Armory Docs – spinnaker.deployment.tasks.before

Plugins: spinnaker.deployment.tasks.before.cleanupArtifacts

Mon, 01 Jan 0001 00:00:00 +0000

Example Payload

Click to expand

{
 "input": {
 "deploy": {
 "account": "spinnaker",
 "credentials": "spinnaker",
 "events": [],
 "manifests": [
 {
 "apiVersion": "apps/v1",
 "kind": "Deployment",
 "metadata": {
 "annotations": {
 "artifact.spinnaker.io/location": "staging",
 "artifact.spinnaker.io/name": "hostname",
 "artifact.spinnaker.io/type": "kubernetes/deployment",
 "artifact.spinnaker.io/version": "",
 "deployment.kubernetes.io/revision": "4",
 "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"apps/v1\",\"kind\":\"Deployment\",\"metadata\":{\"annotations\":{\"artifact.spinnaker.io/location\":\"staging\",\"artifact.spinnaker.io/name\":\"hostname\",\"artifact.spinnaker.io/type\":\"kubernetes/deployment\",\"artifact.spinnaker.io/version\":\"\",\"moniker.spinnaker.io/application\":\"hostname\",\"moniker.spinnaker.io/cluster\":\"deployment hostname\"},\"labels\":{\"app.kubernetes.io/managed-by\":\"spinnaker\",\"app.kubernetes.io/name\":\"hostname\"},\"name\":\"hostname\",\"namespace\":\"staging\"},\"spec\":{\"replicas\":4,\"selector\":{\"matchLabels\":{\"app\":\"hostname\",\"version\":\"v1\"}},\"strategy\":{\"rollingUpdate\":{\"maxSurge\":1,\"maxUnavailable\":1},\"type\":\"RollingUpdate\"},\"template\":{\"metadata\":{\"annotations\":{\"artifact.spinnaker.io/location\":\"staging\",\"artifact.spinnaker.io/name\":\"hostname\",\"artifact.spinnaker.io/type\":\"kubernetes/deployment\",\"artifact.spinnaker.io/version\":\"\",\"moniker.spinnaker.io/application\":\"hostname\",\"moniker.spinnaker.io/cluster\":\"deployment hostname\",\"prometheus.io/port\":\"9113\",\"prometheus.io/scrape\":\"true\"},\"labels\":{\"app\":\"hostname\",\"app.kubernetes.io/managed-by\":\"spinnaker\",\"app.kubernetes.io/name\":\"hostname\",\"version\":\"v1\"}},\"spec\":{\"containers\":[{\"image\":\"rstarmer/hostname:v1\",\"imagePullPolicy\":\"Always\",\"name\":\"hostname\",\"resources\":{},\"volumeMounts\":[{\"mountPath\":\"/etc/nginx/conf.d/nginx-status.conf\",\"name\":\"nginx-status-conf\",\"readOnly\":true,\"subPath\":\"nginx.status.conf\"}]},{\"args\":[\"-nginx.scrape-uri=http://localhost:8090/nginx_status\"],\"image\":\"nginx/nginx-prometheus-exporter:0.3.0\",\"imagePullPolicy\":\"Always\",\"name\":\"nginx-exporter\",\"ports\":[{\"containerPort\":9113,\"name\":\"nginx-ex-port\",\"protocol\":\"TCP\"}]}],\"restartPolicy\":\"Always\",\"volumes\":[{\"configMap\":{\"defaultMode\":420,\"name\":\"nginx-status-conf-v000\"},\"name\":\"nginx-status-conf\"}]}}}}\n",
 "moniker.spinnaker.io/application": "hostname",
 "moniker.spinnaker.io/cluster": "deployment hostname"
 },
 "creationTimestamp": "2021-04-30T21:19:15Z",
 "generation": 11,
 "labels": {
 "app.kubernetes.io/managed-by": "spinnaker",
 "app.kubernetes.io/name": "hostname"
 },
 "managedFields": [
 {
 "apiVersion": "apps/v1",
 "fieldsType": "FieldsV1",
 "fieldsV1": {
 "f:metadata": {
 "f:annotations": {
 ".": {},
 "f:artifact.spinnaker.io/location": {},
 "f:artifact.spinnaker.io/name": {},
 "f:artifact.spinnaker.io/type": {},
 "f:artifact.spinnaker.io/version": {},
 "f:kubectl.kubernetes.io/last-applied-configuration": {},
 "f:moniker.spinnaker.io/application": {},
 "f:moniker.spinnaker.io/cluster": {}
 },
 "f:labels": {
 ".": {},
 "f:app.kubernetes.io/managed-by": {},
 "f:app.kubernetes.io/name": {}
 }
 },
 "f:spec": {
 "f:progressDeadlineSeconds": {},
 "f:replicas": {},
 "f:revisionHistoryLimit": {},
 "f:selector": {
 "f:matchLabels": {
 ".": {},
 "f:app": {},
 "f:version": {}
 }
 },
 "f:strategy": {
 "f:rollingUpdate": {
 ".": {},
 "f:maxSurge": {},
 "f:maxUnavailable": {}
 },
 "f:type": {}
 },
 "f:template": {
 "f:metadata": {
 "f:annotations": {
 ".": {},
 "f:artifact.spinnaker.io/location": {},
 "f:artifact.spinnaker.io/name": {},
 "f:artifact.spinnaker.io/type": {},
 "f:artifact.spinnaker.io/version": {},
 "f:moniker.spinnaker.io/application": {},
 "f:moniker.spinnaker.io/cluster": {},
 "f:prometheus.io/port": {},
 "f:prometheus.io/scrape": {}
 },
 "f:labels": {
 ".": {},
 "f:app": {},
 "f:app.kubernetes.io/managed-by": {},
 "f:app.kubernetes.io/name": {},
 "f:version": {}
 }
 },
 "f:spec": {
 "f:containers": {
 "k:{\"name\":\"hostname\"}": {
 ".": {},
 "f:image": {},
 "f:imagePullPolicy": {},
 "f:name": {},
 "f:resources": {},
 "f:terminationMessagePath": {},
 "f:terminationMessagePolicy": {},
 "f:volumeMounts": {
 ".": {},
 "k:{\"mountPath\":\"/etc/nginx/conf.d/nginx-status.conf\"}": {
 ".": {},
 "f:mountPath": {},
 "f:name": {},
 "f:readOnly": {},
 "f:subPath": {}
 }
 }
 },
 "k:{\"name\":\"nginx-exporter\"}": {
 ".": {},
 "f:args": {},
 "f:image": {},
 "f:imagePullPolicy": {},
 "f:name": {},
 "f:ports": {
 ".": {},
 "k:{\"containerPort\":9113,\"protocol\":\"TCP\"}": {
 ".": {},
 "f:containerPort": {},
 "f:name": {},
 "f:protocol": {}
 }
 },
 "f:resources": {},
 "f:terminationMessagePath": {},
 "f:terminationMessagePolicy": {}
 }
 },
 "f:dnsPolicy": {},
 "f:restartPolicy": {},
 "f:schedulerName": {},
 "f:securityContext": {},
 "f:terminationGracePeriodSeconds": {},
 "f:volumes": {
 ".": {},
 "k:{\"name\":\"nginx-status-conf\"}": {
 ".": {},
 "f:configMap": {
 ".": {},
 "f:defaultMode": {},
 "f:name": {}
 },
 "f:name": {}
 }
 }
 }
 }
 }
 },
 "manager": "kubectl",
 "operation": "Update",
 "time": "2021-04-30T21:19:15Z"
 },
 {
 "apiVersion": "apps/v1",
 "fieldsType": "FieldsV1",
 "fieldsV1": {
 "f:metadata": {
 "f:annotations": {
 "f:deployment.kubernetes.io/revision": {}
 }
 },
 "f:status": {
 "f:availableReplicas": {},
 "f:conditions": {
 ".": {},
 "k:{\"type\":\"Available\"}": {
 ".": {},
 "f:lastTransitionTime": {},
 "f:lastUpdateTime": {},
 "f:message": {},
 "f:reason": {},
 "f:status": {},
 "f:type": {}
 },
 "k:{\"type\":\"Progressing\"}": {
 ".": {},
 "f:lastTransitionTime": {},
 "f:lastUpdateTime": {},
 "f:message": {},
 "f:reason": {},
 "f:status": {},
 "f:type": {}
 }
 },
 "f:observedGeneration": {},
 "f:readyReplicas": {},
 "f:replicas": {},
 "f:updatedReplicas": {}
 }
 },
 "manager": "kube-controller-manager",
 "operation": "Update",
 "time": "2021-05-07T22:39:40Z"
 }
 ],
 "name": "hostname",
 "namespace": "staging",
 "resourceVersion": "25266763",
 "selfLink": "/apis/apps/v1/namespaces/staging/deployments/hostname",
 "uid": "e1d20734-60ea-44a0-a830-168f001b482f"
 },
 "spec": {
 "progressDeadlineSeconds": 600,
 "replicas": 4,
 "revisionHistoryLimit": 10,
 "selector": {
 "matchLabels": {
 "app": "hostname",
 "version": "v1"
 }
 },
 "strategy": {
 "rollingUpdate": {
 "maxSurge": 1,
 "maxUnavailable": 1
 },
 "type": "RollingUpdate"
 },
 "template": {
 "metadata": {
 "annotations": {
 "artifact.spinnaker.io/location": "staging",
 "artifact.spinnaker.io/name": "hostname",
 "artifact.spinnaker.io/type": "kubernetes/deployment",
 "artifact.spinnaker.io/version": "",
 "moniker.spinnaker.io/application": "hostname",
 "moniker.spinnaker.io/cluster": "deployment hostname",
 "prometheus.io/port": "9113",
 "prometheus.io/scrape": "true"
 },
 "labels": {
 "app": "hostname",
 "app.kubernetes.io/managed-by": "spinnaker",
 "app.kubernetes.io/name": "hostname",
 "version": "v1"
 }
 },
 "spec": {
 "containers": [
 {
 "image": "rstarmer/hostname:v1",
 "imagePullPolicy": "Always",
 "name": "hostname",
 "resources": {},
 "terminationMessagePath": "/dev/termination-log",
 "terminationMessagePolicy": "File",
 "volumeMounts": [
 {
 "mountPath": "/etc/nginx/conf.d/nginx-status.conf",
 "name": "nginx-status-conf",
 "readOnly": true,
 "subPath": "nginx.status.conf"
 }
 ]
 },
 {
 "args": [
 "-nginx.scrape-uri=http://localhost:8090/nginx_status"
 ],
 "image": "nginx/nginx-prometheus-exporter:0.3.0",
 "imagePullPolicy": "Always",
 "name": "nginx-exporter",
 "ports": [
 {
 "containerPort": 9113,
 "name": "nginx-ex-port",
 "protocol": "TCP"
 }
 ],
 "resources": {},
 "terminationMessagePath": "/dev/termination-log",
 "terminationMessagePolicy": "File"
 }
 ],
 "dnsPolicy": "ClusterFirst",
 "restartPolicy": "Always",
 "schedulerName": "default-scheduler",
 "securityContext": {},
 "terminationGracePeriodSeconds": 30,
 "volumes": [
 {
 "configMap": {
 "defaultMode": 420,
 "name": "nginx-status-conf-v000"
 },
 "name": "nginx-status-conf"
 }
 ]
 }
 }
 },
 "status": {
 "availableReplicas": 10,
 "conditions": [
 {
 "lastTransitionTime": "2021-04-30T21:19:15Z",
 "lastUpdateTime": "2021-05-07T20:39:03Z",
 "message": "ReplicaSet \"hostname-f5b957cc\" has successfully progressed.",
 "reason": "NewReplicaSetAvailable",
 "status": "True",
 "type": "Progressing"
 },
 {
 "lastTransitionTime": "2021-05-07T22:39:40Z",
 "lastUpdateTime": "2021-05-07T22:39:40Z",
 "message": "Deployment has minimum availability.",
 "reason": "MinimumReplicasAvailable",
 "status": "True",
 "type": "Available"
 }
 ],
 "observedGeneration": 10,
 "readyReplicas": 10,
 "replicas": 10,
 "updatedReplicas": 10
 }
 }
 ]
 }
 }
}

Example Policy

Prevents cleanupArtifacts tasks from running on any account in a predefined list.

package spinnaker.deployment.tasks.before.cleanupArtifacts

productionAccounts :=["prod1","prod2"]

deny["Artifactss may not be cleaned up from production accounts"] {
 input.deploy.account==productionAccounts[_]
}

Keys

Key	Type	Description
`input.deploy.account`	`string`	The account being deployed to.
`input.deploy.credentials`	`string`	The credentials to use to access the account.
`input.deploy.manifests[].*`	`*`	The entire Kubernetes manifest to be removed.

Plugins: spinnaker.deployment.tasks.before.deleteManifest

Mon, 01 Jan 0001 00:00:00 +0000

If your policy is for controlling deletion from within a pipeline, more information is available in policies written against the spinnaker.deployment.tasks.before.deployManifest package.

If your policy is for controlling manual deletion triggers from within the Armory Continuous Deployment UI that are not triggered via a pipeline, more information is available in policies written against the spinnaker.http.authz package.

Example Payload

Click to expand

{
 "input": {
 "deploy": {
 "account": "spinnaker",
 "allCoordinates": [],
 "credentials": "spinnaker",
 "events": [],
 "kinds": [],
 "labelSelectors": {
 "empty": true,
 "notEmpty": false,
 "selectors": []
 },
 "location": "staging",
 "manifestName": "deployment hostname",
 "options": {
 "apiVersion": null,
 "dryRun": null,
 "gracePeriodSeconds": 5,
 "kind": null,
 "orphanDependents": null,
 "preconditions": null,
 "propagationPolicy": null
 }
 }
 }
}

Example Policy

This example policy prevents deleteManifest tasks from running unless they provide a grace period of 30 seconds or more.

package spinnaker.deployment.tasks.before.deleteManifest

deny["A minimum 30 second grace period must be given when deleting a kubernetes manifest"] {
 input.deploy.options.gracePeriodSeconds<30
}

Keys

Key	Type	Description
`input.deploy.account`	`string`	The account being deployed to.
`input.deploy.credentials`	`string`	The credentials to use to access the account.
`input.deploy.labelSelectors.empty`	`boolean`
`input.deploy.labelSelectors.notEmpty`	`boolean`
`input.deploy.location`	`string`	The name of the namespace from which the manifest is being deleted.
`input.deploy.manifestName`	`string`	The name of the manifest being deleted.
`input.deploy.options.apiVersion`	`string`	The API version in which the manifest’s kind is defined.
`input.deploy.options.dryRun`	`boolean`	If true then the manifest is not actually deleted. if false it is.
`input.deploy.options.gracePeriodSeconds`	`number`	How many seconds should the resource being deleted be given to shut down gracefully before being forcefully shut down.
`input.deploy.options.kind`	`string`	The kind of manifest that is being deleted.
`input.deploy.options.orphanDependents`	`boolean`	When set, delete all resources managed by this resource as well (all pods owned by a replica set). When unset, this may orphan resources.
`input.deploy.options.preconditions`
`input.deploy.options.propagationPolicy`	`string`	There are three different ways to delete a Kubernetes object: Foreground: The object itself cannot be deleted unless the objects that it owns have already been deleted. Background: The object itself is deleted, then the objects that it owned are automatically deleted. Orphan: The object itself is deleted. Any objects it owns are “orphaned.”

Plugins: spinnaker.deployment.tasks.before.deployManifest

Mon, 01 Jan 0001 00:00:00 +0000

Example Payload

Click to expand

{
 "input": {
 "deploy": {
 "account": "spinnaker",
 "credentials": "spinnaker",
 "enableTraffic": true,
 "events": [],
 "manifest": null,
 "manifestArtifact": null,
 "manifests": [
 {
 "apiVersion": "apps/v1",
 "kind": "Deployment",
 "metadata": {
 "annotations": {
 "artifact.spinnaker.io/location": "staging",
 "artifact.spinnaker.io/name": "hostname",
 "artifact.spinnaker.io/type": "kubernetes/deployment",
 "artifact.spinnaker.io/version": "",
 "moniker.spinnaker.io/application": "hostname",
 "moniker.spinnaker.io/cluster": "deployment hostname"
 },
 "labels": {
 "app.kubernetes.io/managed-by": "spinnaker",
 "app.kubernetes.io/name": "hostname"
 },
 "name": "hostname",
 "namespace": "staging"
 },
 "spec": {
 "replicas": 4,
 "selector": {
 "matchLabels": {
 "app": "hostname",
 "version": "v1"
 }
 },
 "strategy": {
 "rollingUpdate": {
 "maxSurge": 1,
 "maxUnavailable": 1
 },
 "type": "RollingUpdate"
 },
 "template": {
 "metadata": {
 "annotations": {
 "artifact.spinnaker.io/location": "staging",
 "artifact.spinnaker.io/name": "hostname",
 "artifact.spinnaker.io/type": "kubernetes/deployment",
 "artifact.spinnaker.io/version": "",
 "moniker.spinnaker.io/application": "hostname",
 "moniker.spinnaker.io/cluster": "deployment hostname",
 "prometheus.io/port": "9113",
 "prometheus.io/scrape": "true"
 },
 "labels": {
 "app": "hostname",
 "app.kubernetes.io/managed-by": "spinnaker",
 "app.kubernetes.io/name": "hostname",
 "version": "v1"
 }
 },
 "spec": {
 "containers": [
 {
 "image": "rstarmer/hostname:v1",
 "imagePullPolicy": "Always",
 "name": "hostname",
 "resources": {},
 "volumeMounts": [
 {
 "mountPath": "/etc/nginx/conf.d/nginx-status.conf",
 "name": "nginx-status-conf",
 "readOnly": true,
 "subPath": "nginx.status.conf"
 }
 ]
 },
 {
 "args": [
 "-nginx.scrape-uri=http://localhost:8090/nginx_status"
 ],
 "image": "nginx/nginx-prometheus-exporter:0.3.0",
 "imagePullPolicy": "Always",
 "name": "nginx-exporter",
 "ports": [
 {
 "containerPort": 9113,
 "name": "nginx-ex-port",
 "protocol": "TCP"
 }
 ]
 }
 ],
 "restartPolicy": "Always",
 "volumes": [
 {
 "configMap": {
 "defaultMode": 420,
 "name": "nginx-status-conf-v000"
 },
 "name": "nginx-status-conf"
 }
 ]
 }
 }
 }
 }
 ],
 "moniker": {
 "app": "hostname",
 "cluster": "deployment hostname",
 "detail": null,
 "sequence": null,
 "stack": null
 },
 "namespaceOverride": null,
 "optionalArtifacts": [],
 "requiredArtifacts": [],
 "services": null,
 "source": "text",
 "strategy": null,
 "versioned": null
 }
 }
}

Example Policy

This example prevents deploying of pods, pod templates (deployments/jobs/replicasets) and services that use the following services: HTTP, FTP, TELNET, POP3, NNTP, IMAP, LDAP, SMTP

package spinnaker.deployment.tasks.before.deployManifest

blockedPorts := [20,21,23,80,110,119,143,389,587,8080,8088,8888]

deny["A port typically used by an unencrypted protocol was detected."] {
 #Check for service
 ports := input.deploy.manifests[_].spec.ports[_]
 any([object.get(ports,"port",null) == blockedPorts[_],
 object.get(ports,"targetPort",null) == blockedPorts[_]])
}{
 #Check for pod
 input.deploy.manifests[_].spec.containers[_].ports[_].containerPort=blockedPorts[_]
} {
 #Check for pod template
 input.deploy.manifests[_].spec.template.spec.containers[_].ports[_].containerPort=blockedPorts[_]
 }

This example requires that the annotations ‘owner’ and ‘app’ are applied on all deployed infrastructure.

package spinnaker.deployment.tasks.before.deployManifest

required_annotations:=["app","owner"]

deny["Manifest is missing a required annotation"] {
 annotations :=input.deploy.manifests[_].metadata.annotations

 # Use object.get to check if data exists
 object.get(annotations,required_annotations[_],null)==null
}

Keys

Key	Type	Description
`input.deploy.account`	`string`	The account being deployed to.
`input.deploy.credentials`	`string`	The credentials to use to access the account.
`input.deploy.enableTraffic`	`boolean`	Allow Armory Continuous Deployment to associate each ReplicaSet deployed in this stage with one or more services and manage traffic based on your selected rollout strategy options.
`input.deploy.manifest`	`[array]`	An array of the manifests being deployed
`input.deploy.manifestArtifact`		The name of the artifact from which the manifest should be read.
`input.deploy.manifests[].*`	`*`	The entire Kubernetes manifest to be deployed.
`input.deploy.moniker.app`	`string`	The name of the application being deployed
`input.deploy.moniker.cluster`	`string`	The name of the cluster you are deploying to.
`input.deploy.moniker.detail`
`input.deploy.moniker.sequence`
`input.deploy.moniker.stack`
`input.deploy.namespaceOverride`		The namespace the job should deploy to
`input.deploy.services`		The services that are having their traffic managed, if any.
`input.deploy.source`	`string`
`input.deploy.strategy`		The rollout strategy tells Armory Continuous Deployment what to do with the previous version(s) of the ReplicaSet in the cluster.
`input.deploy.versioned`

Plugins: spinnaker.deployment.tasks.before.scaleManifest

Mon, 01 Jan 0001 00:00:00 +0000

Example Payload

Click to expand

{
 "input": {
 "deploy": {
 "account": "spinnaker",
 "credentials": "spinnaker",
 "events": [],
 "location": "staging",
 "manifestName": "deployment hostname",
 "replicas": 10
 }
 }
}

Example Policy

This policy prevents scaling a deployment or replicaset in a production account to have <2 replicas.

package spinnaker.deployment.tasks.before.scaleManifest

productionAccounts :=["prod1","prod2"]

deny["production accounts require >1 replicas to avoid a single point of failure."]{
 input.deploy.location==productionAccounts[_]
 input.deploy.replicas<2
}

Keys

Key	Type	Description
`input.deploy.account`	`string`	The account being deployed to.
`input.deploy.credentials`	`string`	The credentials used to access the account.
`input.deploy.location`	`string`	The name of the namespace the manifest is being deleted from.
`input.deploy.manifestName`	`string`	The name of the manifest being deleted.
`input.deploy.replicas`	`number`	How many pods should be running after the scaling action.

Plugins: spinnaker.deployment.tasks.before.undoRolloutManifest

Mon, 01 Jan 0001 00:00:00 +0000

Example Payload

Click to expand

{
 "input": {
 "deploy": {
 "account": "spinnaker",
 "credentials": "spinnaker",
 "events": [],
 "location": "staging",
 "manifestName": "deployment hostname",
 "numRevisionsBack": 1,
 "revision": null
 }
 }
}

Example Policy

package spinnaker.deployment.tasks.before.undoRolloutManifest

deny ["You may only rollback 1 revision at a time."]{
 input.deploy.numRevisionsBack!=1
}

Keys

Key	Type	Description
`input.deploy.account`	`string`	The spinnaker account to which this stage is deploying.
`input.deploy.credentials`	`string`	The credentials to use to access the account.
`input.deploy.location`	`string`	The name of the namespace the manifest is being deleted from.
`input.deploy.manifestName`	`string`	The name of the manifest being deleted.
`input.deploy.numRevisionsBack`	`number`	How many revisions of the manifest should be rolled back.
`input.deploy.revision`	`number`	What revision the manifest should be rolled back to.