( )⚙ D7113 automation: schedule an EC2Launch run on next boot

This is an archive of the discontinued Mercurial Phabricator instance.

Differential D7113

automation: schedule an EC2Launch run on next boot
ClosedPublic

Authored by indygreg on Oct 16 2019, 12:17 AM.

Details

Reviewers
pulkit
Group Reviewers
hg-reviewers
Commits
rHGc09e8ac3f61f: automation: schedule an EC2Launch run on next boot
rHG20402153ce11: automation: schedule an EC2Launch run on next boot
rHGae3491aad62a: automation: schedule an EC2Launch run on next boot
Summary

Without this, launching EC2 instances constructed from the AMI
won't go through the normal EC2 instance launch machinery. This
missing machinery does important things like set up network
routes to use the instance metadata service and process any
UserData.

Since EC2Launch now runs on subsequent boots and UserData is
processed, we needed to make setting of UserData conditional
on bootstrapping mode.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

indygreg created this revision.Oct 16 2019, 12:17 AM
pulkit accepted this revision.Oct 16 2019, 9:45 AM
This revision is now accepted and ready to land.Oct 16 2019, 9:45 AM
indygreg added a commit: rHGae3491aad62a: automation: schedule an EC2Launch run on next boot.Oct 16 2019, 10:21 AM
Closed by commit rHGae3491aad62a: automation: schedule an EC2Launch run on next boot (authored by indygreg). · Explain Why
This revision was automatically updated to reflect the committed changes.
martinvonz added a subscriber: martinvonz.Oct 16 2019, 12:11 PM
martinvonz added inline comments.
contrib/automation/hgautomation/aws.py
1128

black wants this line to be wrapped. I'll fix that in flight.

pulkit added inline comments.Oct 16 2019, 12:32 PM
contrib/automation/hgautomation/aws.py
1128

I should install black, I was waiting for Augie's fix to land to prevent doing some extra work.

Revision Contents
Changeset List

Diff 17202

contrib/automation/hgautomation/aws.py

if ids: if ids:
print('terminating instances: %s' % ' '.join(ids)) print('terminating instances: %s' % ' '.join(ids))
for instance in res: for instance in res:
instance.terminate() instance.terminate()
print('terminated %d instances' % len(ids)) print('terminated %d instances' % len(ids))
@contextlib.contextmanager @contextlib.contextmanager
def create_temp_windows_ec2_instances(c: AWSConnection, config): def create_temp_windows_ec2_instances(
c: AWSConnection, config, bootstrap: bool = False
):
"""Create temporary Windows EC2 instances. """Create temporary Windows EC2 instances.
This is a higher-level wrapper around ``create_temp_ec2_instances()`` that This is a higher-level wrapper around ``create_temp_ec2_instances()`` that
configures the Windows instance for Windows Remote Management. The emitted configures the Windows instance for Windows Remote Management. The emitted
instances will have a ``winrm_client`` attribute containing a instances will have a ``winrm_client`` attribute containing a
``pypsrp.client.Client`` instance bound to the instance. ``pypsrp.client.Client`` instance bound to the instance.
""" """
if 'IamInstanceProfile' in config: if 'IamInstanceProfile' in config:
raise ValueError('IamInstanceProfile cannot be provided in config') raise ValueError('IamInstanceProfile cannot be provided in config')
if 'UserData' in config: if 'UserData' in config:
raise ValueError('UserData cannot be provided in config') raise ValueError('UserData cannot be provided in config')
password = c.automation.default_password() password = c.automation.default_password()
config = copy.deepcopy(config) config = copy.deepcopy(config)
config['IamInstanceProfile'] = { config['IamInstanceProfile'] = {
'Name': 'hg-ephemeral-ec2-1', 'Name': 'hg-ephemeral-ec2-1',
} }
config.setdefault('TagSpecifications', []).append( config.setdefault('TagSpecifications', []).append(
{ {
'ResourceType': 'instance', 'ResourceType': 'instance',
'Tags': [{'Key': 'Name', 'Value': 'hg-temp-windows'}], 'Tags': [{'Key': 'Name', 'Value': 'hg-temp-windows'}],
} }
) )
if bootstrap:
config['UserData'] = WINDOWS_USER_DATA % password config['UserData'] = WINDOWS_USER_DATA % password
with temporary_ec2_instances(c.ec2resource, config) as instances: with temporary_ec2_instances(c.ec2resource, config) as instances:
wait_for_ip_addresses(instances) wait_for_ip_addresses(instances)
print('waiting for Windows Remote Management service...') print('waiting for Windows Remote Management service...')
for instance in instances: for instance in instances:
client = wait_for_winrm( client = wait_for_winrm(
'Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0', 'Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0',
'Set-Service -Name sshd -StartupType "Automatic"', 'Set-Service -Name sshd -StartupType "Automatic"',
'Write-Output "OpenSSH server running"', 'Write-Output "OpenSSH server running"',
] ]
with INSTALL_WINDOWS_DEPENDENCIES.open('r', encoding='utf-8') as fh: with INSTALL_WINDOWS_DEPENDENCIES.open('r', encoding='utf-8') as fh:
commands.extend(l.rstrip() for l in fh) commands.extend(l.rstrip() for l in fh)
# Schedule run of EC2Launch on next boot. This ensures that UserData
# is executed.
# We disable setComputerName because it forces a reboot.
# We set an explicit admin password because this causes UserData to run
# as Administrator instead of System.
commands.extend(
[
r'''Set-Content -Path C:\ProgramData\Amazon\EC2-Windows\Launch\Config\LaunchConfig.json '''
r'''-Value '{"setComputerName": false, "setWallpaper": true, "addDnsSuffixList": true, '''
r'''"extendBootVolumeSize": true, "handleUserData": true, '''
r'''"adminPasswordType": "Specify", "adminPassword": "%s"}' ''' % c.automation.default_password(),
martinvonzUnsubmitted
Not Done

black wants this line to be wrapped. I'll fix that in flight.

martinvonz: black wants this line to be wrapped. I'll fix that in flight.
pulkitUnsubmitted
Not Done

I should install black, I was waiting for Augie's fix to land to prevent doing some extra work.

pulkit: I should install black, I was waiting for Augie's fix to land to prevent doing some extra work.
r'C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeInstance.ps1 '
r'–Schedule',
]
)
# Disable Windows Defender when bootstrapping because it just slows # Disable Windows Defender when bootstrapping because it just slows
# things down. # things down.
commands.insert(0, 'Set-MpPreference -DisableRealtimeMonitoring $true') commands.insert(0, 'Set-MpPreference -DisableRealtimeMonitoring $true')
commands.append('Set-MpPreference -DisableRealtimeMonitoring $false') commands.append('Set-MpPreference -DisableRealtimeMonitoring $false')
# Compute a deterministic fingerprint to determine whether image needs # Compute a deterministic fingerprint to determine whether image needs
# to be regenerated. # to be regenerated.
fingerprint = resolve_fingerprint( fingerprint = resolve_fingerprint(
{ {
'instance_config': config, 'instance_config': config,
'user_data': WINDOWS_USER_DATA, 'user_data': WINDOWS_USER_DATA,
'initial_bootstrap': WINDOWS_BOOTSTRAP_POWERSHELL, 'initial_bootstrap': WINDOWS_BOOTSTRAP_POWERSHELL,
'bootstrap_commands': commands, 'bootstrap_commands': commands,
'base_image_name': base_image_name, 'base_image_name': base_image_name,
} }
) )
existing_image = find_and_reconcile_image(ec2resource, name, fingerprint) existing_image = find_and_reconcile_image(ec2resource, name, fingerprint)
if existing_image: if existing_image:
return existing_image return existing_image
print('no suitable Windows development image found; creating one...') print('no suitable Windows development image found; creating one...')
with create_temp_windows_ec2_instances(c, config) as instances: with create_temp_windows_ec2_instances(
c, config, bootstrap=True
) as instances:
assert len(instances) == 1 assert len(instances) == 1
instance = instances[0] instance = instances[0]
wait_for_ssm(ssmclient, [instance]) wait_for_ssm(ssmclient, [instance])
# On first boot, install various Windows updates. # On first boot, install various Windows updates.
# We would ideally use PowerShell Remoting for this. However, there are # We would ideally use PowerShell Remoting for this. However, there are
# trust issues that make it difficult to invoke Windows Update # trust issues that make it difficult to invoke Windows Update