Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Self-hosted shield.io instance #3044

Closed
lemeurherve opened this issue Jul 11, 2022 · 4 comments
Closed

Self-hosted shield.io instance #3044

lemeurherve opened this issue Jul 11, 2022 · 4 comments
Labels
ci.jenkins.io enhancement New feature or request
Milestone
infra-team-sync-2...

Comments

@lemeurherve
Copy link
Member

lemeurherve commented Jul 11, 2022 •
edited

Related to "Consider removing embeddable-build-status plugin" and since ci.jenkins.io is blocking access to ../api/json path for security reason, I'm proposing to self-host a shield.io instance instead of putting in place a token to authorize shield.io access to these urls.

The token solution would need a patch on shield.io server codebase to add this token for ci.jenkins.io requests, but since there aren't that much uses I don't think it worth it for them.

The self-hosted instance wouldn't need a token as we could whitelist it on ci.jenkins.io

WDYT?
@lemeurherve lemeurherve added enhancement New feature or request ci.jenkins.io labels Jul 11, 2022
@lemeurherve lemeurherve changed the title Self-hosted a shield.io instance Self-hosted shield.io instance Jul 11, 2022
@lemeurherve lemeurherve mentioned this issue Jul 11, 2022
Closed
@dduportal
Copy link
Contributor

Excellent idea!

Proposal: if we host the "shields.jenkins.io" (I'll refer to it with this name for clarity but it can be chaneged of course!) service on the same VM as ci.jenkins.io, we would not even need any token:

  • The Apache server exposing ci.jenkins.io would be updated with a new virtual host for "shields.jenkins.io"
  • The backend for "shields.jenkins.io" can either be a docker container or a "Linux-raw service". In both cases, it can directly access the /api/json path on the Jenkins container (e.g. on http://localhost:8080/api/json) so no blocking from the Apache server.

I guess we have to evaluate the requirements for this services:

  • Expected minimal resources (CPU/memory) to evaluate if it fit on this VM
  • Deployment method of the service

@dduportal dduportal mentioned this issue Jul 11, 2022
Closed
@lemeurherve lemeurherve mentioned this issue Jul 11, 2022
Closed
@lemeurherve
Copy link
Member Author

Additional doc on self-hosting shield.io: https://github.com/badges/shields/blob/master/doc/releases.md#shields-server

@lemeurherve
Copy link
Member Author

As I didn't managed to join shield.io discord server, I've opened a discussion to ask about requirements.

@dduportal dduportal added this to the infra-team-sync-2022-07-19 milestone Jul 13, 2022
@MarkEWaite MarkEWaite mentioned this issue Jul 14, 2022
Merged
9 tasks
timja pushed a commit to jenkins-infra/repository-permissions-updater that referenced this issue Jul 14, 2022
@MarkEWaite
Add darinpope and markewaite as embeddable build status maintainers (#…
4ccbd3a 
…2648)

https://docs.google.com/document/d/11Nr8QpqYgBiZjORplL_3Zkwys2qK1vEvK-NYyYa4rzg/edit?disco=AAAAYXxgRHI
provides more context for the adoption request.  We believe it may be
cheaper and easier to adopt this plugin than to remove the plugin from
ci.jenkins.io and update the many repositories that refer to it.

Help desk jenkins-infra/helpdesk#3013 suggests
that we should consider removing the plugin because it is not actively
maintained.

Help desk jenkins-infra/helpdesk#3044 proposes
steps to replace the use of this plugin with something hosted elsewhere
on Jenkins infrastructure.

One of the existing maintainers needs to approve the adoption request.
Existing maintainers are:

* @thomas-dee
* @mgedmin
* @christiangalsterer
* @jglick
@lemeurherve
Copy link
Member Author

As @MarkEWaite and @darinpope adopted the plugin, it doesn't have to be removed from ci.jenkins.io.
No need for a self-hosted shield.io instance, closing this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
ci.jenkins.io enhancement New feature or request
Projects
None yet
Milestone
infra-team-sync-2022-07-19
Development

No branches or pull requests
2 participants
@dduportal @lemeurherve