deploy.gitlab-ci.yml

# ---------------------------------------------------------------------------
# ---------------------------------------------------------------------------

# .auto_devops: &auto_devops |
#   # Auto DevOps variables and functions

#   set -x

#   export RELEASE_NAME=${HELM_RELEASE_NAME:-$CI_ENVIRONMENT_SLUG}
#   export AUTO_DEPLOY_ENVIRONMENT_VALUES_FILE=/tmp/auto-deploy-environment-values.yaml
#   export ASSETS_DIR='/assets'
#   export ASSETS_CHART_DIR="${ASSETS_DIR}/auto-deploy-app"

#   check_kube_domain() {

#     if [ -z "$KUBE_INGRESS_BASE_DOMAIN" ]; then
#       echo "In order to deploy or use Review Apps,"
#       echo "KUBE_INGRESS_BASE_DOMAIN variables must be set"
#       echo "From 11.8, you can set KUBE_INGRESS_BASE_DOMAIN in cluster settings"
#       echo "or by defining a variable at group or project level."
#       echo "You can also manually add it in .gitlab-ci.yml"
#       false
#     else
#       true
#     fi
#   }

#   prepare_deploy() {

#     echo "Installing dependencies..."

#     apk add -U openssh openssl curl tar gzip bash ca-certificates git jq
#     curl -sSL -o /etc/apk/keys/sgerrand.rsa.pub "https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub"
#     curl -sSL -O "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-${GLIBC_VERSION}.apk"
#     apk add glibc-${GLIBC_VERSION}.apk
#     apk add ruby jq ruby-json
#     rm "glibc-${GLIBC_VERSION}.apk"

#     curl -L -o /usr/bin/kubectl "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl"
#     chmod +x /usr/bin/kubectl
#     kubectl version --client

#     echo "Checking kubernetes namespace..."
#     kubectl describe namespace "$KUBE_NAMESPACE" || kubectl create namespace "$KUBE_NAMESPACE"

#     curl "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | tar zx
#     mv linux-amd64/helm /usr/bin/
#     chmod +x /usr/bin/helm
#     helm version --client
#   }

#   download_chart() {
#     add_chart_repositories

#     if [ -d chart ]; then
#       echo "Download skipped. Using the chart at local path 'chart/'..."
#     elif [ -n "$AUTO_DEVOPS_CHART" ]; then
#       # user specified a custom chart to use, but it can be a local directory or a remote chart
#       if [ -d "$AUTO_DEVOPS_CHART" ]; then
#         echo "Download skipped. Using the chart at local path '$AUTO_DEVOPS_CHART' (moving to 'chart/' first)..."
#         mv "$AUTO_DEVOPS_CHART" chart/
#       else
#         echo "Downloading remote chart '$AUTO_DEVOPS_CHART'..."
#         helm pull "$AUTO_DEVOPS_CHART" --untar

#         local auto_chart_name
#         auto_chart_name=$(basename "$AUTO_DEVOPS_CHART")
#         auto_chart_name=${auto_chart_name%.tgz}
#         auto_chart_name=${auto_chart_name%.tar.gz}
#         if [ "$auto_chart_name" != "chart" ]; then
#           mv "$auto_chart_name" chart
#         fi
#       fi
#     else
#       echo "Download skipped. Using the default chart included in auto-deploy-image..."
#       cp -R "$ASSETS_CHART_DIR" chart
#     fi

#     if [ -f chart/requirements.lock ]; then
#       helm dependency build chart/
#     else
#       helm dependency update chart/
#     fi
#   }

#   add_chart_repositories() {
#     helm repo add stable https://charts.helm.sh/stable
#     # bitnami repository is used for in-cluster PostgreSQL installation.
#     if [ "$POSTGRES_ENABLED" == "true" ]; then
#       helm repo add bitnami https://charts.bitnami.com/bitnami
#     fi
#     # Additionaly, users can specify their custom chart repository.
#     add_custom_chart_repository
#   }

#   add_custom_chart_repository() {
#     if [ -z "$AUTO_DEVOPS_CHART_REPOSITORY" ]; then
#       return
#     fi

#     echo "Adding Helm chart repository '$AUTO_DEVOPS_CHART_REPOSITORY_NAME'"

#     # repo should always be added when present, because any chart can have external dependencies
#     local helm_repo_auth=()
#     if [ -n "$AUTO_DEVOPS_CHART_REPOSITORY_USERNAME" ]; then
#       helm_repo_auth+=('--username' "$AUTO_DEVOPS_CHART_REPOSITORY_USERNAME")
#     fi
#     if [ -n "$AUTO_DEVOPS_CHART_REPOSITORY_PASSWORD" ]; then
#       helm_repo_auth+=('--password' "$AUTO_DEVOPS_CHART_REPOSITORY_PASSWORD")
#     fi
#     helm repo add \
#       "${AUTO_DEVOPS_CHART_REPOSITORY_NAME}" \
#       "${AUTO_DEVOPS_CHART_REPOSITORY}" \
#       "${helm_repo_auth[@]}"
#   }

#   ensure_namespace() {
#     kubectl get namespace "$KUBE_NAMESPACE" || kubectl create namespace "$KUBE_NAMESPACE"
#   }

#   write_environment_values_file() {
#     echo "deploymentApiVersion: apps/v1" >"$AUTO_DEPLOY_ENVIRONMENT_VALUES_FILE"

#     # Helm 3 does not like `--set image.secrets[0]=""`
#     if [ "$CI_PROJECT_VISIBILITY" != "public" ]; then
#       echo "image: { secrets: [ { name: gitlab-registry-${CI_PROJECT_PATH_SLUG} } ] }" >>"$AUTO_DEPLOY_ENVIRONMENT_VALUES_FILE"
#     else
#       echo "image: { secrets: null }" >>"$AUTO_DEPLOY_ENVIRONMENT_VALUES_FILE"
#     fi
#   }

#   create_secret() {
#     echo "Create secret..."
#     if [ "$CI_PROJECT_VISIBILITY" == "public" ]; then
#       return
#     fi

#     kubectl create secret -n "$KUBE_NAMESPACE" \
#       docker-registry "gitlab-registry-${CI_PROJECT_PATH_SLUG}" \
#       --docker-server="$CI_REGISTRY" \
#       --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \
#       --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \
#       --docker-email="$GITLAB_USER_EMAIL" \
#       -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -
#   }

#   # shellcheck disable=SC2086
#   persist_environment_url() {
#     echo $CI_ENVIRONMENT_URL >environment_url.txt
#   }

#   deploy() {

#     validate-chart-version "$(helm list --namespace "$KUBE_NAMESPACE" --output json)" "chart" "$name"

#     local image_repository
#     local image_tag

#     if [ -z "$CI_COMMIT_TAG" ]; then
#       image_repository=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG}
#       image_tag=${CI_APPLICATION_TAG:-$CI_COMMIT_SHA}
#     else
#       image_repository=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE}
#       image_tag=${CI_APPLICATION_TAG:-$CI_COMMIT_TAG}
#     fi


#     local modsecurity_set_args=()
#     if [ -n "$AUTO_DEVOPS_MODSECURITY_SEC_RULE_ENGINE" ]; then
#       modsecurity_set_args=("--set" "ingress.modSecurity.enabled=true,ingress.modSecurity.secRuleEngine=$AUTO_DEVOPS_MODSECURITY_SEC_RULE_ENGINE")
#     fi

#     create_application_secret "$track"

#     local env_slug
#     env_slug=$(echo "${CI_ENVIRONMENT_SLUG//-/_}" | tr '[:lower:]' '[:upper:]')

#     local additional_hosts
#     eval local env_ADDITIONAL_HOSTS="\$${env_slug}_ADDITIONAL_HOSTS"
#     if [ -n "$env_ADDITIONAL_HOSTS" ]; then
#       additional_hosts="{$env_ADDITIONAL_HOSTS}"
#     elif [ -n "$ADDITIONAL_HOSTS" ]; then
#       additional_hosts="{$ADDITIONAL_HOSTS}"
#     fi

#     local helm_values_args=()
#     local helm_values_file=${HELM_UPGRADE_VALUES_FILE:-.gitlab/auto-deploy-values.yaml}
#     if [ -f "${helm_values_file}" ]; then
#       echo "Using helm values file ${helm_values_file@Q}"
#       helm_values_args=(--values "${helm_values_file}")
#     else
#       echo "No helm values file found at ${helm_values_file@Q}"
#     fi


#     # TODO: Over time, migrate all --set values to this file, see https://gitlab.com/gitlab-org/cluster-integration/auto-deploy-image/-/issues/31
#     write_environment_values_file

#     echo "Deploying new release..."
#     # shellcheck disable=SC2086 # HELM_UPGRADE_EXTRA_ARGS -- double quote variables to prevent globbing
#     helm upgrade --install \
#       --wait \
#       --set gitlab.app="$CI_PROJECT_PATH_SLUG" \
#       --set gitlab.env="$CI_ENVIRONMENT_SLUG" \
#       --set gitlab.envName="$CI_ENVIRONMENT_NAME" \
#       --set gitlab.envURL="$CI_ENVIRONMENT_URL" \
#       --set gitlab.projectID="$CI_PROJECT_ID" \
#       --set releaseOverride="$RELEASE_NAME" \
#       --set image.repository="$image_repository" \
#       --set-string image.tag="$image_tag" \
#       --set application.secretName="$APPLICATION_SECRET_NAME" \
#       --set application.secretChecksum="$APPLICATION_SECRET_CHECKSUM" \
#       --set service.commonName="le-$CI_PROJECT_ID.$KUBE_INGRESS_BASE_DOMAIN" \
#       --set service.url="$CI_ENVIRONMENT_URL" \
#       --set service.additionalHosts="$additional_hosts" \
#       --set replicaCount="$replicas" \
#       --set ingress.canary.weight="${percentage}" \
#       --set application.initializeCommand="" \
#       "${modsecurity_set_args[@]}" \
#       --values "$AUTO_DEPLOY_ENVIRONMENT_VALUES_FILE" \
#       "${helm_values_args[@]}" \
#       $HELM_UPGRADE_EXTRA_ARGS \
#       --namespace="$KUBE_NAMESPACE" \
#       "$name" \
#       chart/

#     if [ -z "$ROLLOUT_STATUS_DISABLED" ]; then
#       kubectl rollout status -n "$KUBE_NAMESPACE" -w "$ROLLOUT_RESOURCE_TYPE/$name"
#     fi

#   }

#   scale() {
#     local track="${1-stable}"
#     local percentage="${2-100}"
#     local name
#     name=$(deploy_name "$track")

#     local replicas
#     replicas=$(get_replicas "$track")

#     if [ -n "$(helm ls --namespace "$KUBE_NAMESPACE" -q -f "^$name$")" ]; then
#       helm upgrade --reuse-values \
#         --wait \
#         --set replicaCount="$replicas" \
#         --set ingress.canary.weight="${percentage}" \
#         --namespace="$KUBE_NAMESPACE" \
#         "$name" \
#         chart/
#     fi
#   }

#   # This deletes the PVC for the database if the track is stable
#   delete() {
#     local track="${1-stable}"
#     local name
#     name=$(deploy_name "$track")

#     if [ -n "$(helm ls --namespace "$KUBE_NAMESPACE" -q -f "^$name$")" ]; then
#       helm delete "$name" --namespace "$KUBE_NAMESPACE"
#     fi

#     local secret_name
#     secret_name=$(application_secret_name "$track")

#     kubectl delete secret --ignore-not-found -n "$KUBE_NAMESPACE" "$secret_name"
#   }


#   ## Helper functions
#   ##

#   # Extracts variables prefixed with K8S_SECRET_
#   # and creates a Kubernetes secret.
#   #
#   # e.g. If we have the following environment variables:
#   #   K8S_SECRET_A=value1
#   #   K8S_SECRET_B=multi\ word\ value
#   #
#   # Then we will create a secret with the following key-value pairs:
#   #   data:
#   #     A: dmFsdWUxCg==
#   #     B: bXVsdGkgd29yZCB2YWx1ZQo=
#   #
#   create_application_secret() {
#     local track="${1-stable}"
#     local k8s_secrets_file

#     # shellcheck disable=SC2155 # declare and assign separately to avoid masking return values.
#     export APPLICATION_SECRET_NAME=$(application_secret_name "$track")

#     k8s_secrets_file=$(mktemp)

#     auto-deploy-application-secrets-yaml "$k8s_secrets_file"

#     kubectl replace -f "$k8s_secrets_file" -n "$KUBE_NAMESPACE" --force

#     # shellcheck disable=SC2002 # useless cat, prefer cmd < file
#     # shellcheck disable=SC2155 # declare and assign separately to avoid masking return values.
#     export APPLICATION_SECRET_CHECKSUM=$(cat "$k8s_secrets_file" | sha256sum | cut -d ' ' -f 1)

#     rm "$k8s_secrets_file"
#   }

#   application_secret_name() {
#     local track="${1-stable}"
#     local name
#     name=$(deploy_name "$track")

#     echo "${name}-secret"
#   }

#   # shellcheck disable=SC2086
#   deploy_name() {
#     local name="$RELEASE_NAME"
#     local track="${1-stable}"

#     if [ "$track" != "stable" ]; then
#       name="$name-$track"
#     fi

#     echo $name
#   }

#   # shellcheck disable=SC2086 # double quote to prevent globbing
#   # shellcheck disable=SC2153 # incorrectly thinks replicas vs REPLICAS is a misspelling
#   get_replicas() {
#     local track="${1:-stable}"

#     local env_track
#     env_track=$(echo $track | tr '[:lower:]' '[:upper:]')

#     local env_slug
#     env_slug=$(echo ${CI_ENVIRONMENT_SLUG//-/_} | tr '[:lower:]' '[:upper:]')

#     local environment_track_replicas
#     local environment_replicas
#     eval environment_track_replicas=\$${env_track}_${env_slug}_REPLICAS
#     eval environment_replicas=\$${env_slug}_REPLICAS

#     local new_replicas
#     new_replicas=${environment_track_replicas}
#     new_replicas=${new_replicas:-$environment_replicas}
#     new_replicas=${new_replicas:-$REPLICAS}

#     if [ -n "$new_replicas" ]; then
#       # If zero replicas requested, then return 0
#       echo "$new_replicas"
#     else
#       # Return one if replicas is not specified
#       echo 1
#     fi
#   }
#   ##
#   ## End Helper functions

# variables:
#   HELM_VERSION: 3.2.4
#   KUBERNETES_VERSION: 1.15.12
#   ALPINE_VERSION: '3.12'
#   GLIBC_VERSION: 2.31-r0

# stages:
#   - production

# production:
#   image: docker:stable-git
#   stage: production
#   services:
#     - docker:stable-dind
#   before_script:
#     - echo "Deploy to PROD...START!"
#     - *auto_devops
#   script:
#     - check_kube_domain
#     - prepare_deploy
#     - download_chart
#     - ensure_namespace
#     - create_secret
#     - deploy
#     - persist_environment_url
#   after_script:
#     - echo "Deploy to PROD...DONE!
#   environment:
#     name: eks/production
#     url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN
#   artifacts:
#     paths: [environment_url.txt]
.auto-deploy:
  image: "registry.gitlab.com/gitlab-org/cluster-integration/auto-deploy-image:v1.0.7"
  dependencies: []

# Staging deploys are disabled by default since
# continuous deployment to production is enabled by default
# If you prefer to automatically deploy to staging and
# only manually promote to production, enable this job by setting
# STAGING_ENABLED.

staging_aws:
  extends: .auto-deploy
  stage: staging
  script:
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy ensure_namespace
    - auto-deploy initialize_tiller
    - auto-deploy create_secret
    - auto-deploy deploy
  environment:
    name: eks/staging
    url: http://$CI_PROJECT_PATH_SLUG-staging.$KUBE_INGRESS_BASE_DOMAIN
  artifacts:
    paths: [environment_url.txt]
    when: always
  rules:
    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
      when: never
    - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
      when: never
    - if: '$STAGING_ENABLED'

staging_gcp:
  extends: .auto-deploy
  stage: staging
  script:
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy ensure_namespace
    - auto-deploy initialize_tiller
    - auto-deploy create_secret
    - auto-deploy deploy
  environment:
    name: gke/staging
    url: http://$CI_PROJECT_PATH_SLUG-staging.$KUBE_INGRESS_BASE_DOMAIN
  artifacts:
    paths: [environment_url.txt]
    when: always
  rules:
    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
      when: never
    - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
      when: never
    - if: '$STAGING_ENABLED'

production_aws:
  extends: .auto-deploy
  stage: production
  script:
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy ensure_namespace
    - auto-deploy initialize_tiller
    - auto-deploy create_secret
    - auto-deploy deploy
    - auto-deploy delete canary
    - auto-deploy delete rollout
    - auto-deploy persist_environment_url
  environment:
    name: eks/production
    url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN
  artifacts:
    paths: [environment_url.txt]
    when: always
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: never
    - if: '$CI_COMMIT_TAG == "aws"'

production_gcp:
  extends: .auto-deploy
  stage: production
  script:
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy ensure_namespace
    - auto-deploy initialize_tiller
    - auto-deploy create_secret
    - auto-deploy deploy
    - auto-deploy delete canary
    - auto-deploy delete rollout
    - auto-deploy persist_environment_url
  environment:
    name: gke/production
    url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN
  artifacts:
    paths: [environment_url.txt]
    when: always
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: never
    - if: '$CI_COMMIT_TAG == "gcp"'