.gitlab-ci.yml

---
# This pipeline requires 7 variables to be set in the CI/CD Settings
# hint for creating the base64 encoded content: `cat .ssh/id_rsa|base64|pbcopy`

# AWS_CREDENTIALS - base64 encoded credentials file (think ~/.aws/credentials)
# AWS_CONFIG - base64 encoded config file (think ~/.aws/config)
# GKE_CONFIG - base64 encoded json file (think ~/.config/gcloud/someconfig.json)
# REGISTRY_PASSWORD - robot token for kraken_lib_rw
# REGISTRY_PASSWORD_K2 - robot token for k2_rw
image: docker:latest

services:
  - docker:dind

variables:
  DOCKER_HOST: tcp://localhost:2375
  DOCKER_DRIVER: overlay2
  REGISTRY_USER: samsung_cnct
  IMAGE_NAME: kraken-lib
  REGISTRY: quay.io
  ROBOT_ACCOUNT: kraken_lib_rw
  ROBOT_ACCOUNT_K2: k2_rw
  KUBERNETES_E2E_TEST_VERSION: v1.9.0
  KUBERNETES_E2E_TEST_VERSION_MINUS_ONE: v1.8.5
  KUBERNETES_E2E_TEST_VERSION_MINUS_TWO: v1.7.11
  ANSIBLE_LINT: "quay.io/samsung_cnct/ansible-lint:latest"
  KRAKEN_TOOLS: "quay.io/samsung_cnct/kraken-tools:latest"
  # this is used to build tagged versions of kraken-lib
  KRAKEN_TOOLS_TAGGED: "quay.io/samsung_cnct/kraken-tools:v0.9"
  E2E_TESTER: "quay.io/samsung_cnct/e2etester:0.2"

stages:
  - vet
  - config-generation
  - pre-test
  - test
  - test-security
  - test-e2e
  - cleanup
  - build
  - publish

#This is the *Default* before_script; some jobs override, and therefore must reference it through YAML pointers.
before_script: &setup_credentials
  - mkdir -p /root/.aws /root/.config/gcloud
  - echo "$AWS_CREDENTIALS" | base64 -d > /root/.aws/credentials
  - echo "$AWS_CONFIG" | base64 -d > /root/.aws/config
  - echo "$GKE_CONFIG" | base64 -d > /root/.config/gcloud/patrickRobot.json
  - mkdir -p /root/.ssh
  - cp -v ${CI_PROJECT_DIR}/.ssh/id_rsa* /root/.ssh/

vet:ansible-lint:
  stage: vet
  image: $ANSIBLE_LINT
  before_script: # override the default above
    - echo "Linting doesn't require secrets, huzzah!"
  script:
    - ls ansible/*.yaml ansible/**/*.yaml | xargs -I {} ansible-lint {}


# NOTE: artifacts cannot be pulled from /root/
config-generation:create-ssh-keys:
  stage: config-generation
  image: $KRAKEN_TOOLS
  before_script: # override the default above
    - echo "Generating SSH keys doesn't require secrets, but maybe it should? We could use a CI passphrase for stronger security."
  script:
    - mkdir -p /root/.ssh
    - ./hack/key_gen
    - test -f /root/.ssh/id_rsa || exit $?
    - mkdir -p ${CI_PROJECT_DIR}/.ssh/
    - cp /root/.ssh/id_rsa* ${CI_PROJECT_DIR}/.ssh/
  artifacts:
    paths: 
      - ${CI_PROJECT_DIR}/.ssh/
    expire_in: 14 day

config-generation:create-aws-config-default:
  stage: config-generation
  only:
    - tags
    - branches
  image: $KRAKEN_TOOLS
  artifacts:
    paths:
      - $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/config.yaml
    expire_in: 14 day
    when: always
  before_script:
    - echo "We don't need secrets to generate config."
  script:
    - hack/gen-test-config.sh aws $KUBERNETES_E2E_TEST_VERSION

config-generation:create-aws-config-minus-one:
  stage: config-generation
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $KRAKEN_TOOLS
  artifacts:
    paths:
      - $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/config.yaml
    expire_in: 14 day
  before_script:
    - echo "We don't need secrets to generate config."
  script:
    - hack/gen-test-config.sh aws $KUBERNETES_E2E_TEST_VERSION_MINUS_ONE

config-generation:create-aws-config-minus-two:
  stage: config-generation
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $KRAKEN_TOOLS
  artifacts:
    paths:
      - $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/config.yaml
    expire_in: 14 day
  before_script:
    - echo "We don't need secrets to generate config."
  script:
    - hack/gen-test-config.sh aws $KUBERNETES_E2E_TEST_VERSION_MINUS_TWO

config-generation:create-gke-config:
  stage: config-generation
  only:
    - tags
    - branches
  image: $KRAKEN_TOOLS
  artifacts:
    paths:
      - $CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/config.yaml
    expire_in: 14 day 
    when: always
  before_script:
    - echo "We don't need secrets to generate config."
  script:
    - hack/gen-test-config.sh gke $KUBERNETES_E2E_TEST_VERSION

# Fail as early as possible if the generated dependencies somehow are missing.
test:validate-config:
  stage: pre-test
  script:
    - echo "When this job fails, something's wrong in your CI config."
    - test -f /root/.ssh/id_rsa || exit $?
    - test -f $CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/config.yaml || exit $?
    - test -f $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/config.yaml || exit $?
    - test -s /root/.aws/config || exit $?
    - test -s /root/.aws/credentials || exit $?
    - test -s /root/.config/gcloud/patrickRobot.json || exit $?


test:aws-dry-run-default:
  stage: pre-test
  only:
    - tags
    - branches
  variables:
    JOB_BASE_NAME: ${CI_PROJECT_NAME}
    BUILD_ID: $CI_PIPELINE_ID
  image: $KRAKEN_TOOLS
  script:
    - >-
      PWD=`pwd` ./bin/up.sh
      --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/config.yaml
      --output $PWD/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/
      --tags dryrun

test:aws-dry-run-minus-one:
  stage: pre-test
  only:
    - "/master/"
    - "/.*test-all.*/"
  variables:
    JOB_BASE_NAME: ${CI_PROJECT_NAME}
    BUILD_ID: $CI_PIPELINE_ID
  image: $KRAKEN_TOOLS
  script:
    - >-
      PWD=`pwd` ./bin/up.sh
      --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/config.yaml
      --output $PWD/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/
      --tags dryrun

test:aws-dry-run-minus-two:
  stage: pre-test
  only:
    - "/master/"
    - "/.*test-all.*/"
  variables:
    JOB_BASE_NAME: ${CI_PROJECT_NAME}
    BUILD_ID: $CI_PIPELINE_ID
  image: $KRAKEN_TOOLS
  script:
    - >-
      PWD=`pwd` ./bin/up.sh
      --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/config.yaml
      --output $PWD/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/
      --tags dryrun

# Setup a cluster in AWS
test:cloud-aws-default:
  stage: test
  image: $KRAKEN_TOOLS
  artifacts:
    when: always
    paths:
      - $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/**
    expire_in: 14 day
  script:
    - test -f "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/config.yaml" || exit $?
    - ./bin/up.sh --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/config.yaml --output $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/ --verbose "-vvv"

# Setup a cluster in AWS
test:cloud-aws-minus-one:
  stage: test
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $KRAKEN_TOOLS
  artifacts:
    when: always
    paths:
      - $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/**
    expire_in: 14 day
  script:
    - test -f "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/config.yaml" || exit $?
    - ./bin/up.sh --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/config.yaml --output $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/ --verbose "-vvv"

# Setup a cluster in AWS
test:cloud-aws-minus-two:
  stage: test
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $KRAKEN_TOOLS
  artifacts:
    when: always
    paths:
      - $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/**
    expire_in: 14 day
  script:
    - test -f "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/config.yaml" || exit $?
    - ./bin/up.sh --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/config.yaml --output $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/ --verbose "-vvv"


# Setup a cluster in GKE
test:cloud-gke:
  stage: test
  image: $KRAKEN_TOOLS
  artifacts:
    when: always
    paths:
      - $CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/**
    expire_in: 14 day
  script:
    - test -f "$CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/config.yaml" || exit $?
    - ./bin/up.sh --config $CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/config.yaml --output $CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/ --verbose "-vvv"

test-security:benchmark:
  stage: test-security
  only:
    - tags
    - branches
  image: $KRAKEN_TOOLS
  artifacts:
    paths:
      - $CI_PROJECT_DIR/build/tests/**
    expire_in: 14 day
  allow_failure: true
  script:
    - build-scripts/benchmark-tests "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION"

test-security:benchmark-minus-one:
  stage: test-security
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $KRAKEN_TOOLS
  artifacts:
    paths:
      - $CI_PROJECT_DIR/build/tests/**
    expire_in: 14 day
  allow_failure: true
  script:
    - build-scripts/benchmark-tests "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE"

test-security:benchmark-minus-two:
  stage: test-security
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $KRAKEN_TOOLS
  artifacts:
    paths:
      - $CI_PROJECT_DIR/build/tests/**
    expire_in: 14 day
  allow_failure: true
  script:
    - build-scripts/benchmark-tests "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO"

test-e2e:e2e:
  stage: test-e2e
  only:
    - tags
    - branches
  image: $E2E_TESTER
  allow_failure: true
  script:
    - build-scripts/conformance-tests "${KUBERNETES_E2E_TEST_VERSION}" krakenlib-$CI_PIPELINE_ID-$KUBERNETES_E2E_TEST_VERSION /var/opt/gitlab

test-e2e:e2e-minus-one:
  stage: test-e2e
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $E2E_TESTER
  allow_failure: true
  script:
    - build-scripts/conformance-tests "${KUBERNETES_E2E_TEST_VERSION_MINUS_ONE}" krakenlib-$CI_PIPELINE_ID-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE /var/opt/gitlab

test-e2e:e2e-minus-two:
  stage: test-e2e
  only:
    - "/master/"
    - "/.*test-all.*/"
  image: $E2E_TESTER
  allow_failure: true
  script:
    - build-scripts/conformance-tests "${KUBERNETES_E2E_TEST_VERSION_MINUS_TWO}" krakenlib-$CI_PIPELINE_ID-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO /var/opt/gitlab


cleanup:cloud-aws-default:
  stage: cleanup
  image: $KRAKEN_TOOLS
  when: always
  script:
    - test -f "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/config.yaml" || exit $?
    - ./bin/down.sh --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/config.yaml --output $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION/ --verbose "-vvv"

cleanup:cloud-aws-default-minus-one:
  stage: cleanup
  image: $KRAKEN_TOOLS
  only:
    - "/master/"
    - "/.*test-all.*/"
  when: always
  script:
    - test -f "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/config.yaml" || exit $?
    - ./bin/down.sh --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/config.yaml --output $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_ONE/ --verbose "-vvv"

cleanup:cloud-aws-default-minus-two:
  stage: cleanup
  image: $KRAKEN_TOOLS
  only:
    - "/master/"
    - "/.*test-all.*/"
  when: always
  script:
    - test -f "$CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/config.yaml" || exit $?
    - ./bin/down.sh --config $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/config.yaml --output $CI_PROJECT_DIR/cluster/aws-$KUBERNETES_E2E_TEST_VERSION_MINUS_TWO/ --verbose "-vvv"

cleanup:cloud-gke:
  stage: cleanup
  image: $KRAKEN_TOOLS
  when: always
  script:
    - test -f "$CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/config.yaml" || exit $?
    - ./bin/down.sh --config $CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/config.yaml --output $CI_PROJECT_DIR/cluster/gke-$KUBERNETES_E2E_TEST_VERSION/ --verbose "-vvv"

# build and publish kraken-lib and backwards compatibility project name "K2"
build:build-latest-master-quay:
  stage: build
  only:
    - master
  variables:
    IMAGE_URI: $CI_REGISTRY_IMAGE:branch-$CI_COMMIT_REF_NAME-$CI_PIPELINE_ID
  before_script:
    - docker info
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
  script:
    - docker build -t $IMAGE_URI docker/
    - docker push $IMAGE_URI

build:build-tagged-image-quay:
  stage: build
  only:
    - /v[0-9]+\.[0-9]+(\.[0-9]+[a-z]?)?/
  except:
    - branches
  variables:
    IMAGE_URI: $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
  before_script:
    - docker info
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
    - ./build-scripts/docker-update.sh $KRAKEN_TOOLS_TAGGED docker/Dockerfile
  script:
    - docker build -t $IMAGE_URI docker/
    - docker push $IMAGE_URI 

publish:publish-latest-master-quay:
  stage: publish
  only:
    - master
  variables:
    IMAGE_URI: $CI_REGISTRY_IMAGE:branch-$CI_COMMIT_REF_NAME-$CI_PIPELINE_ID
  before_script:
    - docker info
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
  script:
    - docker pull $IMAGE_URI
    - docker login ${REGISTRY} -u ${REGISTRY_USER}+${ROBOT_ACCOUNT} -p ${REGISTRY_PASSWORD}
    # Any merge to master (i.e. a successful CI pass) will be tagged and pushed as latest
    - docker tag ${IMAGE_URI} ${REGISTRY}/${REGISTRY_USER}/${IMAGE_NAME}:latest
    - docker push ${REGISTRY}/${REGISTRY_USER}/${IMAGE_NAME}:latest
    # backwards compatibility
    - docker login ${REGISTRY} -u ${REGISTRY_USER}+${ROBOT_ACCOUNT_K2} -p ${REGISTRY_PASSWORD_K2}
    - docker tag ${IMAGE_URI} ${REGISTRY}/${REGISTRY_USER}/k2:latest
    - docker push ${REGISTRY}/${REGISTRY_USER}/k2:latest

publish:publish-tagged-image-quay:
  stage: publish
  only:
    - /v[0-9]+\.[0-9]+(\.[0-9]+[a-z]?)?/
  except:
    - branches
  variables:
    IMAGE_URI: $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
  before_script:
    - docker info
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
  script:
    - docker pull $IMAGE_URI
    - docker login ${REGISTRY} -u ${REGISTRY_USER}+${ROBOT_ACCOUNT} -p ${REGISTRY_PASSWORD}
    # A tag push to master will be pushed to Quay with that tag
    - docker tag ${IMAGE_URI} ${REGISTRY}/${REGISTRY_USER}/${IMAGE_NAME}:$CI_COMMIT_TAG
    - docker push ${REGISTRY}/${REGISTRY_USER}/${IMAGE_NAME}:$CI_COMMIT_TAG
    # backwards compatibility
    - docker login ${REGISTRY} -u ${REGISTRY_USER}+${ROBOT_ACCOUNT_K2} -p ${REGISTRY_PASSWORD_K2}
    - docker tag ${IMAGE_URI} ${REGISTRY}/${REGISTRY_USER}/k2:$CI_COMMIT_TAG
    - docker push ${REGISTRY}/${REGISTRY_USER}/k2:$CI_COMMIT_TAG