vranystepan

Simple AWS IAM role assume for CI/CD environments

Example

set AWS env. variables

export ASSUME_ROLE_ARN="arn:aws:iam::000000000000:role/role00001"
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."

vranystepan

while getopts 'mv:fdhn:ot:p:iu:' OPTION; do
	case "$OPTION" in
		m)
			MIGRATE="true"
			;;
		v)
			VERSION="${OPTARG}"
			;;
		f)
			FORCE="true"

vranystepan

      find . -exec touch --date=@0 {} +
      buildah build \
        --format=docker \
        -f Dockerfile \
        -t "${CONTAINER_REPOSITORY}:${CONTAINER_TAG}" \
        --cache-to "${CACHE_REPOSITORY}" \
        --cache-from "${CACHE_REPOSITORY}" \
        --layers \
        --jobs 10 \
        .

vranystepan

[program:messenger-consume]
command=php -d memory_limit=%(ENV_CRON_MEMORY_LIMIT)s /src/bin/console %(ENV_CRON_COMMAND)s --limit=10
user=root
numprocs=1
startsecs=0
autostart=true
autorestart=true
startretries=10
process_name=%(program_name)s_%(process_num)02d

vranystepan

apiVersion: v1
kind: ConfigMap
metadata:
  name: app
data:
  CONFIG_SOME_VALUE_1: value1
---
apiVersion: v1
data:
  CONFIG_SOME_SECRET_VALUE_1: c2VjcmV0MQ==

vranystepan

Running Gitlab-CI and Minio with docker-compose

features

method

Generate some random string for minio

</dev/urandom tr -dc '12345!@#$%qwertQWERTasdfgASDFGzxcvbZXCVB' | head -c32; echo ""

vranystepan

[profile parent]
aws_access_key_id =
aws_secret_access_key =
region = eu-central-1

[profile child]
source_profile = parent
role_arn = arn:aws:iam::123456789123:role/role
region = eu-central-1

vranystepan

  Certificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DomainName
      DomainValidationOptions:
        - DomainName: !Ref DomainName
          HostedZoneId: !Ref HostedZoneId
      ValidationMethod: DNS

vranystepan

name: 'Test and Deploy'

on:
  push:
    branches:
      - '*'

jobs:     
  ecr-login:
    runs-on: ubuntu-latest

vranystepan

/go/bin/aws-sigv4-proxy \
  --name=es \
  --region=eu-west-1 \
  --host=redacted.eu-west-1.es.amazonaws.com