Skip to content

Commit 31b4d43

Browse files
jusiskinjusiskin
authored
Merge pull request #344 from aws/bump/0.27.0
chore(release): 0.27.0
2 parents f96be91 + e9d4fcd commit 31b4d43

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+3627
-2047
lines changed

‎.github/workflows/ci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
steps:
2424
- uses: actions/checkout@v2
2525
- name: Use Node.js ${{ matrix.node-version }}
26-
uses: actions/[email protected].4
26+
uses: actions/[email protected].5
2727
with:
2828
node-version: ${{ matrix.node-version }}
2929
- run: yarn global add typescript

‎CHANGELOG.md

+32
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,38 @@
22

33
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
44

5+
## [0.27.0](https://github.com/aws/aws-rfdk/compare/v0.26.0...v0.27.0) (2021-03-12)
6+
7+
8+
### Supported CDK Version
9+
10+
* [1.91.0](https://github.com/aws/aws-cdk/releases/tag/v1.91.0)
11+
12+
13+
### Officially Supported Deadline Versions
14+
15+
* [10.1.9.2 to 10.1.14.4](https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/release-notes.html)
16+
17+
18+
### Security Notice
19+
20+
RFDK version 0.27.x and later include security enhancements. We recommend you upgrade RFDK and Deadline to further restrict the permissions required for RFDK & Deadline to function. Please upgrade the version of RFDK used in your CDK application to 0.27.x, and configure your application to deploy Deadline 10.1.14.x or later to resolve the issue.
21+
22+
If you have an existing deployment that was built with RFDK versions 0.26.x or earlier, you will need to upgrade to RFDK 0.27.x and Deadline 10.1.14.x or later before June 10, 2021 @ 1:00PM PST/ 3:00PM CST/ 4:00PM EST. Failure to upgrade by the above date may result in disruptions to your render farm. If you have any questions, please contact AWS Thinkbox Customer Support at https://support.thinkboxsoftware.com/.
23+
24+
### ⚠ BREAKING CHANGES
25+
26+
- If your application provides an EFS file-system to a Repository construct, it must now also pass an
27+
[EFS Access Point](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html). See the [RFDK 0.27.x upgrade documentation](https://github.com/aws/aws-rfdk/blob/v0.27.0/packages/aws-rfdk/docs/upgrade/upgrading-0.27.md)
28+
for details.
29+
30+
### Features
31+
32+
* **core:** make cloudwatch agent install optional ([#338](https://github.com/aws/aws-rfdk/issues/338)) ([ac052ea](https://github.com/aws/aws-rfdk/commit/ac052ea67ab90e8c6ac18af71a950b20c68a24f1))
33+
* **core:** add ability to use EFS access points ([#339](https://github.com/aws/aws-rfdk/issues/339)) ([544496c](https://github.com/aws/aws-rfdk/commit/544496cb67b3880fc187716a33ebeca595c108d7))
34+
* **deadline:** add ability to use EFS access points ([#339](https://github.com/aws/aws-rfdk/issues/339)) ([544496c](https://github.com/aws/aws-rfdk/commit/544496cb67b3880fc187716a33ebeca595c108d7))
35+
36+
537
## [0.26.0](https://github.com/aws/aws-rfdk/compare/v0.25.0...v0.26.0) (2021-03-01)
638

739

‎THIRD-PARTY

+617-2
Large diffs are not rendered by default.

‎examples/deadline/All-In-AWS-Infrastructure-Basic/python/package/app.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ def main():
101101
# ------------------------------
102102
service_props = service_tier.ServiceTierProps(
103103
database=storage.database,
104-
file_system=storage.file_system,
104+
mountable_file_system=storage.mountable_file_system,
105105
vpc=network.vpc,
106106
ubl_certs_secret_arn=config.ubl_certificate_secret_arn,
107107
ubl_licenses=config.ubl_licenses,

‎examples/deadline/All-In-AWS-Infrastructure-Basic/python/package/config.py

+4-4
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ def __init__(self):
3232
# to pin to. Some examples of pinned version values are "10", "10.1", or "10.1.12"
3333
self.deadline_version: Optional[str] = None
3434

35-
# A map of regions to Deadline Client Linux AMIs. As an example, the Linux Deadline 10.1.12.1 AMI ID
36-
# from us-west-2 is filled in. It can be used as-is, added to, or replaced. Ideally the version here
37-
# should match the one used for staging the render queue and usage based licensing recipes.
38-
self.deadline_client_linux_ami_map: Mapping[str, str] = {'us-west-2': 'ami-039f0c1faba28b015'}
35+
# A map of regions to Deadline Client Linux AMIs. As an example, the Linux Deadline 10.1.13.2 AMI ID
36+
# from us-west-2 is filled in. It can be used as-is, added to, or replaced. Ideally the version here should match the version of
37+
# Deadline used in any connected Deadline constructs.
38+
self.deadline_client_linux_ami_map: Mapping[str, str] = {'us-west-2': 'ami-0237f13ce87af168e'}
3939

4040
# A secret (in binary form) in SecretsManager that stores the UBL certificates in a .zip file.
4141
self.ubl_certificate_secret_arn: str =\

‎examples/deadline/All-In-AWS-Infrastructure-Basic/python/package/lib/service_tier.py

+8-7
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030

3131
from aws_rfdk import (
3232
DistinguishedName,
33-
IMountableLinuxFilesystem,
33+
MountableEfs,
3434
SessionManagerHelper,
3535
X509CertificatePem
3636
)
@@ -58,8 +58,8 @@ class ServiceTierProps(StackProps):
5858
vpc: IVpc
5959
# The database to connect to.
6060
database: DatabaseConnection
61-
# The file system to install Deadline Repository to.
62-
file_system: IMountableLinuxFilesystem
61+
# The file-system to install Deadline Repository to.
62+
mountable_file_system: MountableEfs
6363
# The ARN of the secret containing the UBL certificates .zip file (in binary form).
6464
ubl_certs_secret_arn: typing.Optional[str]
6565
# The UBL licenses to configure
@@ -109,9 +109,9 @@ def __init__(self, scope: Construct, stack_id: str, *, props: ServiceTierProps,
109109
]
110110
)
111111

112-
# Granting the bastion access to the file system mount for convenience.
113-
# This can also safely be removed.
114-
props.file_system.mount_to_linux_instance(
112+
# Mounting the root of the EFS file-system to the bastion access for convenience.
113+
# This can safely be removed.
114+
MountableEfs(self, filesystem=props.mountable_file_system.file_system).mount_to_linux_instance(
115115
self.bastion.instance,
116116
location='/mnt/efs'
117117
)
@@ -127,8 +127,9 @@ def __init__(self, scope: Construct, stack_id: str, *, props: ServiceTierProps,
127127
'Repository',
128128
vpc=props.vpc,
129129
database=props.database,
130-
file_system=props.file_system,
130+
file_system=props.mountable_file_system,
131131
repository_installation_timeout=Duration.minutes(20),
132+
repository_installation_prefix='/',
132133
version=self.version
133134
)
134135

‎examples/deadline/All-In-AWS-Infrastructure-Basic/python/package/lib/storage_tier.py

+47-10
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,10 @@
2525
SubnetType
2626
)
2727
from aws_cdk.aws_efs import (
28+
AccessPoint,
29+
Acl,
2830
FileSystem,
31+
PosixUser
2932
)
3033
from aws_cdk.aws_route53 import (
3134
IPrivateHostedZone
@@ -75,20 +78,54 @@ def __init__(self, scope: Construct, stack_id: str, *, props: StorageTierProps,
7578
:param kwargs: Any kwargs that need to be passed on to the parent class.
7679
"""
7780
super().__init__(scope, stack_id, **kwargs)
78-
# The file system to use (e.g. to install Deadline Repository onto).
79-
self.file_system = MountableEfs(
81+
82+
# The file-system to use (e.g. to install Deadline Repository onto).
83+
file_system = FileSystem(
84+
self,
85+
'EfsFileSystem',
86+
vpc=props.vpc,
87+
encrypted=True,
88+
# TODO - Evaluate this removal policy for your own needs. This is set to DESTROY to
89+
# cleanly remove everything when this stack is destroyed. If you would like to ensure
90+
# that your data is not accidentally deleted, you should modify this value.
91+
removal_policy=RemovalPolicy.DESTROY
92+
)
93+
94+
# Create an EFS access point that is used to grant the Repository and RenderQueue with write access to the
95+
# Deadline Repository directory in the EFS file-system.
96+
access_point = AccessPoint(
8097
self,
81-
filesystem=FileSystem(
82-
self,
83-
'EfsFileSystem',
84-
vpc=props.vpc,
85-
# TODO - Evaluate this removal policy for your own needs. This is set to DESTROY to
86-
# cleanly remove everything when this stack is destroyed. If you would like to ensure
87-
# that your data is not accidentally deleted, you should modify this value.
88-
removal_policy=RemovalPolicy.DESTROY
98+
'AccessPoint',
99+
file_system=file_system,
100+
101+
# The AccessPoint will create the directory (denoted by the path property below) if it doesn't exist with
102+
# the owning UID/GID set as specified here. These should be set up to grant read and write access to the
103+
# UID/GID configured in the "poxis_user" property below.
104+
create_acl=Acl(
105+
owner_uid='10000',
106+
owner_gid='10000',
107+
permissions='750',
108+
),
109+
110+
# When you mount the EFS via the access point, the mount will be rooted at this path in the EFS file-system
111+
path='/DeadlineRepository',
112+
113+
# TODO - When you mount the EFS via the access point, all file-system operations will be performed using
114+
# these UID/GID values instead of those from the user on the system where the EFS is mounted. If you intend
115+
# to use the same EFS file-system for other purposes (e.g. render assets, plug-in storage), you may want to
116+
# evaluate the UID/GID permissions based on your requirements.
117+
posix_user=PosixUser(
118+
uid='10000',
119+
gid='10000'
89120
)
90121
)
91122

123+
self.mountable_file_system = MountableEfs(
124+
self,
125+
filesystem=file_system,
126+
access_point=access_point
127+
)
128+
92129
# The database to connect Deadline to.
93130
self.database: Optional[DatabaseConnection] = None
94131

‎examples/deadline/All-In-AWS-Infrastructure-Basic/python/setup.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
install_requires=[
2020
"aws-cdk.core==1.91.0",
21-
"aws-rfdk==0.26.0"
21+
"aws-rfdk==0.27.0"
2222
],
2323

2424
python_requires=">=3.7",

‎examples/deadline/All-In-AWS-Infrastructure-Basic/ts/bin/app.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ if (config.deployMongoDB) {
9898
const service = new ServiceTier(app, 'ServiceTier', {
9999
env,
100100
database: storage.database,
101-
fileSystem: storage.fileSystem,
101+
mountableFileSystem: storage.mountableFileSystem,
102102
vpc: network.vpc,
103103
deadlineVersion: config.deadlineVersion,
104104
ublCertsSecretArn: config.ublCertificatesSecretArn,

‎examples/deadline/All-In-AWS-Infrastructure-Basic/ts/bin/config.ts

+4-4
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ class AppConfig {
3131
public readonly deadlineVersion?: string;
3232

3333
/**
34-
* A map of regions to Deadline Client Linux AMIs. As an example, the Linux Deadline 10.1.12.1 AMI ID from us-west-2
35-
* is filled in. It can be used as-is, added to, or replaced. Ideally the version here should match the one in
36-
* package.json used for staging the render queue and usage based licensing recipes.
34+
* A map of regions to Deadline Client Linux AMIs. As an example, the Linux Deadline 10.1.13.2 AMI ID from us-west-2
35+
* is filled in. It can be used as-is, added to, or replaced. Ideally the version here should match the version of
36+
* Deadline used in any connected Deadline constructs.
3737
*/
38-
public readonly deadlineClientLinuxAmiMap: Record<string, string> = {['us-west-2']: 'ami-039f0c1faba28b015'};
38+
public readonly deadlineClientLinuxAmiMap: Record<string, string> = {['us-west-2']: 'ami-0237f13ce87af168e'};
3939

4040
/**
4141
* (Optional) A secret (in binary form) in SecretsManager that stores the UBL certificates in a .zip file.

‎examples/deadline/All-In-AWS-Infrastructure-Basic/ts/lib/service-tier.ts

+13-9
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import {
1717
} from '@aws-cdk/aws-route53';
1818
import * as cdk from '@aws-cdk/core';
1919
import {
20-
IMountableLinuxFilesystem,
20+
MountableEfs,
2121
X509CertificatePem,
2222
} from 'aws-rfdk';
2323
import {
@@ -33,7 +33,6 @@ import {
3333
import {
3434
Secret,
3535
} from '@aws-cdk/aws-secretsmanager';
36-
import { Duration } from '@aws-cdk/core';
3736
import { SessionManagerHelper } from 'aws-rfdk/lib/core';
3837

3938
/**
@@ -51,9 +50,9 @@ export interface ServiceTierProps extends cdk.StackProps {
5150
readonly database: DatabaseConnection;
5251

5352
/**
54-
* The file system to install Deadline Repository to.
53+
* The file-system to install Deadline Repository to.
5554
*/
56-
readonly fileSystem: IMountableLinuxFilesystem;
55+
readonly mountableFileSystem: MountableEfs;
5756

5857
/**
5958
* Our self-signed root CA certificate for the internal endpoints in the farm.
@@ -136,11 +135,15 @@ export class ServiceTier extends cdk.Stack {
136135
volume: BlockDeviceVolume.ebs(50, {
137136
encrypted: true,
138137
})},
139-
]
138+
],
140139
});
141-
// Granting the bastion access to the file system mount for convenience
140+
props.database.allowConnectionsFrom(this.bastion);
141+
142+
// Granting the bastion access to the entire EFS file-system.
142143
// This can also be safely removed
143-
props.fileSystem.mountToLinuxInstance(this.bastion.instance, {
144+
new MountableEfs(this, {
145+
filesystem: props.mountableFileSystem.fileSystem,
146+
}).mountToLinuxInstance(this.bastion.instance, {
144147
location: '/mnt/efs',
145148
});
146149

@@ -152,8 +155,9 @@ export class ServiceTier extends cdk.Stack {
152155
vpc: props.vpc,
153156
version: this.version,
154157
database: props.database,
155-
fileSystem: props.fileSystem,
156-
repositoryInstallationTimeout: Duration.minutes(20),
158+
fileSystem: props.mountableFileSystem,
159+
repositoryInstallationTimeout: cdk.Duration.minutes(20),
160+
repositoryInstallationPrefix: "/",
157161
});
158162

159163
const images = new ThinkboxDockerImages(this, 'Images', {

‎examples/deadline/All-In-AWS-Infrastructure-Basic/ts/lib/storage-tier.ts

+45-13
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,13 @@ import {
1010
} from '@aws-cdk/aws-ec2';
1111
import * as cdk from '@aws-cdk/core';
1212
import { DatabaseCluster } from '@aws-cdk/aws-docdb';
13-
import { FileSystem } from '@aws-cdk/aws-efs';
13+
import {
14+
AccessPoint,
15+
FileSystem,
16+
} from '@aws-cdk/aws-efs';
1417
import { IPrivateHostedZone } from '@aws-cdk/aws-route53';
1518
import { RemovalPolicy, Duration } from '@aws-cdk/core';
1619
import {
17-
IMountableLinuxFilesystem,
1820
MongoDbInstance,
1921
MongoDbPostInstallSetup,
2022
MongoDbSsplLicenseAcceptance,
@@ -45,9 +47,9 @@ export interface StorageTierProps extends cdk.StackProps {
4547
*/
4648
export abstract class StorageTier extends cdk.Stack {
4749
/**
48-
* The file system to use (e.g. to install Deadline Repository onto).
50+
* The mountable file-system to use for the Deadline Repository
4951
*/
50-
public readonly fileSystem: IMountableLinuxFilesystem;
52+
public readonly mountableFileSystem: MountableEfs;
5153

5254
/**
5355
* The database to connect Deadline to.
@@ -63,15 +65,45 @@ export abstract class StorageTier extends cdk.Stack {
6365
constructor(scope: cdk.Construct, id: string, props: StorageTierProps) {
6466
super(scope, id, props);
6567

66-
this.fileSystem = new MountableEfs(this, {
67-
filesystem: new FileSystem(this, 'EfsFileSystem', {
68-
vpc: props.vpc,
69-
encrypted: true,
70-
// TODO - Evaluate this removal policy for your own needs. This is set to DESTROY to
71-
// cleanly remove everything when this stack is destroyed. If you would like to ensure
72-
// that your data is not accidentally deleted, you should modify this value.
73-
removalPolicy: RemovalPolicy.DESTROY,
74-
}),
68+
const fileSystem = new FileSystem(this, 'EfsFileSystem', {
69+
vpc: props.vpc,
70+
encrypted: true,
71+
// TODO - Evaluate this removal policy for your own needs. This is set to DESTROY to
72+
// cleanly remove everything when this stack is destroyed. If you would like to ensure
73+
// that your data is not accidentally deleted, you should modify this value.
74+
removalPolicy: RemovalPolicy.DESTROY,
75+
});
76+
77+
// Create an EFS access point that is used to grant the Repository and RenderQueue with write access to the Deadline
78+
// Repository directory in the EFS file-system.
79+
const accessPoint = new AccessPoint(this, 'AccessPoint', {
80+
fileSystem,
81+
82+
// The AccessPoint will create the directory (denoted by the "path" property below) if it doesn't exist with the
83+
// owning UID/GID set as specified here. These should be set up to grant read and write access to the UID/GID
84+
// configured in the "poxisUser" property below.
85+
createAcl: {
86+
ownerGid: '10000',
87+
ownerUid: '10000',
88+
permissions: '750',
89+
},
90+
91+
// When you mount the EFS via the access point, the mount will be rooted at this path in the EFS file-system
92+
path: '/DeadlineRepository',
93+
94+
// TODO - When you mount the EFS via the access point, all file-system operations will be performed using these
95+
// UID/GID values instead of those from the user on the system where the EFS is mounted. If you intend to use the
96+
// same EFS file-system for other purposes (e.g. render assets, plug-in storage), you may want to evaluate the
97+
// UID/GID permissions based on your requirements.
98+
posixUser: {
99+
uid: '10000',
100+
gid: '10000',
101+
},
102+
});
103+
104+
this.mountableFileSystem = new MountableEfs(this, {
105+
filesystem: fileSystem,
106+
accessPoint,
75107
});
76108
}
77109
}

‎examples/deadline/All-In-AWS-Infrastructure-Basic/ts/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "all-in-farm-basic",
3-
"version": "0.26.0",
3+
"version": "0.27.0",
44
"bin": {
55
"app": "bin/app.js"
66
},
@@ -21,7 +21,7 @@
2121
},
2222
"dependencies": {
2323
"@aws-cdk/core": "1.91.0",
24-
"aws-rfdk": "0.26.0",
24+
"aws-rfdk": "0.27.0",
2525
"source-map-support": "^0.5.19"
2626
}
2727
}

‎examples/deadline/All-In-AWS-Infrastructure-SEP/python/setup.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
install_requires=[
2020
"aws-cdk.core==1.91.0",
21-
"aws-rfdk==0.26.0"
21+
"aws-rfdk==0.27.0"
2222
],
2323

2424
python_requires=">=3.7",

0 commit comments

Comments
 (0)