Skip to main content

Bitbucket Pipelines

Scottsdale Hub uses manual-only Bitbucket pipelines for application deployment.

Deployment Boundary​

  • Pipelines deploy application images and trigger ECS service rollouts.
  • CDK infrastructure changes are deployed separately.

Do not use app pipeline runs as a substitute for infrastructure deployment.

Manual Pipeline Entries​

Run one of these pipeline names manually:

  • deploy-dev
  • deploy-staging
  • deploy-production

Deployment Flow​

  1. Build app image from repository root Dockerfile.
  2. Push a shared image to ECR used by API, Horizon, Scheduler, and Ops.
  3. Force ECS deployment for target stage services.

For dev and staging, infrastructure may start services at desired count 0; deploy scripts bootstrap counts before force-deploy.

Self-Hosted Runner Model​

Pipeline steps target labels:

  • self.hosted
  • linux.shell
  • scottsdale.runner

Runner host profile:

  • EC2 host in private networking
  • Access through AWS Systems Manager Session Manager
  • Uses instance profile for AWS API access

Runner bootstrap installs Docker, AWS CLI, jq, curl, unzip, Java Corretto, git, and SSM dependencies.

Stage to Cluster Mapping​

Default mapping when CLUSTER_NAME is not set:

  • dev -> hubdev-cluster
  • staging -> hubstg-cluster
  • production -> hubprod-cluster

Required and Optional Variables​

Runner AWS authentication uses EC2 role, so no static AWS keys are required.

Common optional overrides:

  • AWS_REGION
  • AWS_ACCOUNT_ID
  • ECR_APP_REPO
  • CLUSTER_NAME
  • STACK_PREFIX
  • API_SERVICE_NAME
  • HORIZON_SERVICE_NAME
  • SCHEDULER_SERVICE_NAME
  • OPS_SERVICE_NAME

Runner IAM Permissions​

Minimum required capabilities include:

  • ECR image push permissions
  • ECS list/describe/update service permissions
  • CloudFormation exports read
  • STS caller identity

Troubleshooting Highlights​

203/EXEC service errors usually indicate invalid ExecStart paths in runner systemd configuration. Reconcile absolute paths with actual start.sh location and restart service.

No public IP runner access is expected. Use SSM session start:

aws ssm start-session --target <instance-id> --region us-west-2