Skip to content

Commit 9f71eb7

Browse files
hllvchllvc
committed
SG-4240: Update how commands are built for execution.
1 parent c3a5509 commit 9f71eb7

1 file changed

Lines changed: 66 additions & 52 deletions

File tree

‎main.sh‎

Lines changed: 66 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
#
33
# Register external instance to Stackguardian platform.
44

5+
set -o nounset
56
set -o pipefail
67

78
#{{{ Environment variables
@@ -266,7 +267,7 @@ print_details() { #{{{
266267
details_item "Private IP Address" "$(ip route | grep default | cut -d" " -f9)"
267268
details_item "Public IP Address" "$(curl -fSs ifconfig.me)"
268269
# TODO: Print only when HTTP_PROXY is set
269-
details_item "HTTP PROXY" "$HTTP_PROXY"
270+
details_item "HTTP PROXY" "${HTTP_PROXY:-}"
270271
echo
271272
details_frame "System Information"
272273
details_item "OS Release" "$(cat /etc/*release | grep -oP '(?<=PRETTY_NAME=").*?(?=")')"
@@ -660,25 +661,25 @@ clean_cron() { #{{{
660661

661662
cleanup() { #{{{
662663
printf "\nGraceful shutdown..\n"
663-
[[ -n ${spinner_pid} ]] && kill "${spinner_pid}" >&/dev/null
664+
[[ -n ${spinner_pid:-} ]] && kill "${spinner_pid}" >&/dev/null
664665
exit 0
665666
}
666667
#}}}: cleanup
667668

668669
force_exec() { #{{{
669-
[[ "$FORCE_PASS" == true ]] && return 0
670+
[[ "${FORCE_PASS:-}" == true ]] && return 0
670671
return 1
671672
}
672673
#}}}: force_exec
673674

674675
no_clean_on_fail() { #{{{
675-
[[ "$NO_CLEAN_ON_FAIL" == true ]] && return 0
676+
[[ "${NO_CLEAN_ON_FAIL:-}" == true ]] && return 0
676677
return 1
677678
}
678679
#}}}: no_clean_on_fail
679680

680681
ignore_fluentbit_errors() { #{{{
681-
[[ "$IGNORE_FLUENTBIT_ERRORS" == true ]] && return 0
682+
[[ "${IGNORE_FLUENTBIT_ERRORS:-}" == true ]] && return 0
682683
return 1
683684
}
684685
#}}}: ignore_fluentbit_errors
@@ -703,7 +704,8 @@ spinner() { #{{{
703704
tail -n0 -f "${log_file}" --pid "${spinner_pid}"
704705
fi
705706
wait "${spinner_pid}"
706-
local exit_code=$?
707+
local exit_code
708+
exit_code=$?
707709
printf " \b\b\b\b\b\r"
708710
debug "$msg (exit code):" "$exit_code"
709711
if [[ ! "${LOG_DEBUG}" =~ true|True ]]; then
@@ -1138,34 +1140,37 @@ configure_fluentbit() { #{{{
11381140
local exists
11391141
local image
11401142

1141-
image="$($CONTAINER_ORCHESTRATOR images -q -f reference="$FLUENTBIT_IMAGE")"
1143+
image=$($CONTAINER_ORCHESTRATOR images -q -f reference="$FLUENTBIT_IMAGE")
11421144
if [[ -z "$image" ]]; then
11431145
info "Fluentbit image:" "$FLUENTBIT_IMAGE"
11441146
$CONTAINER_ORCHESTRATOR pull "$FLUENTBIT_IMAGE" >> "$LOG_FILE" 2>&1 &
11451147
spinner "$!" "Pulling image"
11461148
fi
11471149

11481150
spinner_wait "Configuring fluentbit agent for workflow log collection.."
1149-
# TODO: Identify --network host use-case
1150-
docker_run_command="$CONTAINER_ORCHESTRATOR run -d \
1151-
--name fluentbit-agent \
1152-
--restart=always \
1153-
-p 24224:24224 \
1154-
-p 2020:2020 \
1155-
--network bridge \
1156-
-v /var/lib/docker/containers:/var/lib/docker/containers:ro \
1157-
-v $(pwd)/volumes/db-state/:/var/log/ \
1158-
-v $(pwd)/fluent-bit.conf:/fluent-bit/etc/fluentbit.conf \
1159-
-v /var/log/registration:/var/log/registration \
1160-
--log-driver=fluentd \
1161-
--log-opt fluentd-async=true \
1162-
--log-opt tag=fluentbit
1163-
"
1151+
11641152
running=$($CONTAINER_ORCHESTRATOR ps -q --filter "name=fluentbit-agent")
11651153
exists=$($CONTAINER_ORCHESTRATOR ps -aq --filter "name=fluentbit-agent")
11661154

11671155
if [[ -z "${exists}" ]]; then
1168-
if [[ "${STORAGE_BACKEND_TYPE}" == "aws_s3" && -n "${S3_AWS_ACCESS_KEY_ID}" && -n "${S3_AWS_SECRET_ACCESS_KEY}" && -n "${S3_AWS_REGION}" ]]; then
1156+
# Build docker command as array to prevent word splitting issues
1157+
local -a docker_cmd=(
1158+
"$CONTAINER_ORCHESTRATOR" run -d
1159+
--name fluentbit-agent
1160+
--restart=always
1161+
-p 24224:24224
1162+
-p 2020:2020
1163+
--network bridge
1164+
-v /var/lib/docker/containers:/var/lib/docker/containers:ro
1165+
-v "$(pwd)/volumes/db-state/:/var/log/"
1166+
-v "$(pwd)/fluent-bit.conf:/fluent-bit/etc/fluentbit.conf"
1167+
-v /var/log/registration:/var/log/registration
1168+
--log-driver=fluentd
1169+
--log-opt fluentd-async=true
1170+
--log-opt tag=fluentbit
1171+
)
1172+
1173+
if [[ "${STORAGE_BACKEND_TYPE}" == "aws_s3" && -n "${S3_AWS_ACCESS_KEY_ID:-}" && -n "${S3_AWS_SECRET_ACCESS_KEY:-}" && -n "${S3_AWS_REGION:-}" ]]; then
11691174
# Create AWS credentials file (cleaned up during deregistration via clean_local_setup)
11701175
mkdir -p "$(pwd)/volumes/aws"
11711176
chmod 700 "$(pwd)/volumes/aws"
@@ -1177,16 +1182,14 @@ region = ${S3_AWS_REGION}
11771182
EOF
11781183
chmod 600 "$(pwd)/volumes/aws/credentials"
11791184

1180-
extra_options="-v $(pwd)/volumes/aws/credentials:/root/.aws/credentials:ro \
1181-
-e AWS_REGION=${S3_AWS_REGION} \
1182-
$FLUENTBIT_IMAGE \
1183-
/fluent-bit/bin/fluent-bit -c /fluent-bit/etc/fluentbit.conf"
1184-
$docker_run_command $extra_options >> "$LOG_FILE" 2>&1
1185-
elif [[ "${STORAGE_BACKEND_TYPE}" == "azure_blob_storage" || "${STORAGE_BACKEND_TYPE}" == "aws_s3" ]]; then
1186-
extra_options="$FLUENTBIT_IMAGE \
1187-
/fluent-bit/bin/fluent-bit -c /fluent-bit/etc/fluentbit.conf"
1188-
$docker_run_command $extra_options >> "$LOG_FILE" 2>&1
1185+
docker_cmd+=(-v "$(pwd)/volumes/aws/credentials:/root/.aws/credentials:ro")
1186+
docker_cmd+=(-e "AWS_REGION=${S3_AWS_REGION}")
11891187
fi
1188+
1189+
docker_cmd+=("$FLUENTBIT_IMAGE")
1190+
docker_cmd+=(/fluent-bit/bin/fluent-bit -c /fluent-bit/etc/fluentbit.conf)
1191+
1192+
"${docker_cmd[@]}" >> "$LOG_FILE" 2>&1
11901193
else
11911194
if [[ -z "${running}" ]]; then
11921195
$CONTAINER_ORCHESTRATOR start fluentbit-agent >&/dev/null
@@ -1387,20 +1390,35 @@ deregister_instance() { #{{{
13871390
}
13881391
#}}}: deregister_instance
13891392

1393+
#######################################
1394+
# Update diagnostic JSON file with key-value pair
1395+
# Globals:
1396+
# SG_DIAGNOSTIC_FILE
1397+
# SG_DIAGNOSTIC_TMP_FILE
1398+
# Arguments:
1399+
# $1 - JSON key path (e.g., "system.last_check")
1400+
# $2 - Value to set
1401+
#######################################
1402+
update_diagnostic() { #{{{
1403+
local key="$1"
1404+
local value="$2"
1405+
jq ".$key = \"$value\"" "$SG_DIAGNOSTIC_FILE" > "$SG_DIAGNOSTIC_TMP_FILE"
1406+
mv "$SG_DIAGNOSTIC_TMP_FILE" "$SG_DIAGNOSTIC_FILE"
1407+
}
1408+
#}}}: update_diagnostic
1409+
13901410
doctor() { #{{{
13911411
echo
13921412

1393-
jq ".system.last_check = \"$(date)\"" "$SG_DIAGNOSTIC_FILE" >> "$SG_DIAGNOSTIC_TMP_FILE"
1394-
mv "$SG_DIAGNOSTIC_TMP_FILE" "$SG_DIAGNOSTIC_FILE"
1413+
update_diagnostic "system.last_check" "$(date)"
13951414

13961415
local status_list=""
13971416
local service_status
13981417
local service_list=( "ecs" "docker" )
13991418

14001419
for service in "${service_list[@]}"; do
14011420
service_status="$(systemctl is-active "${service}")"
1402-
jq ".health.service.${service} = \"$service_status\"" $SG_DIAGNOSTIC_FILE > $SG_DIAGNOSTIC_TMP_FILE
1403-
mv $SG_DIAGNOSTIC_TMP_FILE $SG_DIAGNOSTIC_FILE
1421+
update_diagnostic "health.service.${service}" "$service_status"
14041422
if [[ -n ${service_status} && ${service_status} == "active" ]]; then
14051423
status_list="$(printf "%s\n%s" \
14061424
"${status_list}" \
@@ -1416,8 +1434,7 @@ doctor() { #{{{
14161434
echo
14171435
service_status="$(systemctl is-active "$CONTAINER_ORCHESTRATOR")"
14181436
if [[ "${service_status}" != "active" ]]; then
1419-
jq ".health.service.$CONTAINER_ORCHESTRATOR = \"$service_status\"" "$SG_DIAGNOSTIC_FILE" > "$SG_DIAGNOSTIC_TMP_FILE"
1420-
mv "$SG_DIAGNOSTIC_TMP_FILE" "$SG_DIAGNOSTIC_FILE"
1437+
update_diagnostic "health.service.$CONTAINER_ORCHESTRATOR" "$service_status"
14211438
printf " + Container Status (${C_BOLD}$CONTAINER_ORCHESTRATOR ${C_RESET}service: ${C_RED}%s${C_RESET})\n\n" "${service_status}"
14221439
return
14231440
fi
@@ -1432,14 +1449,12 @@ doctor() { #{{{
14321449
--format '{{.Status}}'\
14331450
)"
14341451
if [[ -z ${container_status} ]]; then
1435-
jq ".health.container.$container = \"Not Running\"" $SG_DIAGNOSTIC_FILE > $SG_DIAGNOSTIC_TMP_FILE
1436-
mv $SG_DIAGNOSTIC_TMP_FILE $SG_DIAGNOSTIC_FILE
1452+
update_diagnostic "health.container.$container" "Not Running"
14371453
status_list="$(printf "%s\n%s" \
14381454
"${status_list}" \
14391455
"$(printf " | * ${C_BOLD}%s${C_RESET} agent: ${C_RED}Not Running${C_RESET}\n" "${container}")")"
14401456
else
1441-
jq ".health.container.$container = \"$container_status\"" $SG_DIAGNOSTIC_FILE > $SG_DIAGNOSTIC_TMP_FILE
1442-
mv $SG_DIAGNOSTIC_TMP_FILE $SG_DIAGNOSTIC_FILE
1457+
update_diagnostic "health.container.$container" "$container_status"
14431458
status_list="$(printf "%s\n%s" \
14441459
"${status_list}" \
14451460
"$(printf " | * ${C_BOLD}%s${C_RESET} agent: ${C_GREEN}%s${C_RESET}\n" "${container}" "${container_status}")")"
@@ -1452,25 +1467,24 @@ doctor() { #{{{
14521467

14531468
prune() { #{{{
14541469
local reclaimed
1455-
prune_filter="until=4h"
1470+
local prune_filter="until=4h"
1471+
local curr_time
14561472
curr_time=$(date)
14571473

14581474
spinner_wait "Cleaning up system.."
1475+
local reclaimed_containers_images
14591476
reclaimed_containers_images=$($CONTAINER_ORCHESTRATOR system prune -f \
1460-
--filter $prune_filter \
1477+
--filter "$prune_filter" \
14611478
| cut -d: -f2 | tr -d ' ')
14621479

1463-
jq ".system.docker.last_prune = \"$curr_time\"" "$SG_DIAGNOSTIC_FILE" >> "$SG_DIAGNOSTIC_TMP_FILE"
1464-
mv "$SG_DIAGNOSTIC_TMP_FILE" "$SG_DIAGNOSTIC_FILE"
1465-
jq ".system.docker.reclaimed_containers_images = \"$reclaimed_containers_images\"" "$SG_DIAGNOSTIC_FILE" >> "$SG_DIAGNOSTIC_TMP_FILE"
1466-
mv "$SG_DIAGNOSTIC_TMP_FILE" "$SG_DIAGNOSTIC_FILE"
1467-
jq ".system.docker.prune_filter = \"$prune_filter\"" "$SG_DIAGNOSTIC_FILE" >> "$SG_DIAGNOSTIC_TMP_FILE"
1468-
mv "$SG_DIAGNOSTIC_TMP_FILE" "$SG_DIAGNOSTIC_FILE"
1480+
update_diagnostic "system.docker.last_prune" "$curr_time"
1481+
update_diagnostic "system.docker.reclaimed_containers_images" "$reclaimed_containers_images"
1482+
update_diagnostic "system.docker.prune_filter" "$prune_filter"
14691483

1484+
local reclaimed_volumes
14701485
reclaimed_volumes=$($CONTAINER_ORCHESTRATOR system prune --volumes -f \
14711486
| cut -d: -f2 | tr -d ' ')
1472-
jq ".system.docker.reclaimed_volumes = \"$reclaimed_volumes\"" "$SG_DIAGNOSTIC_FILE" >> "$SG_DIAGNOSTIC_TMP_FILE"
1473-
mv "$SG_DIAGNOSTIC_TMP_FILE" "$SG_DIAGNOSTIC_FILE"
1487+
update_diagnostic "system.docker.reclaimed_volumes" "$reclaimed_volumes"
14741488

14751489
# # Already taken care by ECS agent: Remove all unused images not just dangling, older than 10 days, check if the image created date is used.
14761490
# reclaimed=$($CONTAINER_ORCHESTRATOR system prune -a \

0 commit comments

Comments
 (0)