-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
OSS release for Metaflowbot Co-authored-by: Savin <[email protected]>
- Loading branch information
1 parent
a59d784
commit b60e32c
Showing
25 changed files
with
966 additions
and
178 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| name: Docker Image CI | ||
| on: | ||
| release: | ||
| types : [published] | ||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v2 | ||
| - name: Docker meta | ||
| id: meta | ||
| uses: docker/metadata-action@v3 | ||
| with: | ||
| images: | | ||
| outerbounds/metaflowbot | ||
| tags: | | ||
| type=ref,event=branch | ||
| type=ref,event=pr | ||
| type=semver,pattern={{version}} | ||
| type=semver,pattern={{major}}.{{minor}} | ||
| type=sha | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v1 | ||
| - name: Login to DockerHub | ||
| if: github.event_name != 'pull_request' | ||
| uses: docker/login-action@v1 | ||
| with: | ||
| username: ${{ secrets.DOCKER_USERNAME }} | ||
| password: ${{ secrets.DOCKER_ACCESS_TOKEN }} | ||
| - name: Build and push | ||
| uses: docker/build-push-action@v2 | ||
| with: | ||
| context: . | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| name: Publish PyPi | ||
| on: | ||
| release: | ||
| types: [published] | ||
| jobs: | ||
| publish: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v2 | ||
| - name: Set up Python 3.7.x | ||
| uses: actions/setup-python@v1 | ||
| with: | ||
| python-version: '3.7.x' | ||
| - name: Install Python 3.7.x dependencies | ||
| run: | | ||
| python3 -m pip install --upgrade pip | ||
| pip3 install setuptools wheel twine | ||
| - name: Build package | ||
| run: | | ||
| python3 setup.py sdist bdist_wheel --universal | ||
| - name: Publish package | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| with: | ||
| user: __token__ | ||
| password: ${{ secrets.PYPI_PASSWORD }} | ||
| verbose: true | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,246 @@ | ||
| Description: Cloudformation Stack for Deploying Metaflowbot | ||
| Parameters: | ||
| AdminEmailAddress: | ||
| Description: Email address of the admin user in the slack workspace | ||
| Type: String | ||
| MetadataServiceAuthParameterKey: | ||
| Default: METADATASERVICE_AUTH_KEY | ||
| Description: Key for Metadata service auth parameter in Secrets Manager. | ||
| Type: String | ||
| MetadataServiceUrl: | ||
| Description: URL of the metadata service | ||
| Type: String | ||
| MetaflowDatastoreSysrootS3: | ||
| Description: 'Amazon S3 URL for Metaflow DataStore ' | ||
| Type: String | ||
| MetaflowbotSecretsManagerARN: | ||
| Description: ARN of the secret holding Metaflowbot credentials in Secrets Manager | ||
| Type: String | ||
| SlackAppTokenParameterKey: | ||
| Default: SLACK_APP_TOKEN_KEY | ||
| Description: Key for SLACK_APP_TOKEN parameter in Secrets Manager. | ||
| Type: String | ||
| SlackBotTokenParameterKey: | ||
| Default: SLACK_BOT_TOKEN_KEY | ||
| Description: Key for SLACK_BOT_TOKEN parameter in Secrets Manager. | ||
| Type: String | ||
| Resources: | ||
| EcsClusterRole: | ||
| Properties: | ||
| AssumeRolePolicyDocument: | ||
| Statement: | ||
| - Action: sts:AssumeRole | ||
| Effect: Allow | ||
| Principal: | ||
| Service: ecs-tasks.amazonaws.com | ||
| Version: '2012-10-17' | ||
| ManagedPolicyArns: | ||
| - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM | ||
| Path: / | ||
| Type: AWS::IAM::Role | ||
| EcsTaskRole: | ||
| Properties: | ||
| AssumeRolePolicyDocument: | ||
| Statement: | ||
| - Action: sts:AssumeRole | ||
| Effect: Allow | ||
| Principal: | ||
| Service: ecs-tasks.amazonaws.com | ||
| Version: '2012-10-17' | ||
| Path: / | ||
| Type: AWS::IAM::Role | ||
| InternetGatewayAttachment: | ||
| Properties: | ||
| InternetGatewayId: !Ref 'MetaflowbotInternetGateway' | ||
| VpcId: !Ref 'MetaflowbotPublicVpc' | ||
| Type: AWS::EC2::VPCGatewayAttachment | ||
| MetaflowbotCluster: | ||
| Type: AWS::ECS::Cluster | ||
| MetaflowbotDeployment: | ||
| Properties: | ||
| Cluster: !Ref 'MetaflowbotCluster' | ||
| DesiredCount: 1 | ||
| LaunchType: FARGATE | ||
| NetworkConfiguration: | ||
| AwsvpcConfiguration: | ||
| AssignPublicIp: ENABLED | ||
| SecurityGroups: | ||
| - !Ref 'MetaflowbotSecurityGroup' | ||
| Subnets: | ||
| - !Ref 'MetaflowbotDeploymentSubnet' | ||
| TaskDefinition: !Ref 'MetaflowbotTaskDefinition' | ||
| Type: AWS::ECS::Service | ||
| MetaflowbotDeploymentSubnet: | ||
| Properties: | ||
| AvailabilityZone: !Select | ||
| - 0 | ||
| - !GetAZs | ||
| Ref: AWS::Region | ||
| CidrBlock: 10.0.0.0/24 | ||
| MapPublicIpOnLaunch: true | ||
| VpcId: !Ref 'MetaflowbotPublicVpc' | ||
| Type: AWS::EC2::Subnet | ||
| MetaflowbotInternetGateway: | ||
| Type: AWS::EC2::InternetGateway | ||
| MetaflowbotLogGroup: | ||
| Properties: | ||
| LogGroupName: !Join | ||
| - '' | ||
| - - /ecs/ | ||
| - !Ref 'AWS::StackName' | ||
| - -metaflowbot | ||
| Type: AWS::Logs::LogGroup | ||
| MetaflowbotPublicVpc: | ||
| Properties: | ||
| CidrBlock: 10.0.0.0/16 | ||
| Type: AWS::EC2::VPC | ||
| MetaflowbotSecretAccess: | ||
| Properties: | ||
| PolicyDocument: | ||
| Statement: | ||
| - Action: | ||
| - secretsmanager:GetSecretValue | ||
| Effect: Allow | ||
| Resource: | ||
| - !Ref 'MetaflowbotSecretsManagerARN' | ||
| Sid: S3GetObject | ||
| Version: '2012-10-17' | ||
| PolicyName: Metaflowbot | ||
| Roles: | ||
| - !Ref 'EcsClusterRole' | ||
| Type: AWS::IAM::Policy | ||
| MetaflowbotSecurityGroup: | ||
| Properties: | ||
| GroupDescription: Allow All In and outbound traffic | ||
| SecurityGroupEgress: | ||
| - CidrIp: '0.0.0.0/0' | ||
| FromPort: 0 | ||
| IpProtocol: tcp | ||
| ToPort: 65534 | ||
| VpcId: !Ref 'MetaflowbotPublicVpc' | ||
| Type: AWS::EC2::SecurityGroup | ||
| MetaflowbotTaskDefinition: | ||
| Properties: | ||
| ContainerDefinitions: | ||
| - Environment: | ||
| - Name: ADMIN_USER_ADDRESS | ||
| Value: !Ref 'AdminEmailAddress' | ||
| - Name: USERNAME | ||
| Value: slackbot | ||
| - Name: METAFLOW_SERVICE_URL | ||
| Value: !Ref 'MetadataServiceUrl' | ||
| - Name: METAFLOW_DATASTORE_SYSROOT_S3 | ||
| Value: !Ref 'MetaflowDatastoreSysrootS3' | ||
| - Name: METAFLOW_DEFAULT_DATASTORE | ||
| Value: s3 | ||
| - Name: METAFLOW_DEFAULT_METADATA | ||
| Value: service | ||
| Essential: true | ||
| Image: outerbounds/metaflowbot | ||
| LogConfiguration: | ||
| LogDriver: awslogs | ||
| Options: | ||
| awslogs-group: !Join | ||
| - '' | ||
| - - /ecs/ | ||
| - !Ref 'AWS::StackName' | ||
| - -metaflowbot | ||
| awslogs-region: !Ref 'AWS::Region' | ||
| awslogs-stream-prefix: ecs | ||
| Name: metaflowbot | ||
| Secrets: | ||
| - Name: METAFLOW_SERVICE_AUTH_KEY | ||
| ValueFrom: !Join | ||
| - '' | ||
| - - !Ref 'MetaflowbotSecretsManagerARN' | ||
| - ':' | ||
| - !Ref 'MetadataServiceAuthParameterKey' | ||
| - '::' | ||
| - Name: SLACK_APP_TOKEN | ||
| ValueFrom: !Join | ||
| - '' | ||
| - - !Ref 'MetaflowbotSecretsManagerARN' | ||
| - ':' | ||
| - !Ref 'SlackAppTokenParameterKey' | ||
| - '::' | ||
| - Name: SLACK_BOT_TOKEN | ||
| ValueFrom: !Join | ||
| - '' | ||
| - - !Ref 'MetaflowbotSecretsManagerARN' | ||
| - ':' | ||
| - !Ref 'SlackBotTokenParameterKey' | ||
| - '::' | ||
| Cpu: '4096' | ||
| ExecutionRoleArn: !GetAtt 'EcsClusterRole.Arn' | ||
| Memory: '8192' | ||
| NetworkMode: awsvpc | ||
| RequiresCompatibilities: | ||
| - FARGATE | ||
| TaskRoleArn: !GetAtt 'EcsTaskRole.Arn' | ||
| Type: AWS::ECS::TaskDefinition | ||
| PolicyEcr: | ||
| Properties: | ||
| PolicyDocument: | ||
| Statement: | ||
| - Action: | ||
| - ecr:GetAuthorizationToken | ||
| Effect: Allow | ||
| Resource: | ||
| - '*' | ||
| - Action: | ||
| - ecr:GetDownloadUrlForLayer | ||
| - ecr:BatchGetImage | ||
| - ecr:BatchCheckLayerAvailability | ||
| - logs:CreateLogStream | ||
| - logs:PutLogEvents | ||
| Effect: Allow | ||
| Resource: | ||
| - '*' | ||
| Sid: AllowPull | ||
| Version: '2012-10-17' | ||
| PolicyName: MetaflowbotEcrPolicy | ||
| Roles: | ||
| - !Ref 'EcsClusterRole' | ||
| Type: AWS::IAM::Policy | ||
| PublicDefaultRoute: | ||
| Properties: | ||
| DestinationCidrBlock: '0.0.0.0/0' | ||
| GatewayId: !Ref 'MetaflowbotInternetGateway' | ||
| RouteTableId: !Ref 'PublicRouteTable' | ||
| Type: AWS::EC2::Route | ||
| PublicRouteAssociation: | ||
| Properties: | ||
| RouteTableId: !Ref 'PublicRouteTable' | ||
| SubnetId: !Ref 'MetaflowbotDeploymentSubnet' | ||
| Type: AWS::EC2::SubnetRouteTableAssociation | ||
| PublicRouteTable: | ||
| Properties: | ||
| VpcId: !Ref 'MetaflowbotPublicVpc' | ||
| Type: AWS::EC2::RouteTable | ||
| S3AccessPolicy: | ||
| Properties: | ||
| PolicyDocument: | ||
| Statement: | ||
| - Action: | ||
| - s3:GetObject | ||
| - s3:ListBucket | ||
| Effect: Allow | ||
| Resource: | ||
| - !Join | ||
| - '' | ||
| - - !Join | ||
| - '' | ||
| - - 'arn:aws:s3:::' | ||
| - !Select | ||
| - 1 | ||
| - !Split | ||
| - s3:// | ||
| - !Ref 'MetaflowDatastoreSysrootS3' | ||
| - /* | ||
| Sid: S3GetObject | ||
| Version: '2012-10-17' | ||
| PolicyName: MetaflowbotS3AccessPolicy | ||
| Roles: | ||
| - !Ref 'EcsTaskRole' | ||
| Type: AWS::IAM::Policy | ||
|
|
Oops, something went wrong.