#codefresh - March 2019

@dustinvb is there are way to update shared configurations using cli?

w/ https://codefresh-io.github.io/cli/contexts/update-context/

thx!!

feels very much like kubectl

too bad it doesn't support -f - for stdin

@dustinvb got what I wanted to implement (assume roles) for codefresh

has anyone ever set up deploy conditionals to only deploy when a branch is tagged?

New Feature: Pipeline ABAC https://codefresh.io/docs/docs/enterprise/access-control/#marking-pipelines-with-policy-attributes

New Feature: Azure Repositories Support https://codefresh.io/docs/docs/integrations/git-providers/#azure-devops

GitHub Incident - Degraded performance across Web, Pages and Notifications
Mar 12, 15:18 UTC
Investigating - GitHub has reported an incident related to degraded performance across Web, Pages and Notifications.
More information here: https://www.githubstatus.com/

The Codefresh status page includes statuses of everything they depend on

Yea it’s worked wonderfully! We have a channel at CloudPosse with feeds for all the status pages (including AWS) that we depend on

GitHub Incident - Degraded performance across Web, Pages and Notifications
Mar 13, 08:51 UTC
Resolved - This incident has been resolved.
Mar 12, 15:18 UTC
Investigating - GitHub has reported an incident related to degraded performance across Web, Pages and Notifications.
More information here: https://www.githubstatus.com/

Sorry been traveling see you're already here @oscarsullivan_old

Just incase anyone is planning on rolling out Codefresh Enterprise (on prem), in AWS, here’s our terraform module for it: https://github.com/cloudposse/terraform-aws-codefresh-backing-services

this is to leverage as many fully-managed AWS services as possible that are required to run Codefresh

Simple Step for Aqua scanning in a Codefresh pipeline. https://github.com/codefresh-contrib/cfstep-aqua

This is the results passed back to Codefresh registry and there is a link to the detailed report in Aqua

@dustinvb did something change in the last 2-3 weeks in codefresh that would lead to this to start failing?

chsh -s /bin/sh nobody

got it

something in alpine:3.7 has changed

so that it prompts for a password

but doesn't happen in 3.8

i'll figure this out.

I normally see this error related to npm install using global flag. Not sure why it's going to fail here. I have to add the unsafe arg to npmconfig to get around it.

this worked for me

echo "auth sufficient pam_shells.so" > /etc/pam.d/chsh in my alpine container

@dustinvb can i unexport an env? (E.g. cf_unexport) 😃

Sorry no, not a feature at this time.

Codefresh Incident
Mar 19, 15:53 UTC
Investigating - We are investigating an issue on our platform that is affecting build functionality.
We will go to provide more information here as investigation progresses.

Codefresh Incident
Mar 19, 16:15 UTC
Monitoring - There was an issue during a DB upgrade process.
The issue was quickly identified and now is resolved.
But we'll keep monitoring the platform to ensure it is working as expected
Mar 19, 15:53 UTC
Investigating - We are investigating an issue on our platform that is affecting build functionality.
We will go to provide more information here as investigation progresses.

@dustinvb recommends to check out https://github.com/dustinvanbuskirk/github-commit-statistics

This should give you a semi reasonable estimate based on commits to your org repos and the total across all of them.

Yes, our SaaS model gets you out of maintenance and gives you a team of support engineers on our side to assist you if you do run into anything.

I encourage you to reach out to michael.schaaf@codefresh.io to ask any questions about pricing.

Did you use https://plugins.jenkins.io/global-build-stats?

I haven't had much success with it.

OH well... If you can manually count then probably wouldn't even be a metric to concern yourself with. Instead look at concurrency and the runtime sizes memory/compute for each pipeline.

Jenkins is a bit brittle.

I've done it. Terraform + Chef and then ran all the builds from Docker. It was better but I still had to deal with things like the Maven plugin...

Not true

Easy to roll in anything you're doing on the Linux Slave with Jenkins over to an Ubuntu or CentOS Docker image and incorporate that same scripting and push binaries. That's supported.

Depends, we have customers that push jars for example that are used by their customers that are not focused on the Docker artifact. I think it depends on what your plan is for the artifact. If it makes sense to run in a container and it is possible that's an optin.

Yup, and if you're like me you already have the scripting in version control in something like a make file.

Just leaving the item of building the slave Docker image by running apt-get and other package solutions to prepare the image for the build. Then you can use that in a multistage later on.

Yes we have several

Check the blog here.

@Kostis (Codefresh) Is our technical writer and does the comparisons posted on the blog if you have any questions.

2 builds, but could restrict this to not create on specific events.

Say if you have filter on commit and PR open, the commit would have already built unless you wanted to do more in regards to a commit pipeline vs. pr pipeline. Then you'd add pull request synchronized event to build on your commits to existing PR.

Oscar, I'd suggest emailing Michael about the pricing. He can work with you in regards to concerns around these soft build limits in our plans and find you a plan that fits your budget.

Not you ☝️ ?

Oscar, Michael has confirmed there is alternative plans he can discuss with you. Just FYI.

Codefresh Incident
Mar 19, 19:11 UTC
Update - We're still working on resolving some performance issues.
We're constantly monitoring the system.
Once all minor issues are fully resolved, this incident will be closed
Mar 19, 16:15 UTC
Monitoring - There was an issue during a DB upgrade process.
The issue was quickly identified and now is resolved.
But we'll keep monitoring the platform to ensure it is working as expected
Mar 19, 15:53 UTC
Investigating - We are investigating an issue on our platform that is...

Codefresh Incident
Mar 19, 19:46 UTC
Resolved - The issue is now resolved.
Performance is now at expected levels across all the platform.
We're going to keep monitoring the system to ensure a consistent behavior in terms of performance
Mar 19, 19:37 UTC
Update - UPDATE: we're currently performing a DB-upgrade operation as part of the actions to resolve the current performance issues
Mar 19, 19:11 UTC
Update - We're still working on resolving some performance issues.
We're constantly monitoring the system.
Once...

you can definitely have it source controlled

3 ways to define it:

- 1) inline using UI (great for debugging, but not as a workflow)

- 2) from a remote URL

- 3) from source control (how we typically do it)

you can also even define your pipeline creation process as code as we do here:

I already booked the time to attend! This is a do not miss in my book.

Noob question: Hoping to understand (read if there is a resource already) the motivation behind creating codefresh. Just to be clear, this is not an ask what is codefresh but more around the lines of what kind of issues it tackles better.

@Erik Osterman (Cloud Posse)

@Avineshwar Pratap Singh can you ping me on Monday? I am AFK.

@Erik Osterman (Cloud Posse) looking forward! 👍️

Codefresh tackles the move from VMs to micro-services supporting build, test, delivery and deployment of micro-services using micro-service based pipelines built upon a scalable platform meant to scale as micro-services emerge which require 10x-1000x the amount of builds in a CI/CD platform as your typical Legacy build VM based applications. Each micro-service can bring in it's own version of a programming language (best for the job) leaving it up to a VM to build and test offers little flexibility to remain as agile as today's containers allow. Using a pipeline built out of micro-services gives your CI/CD the same flexibility as the applications you're building. Around all of this Codefresh has build a UI that integrates with your Version Control System and Kubernetes. Giving you a soup to nuts view of your CI/CD around containers and Kubernetes. We also provide private Docker registry to aid in your archive/deployment of Docker containers. Please see https://steps.codefresh.io/ for a listing of some of the provides micro-services you can include as steps in your pipeline and of course to this document about Codefresh pipelines: https://codefresh.io/docs/docs/configure-ci-cd-pipeline/introduction-to-codefresh-pipelines/

has anyone used chamber in a codefresh pipeline to inject secrets into helm chart? Wondering whats that best approach for this?

never mind found a link in the docs, here is reference for anyone who cares

if you run kubectl get pods --all-namespaces, what do you see?

@Andriy Knysh (Cloud Posse) others have had trouble with getting nodes registered

What does get nodes show?

(On phone)

and you ran this https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/kubectl.tf ?

for worker nodes to join the cluster, you need to apply that config map

either using the example code, or manually

let me know if that still is not working

it was tested about 2 months ago, was ok

but recently a few people reported issues with workers joining the cluster

so if you have the same issue, I’ll have to look into that

@Andriy Knysh (Cloud Posse) ☝️

i saw that

as i mentioned, we did not see issues like that before

@oscarsullivan_old try the example and let us know

i think geodesic has an ENV var for that, @Erik Osterman (Cloud Posse) do you remember which one?

(or maybe it’s just for kops)

It’s a kubectl env

Yes

That one

@Andriy Knysh (Cloud Posse) what’s the path setting g for the module

That is what should change to dev shm

did you run https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/kubectl.tf

with var.apply_config_map_aws_auth` set to “true”

@Andriy Knysh (Cloud Posse) Where does the module write the config?

you specify the path

Can we specify then dev shm?

need to change that to a var

do you see the workers?

@Andriy Knysh (Cloud Posse) can you update the issue with this new information ?

i can update the issue, yes

but i pointed out a few times there to do what @oscarsullivan_old just did 🙂

so either that did not work for them, or something else was wrong

as i remember there were some thoughts around that, but don’t remember exactly the details 🙂

is it your image?

i think you need to deploy Docker pull secrets to k8s https://github.com/cloudposse/charts/tree/master/incubator/dockercfg

1 sec

- https://github.com/kubernetes/helm/blob/master/docs/charts_tips_and_tricks.md
- https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

yes

when we deploy an app to the cluster, we usually create a helmfile in the same repo

we call it Helm Cartridge

the helmfile deploys the pull-secret chart and then the app chart

I went through this a little while ago, I created a secret in the namespace I was deploying to

kubectl create secret docker-registry ${name_of_secret} --docker-server=<http://r.cfcr.io|r.cfcr.io> --docker-username=${codefresh_username} --docker-password=${codefresh_cr_generated_password} -n ${namespace}

Then when you deploy you have to set the imagePullSecret in the Deployment spec

k8s itself needs permissions to pull images

(that’s for @oscarsullivan_old ^)

when pulling the image during deployment

yeah thats the pull secret that you upload as a secret to kubernetes

it has nothing to do with Codefresh, which just sends k8s resource definitions to the cluster, the cluster itself pulls the images

yes, it does the same as the chart

(too many moving parts 🙂 )

For a quick test, do what Mark showed

We use the chart and the helmfile to automate all of that

thats the token

its whatever you set here

right now it would be your username, unless you have a service account

in the future I think they are going to allow you to generate users for CFCR that are not tied to an individual user

yup, I referenced it in the helm chart

in the Deployment spec

if you are not using helm you can just set it in the deployment spec itself https://kubernetes.io/docs/concepts/containers/images/

here is an example for a pod from their documentation

myregistrykey would be the name of the secret you created in the namespace