-
Notifications
You must be signed in to change notification settings - Fork 42
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(deadline): configure identity registration settings for deadline clients #576
feat(deadline): configure identity registration settings for deadline clients #576
Conversation
f58da2e
to
8c4292d
Compare
8c4292d
to
26cd4e1
Compare
26cd4e1
to
0cc7f99
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall this looks really good, none of my comments should require changing too much in the overall architecture of this. I think the deployment instance could be a really powerful tool.
packages/aws-rfdk/lib/deadline/scripts/python/configure_identity_registration_settings.py
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great job. Just a couple moments that I want clarify.
packages/aws-rfdk/lib/deadline/scripts/python/configure_identity_registration_settings.py
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks great! Just have a few minor comments
packages/aws-rfdk/lib/deadline/scripts/python/configure_identity_registration_settings.py
Outdated
Show resolved
Hide resolved
packages/aws-rfdk/lib/deadline/scripts/python/configure_identity_registration_settings.py
Show resolved
Hide resolved
… client instances
Co-authored-by: David Horsman <56004724+horsmand@users.noreply.github.com>
- reorder DeploymentInstance props - document internal use of RenderQueue.configureSecretsManagementAutoRegistration - move SecretsManagementIdentityRegistration construct ID to constant - Add TSDoc header for SecretsManagementIdentityRegistration construct - Factor out constant for MacOS Deadline path file - Remove artifacts from FileSecret in configure_identity_registration_settings.py - fixes to encoding, logging and error-handling of deadline path on MacOS
…ecret read access
… registration configuration
- TSDoc improvements - Use MachineImage.latestAmazonLinux - Remove unnecessary test parameterization - Add code comments - Fix typos/punctuation/redundant syntax
4bb8df5
to
0cb6210
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
I left a few minor comments, but it's mostly tiny formatting/organization in the unit tests, so not holding back the PR for it.
packages/aws-rfdk/lib/deadline/test/usage-based-licensing.test.ts
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm in the same boat as Jericho. This looks good as-is. I'm going to give my approval but leave it for Josh to look over the comments and decide whether to fix them or merge.
packages/aws-rfdk/lib/deadline/test/configure-spot-event-plugin.test.ts
Outdated
Show resolved
Hide resolved
- flatten jest test heirarchies - fix typos - clarify test name
Summary
This change makes RFDK automatically configure Deadline Secrets Management identity registration settings based on the RFDK constructs that are present in a CDK application.
The changes are broken out by construct below:
DeploymentInstance
(new)This construct is an extraction/generalization of the CDK/CloudFormation pattern used by the
Repository
construct. It deploys an EC2 Auto-Scaling Group with a size of one. The Auto-Scaling Group is configured to require one CloudFormation success signal which is only sent after the user-data completes without error. The user data can optionally (by default enabled) self-terminate the instance by scaling down its own auto-scaling group to zero.For now, this construct is being kept internal to RFDK and not exported. It was designed with the possibility of making it a public construct in the future.
SecretsManagementIdentityRegistration
(new)The
SecretsManagementIdentityRegistration
construct is also introduced in this PR. It is responsible for configuring the user data (on aDeploymentInstance
) to configure the identity registration settings. It adds IAM permissions and user-data to perform the following steps:The main API of this construct is the
.addSubnetIdentityRegistrationSetting(...)
method which a caller can use to specify the subnets of the client, the desired secrets management role and registration status.RenderQueue
(modified)This PR introduces a new
configureSecretsManagementAutoRegistration(...)
method toIRenderQueue
. When called on theRenderQueue
, it will lazily createDeploymentInstance
andSecretsManagementIdentityRegistration
constructs and delegate the work to theSecretsManagementIdentityRegistration
construct. It also accepts adependent
prop which is used to enforce a CloudFormation dependency on a dependent resource of the caller's choosing.The CloudWatch logs for the
DeploymentInstance
are sent to the/renderfarm/ConfigureRepository
log group with the intention that the behavior of the deployment instance can be augmented in the future.WorkerInstanceFleet
/ConfigureSpotEventPlugin
/UsageBasedLicensing
(modified)The RFDK constructs that deploy Deadline Clients were modified to call the
configureSecretsManagementAutoRegistration(...)
methodIVersion
/VersionQuery
/ThinkboxDockerRecipes.version
(modified)The
IVersion
interface and classes that implement it were modified to return the path to the Deadline Client installer location. This was required in order for theSecretsManagementIdentityRegistration
construct to be able to install the Deadline Client on instance deployed by theDeploymentInstance
.Testing
Unit tests were updated to reflect all of the changes
Automatic identity registration of Deadline Clients was end-to-end tested by deploying the
All-In-AWS-Infrastructure-Basic
TypeScript example app with Thinkbox Usage-Based Licensing (UBL). Verified that:renderfarm/ConfigureRepository
log group showed correct behaviorBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license