CICD : Code items Flashcards
General info
CodeCommit
Codepipeline
Codebuild
Codedeploy
Commit: Store Code
Pipeline: orchestration of all events of build test and deploy
Build: Building and testing code
Deploy: Deploy code to Ec2 fleet NOT BEANSTALK
Code Commit Version Control
Version control: Understand changes over time and have ability to roll back.
Version control system is required, EX : GIT
Git Respository lives on machine or online: Allows
Collaboration
Backup
Viewable and auditable.
Code Commit Git repository
Examples:
Github
Bitbucket etc
AWS CODECOMMIT**** Private No size limit Managed and available highly Code ONLY VIA AWS CLOUD ACCOUNT (secure) Secure (Encrypted , has access control) Integrated with Jenkins, Codebuild, CI tools
Code Commit SECURITY
Interactions are done using Git (standard commands for Git etc)
Authentication in Git:
- SSH Keys: IAM console generation
- HTTPS: CLI authentication helper
- MFA: extra auth
Authorization in Git:
-IAM policy manager user/role rights to repo
Encryption:
- Automatically done via KMS
- Https for encryption in transit
Cross account access:
- Dont share SSH keys
- Dont share aws creds
- Use IAM role, other person uses STS for cross account access assumerole* to become role.
CODECOMMIT VS GITHUB
Similar: Both Git Repo Both have code pull request capability Both can be integrated into Codebuild Both support HTTPS and SSH for authentication
Differences: Security: -Github uses github users -Codecommit: IAM users and roles Hosting: -Github online, or on Github enterprise on own server -Codecommit: Manage and hosted by AWS
Code Commit Notifications
Trigger VIA
AWS SNS
AWS LAMBDA
AWS Cloudwatch event rules
SNS/LAMBDA (actions of adding /delete code)
- Deletion of branches
- push detection on master branch
- notify external build system
- lambda code analysis (see if credentials are in code!)
Cloudwatch event rules (more around pull request)
- Trigger for pull request update (Create, update, delete, comment)
- Commit then comments, then event is triggered by COMMENT**
- This goes to SNS topic
CODEPIPLINE OVERVIEW
Visual tool to perform continuous delivery, orchestrate between sources and builds
Source: Github/codecommit/S3
Build: Codebuild , jenkins, etc
Load testing: 3rd party tool
Deploy: AWS codedeploy/ beanstalk/ cloudformation /ecs
Made of Stages
Each stage has sequential actions or paralell.
Build>Test>Deploy>load test>ETC
Can have manual approval at any stage!
TECH STACK CODE BUILD TEST DEPLOY PROVISION
CODE - Code Commit / github
BUILD- Codebuild /jenkins
TEST- Codebuild /jenkins
DEPLOY - Elastic beanstalk / Codedeploy(ec2)
PROVISION - elastic beanstalk / EC2 via cloudformation and previously codedeploy
ORCHESTRATION OF ALL IS CODEPIPELINE
CODEPIPLINE and artifacts
Pipeline has stages, each stage can create artifacts
Artifacts are created by one stage and used by another
These artifacts are stored in S3 and passed into next stage.
Codecommit: Store code into S3
Codebuild: compile and test code from S3 and place result in s3
Deploy: Load s3 code and start ec2 deployment.
CODEPIPLINE Troubleshooting
Cloudpipeline state changes
- state change in pipeline will generate AWS CLOUDWATCH EVENT which can create SNS notification.
useful for failure in failed pipeline
can be used for when someone cancels event.
- Failure, causes pipeline to stop, you can get information at console. SNS notification should be used to prompt us to look into console
AWS API calls for this can be seen in cloudtrail.
**PERMISSIONS ISSUE: If pipeline cannot perform an action it means that attached “IAM service Role” doesn’t have enough permissions in IAM policy.
Codebuild Overview
security
logging
docker
Building and testing application
Like Jenkins
Manged Build Service, Alternative to Jenkins
Continuous Scaling
Pay for usage
Leverage Docker for reproducible builds
May be extended and can use our own Docker images for codebuild, allows customization
SECURE:
integration with KMS for build artifacts
integration with IAM for build permissions, can run in own VPC, can use cloudtrail for call logging.
Codebuild Overview Capabilities code from Build instructions Output logs alarms for failure BUILDS CAN BE DEFINED:
Process Source Code from:
Github, Codecommit, codepipeline, s3
Build instructions can be defined in code (BUILDSPEC.YML)
Output LOGS to Amazon s3 and AWS cloudwatch logs
after build finish, container disappears, this log remains
Metrics: Cloudwatch alarms for failed build and notification
Cloud events / aws lambda allows integration for event reporting, USE SNS for notifications
ABLE to reproduce cloudwatch on local PC for troubleshooting.
BUILDS CAN BE DEFINED:
IN codepipeline
or codebuild itself.
CODEBUILD: VPC
By Default Codebuild containers are launched outside VPC, so it needs to be given access to reach resources inside your VPC
Dont Via VPC configuration: allows access if group rules allow it. Security group**
VPC ID
Subnet ID
Security Group ID
RDS, elasticache, Ec2, ALB etc can now be accessed
CODE DEPLOY OVERVIEW
for what?
what else does it
what does this do that’s different.
-Ability to launch to many EC2 instances
-NOT managed by elastic Beanstalk
-Several ways to handle deployments
chef, terraform, puppet etc
-DEPLOYMENT IN THIS CASE: Will be done via AWS codedeploy! managed service
CODE DEPLOY: Setup
What needs to be done before this process can work
What message is sent to machines
where are files taken from for deployment
how is it reported back?
- Each EC2 or premise machine, MUST be running Code DEPLOY AGENT!
- Agent polls for AWS codedeploy service
- Source code is bundled with Appspec.yaml file
- This code is given to repo (github or s3) and also is able to TRIGGER DEPLOYMENT
- Triggered deployment reaches Ec2 and DEPLOY AGENT
- Deploy agent Downloads code with appspec.yaml file
- Ec2 will run based on appspec.yaml file which is in root of code
- Codedeploy will report of success/failure of deployment
