Skip to content

Commit

Permalink
fix
Browse files Browse the repository at this point in the history 
Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>
  • Loading branch information
@gaiksaya
gaiksaya committed Nov 25, 2024
1 parent eb12990 commit 1b27ce2
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -55,11 +55,11 @@ OpenSearch Continuous Integration is an open source CI system for OpenSearch and
1. Setup your local machine to credentials to deploy to the AWS Account
2. Deploy the bootstrap stack by running the following command that sets up required resources to create the stacks. [More info](https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html)

`npm run cdk bootstrap -- -c useSsl=false -c runWithOidc=false -c serverAccessType=ipv4 -c restrictServerAccessTo=10.10.10.10/32`
`npm run cdk bootstrap -- -c useSsl=false -c serverAccessType=ipv4 -c restrictServerAccessTo=10.10.10.10/32`

3. Deploy the ci-config-stack using the following (takes ~1 minute to deploy) -

`npm run cdk deploy OpenSearch-CI-Config-Dev -- -c useSsl=false -c runWithOidc=false -c serverAccessType=ipv4 -c restrictServerAccessTo=10.10.10.10/32`
`npm run cdk deploy OpenSearch-CI-Config-Dev -- -c useSsl=false -c serverAccessType=ipv4 -c restrictServerAccessTo=10.10.10.10/32`

4. Locate the secret manager arns in the ci-config-stack outputs for `CASC_RELOAD_TOKEN` and update the secret value ([see docs](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/put-secret-value.html)) with the password you want to use to reload jenkins configuration. _Do not enclose it in quotes_
```
Expand All @@ -69,10 +69,10 @@ $aws secretsmanager put-secret-value \
```

5. [Optional](#ssl-configuration) Configure the elements of the config stack for SSL configuration
6. [Optional](#setup-openid-connect-oidc-via-federate) Configure the elements setting up oidc via federate
6. [Optional](#setup-authentication-using-openid-connect-oidc-or-github-authentication) Configure the elements setting up oidc or github Auth via federate
7. Deploy the ci-stack, takes ~10 minutes to deploy (parameter values depend on step 2 and step 3)

`npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c runWithOidc=false -c serverAccessType=ipv4 -c restrictServerAccessTo=10.10.10.10/32`
`npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c serverAccessType=ipv4 -c restrictServerAccessTo=10.10.10.10/32`
8. Fetch the key-pair id of `AgentNodeKeyPair` and locate actual value in SSM Parameter Store, it will of the format `/ec2/keypair/{key_pair_id}`. Add the actual value in Secrets Manager to secret named `jenkins-agent-node-key-pair`. This will allow jenkins manager node to be able to connect to agent nodes.

9. When OIDC is disabled, this set up will enforce the user to secure jenkins by adding first admin user on deployment. Create admin user and password, fill in all other details like name and email id to start using jenkins.
Expand All @@ -87,7 +87,7 @@ $aws secretsmanager put-secret-value \
| [restrictServerAccessTo](#restricting-server-access) <required> | Ipeer | Restrict jenkins server access |
| [authType](#setup-authentication-using-openid-connect-oidc-or-github-authentication) | string | Authentication type for Jenkins login. Acceptable values: github, oidc, default |
| [ignoreResourcesFailures](#ignore-resources-failure) | boolean | Additional verification during deployment and resource startup |
| [adminUsers](#setup-openid-connect-oidc-via-federate) | string[] | List of users with admin access during initial deployment |
| [adminUsers](#setup-authentication-using-openid-connect-oidc-or-github-authentication) | string[] | List of users with admin access during initial deployment |
| [additionalCommands](#runnning-additional-commands) | string | Additional logic that needs to be run on Master Node. The value has to be path to a file |
| [dataRetention](#data-retention) | boolean | Do you want to retain jenkins jobs and build history |
| [agentAssumeRole](#assume-role) | string | IAM role ARN to be assumed by jenkins agent nodes |
Expand All @@ -107,9 +107,9 @@ $aws secretsmanager put-secret-value \
1. Upload the certificate to IAM [see docs](https://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html)
1. Update the secret value for the `certificateArnSecret` with the certificate arn generated by IAM
1. Update the secret value for `redirectUrlSecret` with a dummy or valid redirect URL. eg: https://dummyJenkinsUrl.com
1. Run with parameter using one of the following (refer [this](#setup-openid-connect-oidc-via-federate) for value of `runWithOidc`)
1. `npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=true -c runWithOidc=true` or,
1. `cdk deploy OpenSearch-CI-Dev -c useSsl=true -c runWithOidc=true`
1. Run with parameter using one of the following
1. `npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=true ` or,
1. `cdk deploy OpenSearch-CI-Dev -c useSsl=true `
1. Continue with [next steps](#dev-deployment)

#### Setup Authentication using OpenId Connect (OIDC) or GitHub Authentication
Expand Down Expand Up @@ -205,7 +205,7 @@ envVarsFilePath = 'test/data/env.yaml'
The Created jenkins agent role can assume cross account role by passing `agentAssumeRole` parameter
Example:
```
npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c runWithOidc=false -c agentAssumeRole=arn:aws:iam::522XXX13897:role/sample-assume-role
npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c agentAssumeRole=arn:aws:iam::522XXX13897:role/sample-assume-role
```
NOTE: The assume role has to be pre-created for the agents to assume. Once CDK stack is deployed with `-c agentAssumeRole` flag, make sure this flag is passed for next CDK operations to make sure this created policy that assumes cross-account role is not removed.
Expand All @@ -217,7 +217,7 @@ To deploy mac agents, as a prerequisites make sure the backend AWS account has d
To configure ec2 Mac agent setup run the stack with `-c macAgent=true`.
Example:
```
npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c runWithOidc=false -c macAgent=true
npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c macAgent=true
```
#### Windows agents
Expand All @@ -241,7 +241,7 @@ EOF
To use above example, you need to write the contents of the script to a file, say example.txt and pass the path of example.txt to `additionalCommands` paramter.
Usage:
```
npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c runWithOidc=false -c additionalCommands='./example.txt'
npm run cdk deploy OpenSearch-CI-Dev -- -c useSsl=false -c additionalCommands='./example.txt'
```
#### Use Production Agents
Expand Down

0 comments on commit 1b27ce2

Please sign in to comment.