gsa / jenkins-deploy Goto Github PK

You mentioned Blue Ocean...anything else?

https://github.com/GSA/jenkins-deploy/blob/master/ansible/group_vars/all/defaults.yml

• https://www.cloudbees.com/continuous-delivery/jenkins-docker
• https://docs.google.com/document/d/1vVxbdER2U8mhfkAFVD7d2AsLs6GU36Huql2ipA5DmCs/edit#heading=h.48ezuvkiyna6

• https://github.com/cfpb/jenkins-as-code-starter-project
• https://github.com/Praqma/jenkins.praqma.com
• https://github.com/GSA/datagov-infrastructure/tree/master/jenkins
• https://github.com/OpenSCAP/jenkins

• https://thepracticalsysadmin.com/backing-up-jenkins-configurations-to-s3/
• https://plugins.jenkins.io/scm-sync-configuration
• https://plugins.jenkins.io/periodicbackup

...or at least consider them.

https://www.sans.org/reading-room/whitepapers/bestprac/securing-jenkins-ci-systems-36872

/cc #3

The implementation details here may depend on if/how Docker is used.

• https://docs.google.com/document/d/1vVxbdER2U8mhfkAFVD7d2AsLs6GU36Huql2ipA5DmCs/edit#heading=h.vj9v6d1e2zus
• https://wiki.jenkins-ci.org/display/JENKINS/Distributed+builds

See ansible-role-jenkins issue #170

• https://wiki.jenkins.io/display/JENKINS/Mailer
• https://plugins.jenkins.io/email-ext
• https://github.com/jenkinsci/slack-plugin

Lots here for general reuse, regardless of what's behind the nginx proxy. Credit to @JJediny for inspiring the idea. Existing examples:

• https://github.com/lejmr/nginx_proxy
• https://github.com/pludoni/ansible-nginx_app_proxy

This should be relatively easy, as most of the heavy lifting is done by the included roles.

Some commands will need conditionals to check before trying to execute, or ansible gets mad and fails. For instance, trying to add another Docker group will fail when doing an update of the deployment.

There is probably one out there already we can steal. Maybe data.gov?

• https://github.com/GSA/datagov-infrastructure/tree/master/terraform
• https://github.com/GSA/datagov-infrastructure/tree/master/terraform/modules
• https://github.com/GSA/datagov-infrastructure/tree/master/terraform/modules/asg
• https://sgotti.me/post/terraform-immutable-infrastructure-stateful-rolling-upgrades/

• Turn the Terraform code into one (or more?) modules
• Turn the Ansible code into a Galaxy role
• Break out the example implementation (the Ansible playbook, a sample Jenkins job, etc) - that shows how to use the module+role - to a separate folder/repository

data.gov (and probably others) need terraform and terragrunt installed on jenkins instance for pipelines.

https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+Best+Practices

We likely want to split this up to discrete tasks/issues.

The instance module should support the use of tags.

The include_tasks module is new in ansible v2.4 and not supported in earlier versions.

Started sketching it out here:

https://docs.google.com/drawings/d/1GsDIRJmT7oizqLbQfrsb_yJ-StaxKlkZW4P2B1cvE14/edit

...after some acceptable retention period.

https://support.cloudbees.com/hc/en-us/articles/215549798-Deleting-Old-Builds-Best-Strategy-for-Cleanup-and-disk-space-management

Instance module should support changing public_dns and private_dns from parameters. These should be cleverly stitched together based on input for the hostname and the declared private DNS zone in the variables calling the module.

• https://plugins.jenkins.io/github-oauth
• https://wiki.jenkins-ci.org/display/JENKINS/Matrix-based+security
• https://plugins.jenkins.io/role-strategy

Likely makes sense to address authorization as a separate issue.

From @maverickquant:

Other General Nginx Security concerns and recommendations:

• Disable Unwanted HTTP Methods in Nginx

  if ($request_method !~ ^(GET|HEAD|POST)$) {
    return 444;
  }
  

• Disable weak cipher suites-Enable Strong TLS Ciphers

  Set your cipher strength to something secure, yet compatible. Add following under server block in ssl.conf file:

  ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SH
  

  Not sure if there is a GSA standard for this ciphers-.Will confirm and let you know.

• Avoid self-signed certs especially in prod.

• Remove Unnecessary Modules in Nginx -if any

• Setup Monitor Logs for Nginx

• proxy_ssl_verify: on :: ensure on:: Verifies the validity of certificates.

• Restrict Access by IP from Nginx.

• Limit Input Traffic via IPTables.

• Disable server_tokens Directive in Nginx. The server_tokens directive tells Nginx to display its current version on error pages.

Crossed off items that I don't believe are applicable.

• https://wiki.jenkins-ci.org/display/JENKINS/Securing+Jenkins
• https://jenkins.io/doc/book/operating/security/

We likely want to split this up to discrete tasks/issues.

• https://marcesher.com/2016/06/08/jenkins-as-code-creating-jenkins-jobs-with-text-not-clicks/
• https://marcesher.com/2016/08/04/jenkins-as-code-comparing-job-dsl-and-pipelines/
• https://www.youtube.com/watch?v=cXqG9AgxqRc&feature=youtu.be
• https://github.com/jenkinsci/job-dsl-plugin

We are probably going to want to do the bootstrapping of the Job DSL Plugin in this repository, and give an easy way for users to provide their job configuration files on top.