Skip to content

Commit 7d1c000

Browse files
serkan-ozalserkan-ozal
committed
release layer
1 parent dac2d1a commit 7d1c000

File tree

3 files changed

+162
-43
lines changed

3 files changed

+162
-43
lines changed

‎.github/workflows/build-collector.yml

Lines changed: 87 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -4,65 +4,71 @@ on:
44
workflow_dispatch:
55
inputs:
66
architecture:
7+
description: 'Architecture of the layer to be published'
8+
required: true
79
type: choice
8-
description: Architecture
910
options:
1011
- all
1112
- amd64
1213
- arm64
1314
default: all
14-
aws_region:
15+
aws-region:
16+
description: 'AWS Region(s) where layer will be published'
17+
required: true
1518
type: choice
16-
description: AWS Region
1719
options:
1820
- all
19-
- ap-northeast-1
20-
- ap-northeast-2
21-
- ap-south-1
22-
- ap-southeast-1
23-
- ap-southeast-2
24-
- ca-central-1
25-
- eu-central-1
26-
- eu-north-1
27-
- eu-west-1
28-
- eu-west-2
29-
- eu-west-3
30-
- sa-east-1
31-
- us-east-1
32-
- us-east-2
21+
# - ap-northeast-1
22+
# - ap-northeast-2
23+
# - ap-south-1
24+
# - ap-southeast-1
25+
# - ap-southeast-2
26+
# - ca-central-1
27+
# - eu-central-1
28+
# - eu-north-1
29+
# - eu-west-1
30+
# - eu-west-2
31+
# - eu-west-3
32+
# - sa-east-1
33+
# - us-east-1
34+
# - us-east-2
3335
- us-west-1
3436
- us-west-2
3537
default: all
38+
role-arn:
39+
description: 'AWS IAM Role ARN to be assumed for publishing layer'
40+
required: false
41+
type: string
42+
layer-version:
43+
description: 'Layer version to be appended into the layer name'
44+
required: false
45+
type: string
46+
build-tags:
47+
description: 'Build tags to customize collector build'
48+
required: false
49+
type: string
3650

3751
jobs:
38-
include-jobs:
52+
prepare-build-jobs:
3953
runs-on: ubuntu-latest
4054
outputs:
41-
jobs: ${{ steps.include-jobs.outputs.jobs }}
55+
build_jobs: ${{ steps.prepare-build-jobs.outputs.build_jobs }}
4256
steps:
43-
- id: include-jobs
44-
name: Include jobs
57+
- id: prepare-build-jobs
58+
name: Prepare Build Jobs
4559
run: |
4660
architectures=''
4761
if [ ${{ github.event.inputs.architecture }} == 'all' ]; then
4862
architectures='["amd64", "arm64"]'
4963
else
5064
architectures='["${{ github.event.inputs.architecture }}"]'
5165
fi
52-
aws_regions=''
53-
if [ ${{ github.event.inputs.aws_region }} == 'all' ]; then
54-
aws_regions='["ap-northeast-1", "ap-northeast-2", "ap-south-1", "ap-southeast-1", "ap-southeast-2", "ca-central-1", "eu-central-1", "eu-north-1", "eu-west-1", "eu-west-2", "eu-west-3", "sa-east-1", "us-east-1", "us-east-2", "us-west-1", "us-west-2"]'
55-
else
56-
aws_regions='["${{ github.event.inputs.aws_region }}"]'
57-
fi
58-
echo "jobs={"architecture": ${architectures}, "aws_region": ${aws_regions}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT
59-
build:
60-
needs: include-jobs
66+
echo "build_jobs={"architecture": ${architectures}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT
67+
build-layer:
68+
needs: prepare-build-jobs
6169
runs-on: ubuntu-latest
6270
strategy:
63-
matrix: ${{ fromJSON(needs.include-jobs.outputs.jobs) }}
64-
outputs:
65-
COLLECTOR_VERSION: ${{ steps.save-collector-version.outputs.COLLECTOR_VERSION }}
71+
matrix: ${{ fromJSON(needs.prepare-build-jobs.outputs.build_jobs) }}
6672
steps:
6773
- name: Checkout Repo
6874
uses: actions/checkout@v4
@@ -71,9 +77,55 @@ jobs:
7177
with:
7278
go-version: '~1.21.9'
7379
- name: Build Collector
74-
run: make -C collector package GOARCH=${{ matrix.architecture }}
80+
run: |
81+
if [[ -n "${{ inputs.build-tags }}" ]]; then
82+
BUILDTAGS="${{ inputs.build-tags }}"
83+
if [[ "$BUILDTAGS" != "lambdacomponents.custom"* ]]; then
84+
BUILDTAGS="lambdacomponents.custom,$BUILDTAGS"
85+
fi
86+
fi
87+
echo "Build tags: $BUILDTAGS"
88+
make -C collector package GOARCH=${{ matrix.architecture }} BUILDTAGS=$BUILDTAGS
7589
- name: Upload Collector Artifact
7690
uses: actions/upload-artifact@v4
7791
with:
78-
name: opentelemetry-collector-layer-${{ matrix.architecture }}-${{ matrix.aws_region }}.zip
92+
name: opentelemetry-collector-layer-${{ matrix.architecture }}.zip
7993
path: ${{ github.workspace }}/collector/build/opentelemetry-collector-layer-${{ matrix.architecture }}.zip
94+
prepare-release-jobs:
95+
needs: build-layer
96+
runs-on: ubuntu-latest
97+
outputs:
98+
release_jobs: ${{ steps.prepare-release-jobs.outputs.release_jobs }}
99+
steps:
100+
- id: prepare-release-jobs
101+
name: Prepare Release Jobs
102+
run: |
103+
architectures=''
104+
if [ ${{ github.event.inputs.architecture }} == 'all' ]; then
105+
architectures='["amd64", "arm64"]'
106+
else
107+
architectures='["${{ github.event.inputs.architecture }}"]'
108+
fi
109+
aws_regions=''
110+
if [ ${{ github.event.inputs.aws-region }} == 'all' ]; then
111+
aws_regions='["us-west-1", "us-west-2"]'
112+
else
113+
aws_regions='["${{ github.event.inputs.aws-region }}"]'
114+
fi
115+
echo "release_jobs={"architecture": ${architectures}, "aws_region": ${aws_regions}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT
116+
release-layer:
117+
uses: ./.github/workflows/layer-publish.yml
118+
needs: prepare-release-jobs
119+
strategy:
120+
matrix: ${{ fromJSON(needs.prepare-release-jobs.outputs.release_jobs) }}
121+
with:
122+
artifact-name: opentelemetry-collector-layer-${{ matrix.architecture }}.zip
123+
layer-name: opentelemetry-collector
124+
architecture: ${{ matrix.architecture }}
125+
runtimes: "nodejs16.x nodejs18.x nodejs20.x nodejs22.x java11 java17 java21 python3.8 python3.9 python3.10 python3.11 python3.12"
126+
release-group: prod
127+
aws_region: ${{ matrix.aws_region }}
128+
role-arn: ${{ github.event.inputs.role-arn }}
129+
component-version: 'NA'
130+
layer-version: ${{ github.event.inputs.layer-version }}
131+
secrets: inherit

‎.github/workflows/layer-publish.yml

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,14 @@ on:
3232
description: 'Publish to which AWS region?'
3333
required: true
3434
type: string
35-
35+
role-arn:
36+
description: '(optional) AWS IAM Role ARN to be assumed for publishing layer. If no input is given, defaults to `PROD_LAMBDA_ROLE_ARN` secret.'
37+
required: false
38+
type: string
39+
layer-version:
40+
description: '(optional) Layer version to be used in the layer name. If no input is given, its value is tried to be extracted from the `GITHUB_REF_NAME` variable'
41+
required: false
42+
type: string
3643

3744
permissions:
3845
id-token: write
@@ -58,18 +65,24 @@ jobs:
5865
echo "ARCH=$ARCH" >> $GITHUB_ENV
5966
6067
if [[ -n "${{ inputs.runtimes }}" ]]; then
61-
RUNTIMES="--compatible-runtimes ${{ inputs.runtimes }}"
68+
COMPATIBLE_RUNTIMES="--compatible-runtimes ${{ inputs.runtimes }}"
6269
fi
63-
echo "RUNTIMES=$RUNTIMES" >> $GITHUB_ENV
70+
echo "COMPATIBLE_RUNTIMES=$COMPATIBLE_RUNTIMES" >> $GITHUB_ENV
6471
6572
if [[ "${{ inputs.release-group }}" != "prod" ]]; then
6673
LAYER_NAME=$LAYER_NAME-${{ inputs.release-group }}
6774
fi
6875
69-
LAYER_VERSION=$(echo "$GITHUB_REF_NAME" | sed -r 's/.*\/[^0-9\.]*//g')
70-
LAYER_VERSION_CLEANED=$(echo "$LAYER_VERSION" | sed -r 's/\./_/g')
76+
if [[ -n "${{ inputs.layer-version }}" ]]; then
77+
LAYER_VERSION="${{ inputs.layer-version }}"
78+
else
79+
LAYER_VERSION=$(echo "$GITHUB_REF_NAME" | sed -r 's/.*\/[^0-9\.]*//g')
80+
fi
81+
LAYER_VERSION_CLEANED=$(echo "$LAYER_VERSION" | sed -r 's/\./_/g')
7182
72-
LAYER_NAME=$LAYER_NAME-$LAYER_VERSION_CLEANED
83+
if [[ -n "$LAYER_VERSION_CLEANED" ]]; then
84+
LAYER_NAME=$LAYER_NAME-$LAYER_VERSION_CLEANED
85+
fi
7386
echo "LAYER_NAME=$LAYER_NAME" >> $GITHUB_ENV
7487
7588
echo GITHUB_ENV:
@@ -82,7 +95,7 @@ jobs:
8295

8396
- uses: aws-actions/configure-aws-credentials@v4
8497
with:
85-
role-to-assume: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
98+
role-to-assume: ${{ inputs.role-arn || secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN || secrets.PROD_LAMBDA_ROLE_ARN }}
8699
role-duration-seconds: 1200
87100
aws-region: ${{ inputs.aws_region }}
88101
mask-aws-account-id: false
@@ -93,7 +106,8 @@ jobs:
93106
aws lambda publish-layer-version \
94107
--layer-name $LAYER_NAME \
95108
--license-info "Apache 2.0" \
96-
--compatible-architectures $ARCH $RUNTIMES \
109+
--compatible-architectures $ARCH \
110+
$COMPATIBLE_RUNTIMES \
97111
--zip-file fileb://${{ inputs.artifact-name }} \
98112
--query 'LayerVersionArn' \
99113
--output text

‎utils/aws-cloudformation/aws-cf-stack-for-layer-publish.yml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
Parameters:
2+
GitHubOrgName:
3+
Description: Name of the GitHub organization/user
4+
Type: String
5+
RepositoryName:
6+
Description: Name of the GitHub repository
7+
Type: String
8+
Default: "opentelemetry-lambda"
9+
10+
Resources:
11+
Role:
12+
Type: AWS::IAM::Role
13+
Properties:
14+
RoleName: "github-otel-lambda-layer-publish-role"
15+
AssumeRolePolicyDocument:
16+
Statement:
17+
- Effect: Allow
18+
Action: sts:AssumeRoleWithWebIdentity
19+
Principal:
20+
Federated: !Ref GithubOIDC
21+
Condition:
22+
StringEquals:
23+
token.actions.githubusercontent.com:aud: "sts.amazonaws.com"
24+
StringLike:
25+
token.actions.githubusercontent.com:sub: !Sub "repo:${GitHubOrgName}/${RepositoryName}:*"
26+
Policies:
27+
- PolicyName: "github-otel-lambda-layer-publish-policy"
28+
PolicyDocument:
29+
Version: "2012-10-17"
30+
Statement:
31+
- Effect: Allow
32+
Action:
33+
- "lambda:GetLayer*"
34+
- "lambda:ListLayer*"
35+
- "lambda:AddLayer*"
36+
- "lambda:PublishLayer*"
37+
Resource:
38+
- !Sub "arn:aws:lambda:*:${AWS::AccountId}:layer:opentelemetry-*"
39+
- !Sub "arn:aws:lambda:*:${AWS::AccountId}:layer:opentelemetry-*:*"
40+
41+
GithubOIDC:
42+
Type: AWS::IAM::OIDCProvider
43+
Properties:
44+
Url: "https://token.actions.githubusercontent.com"
45+
ClientIdList:
46+
- "sts.amazonaws.com"
47+
ThumbprintList:
48+
- "ffffffffffffffffffffffffffffffffffffffff"
49+
50+
Outputs:
51+
RoleARN:
52+
Description: "ARN of the AWS IAM role to be assumed by Github for the OpenTelemetry Layer publishing"
53+
Value: !GetAtt Role.Arn

0 commit comments

Comments
 (0)