-
Notifications
You must be signed in to change notification settings - Fork 42
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Create Environment] Adding ec module #1742
Changes from all commits
4c75f1f
26e34e0
c541fae
771638a
f54a9c2
eb9cdd5
f444990
0e71397
056d798
558e2c3
62a121e
0eea065
738d28d
7df2760
cb66ca9
a0b08c5
1a1e991
c19101b
91ed41f
d4f0b38
63bdac7
b8556f4
a71888e
7de6cb4
09f08a0
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -17,7 +17,7 @@ on: | |
default: false | ||
elk-stack-version: | ||
required: true | ||
description: "Stack version: For released/BC version use 8.x.y, for SNAPSHOT use 8.x.y-SNAPSHOT" | ||
description: "Stack version: For released version use 8.x.y, for BC use version with hash 8.x.y-hash, for SNAPSHOT use 8.x.y-SNAPSHOT" | ||
default: "8.11.0" | ||
type: string | ||
ess-region: | ||
|
@@ -54,7 +54,7 @@ on: | |
default: false | ||
elk-stack-version: | ||
required: true | ||
description: "Stack version: For released/BC version use 8.x.y, for SNAPSHOT use 8.x.y-SNAPSHOT" | ||
description: "Stack version: For released version use 8.x.y, for BC use version with hash 8.x.y-hash, for SNAPSHOT use 8.x.y-SNAPSHOT" | ||
default: "8.10.0" | ||
type: string | ||
ess-region: | ||
|
@@ -104,15 +104,13 @@ jobs: | |
run: | ||
working-directory: ${{ env.WORKING_DIR }} | ||
env: | ||
TF_VAR_stack_version: ${{ inputs.elk-stack-version }} | ||
TF_VAR_ess_region: ${{ inputs.ess-region }} | ||
DEPLOYMENT_NAME: ${{ inputs.deployment_name }} | ||
TF_VAR_serverless_mode: ${{ inputs.serverless_mode }} | ||
TEST_AGENTLESS: ${{ inputs.serverless_mode }} | ||
S3_BASE_BUCKET: "s3://tf-state-bucket-test-infra" | ||
S3_BUCKET_URL: "https://s3.console.aws.amazon.com/s3/buckets/tf-state-bucket-test-infra" | ||
DOCKER_IMAGE_OVERRIDE: ${{ inputs.docker-image-override }} | ||
STACK_VERSION: ${{ inputs.elk-stack-version }} | ||
CNVM_STACK_NAME: "${{ inputs.deployment_name }}-cnvm-sanity-test-stack" | ||
# Add "id-token" with the intended permissions. | ||
permissions: | ||
|
@@ -152,6 +150,39 @@ jobs: | |
echo "::add-mask::$ec_api_key" | ||
echo "TF_VAR_ec_api_key=$ec_api_key" >> $GITHUB_ENV | ||
|
||
- name: Process Stack Version | ||
id: remove-commit-hash | ||
run: | | ||
# Extract the stack version | ||
stack_version="${{ inputs.elk-stack-version }}" | ||
|
||
echo "TF_VAR_stack_version=$stack_version" >> $GITHUB_ENV | ||
echo "STACK_VERSION=$stack_version" >> $GITHUB_ENV | ||
|
||
# Handle BC versions with commit hash (e.g. 8.11.0-1234567890) | ||
if [[ $stack_version =~ -[a-f0-9]+ ]]; then | ||
cleaned_version=$(echo $stack_version | awk -F"-" '{print $1}') | ||
|
||
# Versions with commit hash are not allowed for EC regular deployments and should be modified | ||
# EC module resource: | ||
# ec_deployment.deployment.version is required attribute and should be in format 8.x.y | 8.x.y-SNAPSHOT | ||
# Therefore, we need to modify the version in the env variable | ||
echo "TF_VAR_stack_version=$cleaned_version" >> $GITHUB_ENV | ||
|
||
# env variable STACK_VERSION is used in sanity tests for findings validation | ||
# findings are saved with version without commit hash | ||
# therefore, we need to modify the version in the env variable | ||
echo "STACK_VERSION=$cleaned_version" >> $GITHUB_ENV | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove it's declaration on line 115 There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Updates the declaration to support the working of the entire flow retroactively. The version with the hash is only required for Terraform to pin the version of the stack to be deployed. |
||
|
||
# TF_VAR_pin_version is used to override stack docker images | ||
# for BC versions with commit hash | ||
# This version will be used to override the docker images | ||
# elasticsearch.config.docker_image | ||
# kibana.config.docker_image | ||
# integrations_server.config.docker_image | ||
echo "TF_VAR_pin_version=$stack_version" >> $GITHUB_ENV | ||
fi | ||
|
||
- name: Init Enrollment Token | ||
run: | | ||
enrollment_token="init" | ||
|
@@ -198,7 +229,8 @@ jobs: | |
terraform apply --auto-approve \ | ||
-var="deployment_name=${{ env.DEPLOYMENT_NAME }}" \ | ||
-var="region=${{ env.AWS_REGION }}" \ | ||
-var="project=${{ github.actor }}" | ||
-var="project=${{ github.actor }}" \ | ||
-var="owner=${{ github.actor }}" | ||
Comment on lines
+232
to
+233
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💯 |
||
|
||
- name: Set Environment Output | ||
id: env-output | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -12,7 +12,7 @@ on: | |
required: true | ||
target-elk-stack-version: | ||
required: true | ||
description: "Target version of the ELK stack: For BC version use 8.x.y, for SNAPSHOT use 8.x.y-SNAPSHOT" | ||
description: "Target version of the ELK stack: For BC use version with hash 8.x.y-hash, for SNAPSHOT use 8.x.y-SNAPSHOT" | ||
default: "8.11.0" | ||
type: string | ||
base-elk-stack-version: | ||
|
@@ -38,8 +38,9 @@ jobs: | |
init: | ||
runs-on: ubuntu-20.04 | ||
outputs: | ||
stack-version: ${{ steps.set-previous-version.outputs.PREVIOUS_VERSION }} | ||
base-stack-version: ${{ steps.set-previous-version.outputs.PREVIOUS_VERSION }} | ||
ess-region: ${{ env.TF_VAR_ess_region }} | ||
target-agent-version: ${{ steps.clean-version.outputs.AGENT_VERSION }} | ||
steps: | ||
- name: Check out the repo | ||
uses: actions/checkout@v4 | ||
|
@@ -52,7 +53,20 @@ jobs: | |
PREVIOUS_VERSION=$(./.ci/scripts/get-previous-version.sh "$VERSION") | ||
echo "PREVIOUS_VERSION=$PREVIOUS_VERSION" >> $GITHUB_OUTPUT | ||
else | ||
echo "PREVIOUS_VERSION=${{ inputs.base-elk-stack-version }}" >> $GITHUB_ENV | ||
echo "PREVIOUS_VERSION=${{ inputs.base-elk-stack-version }}" >> $GITHUB_OUTPUT | ||
fi | ||
- name: Process BC version | ||
id: clean-version | ||
run: | | ||
# Extract the stack version | ||
stack_version="${{ inputs.target-elk-stack-version }}" | ||
|
||
# Check if the version contains a commit hash, remove it | ||
if [[ $stack_version =~ -[a-f0-9]+ ]]; then | ||
cleaned_version=$(echo $stack_version | awk -F"-" '{print $1}') | ||
echo "AGENT_VERSION=$cleaned_version" >> $GITHUB_OUTPUT | ||
else | ||
echo "AGENT_VERSION=$stack_version" >> $GITHUB_OUTPUT | ||
Comment on lines
+58
to
+69
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. if we reuse this part maybe we can export it to a script or to an action There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The common part is just to retrieve |
||
fi | ||
deploy: | ||
uses: ./.github/workflows/test-environment.yml | ||
|
@@ -63,7 +77,7 @@ jobs: | |
id-token: 'write' | ||
with: | ||
deployment_name: ${{ inputs.deployment_name }} | ||
elk-stack-version: ${{ needs.init.outputs.stack-version }} | ||
elk-stack-version: ${{ needs.init.outputs.base-stack-version }} | ||
ess-region: ${{ needs.init.outputs.ess-region }} | ||
run-sanity-tests: false # Set to true once the issue at https://github.com/elastic/kibana/pull/171200 is resolved. | ||
serverless_mode: false | ||
|
@@ -125,7 +139,11 @@ jobs: | |
id: apply | ||
if: success() | ||
run: | | ||
terraform apply --auto-approve -var="deployment_name=${{ inputs.deployment_name }}" -var="region=${{ env.AWS_REGION }}" | ||
terraform apply --auto-approve \ | ||
-var="deployment_name=${{ inputs.deployment_name }}" \ | ||
-var="region=${{ env.AWS_REGION }}" \ | ||
-var="project=${{ github.actor }}" \ | ||
-var="owner=${{ github.actor }}" | ||
|
||
- name: Set Environment Output | ||
id: env-output | ||
|
@@ -167,7 +185,7 @@ jobs: | |
working-directory: ./tests | ||
env: | ||
USE_K8S: false | ||
AGENT_VERSION: ${{ needs.init.outputs.stack-version }} | ||
AGENT_VERSION: ${{ needs.init.outputs.base-stack-version }} | ||
run: | | ||
poetry install | ||
poetry run pytest -m "sanity" --alluredir=./allure/results/ --clean-alluredir --maxfail=4 | ||
|
@@ -198,20 +216,21 @@ jobs: | |
--name $(terraform output -raw deployment_name) --alias eks-config | ||
kubectl config use-context eks-config | ||
kubectl set image daemonset elastic-agent -n kube-system elastic-agent=${{ env.DOCKER_IMAGE }} | ||
kubectl rollout restart daemonset/elastic-agent -n kube-system | ||
|
||
- name: Upgrade Linux agents | ||
working-directory: ${{ env.WORKING_DIR }}/${{ env.FLEET_API_DIR }} | ||
env: | ||
CNVM_STACK_NAME: ${{ needs.deploy.outputs.cnvm-stack-name }} | ||
STACK_VERSION: ${{ inputs.target-elk-stack-version }} | ||
STACK_VERSION: ${{ needs.init.outputs.target-agent-version }} | ||
run: | | ||
poetry run python upgrade_agents.py | ||
|
||
- name: Run Upgrade Sanity checks | ||
if: success() | ||
working-directory: ./tests | ||
env: | ||
AGENT_VERSION: ${{ inputs.target-elk-stack-version }} | ||
AGENT_VERSION: ${{ needs.init.outputs.target-agent-version }} | ||
USE_K8S: false | ||
run: | | ||
poetry install | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,67 @@ | ||
locals { | ||
version = var.stack_version | ||
region = var.region | ||
name_prefix = var.deployment_name_prefix | ||
deployment_template = var.deployment_template | ||
es_docker_image = lookup(var.docker_image, "elasticsearch", "") | ||
es_docker_image_tag_override = lookup(var.docker_image_tag_override, "elasticsearch", "") | ||
kibana_docker_image = lookup(var.docker_image, "kibana", "") | ||
kibana_docker_image_tag_override = lookup(var.docker_image_tag_override, "kibana", "") | ||
apm_docker_image = lookup(var.docker_image, "apm", "") | ||
apm_docker_image_tag_override = lookup(var.docker_image_tag_override, "apm", "") | ||
Comment on lines
+6
to
+11
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Do we really have a usecase of overriding these? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The main use case is to support pinned BC versions. As described in this task, if we provide just the version (e.g., 8.12.0) and a new BC candidate is released, the stack will be updated with the newest version underneath. To prevent that, we should provide the exact version to be deployed. Unfortunately, the There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. why do we even need the apm component? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The default |
||
} | ||
|
||
data "ec_stack" "deployment_version" { | ||
version_regex = local.version | ||
region = local.region | ||
} | ||
|
||
resource "ec_deployment" "deployment" { | ||
name = "${local.name_prefix}-${data.ec_stack.deployment_version.version}" | ||
version = data.ec_stack.deployment_version.version | ||
region = local.region | ||
deployment_template_id = local.deployment_template | ||
tags = var.tags | ||
|
||
elasticsearch = { | ||
autoscale = var.elasticsearch_autoscale | ||
strategy = "rolling_all" | ||
config = local.es_docker_image_tag_override != "" ? { | ||
docker_image = "${local.es_docker_image}:${local.es_docker_image_tag_override}" | ||
} : null | ||
|
||
cold = { | ||
autoscaling = {} | ||
} | ||
|
||
frozen = { | ||
autoscaling = {} | ||
} | ||
|
||
hot = { | ||
autoscaling = { | ||
max_size = "128g" | ||
max_size_resource = "memory" | ||
} | ||
size = var.elasticsearch_size | ||
zone_count = var.elasticsearch_zone_count | ||
} | ||
|
||
warm = { | ||
autoscaling = {} | ||
} | ||
} | ||
|
||
kibana = { | ||
config = local.kibana_docker_image_tag_override != "" ? { | ||
docker_image = "${local.kibana_docker_image}:${local.kibana_docker_image_tag_override}" | ||
} : null | ||
} | ||
|
||
integrations_server = { | ||
config = local.apm_docker_image_tag_override != "" ? { | ||
docker_image = "${local.apm_docker_image}:${local.apm_docker_image_tag_override}" | ||
} : null | ||
} | ||
|
||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
output "kibana_url" { | ||
value = ec_deployment.deployment.kibana.https_endpoint | ||
description = "The secure Kibana URL" | ||
} | ||
|
||
output "elasticsearch_url" { | ||
value = ec_deployment.deployment.elasticsearch.https_endpoint | ||
description = "The secure Elasticsearch URL" | ||
} | ||
|
||
output "elasticsearch_username" { | ||
value = ec_deployment.deployment.elasticsearch_username | ||
sensitive = true | ||
description = "The Elasticsearch username" | ||
} | ||
|
||
output "elasticsearch_password" { | ||
value = ec_deployment.deployment.elasticsearch_password | ||
sensitive = true | ||
description = "The Elasticsearch password" | ||
} | ||
|
||
output "stack_version" { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Nice, we should start using it instead of the "requested" version. |
||
value = data.ec_stack.deployment_version.version | ||
description = "The matching stack pack version from the provided stack_version" | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
terraform { | ||
required_version = ">= 1.3, <2.0.0" | ||
|
||
required_providers { | ||
ec = { | ||
source = "elastic/ec" | ||
version = ">=0.9.0" | ||
} | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,80 @@ | ||
variable "ec_api_key" { | ||
type = string | ||
} | ||
|
||
variable "stack_version" { | ||
description = "Optional version of the Elastic Cloud deployment" | ||
type = string | ||
default = "latest" | ||
} | ||
|
||
variable "region" { | ||
description = "Optional region of the Elastic Cloud deployment" | ||
type = string | ||
default = "gcp-us-west2" | ||
} | ||
|
||
variable "deployment_template" { | ||
description = "Optional defaults to the CPU optimized template for GCP" | ||
type = string | ||
default = "gcp-compute-optimized-v3" | ||
} | ||
|
||
variable "deployment_name_prefix" { | ||
description = "Prefix for the Elastic Cloud deployment name" | ||
type = string | ||
default = "cloud-security" | ||
} | ||
|
||
variable "tags" { | ||
type = map(string) | ||
default = { | ||
"deployment" = "cloud-security", | ||
"environment" = "test-enviroment", | ||
} | ||
description = "Optional set of tags to use for all deployments" | ||
} | ||
|
||
variable "elasticsearch_size" { | ||
default = "8g" | ||
type = string | ||
description = "Optional Elasticsearch instance size" | ||
} | ||
|
||
variable "elasticsearch_zone_count" { | ||
default = 2 | ||
type = number | ||
description = "Optional Elasticsearch zone count" | ||
} | ||
|
||
variable "elasticsearch_autoscale" { | ||
default = false | ||
type = bool | ||
description = "Optional autoscale the Elasticsearch cluster" | ||
} | ||
|
||
# Docker image overrides | ||
|
||
# Docker image tag override is used to override the default docker image tag | ||
# for BC reasons. This is used to test new versions of the cloud deployment | ||
# This option allow to pin the docker image tag to a specific version to prevent | ||
# unexpected changes in the deployment. | ||
variable "docker_image_tag_override" { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Please add comments on why those are needed especially when deploying BC versions. |
||
default = { | ||
"elasticsearch" = "", | ||
"kibana" = "", | ||
"apm" = "", | ||
Comment on lines
+64
to
+66
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Do we need those? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, each stack component may use a different image tag |
||
} | ||
description = "Optional docker image tag overrides, The full map needs to be specified" | ||
type = map(string) | ||
} | ||
|
||
variable "docker_image" { | ||
default = { | ||
"elasticsearch" = "docker.elastic.co/cloud-release/elasticsearch-cloud-ess", | ||
"kibana" = "docker.elastic.co/cloud-release/kibana-cloud", | ||
"apm" = "docker.elastic.co/cloud-release/elastic-agent-cloud", | ||
} | ||
type = map(string) | ||
description = "Optional docker image overrides. The full map needs to be specified" | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see that we also clean that on the terraform? Where do we use the full version?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For Terraform, we are utilizing the
TF_VAR_stack_version: ${{ inputs.elk-stack-version }}
environment variable, which is passed as is. Full version is used to deploy pinned BC version.