Skip to content

Commit a2adc53

Browse files
nhulstonnhulston
authored
Create bundle and publish to govcloud script (#627)
1 parent c379ff8 commit a2adc53

File tree

3 files changed

+161
-5
lines changed

3 files changed

+161
-5
lines changed

‎.gitlab/input_files/build.yaml.tpl

+28
Original file line numberDiff line numberDiff line change
@@ -175,3 +175,31 @@ publish npm package:
175175
- *node-before-script
176176
script:
177177
- .gitlab/scripts/publish_npm.sh
178+
179+
{{ range $environment := (ds "environments").environments }}
180+
181+
{{ if eq $environment.name "prod" }}signed {{ end }}layer bundle:
182+
stage: {{ if eq $environment.name "prod" }}sign{{ else }}build{{ end }}
183+
image: ${CI_DOCKER_TARGET_IMAGE}:${CI_DOCKER_TARGET_VERSION}
184+
tags: ["arch:amd64"]
185+
rules:
186+
- if: '"{{ $environment.name }}" =~ /^sandbox/'
187+
- if: '$CI_COMMIT_TAG =~ /^v.*/'
188+
needs:
189+
{{ range $runtime := (ds "runtimes").runtimes }}
190+
- {{ if eq $environment.name "prod" }}sign{{ else }}build{{ end }} layer ({{ $runtime.name }})
191+
{{ end }}
192+
dependencies:
193+
{{ range $runtime := (ds "runtimes").runtimes }}
194+
- {{ if eq $environment.name "prod" }}sign{{ else }}build{{ end }} layer ({{ $runtime.name }})
195+
{{ end }}
196+
artifacts:
197+
expire_in: 1 day
198+
paths:
199+
- datadog_lambda_js-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}/
200+
name: datadog_lambda_js-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
201+
script:
202+
- rm -rf datadog_lambda_js-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
203+
- mkdir -p datadog_lambda_js-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
204+
- cp .layers/datadog_lambda_node*.zip datadog_lambda_js-{{ if eq $environment.name "prod"}}signed-{{ end }}bundle-${CI_JOB_ID}
205+
{{ end }}

‎.gitlab/scripts/publish_layers.sh

+9-5
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,18 @@ if [[ "$STAGE" =~ ^(staging|sandbox)$ ]]; then
9595
else
9696
# Running on prod
9797
if [ -z "$CI_COMMIT_TAG" ]; then
98-
printf "[Error] No CI_COMMIT_TAG found.\n"
99-
printf "Exiting script...\n"
100-
exit 1
98+
# this happens during manual govcloud releases.
99+
if [ -z "$VERSION" ]; then
100+
printf "[Error] No CI_COMMIT_TAG or VERSION found.\n"
101+
printf "Exiting script...\n"
102+
exit 1
103+
else
104+
printf "Using provided VERSION: $VERSION\n"
105+
fi
101106
else
102107
printf "Tag found in environment: $CI_COMMIT_TAG\n"
108+
VERSION=$(echo "${CI_COMMIT_TAG##*v}" | cut -d. -f2)
103109
fi
104-
105-
VERSION=$(echo "${CI_COMMIT_TAG##*v}" | cut -d. -f2)
106110
fi
107111

108112
# Target layer version

‎scripts/publish_govcloud_layers.sh

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
#! /usr/bin/env bash
2+
3+
# Unless explicitly stated otherwise all files in this repository are licensed
4+
# under the Apache License Version 2.0.
5+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
6+
# Copyright 2025 Datadog, Inc.
7+
#
8+
# USAGE: download the layer bundle from the build pipeline in gitlab. Use the
9+
# Download button on the `layer bundle` job. This will be a zip file containing
10+
# all of the required layers. Run this script as follows:
11+
#
12+
# ENVIRONMENT=[us1-staging-fed or us1-fed] [PIPELINE_LAYER_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud_layers.sh <layer-bundle.zip>
13+
#
14+
# protip: you can drag the zip file from finder into your terminal to insert
15+
# its path.
16+
17+
set -e
18+
19+
NODE_VERSIONS=("18.12" "20.9" "22.11")
20+
21+
LAYER_PACKAGE=$1
22+
23+
if [ -z "$LAYER_PACKAGE" ]; then
24+
printf "[ERROR]: layer package not provided\n"
25+
exit 1
26+
fi
27+
28+
PACKAGE_NAME=$(basename "$LAYER_PACKAGE" .zip)
29+
echo package name: $PACKAGE_NAME
30+
31+
if [ -z "$ENVIRONMENT" ]; then
32+
printf "[ERROR]: ENVIRONMENT not specified\n"
33+
exit 1
34+
fi
35+
36+
if [ "$ENVIRONMENT" = "us1-staging-fed" ]; then
37+
AWS_VAULT_ROLE=sso-govcloud-us1-staging-fed-power-user
38+
39+
# this role looks like this in ~/.aws/config:
40+
# [profile sso-govcloud-us1-staging-fed-power-user]
41+
# sso_start_url=https://start.us-gov-home.awsapps.com/directory/d-9867188aeb
42+
# sso_account_id=553727695824
43+
# sso_role_name=power-user
44+
# sso_region=us-gov-west-1
45+
# region=us-gov-west-1
46+
47+
export STAGE="sandbox"
48+
if [[ ! "$PACKAGE_NAME" =~ ^datadog_lambda_js-(signed-)?bundle-[0-9]+$ ]]; then
49+
echo "[ERROR]: Unexpected package name: $PACKAGE_NAME"
50+
exit 1
51+
fi
52+
53+
elif [ $ENVIRONMENT = "us1-fed" ]; then
54+
AWS_VAULT_ROLE=sso-govcloud-us1-fed-engineering
55+
56+
# this role looks like this in ~/.aws/config:
57+
# [profile sso-govcloud-us1-fed-engineering]
58+
# sso_start_url=https://start.us-gov-west-1.us-gov-home.awsapps.com/directory/d-98671fdc8b
59+
# sso_account_id=002406178527
60+
# sso_role_name=engineering
61+
# sso_region=us-gov-west-1
62+
# region=us-gov-west-1
63+
64+
export STAGE="prod"
65+
if [[ ! "$PACKAGE_NAME" =~ ^datadog_lambda_js-signed-bundle-[0-9]+$ ]]; then
66+
echo "[ERROR]: Unexpected package name: $PACKAGE_NAME"
67+
exit 1
68+
fi
69+
70+
else
71+
printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed or us1-fed.\n"
72+
exit 1
73+
fi
74+
75+
# Clean and recreate the .layers directory
76+
echo "Cleaning .layers directory..."
77+
rm -rf .layers
78+
mkdir -p .layers
79+
80+
echo "Copying layer files to .layers directory..."
81+
TEMP_DIR=$(mktemp -d)
82+
unzip $LAYER_PACKAGE -d $TEMP_DIR
83+
cp -v $TEMP_DIR/$PACKAGE_NAME/*.zip .layers/
84+
85+
86+
AWS_VAULT_PREFIX="aws-vault exec $AWS_VAULT_ROLE --"
87+
88+
echo "Checking that you have access to the GovCloud AWS account"
89+
$AWS_VAULT_PREFIX aws sts get-caller-identity
90+
91+
92+
AVAILABLE_REGIONS=$($AWS_VAULT_PREFIX aws ec2 describe-regions | jq -r '.[] | .[] | .RegionName')
93+
94+
# Determine the target regions
95+
if [ -z "$REGIONS" ]; then
96+
echo "Region not specified, running for all available regions."
97+
REGIONS=$AVAILABLE_REGIONS
98+
else
99+
echo "Region specified: $REGIONS"
100+
if [[ ! "$AVAILABLE_REGIONS" == *"$REGIONS"* ]]; then
101+
echo "Could not find $REGIONS in available regions: $AVAILABLE_REGIONS"
102+
echo ""
103+
echo "EXITING SCRIPT."
104+
exit 1
105+
fi
106+
fi
107+
108+
for region in $REGIONS
109+
do
110+
echo "Starting publishing layers for region $region..."
111+
112+
for NODE_VERSION in "${NODE_VERSIONS[@]}"; do
113+
echo "Publishing Layer for Node ${NODE_VERSION} in region ${region}"
114+
115+
# Set environment variables for the publish script
116+
export REGION=$region
117+
export NODE_VERSION=$NODE_VERSION
118+
119+
# Run the publish script with AWS credentials
120+
$AWS_VAULT_PREFIX .gitlab/scripts/publish_layers.sh
121+
done
122+
done
123+
124+
echo "Done!"

0 commit comments

Comments
 (0)