There is a new release of the GCP marketplace integration

[izgeri]

Releasing a new GCP marketplace integration

To release a new GCP marketplace app for deploying Conjur OSS, we need to:

Helm updates

• Release a new helm version - There is a new release of the helm chart conjur-oss-helm-chart#53
• Helm automated test enhancements to test upgrade workflows (from XA) - Pipeline validates upgrade instructions conjur-oss-helm-chart#57
• Fix Helm XA issues - Enhancements to deployment and upgrade instructions based on XA feedback conjur-oss-helm-chart#58

GCP marketplace app updates

• Rollback to Conjur 1.5 - Conjur version is rolled back to 1.5.0 #50 (in progress)
• Jenkins test fails when chart tests fail - Jenkins builds fail when the tester's smoketest fails #49 (in progress)
• Bump dependency versions in marketplace app images to be consistent with updated helm chart, and ensure images will fail trivy scans on Critical or High vulns - Review dependency versions and upgrade if appropriate #57
• Review current GCP test automation and add additional flows to validate functionality as needed - Review and enhance test automation #58
• Determine min/max range for PV volume size and update the marketplace app - Adds min/max limits for database storage size #54
• Update the GCP marketplace documentation in line with recent updates to the helm documentation (especially around recommendations for running securely, etc) - includes TW review - Update documentation to be in line with 2.0.0 helm chart release docs #59
• Add NOTICES to GCP marketplace project, and build into all of the Docker images - Marketplace app includes open source acknowledgements #60
• Add tag-triggered Jenkins stage to automate the process of publishing versioned images to our app's cloud storage bucket (see the contributing guide) - Versioned images are auto-published on repo tags #61
• Add automation to the generation of the open source compliance worksheet - Open source compliance worksheet can be automated #62
• Marketplace app has undergone XA - The updated GCP marketplace integration has gone through XA #42
• Create a new GCP marketplace app release - There is a new release of the GCP marketplace app #63
  • Bump the version, review the changelog, and ensure the open source compliance worksheet is up-to-date
  • Tag the project
  • Smoke check that the published app works as expected (see here)
  • Submit the published app for approval (see here)
• Manually verify app works as expected after approval / final publish

Out of Scope:

• Add a migration for breaking version changes
• Troubleshooting guide or enhancements

Original draft

We kicked off this effort to fix an issue with the GCP marketplace integration working in K8s 1.15+ (see #25 for more info), but creating this new release has involved several updates and is a project in its own right.

A review of the definition of done indicates that creating this new release should include:

• The updated GCP marketplace integration is tagged and published (The updated GCP marketplace integration is tagged and published #41)
• The updated GCP marketplace integration has gone through XA (The updated GCP marketplace integration has gone through XA #42)
• Repo docs are updated based on feedback from XA (Repo docs are updated based on XA feedback #43)
  • Note: the website documentation for this project points to the repo README, so that no changes are needed in the Flare documentation as part of this project. We do not intend to revise where the documentation lives as part of this project, but the docs may be migrated to the website documentation in a future effort / as part of an effort considering overall open source docs improvements.
• GCP marketplace integration has undergone security review

Items not included in this version:

• Adding automated tests to this project (This project should have automated testing #13)
• Adding troubleshooting info to this project (this should be considered for the future docs effort)

Already completed tasks:

• Fix vulns in cloud marketplace tester container (Fix vulnerabilites in cloud marketplace tester container (1 critical, 6 high) #32)
• Fix vulns in nginx and postgres containers reported by Google Container Registry (Fix vulnerabilities in nginx and postgres containers reported by GCR #33)
• Fix vulns in deployer container reported by trivy (Fix vulnerabilities in deployer container reported by trivy (3 critical, 17 high) #34)
• Add trivy scan of component images in Jenkins pipeline (Add trivy scan of component images in Jenkins pipeline #35)
• (Bug) Project fails to deploy on GKE 1.15.7-gke.23 (Project fails to deploy on GKE 1.15.7-gke.23 #25)
• Fix vulns in marketplace Conjur app ruby gems (Fix vulnerabilities in marketplace conjur app Ruby gems #37)
• Add build, test, and publishing instructions (Adds build test and publishing instructions #30)

[andytinkham]

From our aborted attempts today to get a working trivy scan again, here's what @diverdane and I encountered (see the re-enable-trivy branch). Latest build of that branch (with trivy on, Postgres bumped to 10.12, and the helm chart version bumped to 2.0.0 in Chart.yaml and requirements.yaml) failed deploy with a Helm hook pre-install is not supported. error. Dane suggested "Probably need a helm client update on the infra GCP."