Skip to content

Commit d4533c9

Browse files
hypolashypolas
committed
fix: ssm change name
1 parent b08c2ce commit d4533c9

File tree

10 files changed

+100
-100
lines changed

10 files changed

+100
-100
lines changed

‎.github/workflows/docker-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Build and Push Docker Images
33
on:
44
push:
55
branches: [ main, develop ]
6-
tags: [ 'v*' ]
6+
tags: [ v* ]
77
pull_request:
88
branches: [ main ]
99
workflow_dispatch:

‎.github/workflows/security-scan.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
pull_request:
77
branches: [ main ]
88
schedule:
9-
- cron: '0 2 * * 1' # Weekly on Monday at 2 AM
9+
- cron: 0 2 * * 1 # Weekly on Monday at 2 AM
1010

1111
env:
1212
REGISTRY: docker.io
@@ -40,22 +40,22 @@ jobs:
4040
- name: Run Trivy vulnerability scanner
4141
uses: aquasecurity/trivy-action@master
4242
with:
43-
image-ref: 'azure-agent:scan'
44-
format: 'sarif'
45-
output: 'trivy-results.sarif'
43+
image-ref: azure-agent:scan
44+
format: sarif
45+
output: trivy-results.sarif
4646

4747
- name: Upload Trivy scan results to GitHub Security tab
48-
uses: github/codeql-action/upload-sarif@v2
48+
uses: github/codeql-action/upload-sarif@v4
4949
if: always()
5050
with:
51-
sarif_file: 'trivy-results.sarif'
51+
sarif_file: trivy-results.sarif
5252

5353
- name: Run Trivy vulnerability scanner (table output)
5454
uses: aquasecurity/trivy-action@master
5555
with:
56-
image-ref: 'azure-agent:scan'
57-
format: 'table'
58-
output: 'trivy-results.txt'
56+
image-ref: azure-agent:scan
57+
format: table
58+
output: trivy-results.txt
5959

6060
- name: Generate security summary
6161
if: always()

‎AWS-SSM.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Binaire AWS SSM
22

3-
**aws-ssm** est automatiquement installé depuis le dépôt `hypolas/aws-ssm-light`.
3+
**aws-ssm** est automatiquement installé depuis le dépôt `hypolas/aws-ssm-lite`.
44

55
## Avantages du binaire aws-ssm
66
- ✅ **Léger** : ~10MB vs ~100MB+ pour AWS CLI

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
6161

6262
COPY download-github-binary.sh /tmp/
6363
RUN chmod +x /tmp/download-github-binary.sh && \
64-
/tmp/download-github-binary.sh "hypolas/aws-ssm-light" "aws-ssm"
64+
/tmp/download-github-binary.sh "hypolas/aws-ssm-lite" "aws-ssm"
6565

6666
# Stage 4: Download Docker CLI
6767
FROM ubuntu:22.04 AS docker-downloader

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ services:
9999
build:
100100
context: .
101101
args:
102-
# aws-ssm installed by default (hypolas/aws-ssm-light)
102+
# aws-ssm installed by default (hypolas/aws-ssm-lite)
103103
INSTALL_AWS_SSM: "true"
104104

105105
container_name: azure-devops-agent
@@ -299,7 +299,7 @@ chmod +x deploy-agents.sh
299299
- 🔢 **Multi-instance**: Multiple agent management via AGENT_NUMBER
300300
- 🌐 **Production-ready**: Optimized for cloud environments
301301

302-
### ⚡ Optimized aws-ssm Binary (hypolas/aws-ssm-light)
302+
### ⚡ Optimized aws-ssm Binary (hypolas/aws-ssm-lite)
303303

304304
The image automatically integrates the **aws-ssm binary** to replace AWS CLI:
305305

‎docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services:
55
build:
66
context: .
77
args:
8-
# aws-ssm installed by default (hypolas/aws-ssm-light)
8+
# aws-ssm installed by default (hypolas/aws-ssm-lite)
99
INSTALL_AWS_SSM: "true"
1010

1111
container_name: azure-devops-agent

‎entrypoint.sh‎

Lines changed: 81 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -3,74 +3,74 @@ set -e
33

44
# Function to be called on shutdown
55
cleanup() {
6-
echo "Container stopped. Running cleanup..."
7-
cd "$INSTALL_FOLDER/$AGENT_NUMBER"
8-
./config.sh remove --unattended --auth pat --token "$AZP_TOKEN"
9-
echo "Agent successfully unregistered."
10-
exit 0
6+
echo "Container stopped. Running cleanup..."
7+
cd "$INSTALL_FOLDER/$AGENT_NUMBER"
8+
./config.sh remove --unattended --auth pat --token "$AZP_TOKEN"
9+
echo "Agent successfully unregistered."
10+
exit 0
1111
}
1212

1313
# Trap SIGTERM and call cleanup
1414
trap cleanup SIGTERM
1515

1616
# Add azureagent user to Docker group if /var/run/docker.sock exists
1717
if [ -S /var/run/docker.sock ]; then
18-
DOCKER_SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
19-
echo "Adding azureagent user to GID $DOCKER_SOCK_GID for Docker access..."
20-
sudo groupadd -g "$DOCKER_SOCK_GID" -f dockerhost 2>/dev/null || true
21-
sudo usermod -aG "$DOCKER_SOCK_GID" azureagent 2>/dev/null || true
22-
# sudo groupadd -g "$DOCKER_SOCK_GID" docker|| true
18+
DOCKER_SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
19+
echo "Adding azureagent user to GID $DOCKER_SOCK_GID for Docker access..."
20+
sudo groupadd -g "$DOCKER_SOCK_GID" -f dockerhost 2>/dev/null || true
21+
sudo usermod -aG "$DOCKER_SOCK_GID" azureagent 2>/dev/null || true
22+
# sudo groupadd -g "$DOCKER_SOCK_GID" docker|| true
2323
fi
2424

2525
# Verify required environment variables
2626
if [ -z "$AZP_URL" ]; then
27-
echo "Error: AZP_URL must be defined"
28-
exit 1
27+
echo "Error: AZP_URL must be defined"
28+
exit 1
2929
fi
3030

3131
# Retrieve Azure DevOps token from AWS Secrets Manager if not provided
3232
if [ -z "$AZP_TOKEN" ]; then
33-
if [ -n "$AZURE_DEVOPS_TOKEN_SECRET_ARN" ] && [ -n "$AWS_REGION" ]; then
34-
echo "Retrieving Azure DevOps token from AWS Secrets Manager..."
35-
36-
# Use official aws-ssm (hypolas/aws-ssm-light) first
37-
if command -v aws-ssm >/dev/null 2>&1; then
38-
echo "Using aws-ssm (hypolas/aws-ssm-light)..."
39-
# Syntax: aws-ssm <secret-id> [region]
40-
SECRET_TOKEN=$(aws-ssm "$AZURE_DEVOPS_TOKEN_SECRET_ARN" "$AWS_REGION" 2>/dev/null)
41-
elif command -v light_ssm >/dev/null 2>&1; then
42-
echo "Using light_ssm (fallback)..."
43-
SECRET_TOKEN=$(light_ssm "$AZURE_DEVOPS_TOKEN_SECRET_ARN" "$AWS_REGION" 2>/dev/null)
44-
else
45-
echo "❌ No AWS Secrets Manager client available (aws-ssm or light_ssm)"
46-
echo "Install aws-ssm from hypolas/aws-ssm-light or enable INSTALL_AWS_SSM=true"
47-
exit 1
48-
fi
49-
50-
if [ -n "$SECRET_TOKEN" ] && [ "$SECRET_TOKEN" != "null" ]; then
51-
AZP_TOKEN="$SECRET_TOKEN"
52-
echo "✅ Token retrieved from AWS Secrets Manager"
53-
else
54-
echo "❌ Failed to retrieve token from Secrets Manager"
55-
exit 1
56-
fi
57-
else
58-
echo "❌ AZP_TOKEN not provided and AWS Secrets Manager not configured"
59-
echo "Provide either AZP_TOKEN, or AWS_REGION + AZURE_DEVOPS_TOKEN_SECRET_ARN"
60-
exit 1
61-
fi
33+
if [ -n "$AZURE_DEVOPS_TOKEN_SECRET_ARN" ] && [ -n "$AWS_REGION" ]; then
34+
echo "Retrieving Azure DevOps token from AWS Secrets Manager..."
35+
36+
# Use official aws-ssm (hypolas/aws-ssm-lite) first
37+
if command -v aws-ssm >/dev/null 2>&1; then
38+
echo "Using aws-ssm (hypolas/aws-ssm-lite)..."
39+
# Syntax: aws-ssm <secret-id> [region]
40+
SECRET_TOKEN=$(aws-ssm "${AZURE_DEVOPS_TOKEN_SECRET_ARN}" "${AWS_REGION}" 2>/dev/null)
41+
elif command -v light_ssm >/dev/null 2>&1; then
42+
echo "Using light_ssm (fallback)..."
43+
SECRET_TOKEN=$(light_ssm "${AZURE_DEVOPS_TOKEN_SECRET_ARN}" "${AWS_REGION}" 2>/dev/null)
44+
else
45+
echo "❌ No AWS Secrets Manager client available (aws-ssm or light_ssm)"
46+
echo "Install aws-ssm from hypolas/aws-ssm-lite or enable INSTALL_AWS_SSM=true"
47+
exit 1
48+
fi
49+
50+
if [[ -n ${SECRET_TOKEN} ]] && [[ ${SECRET_TOKEN} != "null" ]]; then
51+
AZP_TOKEN="${SECRET_TOKEN}"
52+
echo "✅ Token retrieved from AWS Secrets Manager"
53+
else
54+
echo "❌ Failed to retrieve token from Secrets Manager"
55+
exit 1
56+
fi
57+
else
58+
echo "❌ AZP_TOKEN not provided and AWS Secrets Manager not configured"
59+
echo "Provide either AZP_TOKEN, or AWS_REGION + AZURE_DEVOPS_TOKEN_SECRET_ARN"
60+
exit 1
61+
fi
6262
else
63-
echo "✅ Azure DevOps token provided directly"
63+
echo "✅ Azure DevOps token provided directly"
6464
fi
6565

66-
if [ -z "$AZP_POOL" ]; then
67-
echo "Error: AZP_POOL must be defined"
68-
exit 1
66+
if [[ -z ${AZP_POOL} ]]; then
67+
echo "Error: AZP_POOL must be defined"
68+
exit 1
6969
fi
7070

71-
if [ -z "$AGENT_NUMBER" ]; then
72-
echo "Error: AGENT_NUMBER must be defined"
73-
exit 1
71+
if [[ -z ${AGENT_NUMBER} ]]; then
72+
echo "Error: AGENT_NUMBER must be defined"
73+
exit 1
7474
fi
7575

7676
# Set default values if necessary
@@ -80,29 +80,29 @@ DEFAULT_VOLUMES=${DEFAULT_VOLUMES:-"/var/run/docker.sock:/var/run/docker.sock,/c
8080

8181
# Retrieve INSTANCE_ID from AWS metadata if not provided
8282
if [ -z "$INSTANCE_ID" ]; then
83-
echo "Retrieving INSTANCE_ID from AWS using IMDSv2..."
84-
85-
# Retrieve IMDSv2 token to secure metadata access
86-
IMDS_TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
87-
-H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
88-
-s 2>/dev/null) || true
89-
90-
if [ -n "$IMDS_TOKEN" ]; then
91-
# Use token to retrieve instance ID
92-
INSTANCE_ID=$(curl -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
93-
-s "http://169.254.169.254/latest/meta-data/instance-id" 2>/dev/null) || true
94-
fi
95-
96-
echo "INSTANCE_ID from IMDSv2: $INSTANCE_ID"
97-
98-
if [ -z "$INSTANCE_ID" ] || [ "$INSTANCE_ID" = "" ]; then
99-
echo "Warning: Unable to retrieve AWS INSTANCE_ID, using hostname"
100-
INSTANCE_ID=$(hostname)
101-
else
102-
echo "INSTANCE_ID retrieved from AWS: $INSTANCE_ID"
103-
fi
83+
echo "Retrieving INSTANCE_ID from AWS using IMDSv2..."
84+
85+
# Retrieve IMDSv2 token to secure metadata access
86+
IMDS_TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
87+
-H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
88+
-s 2>/dev/null) || true
89+
90+
if [ -n "$IMDS_TOKEN" ]; then
91+
# Use token to retrieve instance ID
92+
INSTANCE_ID=$(curl -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
93+
-s "http://169.254.169.254/latest/meta-data/instance-id" 2>/dev/null) || true
94+
fi
95+
96+
echo "INSTANCE_ID from IMDSv2: $INSTANCE_ID"
97+
98+
if [ -z "$INSTANCE_ID" ] || [ "$INSTANCE_ID" = "" ]; then
99+
echo "Warning: Unable to retrieve AWS INSTANCE_ID, using hostname"
100+
INSTANCE_ID=$(hostname)
101+
else
102+
echo "INSTANCE_ID retrieved from AWS: $INSTANCE_ID"
103+
fi
104104
else
105-
echo "INSTANCE_ID provided: $INSTANCE_ID"
105+
echo "INSTANCE_ID provided: $INSTANCE_ID"
106106
fi
107107

108108
echo "=========================================="
@@ -121,21 +121,21 @@ echo "=========================================="
121121
# Configure the agent
122122
echo "Configuring Azure DevOps agent..."
123123
/opt/setup-scripts/configure-agent.sh \
124-
"$INSTALL_FOLDER" \
125-
"$AZP_URL" \
126-
"$AZP_TOKEN" \
127-
"$AZP_POOL" \
128-
"$AZP_AGENT_NAME" \
129-
"$AGENT_NUMBER" \
130-
"$INSTANCE_ID"
124+
"$INSTALL_FOLDER" \
125+
"$AZP_URL" \
126+
"$AZP_TOKEN" \
127+
"$AZP_POOL" \
128+
"$AZP_AGENT_NAME" \
129+
"$AGENT_NUMBER" \
130+
"$INSTANCE_ID"
131131

132132
# Add capabilities
133133
echo "Adding capabilities..."
134134
/opt/setup-scripts/add-capabilities.sh \
135-
"$DEFAULT_CONTAINER_IMAGE" \
136-
"$DEFAULT_VOLUMES" \
137-
"$AGENT_NUMBER" \
138-
"$INSTALL_FOLDER"
135+
"$DEFAULT_CONTAINER_IMAGE" \
136+
"$DEFAULT_VOLUMES" \
137+
"$AGENT_NUMBER" \
138+
"$INSTALL_FOLDER"
139139

140140
echo "Configuration complete. Starting agent..."
141141

‎test-aws-ssm-quick.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ for platform in "${PLATFORMS[@]}"; do
3636
echo 'Recherche de aws-ssm pour: '\$OS'-'\$GITHUB_ARCH
3737
3838
# Récupérer les assets depuis GitHub
39-
ASSETS=\$(curl -s https://api.github.com/repos/hypolas/aws-ssm-light/releases/latest | jq -r '.assets[].browser_download_url')
39+
ASSETS=\$(curl -s https://api.github.com/repos/hypolas/aws-ssm-lite/releases/latest | jq -r '.assets[].browser_download_url')
4040
4141
echo 'Assets disponibles:'
4242
echo \"\$ASSETS\"

‎test-aws-ssm.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22

3-
echo "🧪 Test d'intégration aws-ssm (hypolas/aws-ssm-light)"
3+
echo "🧪 Test d'intégration aws-ssm (hypolas/aws-ssm-lite)"
44
echo "================================================="
55

66
# Test 1: Vérifier si aws-ssm est disponible
@@ -69,7 +69,7 @@ fi
6969
echo
7070
echo "📊 Résumé du test aws-ssm"
7171
echo "========================"
72-
echo "🎯 Binaire officiel: hypolas/aws-ssm-light"
72+
echo "🎯 Binaire officiel: hypolas/aws-ssm-lite"
7373
echo "📦 Taille optimisée: ~10MB vs ~100MB+ (AWS CLI)"
7474
echo "⚡ Performance: ~50ms vs ~1-2s (AWS CLI)"
7575
echo "🔒 Sécurité: Tests automatisés + checksums SHA256"

‎test-platforms.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \\
8888
COPY download-github-binary.sh /tmp/
8989
RUN chmod +x /tmp/download-github-binary.sh
9090
RUN echo "Testing aws-ssm download for $platform..." && \\
91-
if /tmp/download-github-binary.sh "hypolas/aws-ssm-light" "aws-ssm"; then \\
91+
if /tmp/download-github-binary.sh "hypolas/aws-ssm-lite" "aws-ssm"; then \\
9292
echo "✅ aws-ssm disponible pour $platform"; \\
9393
aws-ssm --version 2>/dev/null || echo "Installed but version not available"; \\
9494
else \\

0 commit comments

Comments
 (0)