128+
129+
$AWS_VAULT_PREFIX .gitlab/scripts/publish_layer.sh
130+
done
131+
132+
done
133+
134+
echo "Done !"

0 commit comments

Comments
 (0)
0