244 lines
11 KiB
YAML
244 lines
11 KiB
YAML
{{- define "Task-createProjectAccess" -}}
|
|
---
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: {{ template "helpers.labels.fullname" . }}-createprojectaccess
|
|
spec:
|
|
params:
|
|
- name: repoRoot
|
|
- name: project
|
|
- name: changeNumber
|
|
- name: patchSetNumber
|
|
workspaces:
|
|
- name: output
|
|
description: The git repo will be cloned onto the volume backing this workspace
|
|
results:
|
|
- name: commit
|
|
description: The precise commit SHA that was fetched by this Task
|
|
steps:
|
|
- name: create-namespace
|
|
image: {{ include "helpers.pod.container.image" ( dict "Global" $ "Application" "task_create_namespace" ) }}
|
|
script: |
|
|
#!/bin/bash
|
|
set -ex
|
|
create_namespace() {
|
|
if ! [[ $(kubectl get ns jarvis-$(params.changeNumber)-$(params.patchSetNumber)) ]] ; then
|
|
kubectl create ns jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
echo "Created namespace jarvis-$(params.changeNumber)-$(params.patchSetNumber)"
|
|
else
|
|
echo "Namespace already exists, delete all resources for re-run."
|
|
kubectl delete all --all -n jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
fi
|
|
}
|
|
create_namespace
|
|
- name: create-k8s-objects
|
|
image: {{ include "helpers.pod.container.image" ( dict "Global" $ "Application" "task_create_namespace" ) }}
|
|
script: |
|
|
#!/bin/bash
|
|
create_sa() {
|
|
if ! [[ $(kubectl get serviceaccount -n jarvis-$(params.changeNumber)-$(params.patchSetNumber) sa-development-pipeline) ]] ; then
|
|
tee $(workspaces.output.path)/service-account.yaml <<EOF
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: sa-development-pipeline
|
|
namespace: jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
EOF
|
|
else
|
|
echo "Service Account already exists"
|
|
exit
|
|
fi
|
|
}
|
|
create_role() {
|
|
if ! [[ $(kubectl get role -n jarvis-$(params.changeNumber)-$(params.patchSetNumber) jarvis-$(params.changeNumber)-$(params.patchSetNumber)) ]] ; then
|
|
tee $(workspaces.output.path)/role.yaml <<EOF
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
namespace: jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
rules:
|
|
# EventListeners need to be able to fetch all namespaced resources
|
|
- apiGroups: ["triggers.tekton.dev"]
|
|
resources: ["eventlisteners", "triggerbindings", "triggertemplates", "triggers"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Permissions to execute helm dry-run TODO restrict to specific namespace
|
|
- apiGroups: [""]
|
|
resources: ["secrets", "services"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["rbac.authorization.k8s.io"]
|
|
resources: ["roles", "rolebindings"]
|
|
verbs: ["get"]
|
|
EOF
|
|
else
|
|
echo "Role already exists"
|
|
exit
|
|
fi
|
|
}
|
|
create_rolebinding() {
|
|
if ! [[ $(kubectl get rolebinding -n jarvis-$(params.changeNumber)-$(params.patchSetNumber) jarvis-$(params.changeNumber)-$(params.patchSetNumber)) ]] ; then
|
|
tee $(workspaces.output.path)/rolebinding.yaml <<EOF
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
namespace: jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: sa-development-pipeline
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
EOF
|
|
else
|
|
echo "rolebinding already exists"
|
|
exit
|
|
fi
|
|
}
|
|
#Service account creation
|
|
create_sa
|
|
create_role
|
|
create_rolebinding
|
|
|
|
cat $(workspaces.output.path)/service-account.yaml | kubectl apply -f -
|
|
cat $(workspaces.output.path)/role.yaml | kubectl apply -f -
|
|
cat $(workspaces.output.path)/rolebinding.yaml | kubectl apply -f -
|
|
|
|
- name: checkout-repo
|
|
image: {{ include "helpers.pod.container.image" ( dict "Global" $ "Application" "task_git" ) }}
|
|
script: |
|
|
#!/bin/sh
|
|
set -eu -o pipefail -x
|
|
|
|
# A change ref has the format refs/changes/X/Y/Z where X is
|
|
# the last two digits of the change number, Y is the entire
|
|
# change number, and Z is the patch set. For example, if
|
|
# the change number is 263270, the ref would be
|
|
# refs/changes/70/263270/2 for the second patch set.
|
|
change_ref="refs/changes/$(echo "0$(params.changeNumber)" | awk '{ print substr( $0, length($0) - 1, length($0) ) }')/$(params.changeNumber)/$(params.patchSetNumber)"
|
|
echo $change_ref
|
|
|
|
|
|
CHECKOUT_DIR="$(workspaces.output.path)"
|
|
|
|
cleandir() {
|
|
# Delete any existing contents of the repo directory if it exists.
|
|
#
|
|
# We don't just "rm -rf $CHECKOUT_DIR" because $CHECKOUT_DIR might be "/"
|
|
# or the root of a mounted volume.
|
|
if [[ -d "$CHECKOUT_DIR" ]] ; then
|
|
# Delete non-hidden files and directories
|
|
rm -rf "$CHECKOUT_DIR"/*
|
|
# Delete files and directories starting with . but excluding ..
|
|
rm -rf "$CHECKOUT_DIR"/.[!.]*
|
|
# Delete files and directories starting with .. plus any other character
|
|
rm -rf "$CHECKOUT_DIR"/..?*
|
|
fi
|
|
}
|
|
cleandir
|
|
|
|
cd ${CHECKOUT_DIR}
|
|
git init
|
|
git config http.sslVerify "false"
|
|
git config advice.detachedHead "false"
|
|
git fetch $(params.repoRoot)/$(params.project) $change_ref
|
|
git checkout FETCH_HEAD
|
|
|
|
RESULT_SHA="$(git rev-parse HEAD)"
|
|
EXIT_CODE="$?"
|
|
if [ "$EXIT_CODE" != 0 ] ; then
|
|
exit $EXIT_CODE
|
|
fi
|
|
|
|
echo -n "$RESULT_SHA" > $(results.commit.path)
|
|
- name: create-secrets
|
|
image: {{ include "helpers.pod.container.image" ( dict "Global" $ "Application" "task_secrets" ) }}
|
|
script: |
|
|
#!/bin/bash
|
|
## Creating kubeconfig secret in correct namespace
|
|
SECRET_JSON_ORIGINAL=$(mktemp --suffix=".json")
|
|
kubectl get secret -n development-pipeline kubeconfig-secret -o=json > "$SECRET_JSON_ORIGINAL"
|
|
SECRET_JSON=$(mktemp --suffix=".json")
|
|
jq 'del(.metadata.namespace) | del(.metadata.creationTimestamp) | del(.metadata.labels."controller-uid") | del(.metadata.resourceVersion) | del(.metadata.selfLink) | del(.metadata.uid) | del(.spec.selector) | del(.spec.template.metadata.creationTimestamp) | del(.spec.template.metadata.labels."controller-uid" )' "$SECRET_JSON_ORIGINAL" > "$SECRET_JSON"
|
|
|
|
cat "$SECRET_JSON" | kubectl create -n jarvis-$(params.changeNumber)-$(params.patchSetNumber) -f -
|
|
|
|
## Creating Harbor certificate in correct namespace
|
|
SECRET_JSON_ORIGINAL=$(mktemp --suffix=".json")
|
|
kubectl get secret -n development-pipeline harbor-ca -o=json > "$SECRET_JSON_ORIGINAL"
|
|
SECRET_JSON=$(mktemp --suffix=".json")
|
|
jq 'del(.metadata.namespace) | del(.metadata.creationTimestamp) | del(.metadata.labels."controller-uid") | del(.metadata.resourceVersion) | del(.metadata.selfLink) | del(.metadata.uid) | del(.spec.selector) | del(.spec.template.metadata.creationTimestamp) | del(.spec.template.metadata.labels."controller-uid" )' "$SECRET_JSON_ORIGINAL" > "$SECRET_JSON"
|
|
|
|
cat "$SECRET_JSON" | kubectl create -n jarvis-$(params.changeNumber)-$(params.patchSetNumber) -f -
|
|
|
|
rm "$SECRET_JSON_ORIGINAL"
|
|
rm "$SECRET_JSON"
|
|
|
|
## Harbor basic auth and docker auth
|
|
kubectl create secret generic harbor-basic-auth \
|
|
--from-literal=username='admin' \
|
|
--from-literal=password='Harbor12345' \
|
|
-n jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
|
|
kubectl create secret docker-registry harbor-docker-auth \
|
|
--docker-username=admin \
|
|
--docker-password=Harbor12345 \
|
|
--docker-email=example@gmail.com \
|
|
--docker-server=harbor-core.jarvis.local \
|
|
-n jarvis-$(params.changeNumber)-$(params.patchSetNumber)
|
|
- name: install-development-pipeline
|
|
image: {{ include "helpers.pod.container.image" ( dict "Global" $ "Application" "task_secrets" ) }}
|
|
script: |
|
|
#!/bin/bash
|
|
|
|
change_ref="refs/changes/$(echo "0$(params.changeNumber)" | awk '{ print substr( $0, length($0) - 1, length($0) ) }')/$(params.changeNumber)/$(params.patchSetNumber)"
|
|
echo $change_ref
|
|
|
|
cd "$(workspaces.output.path)"/jarvis
|
|
|
|
helm upgrade --install development-pipeline \
|
|
-n jarvis-$(params.changeNumber)-$(params.patchSetNumber) \
|
|
./development-pipeline \
|
|
--set "git_repo=$(params.repoRoot)/$(params.project)" \
|
|
--set "refspec=$change_ref"
|
|
- name: create-pipelinerun
|
|
image: {{ include "helpers.pod.container.image" ( dict "Global" $ "Application" "task_secrets" ) }}
|
|
script: |
|
|
#!/bin/bash
|
|
|
|
kubectl create \
|
|
-n jarvis-$(params.changeNumber)-$(params.patchSetNumber) \
|
|
-f "$(workspaces.output.path)"/jarvis/development-pipeline/pipelinerun-validation.yaml
|
|
|
|
# Default wait timeout is 1000 seconds
|
|
end=$(date +%s)
|
|
timeout=${3:-3000}
|
|
end=$((end + timeout))
|
|
|
|
while true; do
|
|
pipelinerunstatus="$(kubectl get pipelinerun -n jarvis-$(params.changeNumber)-$(params.patchSetNumber) $(kubectl get pipelinerun -n jarvis-$(params.changeNumber)-$(params.patchSetNumber) -o name | awk -F '/' "/development-pipeline/ { print \$NF; exit }") | tail -1 | awk '{ print $2 }')"
|
|
[ "${pipelinerunstatus}" == "True" ] && break
|
|
[ "${pipelinerunstatus}" == "False" ] && exit 1
|
|
sleep 5
|
|
now=$(date +%s)
|
|
if [ $now -gt $end ] ; then
|
|
echo "Pipelinerun failed to complete after $timeout seconds"
|
|
echo
|
|
kubectl get pipelinerun --namespace jarvis-$(params.changeNumber)-$(params.patchSetNumber) -o wide
|
|
echo "Some pipelineruns are not complete"
|
|
exit 1
|
|
fi
|
|
echo "kubectl get pipelinerun -n jarvis-$(params.changeNumber)-$(params.patchSetNumber)" | grep development-pipeline
|
|
done
|
|
...
|
|
{{- end -}}
|
|
{{- include "helpers.template.overlay" ( dict "Global" $ "template_definition" "Task-createProjectAccess" ) }}
|