Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable turning on volume encryption #80

Closed
wants to merge 1 commit into from
Closed

Enable turning on volume encryption #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/main/java/com/thoughtworks/gocd/elasticagent/ecs/aws/EC2Config.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,8 @@ public class EC2Config {
private boolean runAsSpotInstance;
private String spotPrice;
private Integer spotRequestExpiresAfter;
private Boolean dockerVolumeEncryption;
private Boolean operatingSystemVolumeEncryption;

public String getAmi() {
return ami;
Expand Down Expand Up @@ -148,6 +150,10 @@ public Date getSpotRequestValidUntil() {
return now().plusMinutes(spotRequestExpiresAfter).toDate();
}

public Boolean getDockerVolumeEncryption() { return dockerVolumeEncryption; }

public Boolean getOperatingSystemVolumeEncryption() { return operatingSystemVolumeEncryption; }

public static class Builder {
static final String NAME = "Name";
static final String CREATOR = "Creator";
Expand Down Expand Up @@ -211,10 +217,12 @@ private EC2Config createLinuxConfig() {
ec2Config.operatingSystemVolumeType = pluginSettings.getLinuxOSVolumeType();
ec2Config.operationSystemVolumeSize = pluginSettings.getLinuxOSVolumeSize();
ec2Config.operationSystemVolumeProvisionedIOPS = pluginSettings.getLinuxOSVolumeProvisionedIOPS();
ec2Config.operatingSystemVolumeEncryption = pluginSettings.getLinuxOSVolumeEncryption();

ec2Config.dockerVolumeType = pluginSettings.getLinuxVolumeType();
ec2Config.dockerVolumeSize = pluginSettings.getLinuxVolumeSize();
ec2Config.dockerVolumeProvisionedIOPS = pluginSettings.getLinuxVolumeProvisionedIOPS();
ec2Config.dockerVolumeEncryption = pluginSettings.getLinuxVolumeEncryption();
ec2Config.registerTimeOut = pluginSettings.getLinuxRegisterTimeout();
ec2Config.maxInstancesAllowed = pluginSettings.getMaxLinuxInstancesAllowed();
ec2Config.minInstanceCount = pluginSettings.getMinLinuxInstanceCount();
Expand Down
9 changes: 5 additions & 4 deletions src/main/java/com/thoughtworks/gocd/elasticagent/ecs/aws/RunInstanceRequestBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,15 +65,16 @@ private void blockOperatingSystemVolume(RunInstancesRequest request) {
}

request.withBlockDeviceMappings(
blockDeviceMapping(osDeviceName(), ec2Config.getOperatingSystemVolumeType(), Integer.parseInt(ec2Config.getOperationSystemVolumeSize()), ec2Config.getOperationSystemVolumeProvisionedIOPS())
blockDeviceMapping(osDeviceName(), ec2Config.getOperatingSystemVolumeType(), Integer.parseInt(ec2Config.getOperationSystemVolumeSize()), ec2Config.getOperationSystemVolumeProvisionedIOPS(), ec2Config.getOperatingSystemVolumeEncryption())
);
}

private BlockDeviceMapping blockDeviceMapping(String deviceName, String volumeType, int volumeSize, Integer provisionedIOPS) {
private BlockDeviceMapping blockDeviceMapping(String deviceName, String volumeType, int volumeSize, Integer provisionedIOPS, Boolean volumeEncryption) {
EbsBlockDevice ebsBlockDevice = new EbsBlockDevice()
.withDeleteOnTermination(true)
.withVolumeType(volumeType)
.withVolumeSize(volumeSize);
.withVolumeSize(volumeSize)
.withEncrypted(volumeEncryption);
return new BlockDeviceMapping()
.withEbs(withIops(ebsBlockDevice, volumeType, provisionedIOPS))
.withDeviceName(deviceName);
Expand All @@ -90,7 +91,7 @@ private void blockDockerVolume(RunInstancesRequest request) {
}

request.withBlockDeviceMappings(
blockDeviceMapping(DEFAULT_LINUX_DOCKER_DEVICE_NAME, ec2Config.getDockerVolumeType(), Integer.parseInt(ec2Config.getDockerVolumeSize()), ec2Config.getDockerVolumeProvisionedIOPS())
blockDeviceMapping(DEFAULT_LINUX_DOCKER_DEVICE_NAME, ec2Config.getDockerVolumeType(), Integer.parseInt(ec2Config.getDockerVolumeSize()), ec2Config.getDockerVolumeProvisionedIOPS(), ec2Config.getDockerVolumeEncryption())
);
}

Expand Down
9 changes: 5 additions & 4 deletions src/main/java/com/thoughtworks/gocd/elasticagent/ecs/aws/SpotInstanceRequestBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,15 +87,16 @@ private void blockOperatingSystemVolume(LaunchSpecification launchSpecification)
}

launchSpecification.withBlockDeviceMappings(
blockDeviceMapping(osDeviceName(), ec2Config.getOperatingSystemVolumeType(), Integer.parseInt(ec2Config.getOperationSystemVolumeSize()), ec2Config.getOperationSystemVolumeProvisionedIOPS())
blockDeviceMapping(osDeviceName(), ec2Config.getOperatingSystemVolumeType(), Integer.parseInt(ec2Config.getOperationSystemVolumeSize()), ec2Config.getOperationSystemVolumeProvisionedIOPS(), ec2Config.getOperatingSystemVolumeEncryption())
);
}

private BlockDeviceMapping blockDeviceMapping(String deviceName, String volumeType, int volumeSize, Integer provisionedIOPS) {
private BlockDeviceMapping blockDeviceMapping(String deviceName, String volumeType, int volumeSize, Integer provisionedIOPS, boolean volumeEncryption) {
EbsBlockDevice ebsBlockDevice = new EbsBlockDevice()
.withDeleteOnTermination(true)
.withVolumeType(volumeType)
.withVolumeSize(volumeSize);
.withVolumeSize(volumeSize)
.withEncrypted(volumeEncryption);
return new BlockDeviceMapping()
.withEbs(withIops(ebsBlockDevice, volumeType, provisionedIOPS))
.withDeviceName(deviceName);
Expand All @@ -112,7 +113,7 @@ private void blockDockerVolume(LaunchSpecification launchSpecification) {
}

launchSpecification.withBlockDeviceMappings(
blockDeviceMapping(DEFAULT_LINUX_DOCKER_DEVICE_NAME, ec2Config.getDockerVolumeType(), Integer.parseInt(ec2Config.getDockerVolumeSize()), ec2Config.getDockerVolumeProvisionedIOPS())
blockDeviceMapping(DEFAULT_LINUX_DOCKER_DEVICE_NAME, ec2Config.getDockerVolumeType(), Integer.parseInt(ec2Config.getDockerVolumeSize()), ec2Config.getDockerVolumeProvisionedIOPS(), ec2Config.getDockerVolumeEncryption())
);
}

Expand Down
20 changes: 18 additions & 2 deletions src/main/java/com/thoughtworks/gocd/elasticagent/ecs/domain/PluginSettings.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -314,6 +314,16 @@ public class PluginSettings {
@Metadata(key = "EfsDnsOrIP", required = false, secure = false)
private String efsDnsOrIP;

@Expose
@SerializedName("LinuxVolumeEncryption")
@Metadata(key = "LinuxVolumeEncryption", required = false, secure = false)
private Boolean linuxVolumeEncryption;

@Expose
@SerializedName("LinuxDockerEncryption")
@Metadata(key = "LinuxDockerEncryption", required = false, secure = false)
private Boolean linuxDockerEncryption;

public String getAccessKeyId() {
return accessKeyId;
}
Expand Down Expand Up @@ -413,6 +423,10 @@ public Integer getLinuxVolumeProvisionedIOPS() {
return getIntOrDefault(linuxVolumeProvisionedIOPS, null);
}

public Boolean getLinuxOSVolumeEncryption() { return linuxVolumeEncryption; }

public Boolean getLinuxVolumeEncryption() { return linuxDockerEncryption; }

public Period getLinuxRegisterTimeout() {
return new Period().withMinutes(getIntOrDefault(this.linuxRegisterTimeout, 5));
}
Expand Down Expand Up @@ -626,12 +640,14 @@ public boolean equals(Object o) {
Objects.equals(privateDockerRegistryEmail, that.privateDockerRegistryEmail) &&
Objects.equals(privateDockerRegistryUsername, that.privateDockerRegistryUsername) &&
Objects.equals(privateDockerRegistryPassword, that.privateDockerRegistryPassword) &&
Objects.equals(efsDnsOrIP, that.efsDnsOrIP);
Objects.equals(efsDnsOrIP, that.efsDnsOrIP) &&
Objects.equals(linuxVolumeEncryption, that.linuxVolumeEncryption) &&
Objects.equals(linuxDockerEncryption, that.linuxDockerEncryption);
}

@Override
public int hashCode() {
return Objects.hash(goServerUrl, clusterName, region, accessKeyId, secretAccessKey, environmentVariables, containerAutoregisterTimeout, maxContainerDataVolumeSize, keyPairName, iamInstanceProfile, subnetIds, securityGroupIds, logDriverName, logOptions, linuxAMI, linuxInstanceType, linuxRegisterTimeout, minLinuxInstanceCount, maxLinuxInstancesAllowed, maxLinuxSpotInstanceAllowed, linuxVolumeType, linuxVolumeSize, linuxVolumeProvisionedIOPS, linuxOSVolumeType, linuxOSVolumeSize, linuxOSVolumeProvisionedIOPS, linuxUserdataScript, linuxStopPolicy, stopLinuxInstanceAfter, terminateStoppedLinuxInstanceAfter, terminateIdleLinuxSpotInstanceAfter, windowsAMI, windowsInstanceType, windowsVolumeType, windowsVolumeSize, windowsOSVolumeProvisionedIOPS, windowsRegisterTimeout, minWindowsInstanceCount, maxWindowsInstancesAllowed, maxWindowsSpotInstanceAllowed, windowsUserdataScript, windowsStopPolicy, stopWindowsInstanceAfter, terminateStoppedWindowsInstanceAfter, terminateIdleWindowsSpotInstanceAfter, privateDockerRegistryAuthType, privateDockerRegistryAuthToken, privateDockerRegistryUrl, privateDockerRegistryEmail, privateDockerRegistryUsername, privateDockerRegistryPassword, efsDnsOrIP);
return Objects.hash(goServerUrl, clusterName, region, accessKeyId, secretAccessKey, environmentVariables, containerAutoregisterTimeout, maxContainerDataVolumeSize, keyPairName, iamInstanceProfile, subnetIds, securityGroupIds, logDriverName, logOptions, linuxAMI, linuxInstanceType, linuxRegisterTimeout, minLinuxInstanceCount, maxLinuxInstancesAllowed, maxLinuxSpotInstanceAllowed, linuxVolumeType, linuxVolumeSize, linuxVolumeProvisionedIOPS, linuxOSVolumeType, linuxOSVolumeSize, linuxOSVolumeProvisionedIOPS, linuxUserdataScript, linuxStopPolicy, stopLinuxInstanceAfter, terminateStoppedLinuxInstanceAfter, terminateIdleLinuxSpotInstanceAfter, windowsAMI, windowsInstanceType, windowsVolumeType, windowsVolumeSize, windowsOSVolumeProvisionedIOPS, windowsRegisterTimeout, minWindowsInstanceCount, maxWindowsInstancesAllowed, maxWindowsSpotInstanceAllowed, windowsUserdataScript, windowsStopPolicy, stopWindowsInstanceAfter, terminateStoppedWindowsInstanceAfter, terminateIdleWindowsSpotInstanceAfter, privateDockerRegistryAuthType, privateDockerRegistryAuthToken, privateDockerRegistryUrl, privateDockerRegistryEmail, privateDockerRegistryUsername, privateDockerRegistryPassword, efsDnsOrIP, linuxVolumeEncryption, linuxDockerEncryption);
}

public String uuid() {
Expand Down
14 changes: 14 additions & 0 deletions src/main/resources/cluster-profile.template.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -556,6 +556,13 @@
<span class="form_error"
ng-show="GOINPUTNAME[LinuxOSVolumeProvisionedIOPS].$error.server">{{GOINPUTNAME[LinuxOSVolumeProvisionedIOPS].$error.server}}</span>
</div>

<div class="col">
<label>Encrypt Volume</label>
<input type="checkbox" ng-model="LinuxVolumeEncryption"/>
<span class="form_error"
ng-show="GOINPUTNAME[LinuxVolumeEncryption].$error.server">{{GOINPUTNAME[LinuxVolumeEncryption].$error.server}}</span>
</div>
</div>
<p class="form-help-content">
Allows to override default operating system volume. This is used to store operating system and
Expand Down Expand Up @@ -600,6 +607,13 @@
<span class="form_error"
ng-show="GOINPUTNAME[LinuxDockerVolumeProvisionedIOPS].$error.server">{{GOINPUTNAME[LinuxDockerVolumeProvisionedIOPS].$error.server}}</span>
</div>

<div class="col" ng-show="LinuxDockerVolumeType != 'none'">
<label>Encrypt Volume</label>
<input type="checkbox" ng-model="LinuxDockerEncryption"/>
<span class="form_error"
ng-show="GOINPUTNAME[LinuxDockerEncryption].$error.server">{{GOINPUTNAME[LinuxDockerEncryption].$error.server}}</span>
</div>
</div>
<p class="form-help-content">
Allows to override default storage with specified type and size. This is used to store docker images and
Expand Down
14 changes: 14 additions & 0 deletions ...m/thoughtworks/gocd/elasticagent/ecs/executors/GetClusterProfileMetadataExecutorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -408,6 +408,20 @@ void assertJsonStructure() throws Exception {
" \"required\": false,\n" +
" \"secure\": false\n" +
" }\n" +
" },\n" +
" {\n" +
" \"key\": \"LinuxVolumeEncryption\",\n" +
" \"metadata\": {\n" +
" \"required\": false,\n" +
" \"secure\": false\n" +
" }\n" +
" },\n" +
" {\n" +
" \"key\": \"LinuxDockerEncryption\",\n" +
" \"metadata\": {\n" +
" \"required\": false,\n" +
" \"secure\": false\n" +
" }\n" +
" }\n" +
"]\n";

Expand Down