Skip to content

Commit 8680c9a

Browse files
arampricecursoragent
aramprice
and
cursoragent
committed
Add job to ensure expected GCP integration network is created
Why --- The bats and test-stemcells-ipv4 jobs assume a GCP subnetwork named stemcell-builder-integration-<subnet_int> exists in the bosh-concourse VPC, with a /24 at 10.100.<subnet_int>.0/24, private Google access, and IPV4_ONLY stack type. They also require a matching ingress firewall rule (all-protocol, source CIDR → tags test-stemcells-bats/bat) so that compilation VMs and BAT deployment VMs can reach the BOSH director's NATS server. Until now both resources had to be created and maintained out of band; their absence caused consistent compilation-VM agent timeouts (builds 466–475). What ---- * ci/tasks/gcp/ensure-integration-network.sh - Authenticates via GCP_JSON_KEY service account. - Derives SUBNET_NAME and SUBNET_CIDR from SUBNET_INT. - For the subnetwork: calls gcloud describe once, capturing exit code for existence and attributes for drift detection in a single API call. Checks network, ipCidrRange, privateIpGoogleAccess, stackType and exits non-zero with a clear error on any mismatch; creates the subnet if absent. - For the firewall rule: same single-call pattern, checking network, direction, and sourceRanges[0]; creates the rule if absent. * ci/tasks/gcp/ensure-integration-network.yml - Concourse task definition. All params (GCP_JSON_KEY, GCP_PROJECT_ID, GCP_REGION, GCP_NETWORK_NAME, SUBNET_INT) are required; no defaults, values are provided explicitly by the pipeline. * ci/pipelines/builder.yml - New infrastructure group containing the new job. - New job ensure-integration-network: * serial: true, manual trigger only. * Gets bosh-stemcells-ci and bosh-integration-image, then runs the task with GCP_REGION=europe-north2 and GCP_NETWORK_NAME=bosh-concourse passed explicitly. * No passed: constraint on existing jobs; run on demand when the subnet/firewall needs to be created or reconciled. Verification ------------ * ytt -f ci/pipelines/builder.yml -f ci/pipelines/vars.yml renders successfully. * fly validate-pipeline -c <rendered> reports "looks good". Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 4a792ed commit 8680c9a

3 files changed

Lines changed: 140 additions & 1 deletion

File tree

‎ci/pipelines/builder.yml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ groups:
4444
- name: docker
4545
jobs:
4646
- build-os-image-stemcell-builder
47+
- name: infrastructure
48+
jobs:
49+
- ensure-integration-network
4750

4851
#@yaml/text-templated-strings
4952
jobs:
@@ -89,6 +92,25 @@ jobs:
8992
get_params:
9093
skip_download: true
9194

95+
#! Manually triggered job that idempotently ensures the GCP subnetwork and
96+
#! firewall rule consumed by deploy-director / cleanup-bats-vms / prepare-bats
97+
#! in the test-stemcells-ipv4 and bats jobs below exist. GCP is the source of
98+
#! truth — no state file is required.
99+
- name: ensure-integration-network
100+
serial: true
101+
plan:
102+
- get: bosh-stemcells-ci
103+
- get: bosh-integration-image
104+
- task: ensure-integration-network
105+
file: bosh-stemcells-ci/ci/tasks/gcp/ensure-integration-network.yml
106+
image: bosh-integration-image
107+
params:
108+
GCP_JSON_KEY: ((gcp_json_key))
109+
GCP_PROJECT_ID: ((gcp_project_id))
110+
GCP_REGION: europe-north2
111+
GCP_NETWORK_NAME: bosh-concourse
112+
SUBNET_INT: (@= data.values.stemcell_details.subnet_int @)
113+
92114
- name: process-high-critical-cves
93115
serial_groups: [log-cves]
94116
plan:
@@ -885,7 +907,6 @@ resource_types:
885907
type: registry-image
886908
source:
887909
repository: frodenas/gcs-resource
888-
889910
#@yaml/text-templated-strings
890911
resources:
891912
- name: daily

‎ci/tasks/gcp/ensure-integration-network.sh‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/usr/bin/env bash
2+
set -eu -o pipefail
3+
4+
: "${GCP_JSON_KEY:?}"
5+
: "${GCP_PROJECT_ID:?}"
6+
: "${GCP_REGION:?}"
7+
: "${GCP_NETWORK_NAME:?}"
8+
: "${SUBNET_INT:?}"
9+
10+
echo "${GCP_JSON_KEY}" | gcloud auth activate-service-account --key-file - --project "${GCP_PROJECT_ID}"
11+
12+
SUBNET_NAME="stemcell-builder-integration-${SUBNET_INT}"
13+
SUBNET_CIDR="10.100.${SUBNET_INT}.0/24"
14+
15+
# Both 'test-stemcells-bats' and 'bat' tags mirror the existing
16+
# stemcell-builder-integration-22 firewall rule: BOSH tags director/compilation
17+
# VMs with 'test-stemcells-bats' while the BATS framework tags its own VMs
18+
# with 'bat'.
19+
FIREWALL_TAGS="bat,test-stemcells-bats"
20+
21+
gcloud_stderr="$(mktemp)"
22+
trap 'rm -f "${gcloud_stderr}"' EXIT
23+
24+
# ── Subnet ────────────────────────────────────────────────────────────────────
25+
echo "Checking for subnet '${SUBNET_NAME}' in region '${GCP_REGION}'..."
26+
current_subnet="$(gcloud compute networks subnets describe "${SUBNET_NAME}" \
27+
--region="${GCP_REGION}" \
28+
--project="${GCP_PROJECT_ID}" \
29+
--format='csv[no-heading](network.basename(),ipCidrRange,privateIpGoogleAccess,stackType)' \
30+
2>"${gcloud_stderr}")" && subnet_exists=true || subnet_exists=false
31+
32+
if ${subnet_exists}; then
33+
expected_subnet="${GCP_NETWORK_NAME},${SUBNET_CIDR},True,IPV4_ONLY"
34+
if [[ "${current_subnet}" != "${expected_subnet}" ]]; then
35+
echo "ERROR: Subnet '${SUBNET_NAME}' exists but is misconfigured."
36+
echo " Expected: ${expected_subnet}"
37+
echo " Actual: ${current_subnet}"
38+
exit 1
39+
fi
40+
echo "Subnet '${SUBNET_NAME}' already exists and matches expected configuration."
41+
elif grep -q "was not found" "${gcloud_stderr}"; then
42+
echo "Creating subnet '${SUBNET_NAME}'..."
43+
gcloud compute networks subnets create "${SUBNET_NAME}" \
44+
--network="${GCP_NETWORK_NAME}" \
45+
--region="${GCP_REGION}" \
46+
--range="${SUBNET_CIDR}" \
47+
--enable-private-ip-google-access \
48+
--stack-type=IPV4_ONLY \
49+
--project="${GCP_PROJECT_ID}"
50+
echo "Subnet '${SUBNET_NAME}' created."
51+
else
52+
echo "ERROR: gcloud describe failed for subnet '${SUBNET_NAME}':"
53+
cat "${gcloud_stderr}" >&2
54+
exit 1
55+
fi
56+
57+
# ── Firewall rule ─────────────────────────────────────────────────────────────
58+
echo "Checking for firewall rule '${SUBNET_NAME}'..."
59+
current_fw="$(gcloud compute firewall-rules describe "${SUBNET_NAME}" \
60+
--project="${GCP_PROJECT_ID}" \
61+
--format='csv[no-heading](network.basename(),direction,allowed[0].IPProtocol,sourceRanges[0],disabled)' \
62+
2>"${gcloud_stderr}")" && fw_exists=true || fw_exists=false
63+
64+
if ${fw_exists}; then
65+
expected_fw="${GCP_NETWORK_NAME},INGRESS,all,${SUBNET_CIDR},False"
66+
if [[ "${current_fw}" != "${expected_fw}" ]]; then
67+
echo "ERROR: Firewall rule '${SUBNET_NAME}' exists but is misconfigured."
68+
echo " Expected: ${expected_fw}"
69+
echo " Actual: ${current_fw}"
70+
exit 1
71+
fi
72+
# Validate target tags independently; sort before comparing since GCP may
73+
# return them in any order.
74+
current_tags="$(gcloud compute firewall-rules describe "${SUBNET_NAME}" \
75+
--project="${GCP_PROJECT_ID}" \
76+
--format='value(targetTags.list())' \
77+
| tr ',;' '\n' | LC_ALL=C sort | tr '\n' ',' | sed 's/,$//')"
78+
expected_tags="$(printf '%s\n' ${FIREWALL_TAGS//,/ } | LC_ALL=C sort | tr '\n' ',' | sed 's/,$//')"
79+
if [[ "${current_tags}" != "${expected_tags}" ]]; then
80+
echo "ERROR: Firewall rule '${SUBNET_NAME}' has wrong target tags."
81+
echo " Expected: ${expected_tags}"
82+
echo " Actual: ${current_tags}"
83+
exit 1
84+
fi
85+
echo "Firewall rule '${SUBNET_NAME}' already exists and matches expected configuration."
86+
elif grep -q "was not found" "${gcloud_stderr}"; then
87+
echo "Creating firewall rule '${SUBNET_NAME}'..."
88+
gcloud compute firewall-rules create "${SUBNET_NAME}" \
89+
--network="${GCP_NETWORK_NAME}" \
90+
--project="${GCP_PROJECT_ID}" \
91+
--direction=INGRESS \
92+
--priority=1000 \
93+
--allow=all \
94+
--source-ranges="${SUBNET_CIDR}" \
95+
--target-tags="${FIREWALL_TAGS}"
96+
echo "Firewall rule '${SUBNET_NAME}' created."
97+
else
98+
echo "ERROR: gcloud describe failed for firewall rule '${SUBNET_NAME}':"
99+
cat "${gcloud_stderr}" >&2
100+
exit 1
101+
fi
102+
103+
echo "Integration network '${SUBNET_NAME}' is ready."

‎ci/tasks/gcp/ensure-integration-network.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
platform: linux
3+
4+
inputs:
5+
- name: bosh-stemcells-ci
6+
7+
params:
8+
GCP_JSON_KEY:
9+
GCP_PROJECT_ID:
10+
GCP_REGION:
11+
GCP_NETWORK_NAME:
12+
SUBNET_INT:
13+
14+
run:
15+
path: bosh-stemcells-ci/ci/tasks/gcp/ensure-integration-network.sh

0 commit comments

Comments
 (0)