Skip to content

Add signing parameters to cfn template #1263

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add signing parameters to cfn template #1263

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
050f993
Add signing parameters to cfn template
moskyb Nov 20, 2023
aff273b
Fix powershell syntax error
moskyb Dec 1, 2023
6dfef84
Add verification failure behaviour param
moskyb Dec 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions packer/linux/conf/bin/bk-install-elastic-stack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,6 +254,7 @@ else
BUILDKITE_AGENT_TIMESTAMPS_LINES="false"
BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS="false"
fi

echo Setting \$BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS to \$BUILDKITE_AGENT_TIMESTAMP_LINES
echo "BUILDKITE_AGENT_TIMESTAMP_LINES is $BUILDKITE_AGENT_TIMESTAMPS_LINES"
echo "BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS is $BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS"
Expand Down Expand Up @@ -292,6 +293,48 @@ tracing-backend=${BUILDKITE_AGENT_TRACING_BACKEND}
cancel-grace-period=${BUILDKITE_AGENT_CANCEL_GRACE_PERIOD}
EOF

if [[ -n "$BUILDKITE_AGENT_SIGNING_KEY_PATH" ]]; then
echo "Fetching signing key from ssm: $BUILDKITE_AGENT_SIGNING_KEY_PATH..."

keyfile=/etc/buildkite-agent/signing-key.json

aws ssm get-parameter \
--name "$BUILDKITE_AGENT_SIGNING_KEY_PATH" \
--with-decryption \
--query Parameter.Value \
--output text >"$keyfile"

echo "Setting ownership of $keyfile to buildkite-agent..."
chown buildkite-agent: "$keyfile"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably chmod 400 it as well. Though, I think preventing writes is a fool's errand if you own the file. Perhaps it should be owned by root, and readable only by a buildkite-agent group, which I don't think exists, but we should check.

This means it should be chmod 640 and owned by root:buildkite-agent.


echo "signing-jwks-file=$keyfile" >>/etc/buildkite-agent/buildkite-agent.cfg
fi

if [[ -n "$BUILDKITE_AGENT_SIGNING_KEY_ID" ]]; then
echo "signing-jwks-key-id=$BUILDKITE_AGENT_SIGNING_KEY_ID" >>/etc/buildkite-agent/buildkite-agent.cfg
fi

if [[ -n "$BUILDKITE_AGENT_VERIFICATION_FAILURE_BEHAVIOR" ]]; then
echo "verification-failure-behavior=$BUILDKITE_AGENT_VERIFICATION_FAILURE_BEHAVIOR" >>/etc/buildkite-agent/buildkite-agent.cfg
fi

if [[ -n "$BUILDKITE_AGENT_VERIFICATION_KEY_PATH" ]]; then
echo "Fetching signing key from ssm: $BUILDKITE_AGENT_VERIFICATION_KEY_PATH..."

keyfile=/etc/buildkite-agent/verification-key.json

aws ssm get-parameter \
--name "$BUILDKITE_AGENT_VERIFICATION_KEY_PATH" \
--with-decryption \
--query Parameter.Value \
--output text >"$keyfile"

echo "Setting ownership of $keyfile to buildkite-agent..."
chown buildkite-agent: "$keyfile"

echo "verification-jwks-file=$keyfile" >>/etc/buildkite-agent/buildkite-agent.cfg
fi

if [[ "${BUILDKITE_ENV_FILE_URL}" != "" ]]; then
echo "Fetching env file from ${BUILDKITE_ENV_FILE_URL}..."
/usr/local/bin/bk-fetch.sh "${BUILDKITE_ENV_FILE_URL}" /var/lib/buildkite-agent/env
Expand Down
36 changes: 36 additions & 0 deletions packer/windows/conf/bin/bk-install-elastic-stack.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,42 @@ tracing-backend=${Env:BUILDKITE_AGENT_TRACING_BACKEND}
"@
$OFS=" "

If (![string]::IsNullOrEmpty($Env:BUILDKITE_AGENT_SIGNING_KEY_PATH)) {
Write-Output "Fetching signing key from ssm: $Env:BUILDKITE_AGENT_SIGNING_KEY_PATH..."

$keyfile=C:\buildkite-agent\signing-key.json

aws ssm get-parameter `
--name "$Env:BUILDKITE_AGENT_SIGNING_KEY_PATH" `
--with-decryption `
--query Parameter.Value `
--output text >"$keyfile"

Add-Content -Path C:\buildkite-agent\buildkite-agent.cfg -Value "signing-jwks-file=$keyfile"
}

if (![string]::IsNullOrEmpty($Env:BUILDKITE_AGENT_SIGNING_KEY_ID)) {
Add-Content -Path C:\buildkite-agent\buildkite-agent.cfg -Value "signing-jwks-key-id=$Env:BUILDKITE_AGENT_SIGNING_KEY_ID"
}

if (![string]::IsNullOrEmpty($Env:BUILDKITE_AGENT_VERIFICATION_FAILURE_BEHAVIOR)) {
Add-Content -Path C:\buildkite-agent\buildkite-agent.cfg -Value "verification-failure-behavior=$Env:BUILDKITE_AGENT_VERIFICATION_FAILURE_BEHAVIOR"
}

if (![string]::IsNullOrEmpty($Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH)) {
Write-Output "Fetching verification key from ssm: $Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH..."

$keyfile=C:\buildkite-agent\verification-key.json

aws ssm get-parameter `
--name "$Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH" `
--with-decryption `
--query Parameter.Value `
--output text >"$keyfile"

Add-Content -Path C:\buildkite-agent\buildkite-agent.cfg -Value "verification-jwks-file=$keyfile"
}

nssm set lifecycled AppEnvironmentExtra +AWS_REGION=$Env:AWS_REGION
nssm set lifecycled AppEnvironmentExtra +LIFECYCLED_HANDLER="C:\buildkite-agent\bin\stop-agent-gracefully.ps1"
Restart-Service lifecycled
Expand Down
40 changes: 40 additions & 0 deletions templates/aws-stack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,10 @@ Metadata:
- BuildkiteAgentScalerServerlessARN
- BuildkiteAgentScalerVersion
- LogRetentionDays
- BuildkiteAgentSigningKeySSMParameter
- BuildkiteAgentSigningKeyID
- BuildkiteAgentVerificationKeySSMParameter
- BuildkiteAgentVerificationFailureBehavior

- Label:
default: Network Configuration
Expand Down Expand Up @@ -202,6 +206,34 @@ Parameters:
- "opentelemetry"
Default: ""

BuildkiteAgentSigningKeySSMParameter:
Description: Existing SSM Parameter Store path to the to a JSON Web Key Set (JWKS) containing a key to sign jobs with.
Type: String
Default: ""
AllowedPattern: "^$|^/[a-zA-Z0-9_.\\-/]+$"
ConstraintDescription: "Expects a leading forward slash"

BuildkiteAgentSigningKeyID:
Description: The ID of the key in the JWKS to use for signing jobs. If not specified, and the JWKS contains only one key, that key will be used.
Type: String
Default: ""

BuildkiteAgentVerificationKeySSMParameter:
Description: Existing SSM Parameter Store path to the to a JSON Web Key Set (JWKS) containing keys with which to verify jobs.
Type: String
Default: ""
AllowedPattern: "^$|^/[a-zA-Z0-9_.\\-/]+$"
ConstraintDescription: "Expects a leading forward slash"

BuildkiteAgentVerificationFailureBehavior:
Description: "How the agent should respond when a job signature fails verification"
Type: String
AllowedValues:
- "block"
- "warn"
- ""
Default: ""

BuildkiteAgentCancelGracePeriod:
Description: The number of seconds a canceled or timed out job is given to gracefully terminate and upload its artifacts.
Type: Number
Expand Down Expand Up @@ -1218,6 +1250,10 @@ Resources:
$Env:BUILDKITE_AGENT_TIMESTAMP_LINES="${BuildkiteAgentTimestampLines}"
$Env:BUILDKITE_AGENT_EXPERIMENTS="${BuildkiteAgentExperiments}"
$Env:BUILDKITE_AGENT_TRACING_BACKEND="${BuildkiteAgentTracingBackend}"
$Env:BUILDKITE_AGENT_SIGNING_KEY_PATH="${BuildkiteAgentSigningKeySSMParameter}"
$Env:BUILDKITE_AGENT_SIGNING_KEY_ID="${BuildkiteAgentSigningKeyID}"
$Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH="${BuildkiteAgentVerificationKeySSMParameter}"
$Env:BUILDKITE_AGENT_VERIFICATION_FAILURE_BEHAVIOR="${BuildkiteAgentVerificationFailureBehavior}"
$Env:BUILDKITE_AGENT_RELEASE="${BuildkiteAgentRelease}"
$Env:BUILDKITE_QUEUE="${BuildkiteQueue}"
$Env:BUILDKITE_AGENT_ENABLE_GIT_MIRRORS="${BuildkiteAgentEnableGitMirrors}"
Expand Down Expand Up @@ -1276,6 +1312,10 @@ Resources:
BUILDKITE_AGENT_TIMESTAMP_LINES="${BuildkiteAgentTimestampLines}" \
BUILDKITE_AGENT_EXPERIMENTS="${BuildkiteAgentExperiments}" \
BUILDKITE_AGENT_TRACING_BACKEND="${BuildkiteAgentTracingBackend}" \
BUILDKITE_AGENT_SIGNING_KEY_PATH="${BuildkiteAgentSigningKeySSMParameter}" \
BUILDKITE_AGENT_SIGNING_KEY_ID="${BuildkiteAgentSigningKeyID}" \
BUILDKITE_AGENT_VERIFICATION_KEY_PATH="${BuildkiteAgentVerificationKeySSMParameter}" \
BUILDKITE_AGENT_VERIFICATION_FAILURE_BEHAVIOR="${BuildkiteAgentVerificationFailureBehavior}" \
BUILDKITE_AGENT_RELEASE="${BuildkiteAgentRelease}" \
BUILDKITE_AGENT_CANCEL_GRACE_PERIOD="${BuildkiteAgentCancelGracePeriod}" \
BUILDKITE_QUEUE="${BuildkiteQueue}" \
Expand Down