-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Add tracking and update cdk for security fixes (#18)
* feat: track if installed, updated or deleted * chore: update to latest cdk and eks blueprint versions This incorporates recent security fixes --------- Co-authored-by: Steffen Neubauer <steffen@garden.io>
- Loading branch information
Showing
8 changed files
with
2,999 additions
and
398 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| import * as path from 'path'; | ||
| import { CustomResource, Stack } from 'aws-cdk-lib'; | ||
| import * as lambda from 'aws-cdk-lib/aws-lambda'; | ||
| import * as lambdaNodejs from 'aws-cdk-lib/aws-lambda-nodejs'; | ||
| import * as cr from 'aws-cdk-lib/custom-resources'; | ||
| import { Construct } from 'constructs'; | ||
| import * as cdk from "aws-cdk-lib"; | ||
| import { PROP_ACCOUNT, PROP_SEGMENT_KEY, PROP_CF_STACK_ARN, PROP_VERSION, PROP_FULL_ACCESS_ROLE, PROP_FULL_ACCESS_PRINCIPALS, PROP_CLUSTER_NAME, PROP_ECR_PREFIX, PROP_ECR_REPO_NAMES, PROP_HOSTEDZONE_ID, PROP_MAX_NODEGROUP_SIZE, PROP_MIN_NODEGROUP_SIZE, PROP_SUBDOMAIN} from '../functions/tracking'; | ||
| import { GardenEKSDevCluster} from '../stacks/garden-dev-cluster'; | ||
|
|
||
|
|
||
| export const cdkEnvironment: string = process.env.CDK_ENVIRONMENT || 'dev'; | ||
| interface TrackUsageProps { | ||
| stackVersion: string; | ||
| account: string; | ||
| parameters: typeof GardenEKSDevCluster.parameters; | ||
| } | ||
|
|
||
| export class TrackUsage extends Construct { | ||
| constructor(scope: Construct, id: string, props: TrackUsageProps) { | ||
| super(scope, id); | ||
|
|
||
| new CustomResource(this, 'Resource', { | ||
| serviceToken: TrackUsageProvider.getOrCreate(this), | ||
| resourceType: 'Custom::TrackUsage', | ||
| properties: { | ||
| [PROP_SEGMENT_KEY]: this.node.tryGetContext(cdkEnvironment).SegmentAPIWriteKey, | ||
| [PROP_VERSION]: props.stackVersion, | ||
| [PROP_ACCOUNT]: props.account, | ||
| [PROP_CF_STACK_ARN]: cdk.Stack.of(scope).stackId, | ||
| [PROP_FULL_ACCESS_ROLE]: props.parameters.fullAccessRole, | ||
| [PROP_FULL_ACCESS_PRINCIPALS]: props.parameters.fullAccessPrincipals, | ||
| [PROP_ECR_REPO_NAMES]: props.parameters.ecrRepoNames, | ||
| [PROP_ECR_PREFIX]: props.parameters.ecrPrefix, | ||
| [PROP_SUBDOMAIN]: props.parameters.subdomain, | ||
| [PROP_HOSTEDZONE_ID]: props.parameters.hostedZoneID, | ||
| [PROP_CLUSTER_NAME]: props.parameters.clusterName, | ||
| [PROP_MIN_NODEGROUP_SIZE]: props.parameters.minNodeGroupSize, | ||
| [PROP_MAX_NODEGROUP_SIZE]: props.parameters.maxNodeGroupSize | ||
| }, | ||
| }); | ||
| } | ||
| } | ||
|
|
||
| class TrackUsageProvider extends Construct { | ||
|
|
||
| /** | ||
| * Returns the singleton provider. | ||
| */ | ||
| public static getOrCreate(scope: Construct) { | ||
| const stack = Stack.of(scope); | ||
| const id = 'garden.custom-track-usage-provider'; | ||
| const x = stack.node.tryFindChild(id) as TrackUsageProvider || new TrackUsageProvider(stack, id); | ||
| return x.provider.serviceToken; | ||
| } | ||
|
|
||
| private readonly provider: cr.Provider; | ||
|
|
||
| constructor(scope: Construct, id: string) { | ||
| super(scope, id); | ||
|
|
||
| this.provider = new cr.Provider(this, 'track-usage-provider', { | ||
| onEventHandler: new lambdaNodejs.NodejsFunction(this, 'tracking-on-event', { | ||
| runtime: lambda.Runtime.NODEJS_18_X , | ||
| entry: path.join(__dirname, '..', 'functions', 'tracking.ts'), | ||
| }), | ||
| }); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| import * as AWSCDKAsyncCustomResource from 'aws-cdk-lib/custom-resources/lib/provider-framework/types'; | ||
| import Analytics from "@segment/analytics-node"; | ||
| import hasha = require("hasha"); | ||
|
|
||
| export const PROP_SEGMENT_KEY = "segmentApiKey" | ||
| export const PROP_VERSION = "gardenDevClusterVersion" | ||
| export const PROP_ACCOUNT = "awsAccount" | ||
| export const PROP_CF_STACK_ARN = "cloudformationStackArn" | ||
| export const PROP_FULL_ACCESS_ROLE = "iamFullAccessRole" | ||
| export const PROP_FULL_ACCESS_PRINCIPALS = "iamFullAccessPrincipals" | ||
| export const PROP_ECR_REPO_NAMES = "ecrRepoNames" | ||
| export const PROP_ECR_PREFIX = "ecrPrefix" | ||
| export const PROP_SUBDOMAIN = "subdomain" | ||
| export const PROP_HOSTEDZONE_ID = "hostedzoneID" | ||
| export const PROP_CLUSTER_NAME = "clusterName" | ||
| export const PROP_MIN_NODEGROUP_SIZE = "minNodegroupSize" | ||
| export const PROP_MAX_NODEGROUP_SIZE = "maxNodegroupSize" | ||
|
|
||
| export async function handler(event: AWSCDKAsyncCustomResource.OnEventRequest): Promise<AWSCDKAsyncCustomResource.OnEventResponse> { | ||
| const version: string = event.ResourceProperties[PROP_VERSION] | ||
| const accountHash: string = hasha(event.ResourceProperties[PROP_ACCOUNT],{algorithm: "sha512"}) | ||
| const cfnStackArnHash: string = hasha(event.ResourceProperties[PROP_CF_STACK_ARN], {algorithm: 'sha512'}).slice(0,64) | ||
| const analytics = new Analytics({writeKey: event.ResourceProperties[PROP_SEGMENT_KEY]}) | ||
| switch (event.RequestType) { | ||
| case 'Create': | ||
| analytics.track({ | ||
| anonymousId: cfnStackArnHash, | ||
| event: "Installed dev-cluster", | ||
| properties: { | ||
| version: version, | ||
| accountHash: accountHash, | ||
| platform: "AWS" | ||
| }, | ||
| }) | ||
| await analytics.closeAndFlush() | ||
| return {} | ||
|
|
||
| case 'Update': | ||
| analytics.track({ | ||
| anonymousId: cfnStackArnHash, | ||
| event: "Updated dev-cluster", | ||
| properties: { | ||
| version: version, | ||
| accountHash: accountHash, | ||
| platform: "AWS" | ||
| }, | ||
| }) | ||
| await analytics.closeAndFlush() | ||
| return {} | ||
|
|
||
| case 'Delete': | ||
| analytics.track({ | ||
| anonymousId: cfnStackArnHash, | ||
| event: "Deleted dev-cluster", | ||
| properties: { | ||
| version: version, | ||
| accountHash: accountHash, | ||
| platform: "AWS" | ||
| }, | ||
| }) | ||
| await analytics.closeAndFlush() | ||
| return {} | ||
| } | ||
| } |