Browse the Repo

file-type-icondata-stores
file-type-iconlambda
file-type-iconmgmt
file-type-iconcloudwatch-dashboard
file-type-iconjenkins
file-type-iconmigration_guides
file-type-iconpacker
file-type-iconuser-data
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconopenvpn-server
file-type-iconnetworking
file-type-iconsecurity
file-type-iconservice-templates
file-type-iconservices
file-type-icontls-scripts
file-type-icon.gitignore
file-type-iconCODEOWNERS
file-type-iconREADME.md

Browse the Repo

file-type-icondata-stores
file-type-iconlambda
file-type-iconmgmt
file-type-iconcloudwatch-dashboard
file-type-iconjenkins
file-type-iconmigration_guides
file-type-iconpacker
file-type-iconuser-data
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconopenvpn-server
file-type-iconnetworking
file-type-iconsecurity
file-type-iconservice-templates
file-type-iconservices
file-type-icontls-scripts
file-type-icon.gitignore
file-type-iconCODEOWNERS
file-type-iconREADME.md
Sample Infrastructure Modules

Sample Infrastructure Modules

Sample infrastructure-modules repo (multi-account setup) for fictional company Acme.

Code Preview

Preview the Code

mobile file icon

README.md

down

Jenkins

This Terraform Module can be used to deploy Jenkins, an open source build automation server.

The resources that are created by this module include:

If you don't have access to any of the Gruntwork modules, email support@gruntwork.io.

How do you use this module?

To use this module, you need to:

  1. Build the AMI
  2. Use the module in your Terraform code

Build the AMI

The Jenkins server should run the AMI built using the Packer template in packer/jenkins-ubuntu.json.

To build the AMI from the Packer template:

  1. Install Packer.
  2. Set your AWS credentials as the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
  3. Set your GitHub access token as the environment variable GITHUB_OAUTH_TOKEN. Your GitHub account must have access to the Gruntwork GitHub repos mentioned in packer/jenkins-ubuntu.json; if you don't have access to those, email support@gruntwork.io.
  4. Run packer build jenkins-ubuntu.json.
  5. When the build completes, it'll output the id of the new AMI.

Use the module in your Terraform code

  • See the root README for instructions on using Terraform modules.
  • See variables.tf for all the variables you can set on this module.

How is Jenkins configured?

The JENKINS_HOME directory

These templates mount the JENKINS_HOME directory on a separate, persistent EBS volume at path /jenkins. Unlike a root volume on an EC2 Instance, this EBS volume will persist between redeploys so you don't lose all your data each time you push out new code.

Upgrades

If you want to upgrade the Jenkins version, your best option is to update the jenkins_version variable in this Packer template. If you use the Jenkins UI to do upgrades, you will lose that upgrade the next time you deploy a new AMI. A Jenkins upgrade installs a new war file for Jenkins onto the root volume. The JENKINS_HOME directory should remain unchanged and continue working with the new version.

Plugins

When you first install Jenkins, it walks you through a Setup Wizard. As part of that process, we recommend using the standard set of plugins recommended by the Setup Wizard. On top of that, we also typically install two other useful plugins using the plugins UI:

  1. Parameterized Trigger Plugin. This allows us to run one build and then use the output of that build to fill in the parameters and trigger a parameterized build.
  2. SSH Agent Plugin. This allows us to load SSH credentials into SSH Agent so that anything in your build that depends on SSH authentication (e.g. Terraform modules pulled down via SSH auth) will "just work".

ALB

We have deployed Jenkins with an Application Load Balancer in front of it for a few reasons:

  1. It provides SSL termination.
  2. It can use SSL certificates from the AWS Certificate Manager. These certificates are free and auto-renew, which makes maintenance much easier.
  3. It allows us to run Jenkins itself in a private subnet. Given all the different types of code a developer is likely to run on Jenkins, it will be hard to lock it down fully, so running it in a private subnet offers a little more protection from dumb mistakes (e.g. opening up a port).

IAM permissions

In order for Jenkins to be able to do automatic deployment by running Terraform, we have given it IAM permissions to access a large number of AWS APIs. This means Jenkins is a highly trusted actor and we need to be extra careful in how we manage and secure it.

Core concepts

For more info on what is Jenkins, how to configure it, and how to use it to set up continuous integration and continuous delivery, see the Jenkins documentation. For info on finding the Jenkins logs in CloudWatch, check out the cloudwatch-log-aggregation-scripts documentation. For info on viewing the custom metrics in CloudWatch, check out the cloudwatch-memory-disk-metrics-scripts documentation.

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?