Skip to content

Concourse workers

Because the app is behind the corporate firewall, you will need concourse workers running on the internal corporate network. We do this to reduce the chance of random internet attacks against our app.

The easiest way to run concourse jobs that need to interact with environments.toolsmiths.cf-app.com is to use Hush-House. Please note hush-house is not owned by Toolsmiths. Once you are onboarded to hush-house, you can tag your tasks with toolsmiths-shared-vsphere.

You can also look for our new shared tag environments.toolsmiths.cf-app.com-shared-vsphere-worker on your existing concourse server. If you don't find one the shared workers, then read on:

Running your own CI?

If you're not running on a shared Concourse such as hush-house or cf-denver, you may want to review the Concourse docs on supporting external workers here. In general, you will need to re-deploy your concourse server web vms after adding a new key-pair, and we will need some information about your concourse server.

The hard part

  • Create an SSH key pair for the Concourse worker
    • Please share the contents of both of these files via LastPass with the Toolsmiths team.
  • Update Concourse Web VM Manifest by adding the worker public key
    • Test that your new key pair enables access to your ATC by attempting to SSH onto your ATC with the Private Key
      • ssh -v -i <path-to-your-private-key> <ATC Hostname> -p 2222
      • example: ssh -v -i wings.priv wings.pivotal.io -p 2222
      • You should see "debug1: Authentication succeeded (publickey)." in the output
  • If you use a firewall on your concourse server, you will need to ensure the SFO and TOR office's public IP's are white-listed. You can find the SFO and TOR office public IP's via a service provided by IOPS: curl -s http://ipam.svc.pivotal.io:8083/. These IPs can change over time.

The easy part

Please send us the following email:

Hello Toolsmiths,

We would like concourse workers for our CI. Here's our info:

- Team email alias: [insert alias here]
- URL to concourse server: [insert url here i.e. toolsmiths.ci.cf-app.com]
- Concourse Server version: [insert version here i.e. 5.3.0]
- Concourse Worker version: [insert version here i.e. 2.1.0]
- Location of SSH Keys in lastpass: [insert name of lastpass entry here]

Details

  • URL to concourse server: This the hostname of your ATC, and is in concourse.yml -> external_url
  • Concourse Server version We recommend upgrading to latest before requesting workers, can be found on the UI of your concourse server
  • Concourse Worker version can be found via fly -t [name] workers
  • Location of SSH Keys in LastPass. Here's a doc that describes how to share credentials.
  • We will collect your TSA Host Public key ourselves via ssh-keyscan -p 2222 hush-house.pivotal.io 2>/dev/null | awk '{ print $3 }' from either the SF or Toronto offices.

We will let you know when the worker is available and ready to be used, as well as the API Token associated with your team.