Commit 861a9120 authored by Thong Kuah's avatar Thong Kuah
Browse files

Merge branch 'initial-build' into 'master' 

Initial build

See merge request gitlab-org/cluster-integration/auto-deploy-image!1
parents 49637634 65985d03

.gitlab-ci.yml

0 → 100644
+250 −0
Original line number Diff line number Diff line 
variables:

  DOCKER_DRIVER: overlay2



  HELM_VERSION: 2.14.0

  KUBERNETES_VERSION: 1.11.10



  BUILD_IMAGE_NAME: "$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA"

  RELEASE_IMAGE_NAME: "$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:stable"



stages:

  - build

  - test

  - release



build:

  stage: build

  image: docker:stable

  services:

    - docker:stable-dind

  before_script:

    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"

  script:

    - docker build --build-arg "HELM_VERSION=$HELM_VERSION" --build-arg "KUBERNETES_VERSION=$KUBERNETES_VERSION" --tag "$BUILD_IMAGE_NAME" .

    - docker push "$BUILD_IMAGE_NAME"



.test-job: &test-job

  stage: test

  image: "$BUILD_IMAGE_NAME"



test-dependencies:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

  script:

    - helm version --client

    - tiller -version

    - kubectl version --client



test-kube-domain:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    KUBE_INGRESS_BASE_DOMAIN: example.com

  script:

    - source /build/deploy-helpers.sh

    - check_kube_domain



test-kube-domain-legacy:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    AUTO_DEVOPS_DOMAIN: example.com

  script:

    - source /build/deploy-helpers.sh

    - check_kube_domain && expected_error || failed_as_expected



test-kube-domain_error:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

  script:

    - source /build/deploy-helpers.sh

    - check_kube_domain && expected_error || failed_as_expected



test-download-chart:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

  script:

    - source /build/deploy-helpers.sh

    - download_chart



test-deploy-name:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    CI_ENVIRONMENT_SLUG: production

  script:

    - source /build/deploy-helpers.sh

    - name=$(deploy_name "stable")

    - |

      if [[ $name != "production" ]]; then

        echo "$name should equal 'production'"

        exit 1

      fi

    - name=$(deploy_name "canary")

    - |

      if [[ $name != "production-canary" ]]; then

        echo "$name should equal 'production-canary'"

        exit 1

      fi



test-get-replicas:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    CI_ENVIRONMENT_SLUG: production

  script:

    - source /build/deploy-helpers.sh

    - replicas=$(get_replicas "stable" "100")

    - |

      if [[ $replicas != 1 ]]; then

        echo "$replicas should equal 1"

        exit 1

      fi



test-ensure-namespace:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    KUBE_NAMESPACE: project-123456

  script:

    - download_k3s

    - start_k3s

    - source /build/deploy-helpers.sh

    - ensure_namespace



test-initialize-tiller:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    KUBE_NAMESPACE: default

  script:

    - download_k3s

    - start_k3s

    - source /build/deploy-helpers.sh

    - initialize_tiller



# disabled, doesn't look like k3s supports docker-registry secret

.test-create-secret:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    KUBE_NAMESPACE: default

    CI_REGISTRY: example.com

    CI_DEPLOY_USER: ci-deploy-user

    CI_DEPLOY_PASSWORD: ci-deploy-password

    GITLAB_USER_EMAIL: user@example.com

  script:

    - download_k3s

    - start_k3s

    - source /build/deploy-helpers.sh

    - create_secret

    - kubectl get secret gitlab-registry -n $KUBE_NAMESPACE



test-create-secret-public-project:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    CI_PROJECT_VISIBILITY: public

    KUBE_NAMESPACE: default

  script:

    - download_k3s

    - start_k3s

    - source /build/deploy-helpers.sh

    - create_secret

    - kubectl get secret gitlab-registry -n $KUBE_NAMESPACE && expected_error || failed_as_expected



test-persist-environment-url:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    CI_ENVIRONMENT_URL: review-app.example.com

  script:

    - source /build/deploy-helpers.sh

    - persist_environment_url

    - grep review-app.example.com environment_url.txt



# disabled, k3s does not support helm charts

.test-deploy:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    CI_APPLICATION_REPOSITORY: "registry.gitlab.com/gitlab-org/cluster-integration/auto-build-image/master/test-dockerfile"

    CI_APPLICATION_TAG: "b359d01bc8c611a2f7b14283cc878dea4a5f85d7"

    CI_ENVIRONMENT_SLUG: production

    CI_ENVIRONMENT_URL: example.com

    CI_PROJECT_PATH_SLUG: "gitlab-org/cluster-integration/auto-build-image"

    CI_PROJECT_VISIBILITY: public

    KUBE_NAMESPACE: default

    KUBE_INGRESS_BASE_DOMAIN: example.com

    POSTGRES_ENABLED: true

    POSTGRES_USER: user

    POSTGRES_PASSWORD: testing-password

    POSTGRES_ENABLED: "true"

    POSTGRES_DB: $CI_ENVIRONMENT_SLUG

    POSTGRES_VERSION: 9.6.2

  script:

    - download_k3s

    - start_k3s

    - source /build/deploy-helpers.sh

    - initialize_tiller

    - download_chart

    - deploy

    - helm ls



test-create-application-secret:

  <<: *test-job

  variables:

    GIT_STRATEGY: none

    KUBE_NAMESPACE: default

    CI_ENVIRONMENT_SLUG: production

    K8S_SECRET_CODE: 12345

  script:

    - download_k3s

    - start_k3s

    - source /build/deploy-helpers.sh

    - create_application_secret "stable"

    - kubectl get secrets -n $KUBE_NAMESPACE

    - kubectl get secrets production-secret -n $KUBE_NAMESPACE



release:

  stage: release

  image: docker:stable

  services:

    - docker:stable-dind

  before_script:

    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"

  script:

    - docker pull "$BUILD_IMAGE_NAME"

    - docker tag "$BUILD_IMAGE_NAME" "$RELEASE_IMAGE_NAME"

    - docker push "$RELEASE_IMAGE_NAME"



before_script:

  - |

    function expected_error() {

      echo "Expected error but exited with $?, failing build!"

      exit 1

    }



    function failed_as_expected() {

      echo "Failed as expected and exited with $?"

    }



    function download_k3s() {

      wget https://github.com/rancher/k3s/releases/download/v0.5.0/k3s

      chmod +x k3s

    }



    function start_k3s() {

      ./k3s server > k3s.log 2>&1 &



      until [ -f /etc/rancher/k3s/k3s.yaml ]; do

        sleep 1

        echo -n .

      done



      export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

      kubectl version

    }

Dockerfile

0 → 100644
+8 −0
Original line number Diff line number Diff line 
FROM alpine:latest



ARG HELM_VERSION

ARG KUBERNETES_VERSION



COPY src/ build/



RUN /build/install_dependencies.sh

src/deploy-helpers.sh

0 → 100755
+309 −0
Original line number Diff line number Diff line 
#! /bin/sh



[[ "$TRACE" ]] && set -x



auto_database_url=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${CI_ENVIRONMENT_SLUG}-postgres:5432/${POSTGRES_DB}

export DATABASE_URL=${DATABASE_URL-$auto_database_url}

export TILLER_NAMESPACE=$KUBE_NAMESPACE



function check_kube_domain() {

  if [[ -z "$KUBE_INGRESS_BASE_DOMAIN" ]]; then

    echo "In order to deploy or use Review Apps,"

    echo "KUBE_INGRESS_BASE_DOMAIN variables must be set"

    echo "From 11.8, you can set KUBE_INGRESS_BASE_DOMAIN in cluster settings"

    echo "or by defining a variable at group or project level."

    echo "You can also manually add it in .gitlab-ci.yml"

    false

  else

    true

  fi

}



function download_chart() {

  if [[ ! -d chart ]]; then

    auto_chart=${AUTO_DEVOPS_CHART:-gitlab/auto-deploy-app}

    auto_chart_name=$(basename $auto_chart)

    auto_chart_name=${auto_chart_name%.tgz}

    auto_chart_name=${auto_chart_name%.tar.gz}

  else

    auto_chart="chart"

    auto_chart_name="chart"

  fi



  helm init --client-only

  helm repo add ${AUTO_DEVOPS_CHART_REPOSITORY_NAME:-gitlab} ${AUTO_DEVOPS_CHART_REPOSITORY:-https://charts.gitlab.io} ${AUTO_DEVOPS_CHART_REPOSITORY_USERNAME:+"--username" "$AUTO_DEVOPS_CHART_REPOSITORY_USERNAME"} ${AUTO_DEVOPS_CHART_REPOSITORY_PASSWORD:+"--password" "$AUTO_DEVOPS_CHART_REPOSITORY_PASSWORD"}

  if [[ ! -d "$auto_chart" ]]; then

    helm fetch ${auto_chart} --untar

  fi

  if [ "$auto_chart_name" != "chart" ]; then

    mv ${auto_chart_name} chart

  fi



  helm dependency update chart/

  helm dependency build chart/

}



function ensure_namespace() {

  kubectl get namespace "$KUBE_NAMESPACE" || kubectl create namespace "$KUBE_NAMESPACE"

}



function initialize_tiller() {

  echo "Checking Tiller..."



  export HELM_HOST="localhost:44134"

  tiller -listen ${HELM_HOST} -alsologtostderr > /dev/null 2>&1 &

  echo "Tiller is listening on ${HELM_HOST}"



  if ! helm version --debug; then

    echo "Failed to init Tiller."

    return 1

  fi

  echo ""

}



function create_secret() {

  echo "Create secret..."

  if [[ "$CI_PROJECT_VISIBILITY" == "public" ]]; then

    return

  fi



  kubectl create secret -n "$KUBE_NAMESPACE" \

    docker-registry gitlab-registry \

    --docker-server="$CI_REGISTRY" \

    --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \

    --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \

    --docker-email="$GITLAB_USER_EMAIL" \

    -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -

}



function persist_environment_url() {

  echo $CI_ENVIRONMENT_URL > environment_url.txt

}



function deploy() {

  track="${1-stable}"

  percentage="${2:-100}"

  name=$(deploy_name "$track")



  if [[ -z "$CI_COMMIT_TAG" ]]; then

    image_repository=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG}

    image_tag=${CI_APPLICATION_TAG:-$CI_COMMIT_SHA}

  else

    image_repository=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE}

    image_tag=${CI_APPLICATION_TAG:-$CI_COMMIT_TAG}

  fi



  service_enabled="true"

  postgres_enabled="$POSTGRES_ENABLED"



  # if track is different than stable,

  # re-use all attached resources

  if [[ "$track" != "stable" ]]; then

    service_enabled="false"

    postgres_enabled="false"

  fi



  replicas=$(get_replicas "$track" "$percentage")



  if [[ "$CI_PROJECT_VISIBILITY" != "public" ]]; then

    secret_name='gitlab-registry'

  else

    secret_name=''

  fi



  create_application_secret "$track"



  env_slug=$(echo ${CI_ENVIRONMENT_SLUG//-/_} | tr -s '[:lower:]' '[:upper:]')

  eval env_ADDITIONAL_HOSTS=\$${env_slug}_ADDITIONAL_HOSTS

  if [ -n "$env_ADDITIONAL_HOSTS" ]; then

    additional_hosts="{$env_ADDITIONAL_HOSTS}"

  elif [ -n "$ADDITIONAL_HOSTS" ]; then

    additional_hosts="{$ADDITIONAL_HOSTS}"

  fi



  if [[ -n "$DB_INITIALIZE" && -z "$(helm ls -q "^$name$")" ]]; then

    echo "Deploying first release with database initialization..."

    helm upgrade --install \

      --wait \

      --set service.enabled="$service_enabled" \

      --set gitlab.app="$CI_PROJECT_PATH_SLUG" \

      --set gitlab.env="$CI_ENVIRONMENT_SLUG" \

      --set releaseOverride="$CI_ENVIRONMENT_SLUG" \

      --set image.repository="$image_repository" \

      --set image.tag="$image_tag" \

      --set image.pullPolicy=IfNotPresent \

      --set image.secrets[0].name="$secret_name" \

      --set application.track="$track" \

      --set application.database_url="$DATABASE_URL" \

      --set application.secretName="$APPLICATION_SECRET_NAME" \

      --set application.secretChecksum="$APPLICATION_SECRET_CHECKSUM" \

      --set service.commonName="le-$CI_PROJECT_ID.$KUBE_INGRESS_BASE_DOMAIN" \

      --set service.url="$CI_ENVIRONMENT_URL" \

      --set service.additionalHosts="$additional_hosts" \

      --set replicaCount="$replicas" \

      --set postgresql.enabled="$postgres_enabled" \

      --set postgresql.nameOverride="postgres" \

      --set postgresql.postgresUser="$POSTGRES_USER" \

      --set postgresql.postgresPassword="$POSTGRES_PASSWORD" \

      --set postgresql.postgresDatabase="$POSTGRES_DB" \

      --set postgresql.imageTag="$POSTGRES_VERSION" \

      --set application.initializeCommand="$DB_INITIALIZE" \

      $HELM_UPGRADE_EXTRA_ARGS \

      --namespace="$KUBE_NAMESPACE" \

      "$name" \

      chart/



    echo "Deploying second release..."

    helm upgrade --reuse-values \

      --wait \

      --set application.initializeCommand="" \

      --set application.migrateCommand="$DB_MIGRATE" \

      $HELM_UPGRADE_EXTRA_ARGS \

      --namespace="$KUBE_NAMESPACE" \

      "$name" \

      chart/

  else

    echo "Deploying new release..."

    helm upgrade --install \

      --wait \

      --set service.enabled="$service_enabled" \

      --set gitlab.app="$CI_PROJECT_PATH_SLUG" \

      --set gitlab.env="$CI_ENVIRONMENT_SLUG" \

      --set releaseOverride="$CI_ENVIRONMENT_SLUG" \

      --set image.repository="$image_repository" \

      --set image.tag="$image_tag" \

      --set image.pullPolicy=IfNotPresent \

      --set image.secrets[0].name="$secret_name" \

      --set application.track="$track" \

      --set application.database_url="$DATABASE_URL" \

      --set application.secretName="$APPLICATION_SECRET_NAME" \

      --set application.secretChecksum="$APPLICATION_SECRET_CHECKSUM" \

      --set service.commonName="le-$CI_PROJECT_ID.$KUBE_INGRESS_BASE_DOMAIN" \

      --set service.url="$CI_ENVIRONMENT_URL" \

      --set service.additionalHosts="$additional_hosts" \

      --set replicaCount="$replicas" \

      --set postgresql.enabled="$postgres_enabled" \

      --set postgresql.nameOverride="postgres" \

      --set postgresql.postgresUser="$POSTGRES_USER" \

      --set postgresql.postgresPassword="$POSTGRES_PASSWORD" \

      --set postgresql.postgresDatabase="$POSTGRES_DB" \

      --set postgresql.imageTag="$POSTGRES_VERSION" \

      --set application.migrateCommand="$DB_MIGRATE" \

      $HELM_UPGRADE_EXTRA_ARGS \

      --namespace="$KUBE_NAMESPACE" \

      "$name" \

      chart/

  fi



  if [[ -z "$ROLLOUT_STATUS_DISABLED" ]]; then

    kubectl rollout status -n "$KUBE_NAMESPACE" -w "$ROLLOUT_RESOURCE_TYPE/$name"

  fi

}



function scale() {

  track="${1-stable}"

  percentage="${2-100}"

  name=$(deploy_name "$track")



  replicas=$(get_replicas "$track" "$percentage")



  if [[ -n "$(helm ls -q "^$name$")" ]]; then

    helm upgrade --reuse-values \

      --wait \

      --set replicaCount="$replicas" \

      --namespace="$KUBE_NAMESPACE" \

      "$name" \

      chart/

  fi

}



function delete() {

  track="${1-stable}"

  name=$(deploy_name "$track")



  if [[ -n "$(helm ls -q "^$name$")" ]]; then

    helm delete --purge "$name"

  fi



  secret_name=$(application_secret_name "$track")

  kubectl delete secret --ignore-not-found -n "$KUBE_NAMESPACE" "$secret_name"

}



## Helper functions



# Extracts variables prefixed with K8S_SECRET_

# and creates a Kubernetes secret.

#

# e.g. If we have the following environment variables:

#   K8S_SECRET_A=value1

#   K8S_SECRET_B=multi\ word\ value

#

# Then we will create a secret with the following key-value pairs:

#   data:

#     A: dmFsdWUxCg==

#     B: bXVsdGkgd29yZCB2YWx1ZQo=

function create_application_secret() {

  track="${1-stable}"

  export APPLICATION_SECRET_NAME=$(application_secret_name "$track")



  env | sed -n "s/^K8S_SECRET_\(.*\)$/\1/p" > k8s_prefixed_variables



  kubectl create secret \

    -n "$KUBE_NAMESPACE" generic "$APPLICATION_SECRET_NAME" \

    --from-env-file k8s_prefixed_variables -o yaml --dry-run |

    kubectl replace -n "$KUBE_NAMESPACE" --force -f -



  export APPLICATION_SECRET_CHECKSUM=$(cat k8s_prefixed_variables | sha256sum | cut -d ' ' -f 1)



  rm k8s_prefixed_variables

}



function application_secret_name() {

  track="${1-stable}"

  name=$(deploy_name "$track")



  echo "${name}-secret"

}



function deploy_name() {

  name="$CI_ENVIRONMENT_SLUG"

  track="${1-stable}"



  if [[ "$track" != "stable" ]]; then

    name="$name-$track"

  fi



  echo $name

}



function get_replicas() {

  track="${1:-stable}"

  percentage="${2:-100}"



  env_track=$( echo $track | tr -s  '[:lower:]'  '[:upper:]' )

  env_slug=$( echo ${CI_ENVIRONMENT_SLUG//-/_} | tr -s  '[:lower:]'  '[:upper:]' )



  if [[ "$track" == "stable" ]] || [[ "$track" == "rollout" ]]; then

    # for stable track get number of replicas from `PRODUCTION_REPLICAS`

    eval new_replicas=\$${env_slug}_REPLICAS

    if [[ -z "$new_replicas" ]]; then

      new_replicas=$REPLICAS

    fi

  else

    # for all tracks get number of replicas from `CANARY_PRODUCTION_REPLICAS`

    eval new_replicas=\$${env_track}_${env_slug}_REPLICAS

    if [[ -z "$new_replicas" ]]; then

      eval new_replicas=\${env_track}_REPLICAS

    fi

  fi



  replicas="${new_replicas:-1}"

  replicas="$(($replicas * $percentage / 100))"



  # always return at least one replicas

  if [[ $replicas -gt 0 ]]; then

    echo "$replicas"

  else

    echo 1

  fi

}

src/install_dependencies.sh

0 → 100755
+14 −0
Original line number Diff line number Diff line 
#! /bin/sh



apk add -U openssl curl tar gzip bash ca-certificates git

curl -sSL -o /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub

curl -sSL -O https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.28-r0/glibc-2.28-r0.apk

apk add glibc-2.28-r0.apk

rm glibc-2.28-r0.apk



curl -sS "https://kubernetes-helm.storage.googleapis.com/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | tar zx

mv linux-amd64/helm /usr/bin/

mv linux-amd64/tiller /usr/bin/



curl -sSL -o /usr/bin/kubectl "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl"

chmod +x /usr/bin/kubectl