|
1 | | -Prerequisites: |
2 | | - |
3 | | -AWS CLI installed and configured with admin access to the C&C account. |
4 | | -Terraform installed |
5 | | -Git installed |
6 | | - |
7 | | - |
8 | | -Create new S3 bucket for new Jenkins instance to use setting the following options DURING CREATION some can't be set after |
9 | | - - bucket should be named using the following template : avillach-biodatacatalyst-deployments-<Random 7 hex digits> |
10 | | - - Object Locking must be enabled |
11 | | - - Encryption should be AES-256 |
12 | | - - Enable Object-level logging as secrets are stored in this bucket |
13 | | - - Enable versioning |
14 | | - - Server access logging enabled (hms-dbmi-cnc-cloudtrail, no target prefix) |
15 | | - |
16 | | -Set Bucket Policy in the Permissions section for the bucket to the following after replacing __BUCKET_NAME__ with the bucket name: |
17 | | - |
18 | | ------------------------------------------------------ |
19 | | -{ |
20 | | - "Version": "2012-10-17", |
21 | | - "Statement": [ |
22 | | - { |
23 | | - "Effect": "Allow", |
24 | | - "Principal": { |
25 | | - "AWS": "arn:aws:iam::191687121306:role/hms-dbmi-cnc-role" |
26 | | - }, |
27 | | - "Action": [ |
28 | | - "s3:GetObject", |
29 | | - "s3:PutObject", |
30 | | - "s3:PutObjectAcl", |
31 | | - "s3:GetObjectAcl", |
32 | | - "s3:GetObjectTagging", |
33 | | - "s3:DeleteObject" |
34 | | - ], |
35 | | - "Resource": "arn:aws:s3:::__BUCKET_NAME__/*" |
36 | | - }, |
37 | | - { |
38 | | - "Effect": "Allow", |
39 | | - "Principal": { |
40 | | - "AWS": "arn:aws:iam::752463128620:role/system/jenkins-s3-role" |
41 | | - }, |
42 | | - "Action": [ |
43 | | - "s3:GetObject", |
44 | | - "s3:PutObject", |
45 | | - "s3:PutObjectAcl", |
46 | | - "s3:GetObjectAcl", |
47 | | - "s3:GetObjectTagging", |
48 | | - "s3:DeleteObject" |
49 | | - ], |
50 | | - "Resource": "arn:aws:s3:::__BUCKET_NAME__/*" |
51 | | - } |
52 | | - ] |
53 | | -} |
54 | | ------------------------------------------------------ |
55 | | - |
56 | | - |
57 | | - |
58 | | - |
59 | | -Clone https://github.com/hms-dbmi/avillachlab-jenkins |
60 | | - |
61 | | -Run the following commands after replacing all __VARIABLE_NAME__ entries with their correct values for the environment: |
62 | | - |
63 | | ------------------------------------------------------ |
64 | | - |
65 | | -cd dev-jenkins-terraform |
66 | | -env > env.txt |
67 | | -terraform init |
68 | | -terraform apply -auto-approve \ |
69 | | --var "git-commit=__GIT_COMMIT_FOR_JENKINS_REPO__" \ |
70 | | --var "stack-s3-bucket=__S3_BUCKET_NAME_YOU_CREATED__" \ |
71 | | --var "stack-id=__S3_BUCKET_NAME_SUFFIX__" \ |
72 | | --var "subnet-id=__JENKINS_SUBNET_ID__" \ |
73 | | --var "vpc-id=__JENKINS_VPC_ID__" \ |
74 | | --var "instance-profile-name=__JENKINS_INSTANCE_PROFILE_NAME__" \ |
75 | | --var "access-cidr=__JENKINS_ACCESS_CIDR__" \ |
76 | | --var "provisioning-cidr=__JENKINS_PROVISIONING_CIDR__" |
77 | | - |
78 | | -aws s3 --sse=AES256 cp terraform.tfstate s3://${stack_s3_bucket}/jenkins_state_${GIT_COMMIT}/terraform.tfstate |
79 | | -aws s3 --sse=AES256 cp env.txt s3://${stack_s3_bucket}/jenkins_state_${GIT_COMMIT}/last_env.txt |
80 | | - |
81 | | -INSTANCE_ID=`terraform state show aws_instance.dev-jenkins | grep "\"i-[a-f0-9]" | cut -f 2 -d "=" | sed 's/"//g'` |
82 | | - |
83 | | -while [ -z $(/usr/local/bin/aws --region=us-east-1 ec2 describe-tags --filters "Name=resource-id,Values=${INSTANCE_ID}" | grep InitComplete) ];do echo "still initializing";sleep 10;done |
84 | | - |
85 | | -echo "http://`terraform state show aws_instance.dev-jenkins | grep private_ip | cut -f 2 -d "=" | sed 's/\"//g' | sed 's/ //g'`" |
86 | | - |
87 | | ------------------------------------------------------ |
88 | | - |
89 | | - |
90 | | -Set stack_s3_bucket Value to new S3 bucket name in new Jenkins |
91 | | - - Manage Jenkins > Configure System |
92 | | - - under "Global properties" set stack_s3_bucket to the new bucket created in the first step |
93 | | - |
94 | | -Add the following arn as a trusted entity in the hms-dbmi-cnc-role in the prod account: |
95 | | - - https://console.aws.amazon.com/iam/home?region=us-east-1#/roles/hms-dbmi-cnc-role?section=trust |
96 | | - - example template : |
97 | | - |
98 | | - { |
99 | | - "Effect": "Allow", |
100 | | - "Principal": { |
101 | | - "AWS": "arn:aws:sts::752463128620:assumed-role/jenkins-s3-role/< instance id of the jenkins ec2 you just created >" |
102 | | - }, |
103 | | - "Action": "sts:AssumeRole", |
104 | | - "Condition": {} |
105 | | - } |
106 | | - |
107 | | - - example : |
108 | | - |
109 | | - { |
110 | | - "Effect": "Allow", |
111 | | - "Principal": { |
112 | | - "AWS": "arn:aws:sts::752463128620:assumed-role/jenkins-s3-role/i-0615f53dd368cbdfc" |
113 | | - }, |
114 | | - "Action": "sts:AssumeRole", |
115 | | - "Condition": {} |
116 | | - } |
117 | | - |
118 | | -Switch to Jenkins Configuration View ( DO NOT QUEUE UP THE JOBS! Wait for each to complete successfully before going on to the next. ) |
119 | | - |
120 | | -Run Jenkins Build "Create stack_variables.tf files" |
121 | | -Run Jenkins Build "Update VPC Settings" after confirming the following: |
122 | | - - confirm that the R53_Zone_ID is correct for the prod account Route 53 Zone |
123 | | - - confirm that the vpc and subnet group names are correct for the prod account |
124 | | -Run Jenkins Build "Update PIC-SURE Token Introspection Token" |
125 | | -Run Jenkins Build "Update Fence Client Credentials" |
126 | | - - provide the correct Fence Client ID and Client Secret as provided by the Fence team |
127 | | -Run Jenkins Build "Update HTTPD Certs and Key" |
128 | | - - provide the correct Cert, Chain and Key file for the production HTTPD server |
| 1 | +# Overview |
129 | 2 |
|
| 3 | +Welcome to the base folder of your Jenkins project. This folder contains two subfolders, each dedicated to a specific aspect of your Jenkins infrastructure: `jenkins-docker` and `jenkins-terraform`. Below, you'll find an overview of each component along with links to their respective README files for detailed information. |
130 | 4 |
|
131 | | -Switch to the Deployment View |
| 5 | +## Jenkins Docker (`jenkins-docker`) |
132 | 6 |
|
133 | | -Run Jenkins Build Check For Updates |
134 | | - - The first time this runs it will take about 1.5 hours because it has to rekey the data. |
| 7 | +This section focuses on the Dockerization of Jenkins, incorporating additional tools and configurations to enhance its functionality. The Jenkins Docker image is extended from the official LTS image, making it a versatile and powerful solution. For more information, refer to the [Jenkins Docker README](jenkins-docker/README.md). |
135 | 8 |
|
136 | | -Run Jenkins Build Swap Stacks |
137 | | - - This will point the internal production CNAME at the current stage environment |
138 | | - - The current stage environment becomes prod and the current prod environment becomes stage |
| 9 | +## Jenkins Terraform (`jenkins-terraform`) |
139 | 10 |
|
140 | | -Run Jenkins Build Check For Updates |
141 | | - - This time it should only take about a half hour because the data has already been rekeyed. |
| 11 | +Here, Terraform is leveraged to deploy and manage Jenkins infrastructure on AWS. The README provides insights into the variables, backend configuration, and outputs defined in the Terraform files. Detailed information about variables, Terraform backend configuration, and outputs can be found in the [Jenkins Terraform README](jenkins-terraform/README.md). |
142 | 12 |
|
| 13 | +Feel free to explore each component to understand their configurations, usage, and any additional details you may need for managing your Jenkins environment efficiently. If you have any questions or need assistance, don't hesitate to reach out. |
143 | 14 |
|
| 15 | +## Table of Contents |
144 | 16 |
|
| 17 | +- [Jenkins Docker](#jenkins-docker) |
| 18 | +- [Jenkins Terraform](#jenkins-terraform) |
145 | 19 |
|
| 20 | +Feel free to dive into the respective sections for detailed information and instructions. |
146 | 21 |
|
| 22 | +# Jenkins Docker (`jenkins-docker`) |
| 23 | + |
| 24 | +This section focuses on the Dockerization of Jenkins, incorporating additional tools and configurations to enhance its functionality. The Jenkins Docker image is extended from the official LTS image, making it a versatile and powerful solution. |
| 25 | + |
| 26 | +## [Jenkins Docker README](jenkins-docker/README.md) |
| 27 | + |
| 28 | +- [Features](jenkins-docker/README.md#features) |
| 29 | +- [Prerequisites](jenkins-docker/README.md#prerequisites) |
| 30 | +- [Building the Image](jenkins-docker/README.md#building-the-image) |
| 31 | +- [Configuration](jenkins-docker/README.md#configuration) |
| 32 | +- [Usage](jenkins-docker/README.md#usage) |
| 33 | +- [Cleanup](jenkins-docker/README.md#cleanup) |
| 34 | +- [Contributing](jenkins-docker/README.md#contributing) |
| 35 | +- [License](jenkins-docker/README.md#license) |
| 36 | + |
| 37 | +Feel free to explore the Jenkins Docker README for comprehensive information on configuring, building, and using the Docker image. |
| 38 | + |
| 39 | +# Jenkins Terraform (`jenkins-terraform`) |
| 40 | + |
| 41 | +Here, Terraform is leveraged to deploy and manage Jenkins infrastructure on AWS. The README provides insights into the variables, backend configuration, and outputs defined in the Terraform files. |
| 42 | + |
| 43 | +## [Jenkins Terraform README](jenkins-terraform/README.md) |
| 44 | + |
| 45 | +- [Variables](jenkins-terraform/README.md#variables) |
| 46 | +- [Terraform Backend](jenkins-terraform/README.md#terraform-backend) |
| 47 | +- [Outputs](jenkins-terraform/README.md#outputs) |
| 48 | + |
| 49 | +Feel free to explore the Jenkins Terraform README for detailed information on variables, Terraform backend configuration, and outputs. |
| 50 | + |
| 51 | +Feel free to explore each component to understand their configurations, usage, and any additional details you may need for managing your Jenkins environment efficiently. If you have any questions or need assistance, don't hesitate to reach out. |
0 commit comments