Skip to content
This repository has been archived by the owner on Feb 9, 2022. It is now read-only.

Feat: Add Cloud-Custodian policies to clean-up Jenkins-BKPR staled resources #907

Merged
merged 8 commits into from
Aug 19, 2020

Conversation

dbarranco
Copy link
Contributor

@dbarranco dbarranco commented Aug 12, 2020

This Pull Request adds a Jenkinsfile that will execute the Cloud-Custodian to enforce hygiene policies in the different accounts/projects/subscriptions used by Jenkins-BKPR for its continuous integration tests.

At this moment, the following cloud resources are covered:

  • AWS

    • Added:
      • EKS clusters
      • IAM service accounts
      • Cloud Formation stacks
    • Missing:
      • Route53 records. The delete operation is not coded yet in Cloud Custodian hence we can not delete those resources.
  • Google

    • Added:
      • At this moment the delete operation is not coded in Cloud Custodian hence we can not delete those resources.
    • Missing:
      • GKE clusters
      • DNS managed zones
  • Azure

    • Added:
      • Azure DNS hosted zones
      • AKS clusters
    • Missing:

In this first iteration of the Cloud Custodian Jenkins pipeline, GCP won't be added to the periodic clean-ups as the delete operations have not been coded yet. I will sign the CLA and contribute to this project with these operations (they seem to be trivial).
Same case for some AWS resources.

Pipeline details

  • This pipeline will run every Saturday at midnight.
  • By default I am marking the DNS hosted zones 7 days prior deletion.

Next action items

  • Contribute to Cloud-Custodian and add the "delete" operation for the missing cloud resources
  • Improve the Cloud-Custodian policies to also notify about the cleaned-up resources, so we can have a trail

Signed-off-by: David Barranco dbarranco@vmware.com

David Barranco added 4 commits August 12, 2020 13:09
…sources

Signed-off-by: David Barranco <dbarranco@vmware.com>
Signed-off-by: David Barranco <dbarranco@vmware.com>
Signed-off-by: David Barranco <dbarranco@vmware.com>
Signed-off-by: David Barranco <dbarranco@vmware.com>
jenkins/cloud-custodian/Jenkinsfile Show resolved Hide resolved
jenkins/cloud-custodian/Jenkinsfile Show resolved Hide resolved
sh "docker pull gcr.io/bitnami-images/sre-cloud-custodian:${env.CUSTODIAN_VERSION}"
}
}
stage("Download the Custodian policy files") {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't we make these files available "locally" in the same (Jenkins) workspace?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changed, thxx

- type: value
key: name
op: regex
value: '^(pr-|trying-|staging-)'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe also add .*bkpr ? to narrow this, obviously in case these match.

- type: value
key: name
op: regex
value: '^(pr-|trying-|staging-)'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ditto narrowing regex

Copy link
Contributor

@jjo jjo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM w/comments, we can further loop and improve this if needed.

Signed-off-by: David Barranco <dbarranco@vmware.com>
jenkins/cloud-custodian/aws.yaml Outdated Show resolved Hide resolved
jenkins/cloud-custodian/Jenkinsfile Show resolved Hide resolved
David Barranco added 3 commits August 18, 2020 11:04
Signed-off-by: David Barranco <dbarranco@vmware.com>
Signed-off-by: David Barranco <dbarranco@vmware.com>
Signed-off-by: David Barranco <dbarranco@vmware.com>
@dbarranco
Copy link
Contributor Author

This is ready.

I will move the improvements in the locking system to a different PR (after the CloudCustodian gets updated).
Will wait until CI passes, then will merge and configure the job in jenkins-bkpr

@dbarranco dbarranco merged commit bdc566c into master Aug 19, 2020
@dbarranco dbarranco deleted the cloudCustodian branch August 19, 2020 11:14
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants