Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Deregistration Protection #516

Merged

Conversation

phuhung273
Copy link
Contributor

@phuhung273 phuhung273 commented Nov 16, 2024

Closes #486

Description

  • Add support for Deregistration Protection
  • Upgrade aws-sdk-go v1.51.32 for EnableDeregistrationProtection API

Integration Test

amazon-ebs.basic-example: output will be in this color.

==> amazon-ebs.basic-example: Prevalidating any provided VPC information
==> amazon-ebs.basic-example: Prevalidating AMI Name: packer-example-20241116152947
    amazon-ebs.basic-example: Found Image ID: ami-0664c8f94c2a2261b
==> amazon-ebs.basic-example: Creating temporary keypair: packer_6738ba6b-1d80-2214-bad8-40de2eadda8d
==> amazon-ebs.basic-example: Creating temporary security group for this instance: packer_6738ba71-0533-49e9-e004-e55fa2b8a344
==> amazon-ebs.basic-example: Authorizing access to port 22 from [0.0.0.0/0] in the temporary security groups...
==> amazon-ebs.basic-example: Launching a source AWS instance...
    amazon-ebs.basic-example: Instance ID: i-031b269632a49e63e
==> amazon-ebs.basic-example: Waiting for instance (i-031b269632a49e63e) to become ready...
==> amazon-ebs.basic-example: Using SSH communicator to connect: 3.85.87.245
==> amazon-ebs.basic-example: Waiting for SSH to become available...
==> amazon-ebs.basic-example: Connected to SSH!
==> amazon-ebs.basic-example: Stopping the source instance...
    amazon-ebs.basic-example: Stopping instance
==> amazon-ebs.basic-example: Waiting for the instance to stop...
==> amazon-ebs.basic-example: Creating AMI packer-example-20241116152947 from instance i-031b269632a49e63e
    amazon-ebs.basic-example: AMI: ami-017c9909fd9e4ba2c
==> amazon-ebs.basic-example: Waiting for AMI to become ready...
==> amazon-ebs.basic-example: Skipping Enable AMI deprecation...
==> amazon-ebs.basic-example: Enabling deregistration protection on AMI (ami-017c9909fd9e4ba2c) in region "us-east-1" ...
==> amazon-ebs.basic-example: Terminating the source AWS instance...
==> amazon-ebs.basic-example: Cleaning up any extra volumes...
==> amazon-ebs.basic-example: No volumes to clean up, skipping
==> amazon-ebs.basic-example: Deleting temporary security group...
==> amazon-ebs.basic-example: Deleting temporary keypair...
Build 'amazon-ebs.basic-example' finished after 3 minutes 55 seconds.

==> Wait completed after 3 minutes 55 seconds

==> Builds finished. The artifacts of successful builds are:
--> amazon-ebs.basic-example: AMIs were created:
us-east-1: ami-017c9909fd9e4ba2c
Screenshot 2024-11-16 223820

@phuhung273 phuhung273 requested a review from a team as a code owner November 16, 2024 15:51
Copy link
Contributor

@lbajolet-hashicorp lbajolet-hashicorp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @phuhung273,

Thanks for the PR! I very much appreciate you adding an acceptance test at the same time, thanks a lot for this; I'll try it in our environment to be sure, but this looks good to me at first glance.

I've left a few comments on the code and the docs, the options for the deregistration_protection are not visible in the READMEs for the builders, so we should probably address that before we merge and release this feature.

Besides that, LGTM! Thanks for the PR again, much appreciated

builder/common/ami_config.go Show resolved Hide resolved
}

for region, ami := range amis {
ui.Say(fmt.Sprintf("Enabling deregistration protection on AMI (%s) in region %q ...", ami, region))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can use ui.Sayf instead of a ui.Say(fmt.Sprintf, though I would suggest we demote this to a log.Printf, this is mostly useful for debugging, showing that log for each AMI to enable protection on might be noisy a bit

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed to log.Printf. I actually stole your code here

ui.Say(fmt.Sprintf("Enabling deprecation on AMI (%s) in region %q ...", ami, region))

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yeah, ui.Sayf is a reasonably recent addition to the SDK, it's likely we have some old code that still uses ui.Say(fmt.Sprintf around the codebase.
We should probably clean this up someday!

return fmt.Errorf("Failed to find ami %s at region %s", ami.Name, ami.Region)
}

ec2conn, _ := testEC2Conn(ami.Region)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest catching the error here and returning it, just so we are aware if creating the connection fails for some reason, otherwise the next statement will panic, which will not make it easier for someone to later troubleshoot.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you so much. Error catched. Should have realised it.

@@ -137,4 +137,7 @@
If you specify a value for seconds, Amazon EC2 rounds the seconds to the nearest minute.
You can’t specify a date in the past. The upper limit for DeprecateAt is 10 years from now.

- `deregistration_protection` (DeregistrationProtectionOptions) - See [DeregistrationProtectionOptions](#deregistration-protection-options) below for more
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this doesn't unroll the contents of the generated docs, I would suggest manually adding them to the docs for each builder, ideally under a # Deregistration Protection Options section so the fragment can point to it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just added to docs/builders. But cannot find a way to view on local machine. Hope it is correct.

@phuhung273
Copy link
Contributor Author

Hey @phuhung273,

Thanks for the PR! I very much appreciate you adding an acceptance test at the same time, thanks a lot for this; I'll try it in our environment to be sure, but this looks good to me at first glance.

I've left a few comments on the code and the docs, the options for the deregistration_protection are not visible in the READMEs for the builders, so we should probably address that before we merge and release this feature.

Besides that, LGTM! Thanks for the PR again, much appreciated

As new contributor, im really grateful for your kind instruction @lbajolet-hashicorp

Copy link
Contributor

@lbajolet-hashicorp lbajolet-hashicorp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the reroll @phuhung273

The code looks good to me, thanks for addressing all my comments; in the current state the PR should be ready to merge today.
I'll just run the acceptance tests you added locally to make sure this works as advertised, and if it's green, we can trigger the merge today!

The acceptance test added as part of the deregistration protection PR
did not include a region as part of the AMI created by the test, so we
add it in order for the test to succeed.
The AMI we create for the deregistration test would linger after the
test was executed, which is less than idea, so this commit ensures we do
remove the AMI after the test executes.
@lbajolet-hashicorp
Copy link
Contributor

Hi again @phuhung273,

I've just tried to run the acceptance test, which failed because the Region was not specified in the AMI specification for the test.
I've also noticed that the created AMI would linger after testing, so I took the liberty to push a couple commits to address those shortcomings on top of yours, hope this is not a problem.

With those changes, the test does succeed and cleans-up afterwards, so provided the tests go green now, I'll be able to trigger a merge!

@lbajolet-hashicorp lbajolet-hashicorp merged commit c4f234e into hashicorp:main Nov 19, 2024
12 checks passed
@phuhung273
Copy link
Contributor Author

Hi again @phuhung273,

I've just tried to run the acceptance test, which failed because the Region was not specified in the AMI specification for the test. I've also noticed that the created AMI would linger after testing, so I took the liberty to push a couple commits to address those shortcomings on top of yours, hope this is not a problem.

With those changes, the test does succeed and cleans-up afterwards, so provided the tests go green now, I'll be able to trigger a merge!

Thank you so much @lbajolet-hashicorp. Not sure why the test succeeded on my side, maybe because I already set AWS_REGION

Again, thank you so much for being incredibly helpful and giving instruction. Hope it wont cause any problem for the plugin.

@phuhung273 phuhung273 deleted the deregistration-protection branch November 19, 2024 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

feat: AMI Deregistration Protection
2 participants