Skip to content

Commit 0832406

Browse files
mcnclmcncl
authored
Merge pull request #1263 from buildkite/signing-params
Add signing parameters to cfn template
2 parents 00832ee + ff9a530 commit 0832406

File tree

3 files changed

+112
-4
lines changed

3 files changed

+112
-4
lines changed

‎packer/linux/stack/conf/bin/bk-install-elastic-stack.sh‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,7 @@ else
259259
BUILDKITE_AGENT_TIMESTAMPS_LINES="false"
260260
BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS="false"
261261
fi
262+
262263
echo Setting \$BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS to \$BUILDKITE_AGENT_TIMESTAMP_LINES
263264
echo "BUILDKITE_AGENT_TIMESTAMP_LINES is $BUILDKITE_AGENT_TIMESTAMPS_LINES"
264265
echo "BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS is $BUILDKITE_AGENT_NO_ANSI_TIMESTAMPS"
@@ -299,9 +300,49 @@ tracing-backend=${BUILDKITE_AGENT_TRACING_BACKEND}
299300
cancel-grace-period=${BUILDKITE_AGENT_CANCEL_GRACE_PERIOD}
300301
signal-grace-period-seconds=${BUILDKITE_AGENT_SIGNAL_GRACE_PERIOD_SECONDS}
301302
signing-aws-kms-key=${BUILDKITE_AGENT_SIGNING_KMS_KEY}
302-
verification-failure-behavior=${BUILDKITE_AGENT_SIGNING_FAILURE_BEHAVIOR}
303+
verification-failure-behavior=${BUILDKITE_AGENT_JOB_VERIFICATION_NO_SIGNATURE_BEHAVIOR}
303304
EOF
304305

306+
if [[ -n "$BUILDKITE_AGENT_SIGNING_KEY_PATH" ]]; then
307+
echo "Fetching signing key from ssm: $BUILDKITE_AGENT_SIGNING_KEY_PATH..."
308+
309+
keyfile=/etc/buildkite-agent/signing-key.json
310+
311+
aws ssm get-parameter \
312+
--name "$BUILDKITE_AGENT_SIGNING_KEY_PATH" \
313+
--with-decryption \
314+
--query Parameter.Value \
315+
--output text >"$keyfile"
316+
317+
echo "Setting ownership and permissions for $keyfile..."
318+
chown root:buildkite-agent "$keyfile"
319+
chmod 640 "$keyfile"
320+
321+
echo "signing-jwks-file=$keyfile" >>/etc/buildkite-agent/buildkite-agent.cfg
322+
fi
323+
324+
if [[ -n "$BUILDKITE_AGENT_SIGNING_KEY_ID" ]]; then
325+
echo "signing-jwks-key-id=$BUILDKITE_AGENT_SIGNING_KEY_ID" >>/etc/buildkite-agent/buildkite-agent.cfg
326+
fi
327+
328+
if [[ -n "$BUILDKITE_AGENT_VERIFICATION_KEY_PATH" ]]; then
329+
echo "Fetching verification key from ssm: $BUILDKITE_AGENT_VERIFICATION_KEY_PATH..."
330+
331+
keyfile=/etc/buildkite-agent/verification-key.json
332+
333+
aws ssm get-parameter \
334+
--name "$BUILDKITE_AGENT_VERIFICATION_KEY_PATH" \
335+
--with-decryption \
336+
--query Parameter.Value \
337+
--output text >"$keyfile"
338+
339+
echo "Setting ownership and permissions for $keyfile..."
340+
chown root:buildkite-agent "$keyfile"
341+
chmod 640 "$keyfile"
342+
343+
echo "verification-jwks-file=$keyfile" >>/etc/buildkite-agent/buildkite-agent.cfg
344+
fi
345+
305346
if [[ "${BUILDKITE_ENV_FILE_URL}" != "" ]]; then
306347
echo "Fetching env file from ${BUILDKITE_ENV_FILE_URL}..."
307348
/usr/local/bin/bk-fetch.sh "${BUILDKITE_ENV_FILE_URL}" /var/lib/buildkite-agent/env

‎packer/windows/stack/conf/bin/bk-install-elastic-stack.ps1‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,10 +161,49 @@ disconnect-after-job=${Env:BUILDKITE_TERMINATE_INSTANCE_AFTER_JOB}
161161
disconnect-after-uptime=${Env:BUILDKITE_AGENT_DISCONNECT_AFTER_UPTIME}
162162
tracing-backend=${Env:BUILDKITE_AGENT_TRACING_BACKEND}
163163
signing-aws-kms-key=${Env:BUILDKITE_AGENT_SIGNING_KMS_KEY}
164-
verification-failure-behavior=${Env:BUILDKITE_AGENT_SIGNING_FAILURE_BEHAVIOR}
164+
verification-failure-behavior=${Env:BUILDKITE_AGENT_JOB_VERIFICATION_NO_SIGNATURE_BEHAVIOR}
165165
"@
166166
$OFS=" "
167167

168+
If (![string]::IsNullOrEmpty($Env:BUILDKITE_AGENT_SIGNING_KEY_PATH)) {
169+
Write-Output "Fetching signing key from ssm: $Env:BUILDKITE_AGENT_SIGNING_KEY_PATH..."
170+
171+
$keyfile=C:\buildkite-agent\signing-key.json
172+
173+
aws ssm get-parameter `
174+
--name "$Env:BUILDKITE_AGENT_SIGNING_KEY_PATH" `
175+
--with-decryption `
176+
--query Parameter.Value `
177+
--output text >"$keyfile"
178+
179+
Write-Output "Setting permissions for $keyfile..."
180+
# Remove inheritance and set explicit permissions: Administrators=FullControl, buildkite-agent=Read
181+
icacls "$keyfile" /inheritance:r /grant:r "Administrators:F" /grant:r "buildkite-agent:R"
182+
183+
Add-Content -Path C:\buildkite-agent\buildkite-agent.cfg -Value "signing-jwks-file=$keyfile"
184+
}
185+
186+
if (![string]::IsNullOrEmpty($Env:BUILDKITE_AGENT_SIGNING_KEY_ID)) {
187+
Add-Content -Path C:\buildkite-agent\buildkite-agent.cfg -Value "signing-jwks-key-id=$Env:BUILDKITE_AGENT_SIGNING_KEY_ID"
188+
}
189+
190+
if (![string]::IsNullOrEmpty($Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH)) {
191+
Write-Output "Fetching verification key from ssm: $Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH..."
192+
193+
$keyfile=C:\buildkite-agent\verification-key.json
194+
195+
aws ssm get-parameter `
196+
--name "$Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH" `
197+
--with-decryption `
198+
--query Parameter.Value `
199+
--output text >"$keyfile"
200+
201+
Write-Output "Setting permissions for $keyfile..."
202+
# Remove inheritance and set explicit permissions: Administrators=FullControl, buildkite-agent=Read
203+
icacls "$keyfile" /inheritance:r /grant:r "Administrators:F" /grant:r "buildkite-agent:R"
204+
Add-Content -Path C:\buildkite-agent\buildkite-agent.cfg -Value "verification-jwks-file=$keyfile"
205+
}
206+
168207
nssm set lifecycled AppEnvironmentExtra +AWS_REGION=$Env:AWS_REGION
169208
nssm set lifecycled AppEnvironmentExtra +LIFECYCLED_HANDLER="C:\buildkite-agent\bin\stop-agent-gracefully.ps1"
170209
Restart-Service lifecycled

‎templates/aws-stack.yml‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ Metadata:
4242
- PipelineSigningKMSKeySpec
4343
- PipelineSigningKMSAccess
4444
- PipelineSigningVerificationFailureBehavior
45+
- BuildkiteAgentSigningKeySSMParameter
46+
- BuildkiteAgentSigningKeyID
47+
- BuildkiteAgentVerificationKeySSMParameter
4548

4649
- Label:
4750
default: Advanced Configuration
@@ -368,6 +371,25 @@ Parameters:
368371
- "opentelemetry"
369372
Default: ""
370373

374+
BuildkiteAgentSigningKeySSMParameter:
375+
Description: Existing SSM Parameter Store path to a JSON Web Key Set (JWKS) containing a key to sign jobs with.
376+
Type: String
377+
Default: ""
378+
AllowedPattern: "^$|^/[a-zA-Z0-9_.\\-/]+$"
379+
ConstraintDescription: "Expects a leading forward slash"
380+
381+
BuildkiteAgentSigningKeyID:
382+
Description: The ID of the key in the JWKS to use for signing jobs. If not specified, and the JWKS contains only one key, that key will be used.
383+
Type: String
384+
Default: ""
385+
386+
BuildkiteAgentVerificationKeySSMParameter:
387+
Description: Existing SSM Parameter Store path to a JSON Web Key Set (JWKS) containing keys with which to verify jobs.
388+
Type: String
389+
Default: ""
390+
AllowedPattern: "^$|^/[a-zA-Z0-9_.\\-/]+$"
391+
ConstraintDescription: "Expects a leading forward slash"
392+
371393
BuildkiteAgentCancelGracePeriod:
372394
Description: The number of seconds a canceled or timed out job is given to gracefully terminate and upload its artifacts.
373395
Type: Number
@@ -1921,12 +1943,15 @@ Resources:
19211943
$Env:BUILDKITE_AGENT_TIMESTAMP_LINES="${BuildkiteAgentTimestampLines}"
19221944
$Env:BUILDKITE_AGENT_EXPERIMENTS="${BuildkiteAgentExperiments}"
19231945
$Env:BUILDKITE_AGENT_TRACING_BACKEND="${BuildkiteAgentTracingBackend}"
1946+
$Env:BUILDKITE_AGENT_SIGNING_KEY_PATH="${BuildkiteAgentSigningKeySSMParameter}"
1947+
$Env:BUILDKITE_AGENT_SIGNING_KEY_ID="${BuildkiteAgentSigningKeyID}"
1948+
$Env:BUILDKITE_AGENT_VERIFICATION_KEY_PATH="${BuildkiteAgentVerificationKeySSMParameter}"
19241949
$Env:BUILDKITE_AGENT_RELEASE="${BuildkiteAgentRelease}"
19251950
$Env:BUILDKITE_QUEUE="${BuildkiteQueue}"
19261951
$Env:BUILDKITE_AGENT_ENABLE_GIT_MIRRORS="${BuildkiteAgentEnableGitMirrors}"
19271952
$Env:BUILDKITE_ELASTIC_BOOTSTRAP_SCRIPT="${BootstrapScriptUrl}"
19281953
$Env:BUILDKITE_AGENT_SIGNING_KMS_KEY="${PipelineSigningKMSKey}"
1929-
$Env:BUILDKITE_AGENT_SIGNING_FAILURE_BEHAVIOR="${PipelineSigningVerificationFailureBehavior}"
1954+
$Env:BUILDKITE_AGENT_JOB_VERIFICATION_NO_SIGNATURE_BEHAVIOR="${PipelineSigningVerificationFailureBehavior}"
19301955
$Env:BUILDKITE_ENV_FILE_URL="${AgentEnvFileUrl}"
19311956
$Env:BUILDKITE_AUTHORIZED_USERS_URL="${AuthorizedUsersUrl}"
19321957
$Env:BUILDKITE_ECR_POLICY="${ECRAccessPolicy}"
@@ -2013,11 +2038,14 @@ Resources:
20132038
BUILDKITE_AGENT_TIMESTAMP_LINES="${BuildkiteAgentTimestampLines}" \
20142039
BUILDKITE_AGENT_EXPERIMENTS="${BuildkiteAgentExperiments}" \
20152040
BUILDKITE_AGENT_TRACING_BACKEND="${BuildkiteAgentTracingBackend}" \
2041+
BUILDKITE_AGENT_SIGNING_KEY_PATH="${BuildkiteAgentSigningKeySSMParameter}" \
2042+
BUILDKITE_AGENT_SIGNING_KEY_ID="${BuildkiteAgentSigningKeyID}" \
2043+
BUILDKITE_AGENT_VERIFICATION_KEY_PATH="${BuildkiteAgentVerificationKeySSMParameter}" \
20162044
BUILDKITE_AGENT_RELEASE="${BuildkiteAgentRelease}" \
20172045
BUILDKITE_AGENT_CANCEL_GRACE_PERIOD="${BuildkiteAgentCancelGracePeriod}" \
20182046
BUILDKITE_AGENT_SIGNAL_GRACE_PERIOD_SECONDS="${BuildkiteAgentSignalGracePeriod}" \
20192047
BUILDKITE_AGENT_SIGNING_KMS_KEY="${PipelineSigningKMSKey}" \
2020-
BUILDKITE_AGENT_SIGNING_FAILURE_BEHAVIOR="${PipelineSigningVerificationFailureBehavior}" \
2048+
BUILDKITE_AGENT_JOB_VERIFICATION_NO_SIGNATURE_BEHAVIOR="${PipelineSigningVerificationFailureBehavior}" \
20212049
BUILDKITE_QUEUE="${BuildkiteQueue}" \
20222050
BUILDKITE_AGENT_ENABLE_GIT_MIRRORS="${BuildkiteAgentEnableGitMirrors}" \
20232051
BUILDKITE_ELASTIC_BOOTSTRAP_SCRIPT="${BootstrapScriptUrl}" \

0 commit comments

Comments
 (0)