feat(deadline): validate minimum Deadline version for secrets managem…

…ent (#573)

packages/aws-rfdk/lib/deadline/lib/render-queue.ts

@@ -257,13 +257,6 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
  */
  private static readonly MINIMUM_LOAD_BALANCING_VERSION = new Version([10, 1, 10, 0]);
 
- // TODO: Update this with the version of Deadline that includes the changes for RFDK Secrets Management.
- // This is a temporary minimum version until this feature branch is merged
- /**
- * The minimum Deadline version required to enable Deadline Secrets Management on the Render Queue.
- */
- private static readonly MINIMUM_SECRETS_MANAGEMENT_VERSION = new Version([10, 1, 15, 0]);
-
  /**
  * Regular expression that validates a hostname (portion in front of the subdomain).
  */
@@ -471,8 +464,8 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
 
  if (props.repository.secretsManagementSettings.enabled) {
  const errors = [];
- if (props.version.isLessThan(RenderQueue.MINIMUM_SECRETS_MANAGEMENT_VERSION)) {
- errors.push(`The supplied Deadline version (${props.version.versionString}) is lower than the minimum required version: ${RenderQueue.MINIMUM_SECRETS_MANAGEMENT_VERSION.toString()}`);
+ if (props.version.isLessThan(Version.MINIMUM_SECRETS_MANAGEMENT_VERSION)) {
+ errors.push(`The supplied Deadline version (${props.version.versionString}) does not support Deadline Secrets Management in RFDK. Either upgrade Deadline to the minimum required version (${Version.MINIMUM_SECRETS_MANAGEMENT_VERSION.versionString}) or disable the feature in the Repository's construct properties.`);
  }
  if (props.repository.secretsManagementSettings.credentials === undefined) {
  errors.push('The Repository does not have Secrets Management credentials');

packages/aws-rfdk/lib/deadline/lib/repository.ts

@@ -77,6 +77,7 @@ import {
 
 import { DatabaseConnection } from './database-connection';
 import { IHost } from './host-ref';
+import { Version } from './version';
 import { VersionQuery } from './version-query';
 import { IVersion } from './version-ref';
 
@@ -596,10 +597,17 @@ export class Repository extends Construct implements IRepository {
 
  this.version = props.version;
 
+ const meetsMinSecretsVersion = !this.version.isLessThan(Version.MINIMUM_SECRETS_MANAGEMENT_VERSION);
+ const secretsManagementIsEnabled = props.secretsManagementSettings?.enabled ?? meetsMinSecretsVersion;
+
+ if (secretsManagementIsEnabled && !meetsMinSecretsVersion) {
+ throw new Error(`The supplied Deadline version (${props.version.versionString}) does not support Deadline Secrets Management in RFDK. Either upgrade Deadline to the minimum required version (${Version.MINIMUM_SECRETS_MANAGEMENT_VERSION.versionString}) or disable the feature in the Repository's construct properties.`);
+ }
+
  this.secretsManagementSettings = {
- enabled: props.secretsManagementSettings?.enabled ?? true,
+ enabled: secretsManagementIsEnabled,
  credentials: props.secretsManagementSettings?.credentials ??
- ((props.secretsManagementSettings?.enabled ?? true) ? new Secret( props.database?.databaseConstruct ? Stack.of(props.database?.databaseConstruct) : this, 'SMAdminUser', {
+ (secretsManagementIsEnabled ? new Secret( props.database?.databaseConstruct ? Stack.of(props.database?.databaseConstruct) : this, 'SMAdminUser', {
  description: 'Admin credentials for Deadline Secrets Management',
  generateSecretString: {
  excludeCharacters: '\"$&\'()/<>[\\]\`{|}',

packages/aws-rfdk/lib/deadline/lib/version.ts

@@ -17,6 +17,11 @@ export class Version implements IPatchVersion {
  */
  public static readonly MINIMUM_SUPPORTED_DEADLINE_VERSION = new Version([10, 1, 9, 2]);
 
+ /**
+ * The minimum Deadline version required to enable Deadline Secrets Management.
+ */
+ public static readonly MINIMUM_SECRETS_MANAGEMENT_VERSION = new Version([10, 1, 19, 0]);
+
  /**
  * This method parses the input string and returns the version object.
  *

packages/aws-rfdk/lib/deadline/test/render-queue.test.ts

@@ -84,6 +84,7 @@ import {
  Repository,
  SecretsManagementRegistrationStatus,
  SecretsManagementRole,
+ Version,
  VersionQuery,
 } from '../lib';
 import { SecretsManagementIdentityRegistration } from '../lib/secrets-management';
@@ -2841,7 +2842,7 @@ describe('RenderQueue', () => {
 
  // THEN
  /* eslint-disable-next-line dot-notation */
- .toThrowError(`The supplied Deadline version (${oldVersion.versionString}) is lower than the minimum required version: ${RenderQueue['MINIMUM_SECRETS_MANAGEMENT_VERSION'].toString()}`);
+ .toThrowError(`The supplied Deadline version (${oldVersion.versionString}) does not support Deadline Secrets Management in RFDK. Either upgrade Deadline to the minimum required version (${Version.MINIMUM_SECRETS_MANAGEMENT_VERSION.versionString}) or disable the feature in the Repository's construct properties.`);
  });
 
  test('grants read permissions to secrets management credentials', () => {

packages/aws-rfdk/lib/deadline/test/repository.test.ts

@@ -118,7 +118,7 @@ beforeEach(() => {
  }
  }
 
- version = new MockVersion([10,1,9,2]);
+ version = new MockVersion([10,1,19,4]);
 });
 
 test('can create two repositories', () => {
@@ -864,7 +864,7 @@ test('repository instance is created with correct installer path version', () =>
 
  // THEN
  const script = (repo.node.defaultChild as AutoScalingGroup).userData;
- expect(script.render()).toMatch(/10\.1\.9\.2/);
+ expect(script.render()).toEqual(expect.stringContaining(version.versionString));
 });
 
 test.each([
@@ -1240,6 +1240,42 @@ test('throws an error if supplied a MountableEfs with no Access Point', () => {
  expect(when).toThrow('When using EFS with the Repository, you must provide an EFS Access Point');
 });
 
+test('disable Secrets Management by default when Deadline version is old', () => {
+ // GIVEN
+ const newStack = new Stack(app, 'NewStack');
+ const oldVersion = new VersionQuery(newStack, 'OldDeadlineVersion', { version: '10.0.0.0' });
+
+ // WHEN
+ const repository = new Repository(newStack, 'Repo', {
+ vpc,
+ version: oldVersion,
+ });
+
+ // THEN
+ expect(repository.secretsManagementSettings.enabled).toBeFalsy();
+ expect(repository.secretsManagementSettings.credentials).toBeUndefined();
+});
+
+test('throws when Secrets Management is enabled but deadline version is too low', () => {
+ // GIVEN
+ const newStack = new Stack(app, 'NewStack');
+ const oldVersion = new VersionQuery(newStack, 'OldDeadlineVersion', { version: '10.0.0.0' });
+
+ // WHEN
+ function when() {
+ new Repository(newStack, 'Repo', {
+ version: oldVersion,
+ vpc,
+ secretsManagementSettings: {
+ enabled: true,
+ },
+ });
+ }
+
+ // THEN
+ expect(when).toThrow(`The supplied Deadline version (${oldVersion.versionString}) does not support Deadline Secrets Management in RFDK. Either upgrade Deadline to the minimum required version (${Version.MINIMUM_SECRETS_MANAGEMENT_VERSION.versionString}) or disable the feature in the Repository's construct properties.`);
+});
+
 test('imports repository settings', () => {
  // GIVEN
  const repositorySettings = new Asset(stack, 'RepositorySettingsAsset', {