improves the screwdriver cookbook.

diff --git a/cookbooks/screwdriver/CHANGELOG.md b/cookbooks/screwdriver/CHANGELOG.md
index 6108ded..6c9f6ec 100644 (file)
--- a/cookbooks/screwdriver/CHANGELOG.md
+++ b/cookbooks/screwdriver/CHANGELOG.md
@@ -1,5 +1,12 @@
 # screwdriver CHANGELOG
 
+0.7.0
+-----
+- fix MySQL data directory's group owner.
+- add secrets generator for DB and Object Storage setup.
+- add `SECRET_HASHING_PASSWORD` env. variable support.
+- add `['screwdriver']['docker-compose']['network_mode_bridge']` attribute.
+
 0.6.0
 -----
 - adds Minio support.

diff --git a/cookbooks/screwdriver/README.md b/cookbooks/screwdriver/README.md
index 2550a90..2fc0b56 100644 (file)
--- a/cookbooks/screwdriver/README.md
+++ b/cookbooks/screwdriver/README.md
@@ -54,6 +54,7 @@ This cookbook sets up a Screwdriver CI/CD service by Docker Compose.
 |`['screwdriver']['jwt_public_key_vault_item']`|Hash|Optional, Sets a JWT public key from Chef Vault. See `attributes/default.rb`|`{}`|
 |`['screwdriver']['cookie_password_vault_item']`|Hash|Optional, Sets a session cookie password from Chef Vault. See `attributes/default.rb`|`{}`|
 |`['screwdriver']['password_vault_item']`|Hash|Optional, Sets a password for secrets encryption from Chef Vault. See `attributes/default.rb`|`{}`|
+|`['screwdriver']['hashing_password_vault_item']`|Hash|Optional, Sets a hashing password for user/pipeline access tokens from Chef Vault. See `attributes/default.rb`|`{}`|
 |`['screwdriver']['db_username_vault_item']`|Hash|Optional, Sets a database username from Chef Vault. See `attributes/default.rb`|`{}`|
 |`['screwdriver']['db_password_vault_item']`|Hash|Optional, Sets a database password from Chef Vault. See `attributes/default.rb`|`{}`|
 |`['screwdriver']['db_root_password_vault_item']`|Hash|Optional, Sets a database password for the root user from Chef Vault. See `attributes/default.rb`|`{}`|
@@ -70,6 +71,7 @@ This cookbook sets up a Screwdriver CI/CD service by Docker Compose.
 |`['screwdriver']['docker-compose']['config_dir']`|String|Path string.|`"#{node['screwdriver']['docker-compose']['app_dir']}/config"`|
 |`['screwdriver']['docker-compose']['data_dir']`|String|Path string.|`"#{node['screwdriver']['docker-compose']['app_dir']}/data"`|
 |`['screwdriver']['docker-compose']['etc_dir']`|String|Path string.|`"#{node['screwdriver']['docker-compose']['app_dir']}/etc"`|
+|`['screwdriver']['docker-compose']['network_mode_bridge']`|Boolean|If this attribute is `true`, all services are connected to the default bridge network (docker0).|`false`|
 |`['screwdriver']['docker-compose']['jwt_private_key_reset']`|Boolean|Only available if the JWT key pair is automatically generated by Chef.|`false`|
 |`['screwdriver']['docker-compose']['jwt_private_key_vault_item']`|Hash|**DEPRECATED**: use `['screwdriver']['jwt_private_key_vault_item']`. Optional, Sets a JWT private key from Chef Vault. See `attributes/default.rb`|`{}`|
 |`['screwdriver']['docker-compose']['jwt_public_key_vault_item']`|Hash|**DEPRECATED**: use `['screwdriver']['jwt_public_key_vault_item']`. Optional, Sets a JWT public key from Chef Vault. See `attributes/default.rb`|`{}`|
@@ -105,6 +107,7 @@ api_port    = '9001'
 store_port  = '9002'
 
 run_list(
+  # see https://osdn.net/projects/metasearch/scm/git/grid-chef-repo/blobs/master/roles/docker-new-repo.rb
   'role[docker]',
   'recipe[screwdriver::docker-compose]',
 )

diff --git a/cookbooks/screwdriver/attributes/default.rb b/cookbooks/screwdriver/attributes/default.rb
index 7b5a296..6ae3a9b 100644 (file)
--- a/cookbooks/screwdriver/attributes/default.rb
+++ b/cookbooks/screwdriver/attributes/default.rb
@@ -169,6 +169,22 @@ default['screwdriver']['api']['config'] = {
         'launchVersion' => 'stable',
       },
     },
+    # TODO: implement default settings
+    'queue' => {
+      'enabled' => 'false',  # EXECUTOR_QUEUE_ENABLED
+      'options' => {
+        # Configuration of the redis instance containing resque
+        'redisConnection' => {
+          'host' => 'QUEUE_REDIS_HOST',
+          'port' => 'QUEUE_REDIS_PORT',
+          'options' => {
+            'password' => 'QUEUE_REDIS_PASSWORD',
+            'tls' => 'QUEUE_REDIS_TLS_ENABLED',
+          },
+          'database' => 'QUEUE_REDIS_DATABASE',
+        },
+      },
+    },
 =end
   },
   'scms' => {
@@ -267,6 +283,7 @@ default['screwdriver']['docker-compose']['bin_dir'] = "#{node['screwdriver']['do
 default['screwdriver']['docker-compose']['config_dir'] = "#{node['screwdriver']['docker-compose']['app_dir']}/config"
 default['screwdriver']['docker-compose']['data_dir'] = "#{node['screwdriver']['docker-compose']['app_dir']}/data"
 default['screwdriver']['docker-compose']['etc_dir'] = "#{node['screwdriver']['docker-compose']['app_dir']}/etc"
+default['screwdriver']['docker-compose']['network_mode_bridge'] = false
 default['screwdriver']['docker-compose']['jwt_private_key_reset'] = false
 
 # **DEPRECATED**: use ['screwdriver']['(jwt|cookie|password)_*_vault_item'] attributes.
@@ -389,6 +406,13 @@ version_2_config = {
 }
 EOS
 =end
+        'EXECUTOR_QUEUE_ENABLED' => 'false',
+        #'QUEUE_REDIS_HOST' => 'queue',
+        # TODO:
+        #'QUEUE_REDIS_PORT' => '',
+        #'QUEUE_REDIS_PASSWORD' => '${REDIS_PASSWORD}'
+        #'QUEUE_REDIS_TLS_ENABLED' => '',
+        #'QUEUE_REDIS_DATABASE' => '',
 =begin
         # SCM settings
         # **DEPRECATED**: Please use the above `['screwdriver']['api']['config']['scms']` attribute
@@ -509,6 +533,21 @@ when 'postgres'
   }
 end
 
+executor_queue_enabled = config_srvs['api']['environment']['EXECUTOR_QUEUE_ENABLED'] == 'true' ? true : false
+if executor_queue_enabled
+  version_2_config['services']['queue'] = {
+    'image' => 'redis:4',
+    'volumes' => [
+      # This variable will be set by the screwdriver::docker-compose recipe automatically.
+      # TODO:
+    ],
+    'environment' => {
+      # These variables will be set by the screwdriver::docker-compose recipe automatically.
+      # TODO:
+    },
+  }
+end
+
 # S3 compatible server
 case node['screwdriver']['store']['backend']
 when 'minio'
@@ -530,4 +569,10 @@ when 'minio'
   }
 end
 
+if node['screwdriver']['docker-compose']['network_mode_bridge']
+  version_2_config['services'].each_value {|srv_config|
+    srv_config['network_mode'] = 'bridge'
+  }
+end
+
 default['screwdriver']['docker-compose']['config'] = version_2_config

diff --git a/cookbooks/screwdriver/recipes/docker-compose.rb b/cookbooks/screwdriver/recipes/docker-compose.rb
index 4450a20..9566dd6 100644 (file)
--- a/cookbooks/screwdriver/recipes/docker-compose.rb
+++ b/cookbooks/screwdriver/recipes/docker-compose.rb
@@ -100,6 +100,7 @@ force_override_config_srvs = node.force_override['screwdriver']['docker-compose'
 api_envs_org = config_srvs['api']['environment']
 api_envs = {}
 api_vols = config_srvs['api']['volumes'].to_a
+api_links = []
 
 api_port = '9001'  # default
 api_in_port = api_envs_org['PORT']
@@ -253,7 +254,7 @@ when 'sqlite'
   api_vols.push("#{data_dir}:/sd-data:rw")
   api_envs['DATASTORE_SEQUELIZE_STORAGE'] = '/sd-data/storage.db'
 when 'mysql', 'postgres'
-  override_config_srvs['api']['links'] = ['db']
+  api_links.push('db')
   api_envs['DATASTORE_SEQUELIZE_HOST'] = 'db'
 end
 
@@ -295,6 +296,23 @@ if db_dialect != 'sqlite'
   end
 end
 
+# queue
+executor_queue_enabled = api_envs_org['EXECUTOR_QUEUE_ENABLED'] == 'true' ? true : false
+if executor_queue_enabled
+  queue_envs = {}
+  queue_vols = config_srvs['queue']['volumes'].to_a
+
+  api_links.push('queue')
+  api_envs['QUEUE_REDIS_HOST'] = 'queue'
+  # TODO: set up env. vars.
+  # QUEUE_REDIS_PORT
+  # QUEUE_REDIS_PASSWORD
+  # QUEUE_REDIS_TLS_ENABLED
+  # QUEUE_REDIS_DATABASE
+end
+
+override_config_srvs['api']['links'] = api_links unless api_links.empty?
+
 # ui
 #ui_envs_org = config_srvs['ui']['environment']
 ui_envs = {}
@@ -317,6 +335,7 @@ store_backend = node['screwdriver']['store']['backend']
 store_envs_org = config_srvs['store']['environment']
 store_envs = {}
 store_vols = config_srvs['store']['volumes'].to_a
+store_links = []
 
 store_port = '9002'  # default
 store_in_port = store_envs_org['PORT']
@@ -346,7 +365,7 @@ store_envs['S3_ACCESS_KEY_SECRET'] = '${S3_ACCESS_KEY_SECRET}'
 
 # S3 compatible server
 if !store_backend.nil? && !store_backend.empty?
-  override_config_srvs['store']['links'] = ['screwdriver.s3']
+  store_links.push('screwdriver.s3')
   store_envs['STRATEGY'] = 's3'
   store_envs['S3_BUCKET'] = 'screwdriver'
 
@@ -387,6 +406,8 @@ if !store_backend.nil? && !store_backend.empty?
   end
 end
 
+override_config_srvs['store']['links'] = store_links unless store_links.empty?
+
 override_store_config['auth']['jwtPublicKey'] = jwt_public_key
 # Note: prevent Chef from logging JWT key attribute value. (=> template variables)
 # However Docker env file format does not support multi-line value and backslash escaped string yet.
@@ -526,24 +547,23 @@ end
   srv_vols.push("#{local_yaml_file}:/config/local.yaml:ro")
 }
 
-# merge environment hash
+# merge environment hash and reset volumes array.
 force_override_config_srvs['api']['environment'] = api_envs unless api_envs.empty?
-force_override_config_srvs['ui']['environment'] = ui_envs unless ui_envs.empty?
-force_override_config_srvs['store']['environment'] = store_envs unless store_envs.empty?
-if db_dialect != 'sqlite'
-  force_override_config_srvs['db']['environment'] = db_envs unless db_envs.empty?
-end
-if !store_backend.nil? && !store_backend.empty?
-  force_override_config_srvs['screwdriver.s3']['environment'] = s3_envs unless s3_envs.empty?
-end
-# reset vlumes array.
 override_config_srvs['api']['volumes'] = api_vols unless api_vols.empty?
+force_override_config_srvs['ui']['environment'] = ui_envs unless ui_envs.empty?
 override_config_srvs['ui']['volumes'] = ui_vols unless ui_vols.empty?
+force_override_config_srvs['store']['environment'] = store_envs unless store_envs.empty?
 override_config_srvs['store']['volumes'] = store_vols unless store_vols.empty?
 if db_dialect != 'sqlite'
+  force_override_config_srvs['db']['environment'] = db_envs unless db_envs.empty?
   override_config_srvs['db']['volumes'] = db_vols unless db_vols.empty?
 end
+if executor_queue_enabled
+  force_override_config_srvs['queue']['environment'] = queue_envs unless queue_envs.empty?
+  override_config_srvs['queue']['volumes'] = queue_vols unless queue_vols.empty?
+end
 if !store_backend.nil? && !store_backend.empty?
+  force_override_config_srvs['screwdriver.s3']['environment'] = s3_envs unless s3_envs.empty?
   override_config_srvs['screwdriver.s3']['volumes'] = s3_vols unless s3_vols.empty?
 end
 

diff --git a/roles/screwdriver-all-on-docker-override.rb b/roles/screwdriver-all-on-docker-override.rb
index 98f2f0e..9d2eee1 100644 (file)
--- a/roles/screwdriver-all-on-docker-override.rb
+++ b/roles/screwdriver-all-on-docker-override.rb
@@ -67,11 +67,11 @@ override_attributes(
       },
     },
     'docker-compose' => {
+      'network_mode_bridge' => false,
       'config' => {
         'services' => {
           'api' => {
             #'image' => 'screwdrivercd/screwdriver:latest',
-            #'network_mode' => 'bridge',
             'ports' => [
               #"#{api_port}:80",
             ],
@@ -85,7 +85,6 @@ override_attributes(
           },
           'ui' => {
             #'image' => 'screwdrivercd/ui:latest',
-            #'network_mode' => 'bridge',
             'ports' => [
               #"#{ui_port}:80",
             ],
@@ -97,7 +96,6 @@ override_attributes(
           },
           'store' => {
             #'image' => 'screwdrivercd/store:latest',
-            #'network_mode' => 'bridge',
             'ports' => [
               #"#{store_port}:80",
             ],
@@ -107,10 +105,8 @@ override_attributes(
             },
           },
           'db' => {
-            #'network_mode' => 'bridge',
           },
           'screwdriver.s3' => {
-            #'network_mode' => 'bridge',
           },
         },
       },

diff --git a/roles/screwdriver-all-on-docker.rb b/roles/screwdriver-all-on-docker.rb
index 3945417..e6acdbd 100644 (file)
--- a/roles/screwdriver-all-on-docker.rb
+++ b/roles/screwdriver-all-on-docker.rb
@@ -74,6 +74,7 @@ override_attributes(
               #'ECOSYSTEM_UI' => "http://#{node['fqdn']}:#{ui_port}",
               #'ECOSYSTEM_STORE' => "http://#{node['fqdn']}:#{store_port}",
               'DATASTORE_SEQUELIZE_DIALECT' => 'mysql',  # or 'postgres'
+              'EXECUTOR_QUEUE_ENABLED' => 'false',
             },
           },
           'ui' => {

diff --git a/roles/screwdriver-on-docker-override.rb b/roles/screwdriver-on-docker-override.rb
index a30bdb5..e7212a1 100644 (file)
--- a/roles/screwdriver-on-docker-override.rb
+++ b/roles/screwdriver-on-docker-override.rb
@@ -67,11 +67,11 @@ override_attributes(
       },
     },
     'docker-compose' => {
+      'network_mode_bridge' => false,
       'config' => {
         'services' => {
           'api' => {
             #'image' => 'screwdrivercd/screwdriver:latest',
-            #'network_mode' => 'bridge',
             'ports' => [
               #"#{api_port}:80",
             ],
@@ -84,7 +84,6 @@ override_attributes(
           },
           'ui' => {
             #'image' => 'screwdrivercd/ui:latest',
-            #'network_mode' => 'bridge',
             'ports' => [
               #"#{ui_port}:80",
             ],
@@ -96,7 +95,6 @@ override_attributes(
           },
           'store' => {
             #'image' => 'screwdrivercd/store:latest',
-            #'network_mode' => 'bridge',
             'ports' => [
               #"#{store_port}:80",
             ],