Merge pull request #636 from aws/bump/0.39.0

chore(release): 0.39.0

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
 
     runs-on: ubuntu-latest
     container:
-      image: jsii/superchain
+      image: jsii/superchain:1-buster-slim-node14
 
     strategy:
       matrix:

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [0.39.0](https://github.com/aws/aws-rfdk/compare/v0.38.0...v0.39.0) (2021-11-20)
+
+
+### Supported CDK Version
+
+* [1.129.0](https://github.com/aws/aws-cdk/releases/tag/v1.129.0)
+
+
+### Officially Supported Deadline Versions
+
+* [10.1.9.2 to 10.1.19.4](https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/release-notes.html)
+
+
+### Bug Fixes
+
+* **deadline:** change dependency when configuring repository clients to its auto scaling group ([#626](https://github.com/aws/aws-rfdk/issues/626)) ([6464f40](https://github.com/aws/aws-rfdk/commit/6464f40a88236797c3e2df5caf5420421e8f7936))
+* **deadline:** configure identity registration settings using RenderQueue backend security group ([#633](https://github.com/aws/aws-rfdk/issues/633)) ([35bb326](https://github.com/aws/aws-rfdk/commit/35bb326e6d6ec6e8f02d0210c2caada74f369062)), closes [#632](https://github.com/aws/aws-rfdk/issues/632)
+
 ## [0.38.0](https://github.com/aws/aws-rfdk/compare/v0.37.0...v0.38.0) (2021-10-25)
 
 
@@ -15,6 +33,13 @@ All notable changes to this project will be documented in this file. See [standa
 * [10.1.9.2 to 10.1.19.4](https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/release-notes.html)
 
 
+### ⚠ BREAKING CHANGES
+
+RFDK will configure Deadline Secrets Management automatically when using Deadline 10.1.19.x or higher. If your CDK app uses the `Repository` construct with an un-pinned [`VersionQuery`](https://docs.aws.amazon.com/rfdk/api/latest/docs/aws-rfdk.deadline.VersionQuery.html), then upgrading RFDK will set up Deadline Secrets Management. Using Deadline Secrets Management is strongly encouraged for securing Deadline render farms, however it can potentially impact your workflows within Deadline. Please review the [Deadline Secrets Management documentation](https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/secrets-management/deadline-secrets-management.html) to learn about the feature.
+
+See the [RFDK 0.38.x upgrade documentation](https://github.com/aws/aws-rfdk/blob/v0.38.0/packages/aws-rfdk/docs/upgrade/upgrading-0.38.md)
+for more details and guidance on how to upgrade.
+
 ### Features
 
 * **deadline:** add Deadline Secrets Management integration in the Render Queue ([#528](https://github.com/aws/aws-rfdk/issues/528)) ([48baa18](https://github.com/aws/aws-rfdk/commit/48baa185b274030cab29a235469536585822313f))
@@ -53,7 +78,7 @@ created with an imported EFS Access Point
 the Render Queue will be modified to have it enabled and using the
 default certificate and hosted zone. To keep external TLS disabled, the
 `enabled` flag on the `RenderQueueExternalTLSProps` can be set to false;
-however, we strongly encourage you to enable TLS. See the[RFDK 0.37.x upgrade documentation](https://github.com/aws/aws-rfdk/blob/v0.37.0/packages/aws-rfdk/docs/upgrade/upgrading-0.37.md)
+however, we strongly encourage you to enable TLS. See the [RFDK 0.37.x upgrade documentation](https://github.com/aws/aws-rfdk/blob/v0.37.0/packages/aws-rfdk/docs/upgrade/upgrading-0.37.md)
 for more details and guidance on how to upgrade.
 
 ### Features

CONTRIBUTING.md

@@ -75,10 +75,10 @@ The developers actively use Linux for development, but macOS and the Windows Sub
 
 To build, we use the [jsii/superchain docker container](https://hub.docker.com/r/jsii/superchain).
 
-1. Acquire the latest `jsii/superchain:node14` docker image, if you do not already have it.
+1. Acquire the latest `jsii/superchain:1-buster-slim-node14` docker image, if you do not already have it.
 
     ```bash
-    docker pull jsii/superchain:node14
+    docker pull jsii/superchain:1-buster-slim-node14
     ```
 
 2. Enter the docker container

examples/deadline/All-In-AWS-Infrastructure-Basic/python/setup.py

@@ -18,7 +18,7 @@
 
     install_requires=[
         "aws-cdk.core==1.129.0",
-        "aws-rfdk==0.38.0"
+        "aws-rfdk==0.39.0"
     ],
 
     python_requires=">=3.7",

examples/deadline/All-In-AWS-Infrastructure-Basic/ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "all-in-farm-basic",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "bin": {
     "app": "bin/app.js"
   },
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "@aws-cdk/core": "1.129.0",
-    "aws-rfdk": "0.38.0",
+    "aws-rfdk": "0.39.0",
     "source-map-support": "^0.5.20"
   }
 }

examples/deadline/All-In-AWS-Infrastructure-SEP/python/setup.py

@@ -18,7 +18,7 @@
 
     install_requires=[
         "aws-cdk.core==1.129.0",
-        "aws-rfdk==0.38.0"
+        "aws-rfdk==0.39.0"
     ],
 
     python_requires=">=3.7",

examples/deadline/All-In-AWS-Infrastructure-SEP/ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "all-in-farm-sep",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "bin": {
     "app": "bin/app.js"
   },
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@aws-cdk/core": "1.129.0",
-    "aws-rfdk": "0.38.0",
+    "aws-rfdk": "0.39.0",
     "source-map-support": "^0.5.20"
   }
 }

examples/deadline/EC2-Image-Builder/python/setup.py

@@ -22,7 +22,7 @@
         "aws-cdk.aws-ec2==1.129.0",
         "aws-cdk.aws-s3-assets==1.129.0",
         "aws-cdk.core==1.129.0",
-        "aws-rfdk==0.38.0",
+        "aws-rfdk==0.39.0",
     ],
 
     python_requires=">=3.7",

examples/deadline/EC2-Image-Builder/ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "all-in-farm-image-builder",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "bin": {
     "app": "bin/app.js"
   },
@@ -25,6 +25,6 @@
     "@aws-cdk/aws-imagebuilder": "1.129.0",
     "@aws-cdk/aws-s3-assets": "1.129.0",
     "@aws-cdk/core": "1.129.0",
-    "aws-rfdk": "0.38.0"
+    "aws-rfdk": "0.39.0"
   }
 }

examples/deadline/Local-Zone/python/setup.py

@@ -21,7 +21,7 @@
         "aws-cdk.aws-elasticloadbalancingv2==1.129.0",
         "aws-cdk.aws-route53==1.129.0",
         "aws-cdk.core==1.129.0",
-        "aws-rfdk==0.38.0",
+        "aws-rfdk==0.39.0",
         "jsii==1.40.0",
     ],
 

examples/deadline/Local-Zone/ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "all-in-farm-local-zone",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "bin": {
     "app": "bin/app.js"
   },
@@ -23,7 +23,7 @@
     "@aws-cdk/aws-elasticloadbalancingv2": "1.129.0",
     "@aws-cdk/aws-route53": "1.129.0",
     "@aws-cdk/core": "1.129.0",
-    "aws-rfdk": "0.38.0",
+    "aws-rfdk": "0.39.0",
     "source-map-support": "^0.5.20"
   }
 }

integ/package.json

@@ -1,6 +1,6 @@
 {
   "name": "integ",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "private": false,
   "description": "Integration tests for RFDK constructs",
   "bin": {
@@ -67,7 +67,7 @@
     "eslint-plugin-import": "^2.25.2",
     "eslint-plugin-license-header": "^0.2.1",
     "jest": "^27.3.1",
-    "pkglint": "0.38.0",
+    "pkglint": "0.39.0",
     "ts-jest": "^27.0.7",
     "typescript": "~4.4.4"
   },
@@ -86,7 +86,7 @@
     "@aws-cdk/aws-s3-assets": "1.129.0",
     "@aws-cdk/aws-secretsmanager": "1.129.0",
     "@aws-cdk/core": "1.129.0",
-    "aws-rfdk": "0.38.0",
+    "aws-rfdk": "0.39.0",
     "aws-sdk": "^2.1012.0"
   },
   "peerDependencies": {
@@ -104,7 +104,7 @@
     "@aws-cdk/aws-s3-assets": "1.129.0",
     "@aws-cdk/aws-secretsmanager": "1.129.0",
     "@aws-cdk/core": "1.129.0",
-    "aws-rfdk": "0.38.0",
+    "aws-rfdk": "0.39.0",
     "aws-sdk": "^2.1012.0"
   },
   "engines": {

lambda-layers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambda-layers",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "private": false,
   "description": "Package containing scripts for building and publishing Lambda Layers",
   "main": "lib/index.js",

lerna.json

@@ -2,5 +2,5 @@
   "npmClient": "yarn",
   "useWorkspaces": true,
   "rejectCycles": "true",
-  "version": "0.38.0"
+  "version": "0.39.0"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-rfdk-project",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "license": "Apache-2.0",
   "author": {
     "name": "Amazon Web Services",

packages/aws-rfdk/lib/core/lib/deployment-instance.ts

@@ -9,12 +9,14 @@ import {
   UpdatePolicy,
 } from '@aws-cdk/aws-autoscaling';
 import {
+  AmazonLinuxGeneration,
   Connections,
   IConnectable,
   IMachineImage,
   InstanceClass,
   InstanceSize,
   InstanceType,
+  ISecurityGroup,
   IVpc,
   MachineImage,
   SubnetSelection,
@@ -92,6 +94,13 @@ export interface DeploymentInstanceProps {
    */
   readonly machineImage?: IMachineImage;
 
+  /**
+   * A security group to associate with the DeploymentInstance
+   *
+   * @default A new security group is created for the DeploymentInstance
+   */
+  readonly securityGroup?: ISecurityGroup;
+
   /**
    * Whether the instance should self-terminate after the deployment succeeds
    *
@@ -164,17 +173,18 @@ export class DeploymentInstance extends Construct implements IScriptHost, IConne
     this.asg = new AutoScalingGroup(this, 'ASG', {
       instanceType: props.instanceType ?? InstanceType.of(InstanceClass.T3, InstanceSize.SMALL),
       keyName: props.keyName,
-      machineImage: props.machineImage ?? MachineImage.latestAmazonLinux(),
-      vpc: props.vpc,
-      vpcSubnets: props.vpcSubnets ?? {
-        subnetType: SubnetType.PRIVATE,
-      },
+      machineImage: props.machineImage ?? MachineImage.latestAmazonLinux({ generation: AmazonLinuxGeneration.AMAZON_LINUX_2 }),
       minCapacity: 1,
       maxCapacity: 1,
+      securityGroup: props.securityGroup,
       signals: Signals.waitForAll({
         timeout: props.executionTimeout ?? DeploymentInstance.DEFAULT_EXECUTION_TIMEOUT,
       }),
       updatePolicy: UpdatePolicy.replacingUpdate(),
+      vpc: props.vpc,
+      vpcSubnets: props.vpcSubnets ?? {
+        subnetType: SubnetType.PRIVATE,
+      },
     });
     this.node.defaultChild = this.asg;
 

packages/aws-rfdk/lib/core/test/deployment-instance.test.ts

@@ -13,6 +13,7 @@ import {
 } from '@aws-cdk/assert';
 import { CfnLaunchConfiguration } from '@aws-cdk/aws-autoscaling';
 import {
+  AmazonLinuxGeneration,
   AmazonLinuxImage,
   ExecuteFileOptions,
   InstanceType,
@@ -167,7 +168,7 @@ describe('DeploymentInstance', () => {
 
       test('uses latest Amazon Linux machine image', () => {
         // GIVEN
-        const amazonLinux = MachineImage.latestAmazonLinux();
+        const amazonLinux = MachineImage.latestAmazonLinux({ generation: AmazonLinuxGeneration.AMAZON_LINUX_2 });
         const imageId: { Ref: string } = stack.resolve(amazonLinux.getImage(stack)).imageId;
 
         // THEN
@@ -659,6 +660,26 @@ describe('DeploymentInstance', () => {
     }));
   });
 
+  test('uses specified security group', () => {
+    // GIVEN
+    const securityGroupId = 'securityGroupId';
+    const securityGroup = SecurityGroup.fromSecurityGroupId(depStack, 'SecurityGroup', securityGroupId);
+    stack = new cdk.Stack(app, 'SecurityGroupStack');
+
+    // WHEN
+    new DeploymentInstance(stack, DEFAULT_CONSTRUCT_ID, {
+      vpc,
+      securityGroup,
+    });
+
+    // THEN
+    expectCDK(stack).to(haveResourceLike('AWS::AutoScaling::LaunchConfiguration', {
+      SecurityGroups: arrayWith(
+        securityGroupId,
+      ),
+    }));
+  });
+
   describe('.selfTermination = false', () => {
     beforeAll(() => {
       // GIVEN

packages/aws-rfdk/lib/deadline/README.md

@@ -196,7 +196,9 @@ The `RenderQueue` construct sets up the RCS and configures it to communicate wit
 The following example outlines how to construct a `RenderQueue`:
 
 ```ts
-const version = VersionQuery.exactString(stack, 'Version', '1.2.3.4');
+const version = new VersionQuery(stack, 'Version', {
+  version: '1.2.3.4',
+});
 const images = new ThinkboxDockerImages(stack, 'Images', {
   version: version,
   // Change this to AwsThinkboxEulaAcceptance.USER_ACCEPTS_AWS_THINKBOX_EULA to accept the terms
@@ -307,7 +309,9 @@ You can create a `Repository` like this:
 ```ts
 const repository = new Repository(stack, 'Repository', {
   vpc: props.vpc,
-  version: VersionQuery.exactString(stack, 'Version', '1.2.3.4')
+  version: new VersionQuery(stack, 'Version', {
+    version: '1.2.3.4',
+  }),
 });
 ```
 
@@ -680,11 +684,8 @@ The `VersionQuery` construct encapsulates a version of Deadline and the location
 
 You can specify a Deadline version as follows:
 ```ts
-const version = VersionQuery.exact(stack, 'ExactVersion', {
-  majorVersion: '1',
-  minorVersion: '2',
-  releaseVersion: '3',
-  patchVersion: '4'
+const version = new VersionQuery(stack, 'Version', {
+  version: '1.2.3.4',
 });
 ```
 

packages/aws-rfdk/lib/deadline/lib/render-queue.ts

@@ -378,7 +378,7 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
   /**
    * Depend on this to ensure that ECS Service is stable.
    */
-  private ecsServiceStabilized: WaitForStableService;
+  private readonly ecsServiceStabilized: WaitForStableService;
 
   constructor(scope: Construct, id: string, private readonly props: RenderQueueProps) {
     super(scope, id);
@@ -973,6 +973,7 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
     const deploymentInstanceNode = this.node.tryFindChild(CONFIGURE_REPOSITORY_CONSTRUCT_ID);
     if (deploymentInstanceNode === undefined) {
       return new DeploymentInstance(this, CONFIGURE_REPOSITORY_CONSTRUCT_ID, {
+        securityGroup: this.backendConnections.securityGroups[0],
         vpc: this.props.vpc,
         vpcSubnets: this.props.vpcSubnets ?? RenderQueue.DEFAULT_VPC_SUBNETS_OTHER,
       });

packages/aws-rfdk/lib/deadline/lib/repository.ts

@@ -841,7 +841,7 @@ export class Repository extends Construct implements IRepository {
 
     // Add an explicit dependency on the Repository. This ensures that deployments of the Repository construct precede
     // deployments of the client and the repository is fully setup.
-    props.containers.taskDefinition.node.addDependency(this);
+    props.containers.taskDefinition.node.addDependency(this.installerGroup);
 
     // Configure a named volume in the task-definition that points to the container host's mount-point of the repository
     // file-system
@@ -875,7 +875,7 @@ export class Repository extends Construct implements IRepository {
   public configureClientInstance(props: InstanceDirectConnectProps): void {
     // Add an explicit dependency on the Repository. This ensures that deployments of the Repository construct precede
     // deployments of the client and the repository is fully setup.
-    props.host.node.addDependency(this);
+    props.host.node.addDependency(this.installerGroup);
 
     this.setupDirectConnect(props.host, props.mountPoint);