generated from IBM/template-java-spring
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Jenkinsfile
556 lines (486 loc) · 21.1 KB
/
Jenkinsfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
def pipelineVersion='1.1.3'
println "Pipeline version: ${pipelineVersion}"
/*
* This is a vanilla Jenkins pipeline that relies on the Jenkins kubernetes plugin to dynamically provision agents for
* the build containers.
*
* The individual containers are defined in the `jenkins-pod-template.yaml` and the containers are referenced by name
* in the `container()` blocks. The underlying pod definition expects certain kube Secrets and ConfigMap objects to
* have been created in order for the Pod to run. See `jenkins-pod-template.yaml` for more information.
*
* The cloudName variable is set dynamically based on the existance/value of env.CLOUD_NAME which allows this pipeline
* to run in both Kubernetes and OpenShift environments.
*/
def buildAgentName(String jobNameWithNamespace, String buildNumber, String namespace) {
def jobName = removeNamespaceFromJobName(jobNameWithNamespace, namespace);
if (jobName.length() > 52) {
jobName = jobName.substring(0, 52);
}
return "a.${jobName}${buildNumber}".replace('_', '-').replace('/', '-').replace('-.', '.');
}
def removeNamespaceFromJobName(String jobName, String namespace) {
return jobName.replaceAll(namespace + "-", "").replaceAll(jobName + "/", "");
}
def buildSecretName(String jobNameWithNamespace, String namespace) {
return jobNameWithNamespace.replaceFirst(namespace + "/", "").replaceFirst(namespace + "-", "").replace(".", "-").toLowerCase();
}
def secretName = buildSecretName(env.JOB_NAME, env.NAMESPACE)
println "Job name: ${env.JOB_NAME}"
println "Secret name: ${secretName}"
def buildLabel = buildAgentName(env.JOB_NAME, env.BUILD_NUMBER, env.NAMESPACE);
def branch = env.BRANCH ?: "master"
def namespace = env.NAMESPACE ?: "dev"
def cloudName = env.CLOUD_NAME == "openshift" ? "openshift" : "kubernetes"
def workingDir = "/home/jenkins/agent"
podTemplate(
label: buildLabel,
cloud: cloudName,
yaml: """
apiVersion: v1
kind: Pod
spec:
serviceAccountName: jenkins
volumes:
- emptyDir: {}
name: varlibcontainers
containers:
- name: jdk11
image: jenkins/slave:latest-jdk11
tty: true
command: ["/bin/bash"]
workingDir: ${workingDir}
envFrom:
- configMapRef:
name: pactbroker-config
optional: true
env:
- name: HOME
value: ${workingDir}
- name: node
image: node:12-stretch
tty: true
command: ["/bin/bash"]
workingDir: ${workingDir}
envFrom:
- configMapRef:
name: pactbroker-config
optional: true
env:
- name: HOME
value: ${workingDir}
- name: BRANCH
value: ${branch}
- name: GIT_AUTH_USER
valueFrom:
secretKeyRef:
name: git-credentials
key: username
optional: true
- name: GIT_AUTH_PWD
valueFrom:
secretKeyRef:
name: git-credentials
key: password
optional: true
- name: buildah
image: quay.io/buildah/stable:v1.9.0
tty: true
command: ["/bin/bash"]
workingDir: ${workingDir}
securityContext:
privileged: true
envFrom:
- configMapRef:
name: ibmcloud-config
- secretRef:
name: ibmcloud-apikey
env:
- name: HOME
value: /home/devops
- name: ENVIRONMENT_NAME
value: ${env.NAMESPACE}
- name: DOCKERFILE
value: ./Dockerfile
- name: CONTEXT
value: .
- name: TLSVERIFY
value: "false"
- name: REGISTRY_USER
valueFrom:
secretKeyRef:
key: REGISTRY_USER
name: ibmcloud-apikey
optional: true
- name: REGISTRY_PASSWORD
valueFrom:
secretKeyRef:
key: REGISTRY_PASSWORD
name: ibmcloud-apikey
optional: true
- name: APIKEY
valueFrom:
secretKeyRef:
key: APIKEY
name: ibmcloud-apikey
optional: true
volumeMounts:
- mountPath: /var/lib/containers
name: varlibcontainers
- name: ibmcloud
image: docker.io/garagecatalyst/ibmcloud-dev:1.0.10
tty: true
command: ["/bin/bash"]
workingDir: ${workingDir}
envFrom:
- configMapRef:
name: ibmcloud-config
- secretRef:
name: ibmcloud-apikey
- configMapRef:
name: artifactory-config
optional: true
- secretRef:
name: artifactory-access
optional: true
env:
- name: CHART_NAME
value: base
- name: CHART_ROOT
value: chart
- name: TMP_DIR
value: .tmp
- name: HOME
value: /home/devops
- name: ENVIRONMENT_NAME
value: ${namespace}
- name: BUILD_NUMBER
value: ${env.BUILD_NUMBER}
- name: BRANCH
value: ${branch}
- name: trigger-cd
image: docker.io/garagecatalyst/ibmcloud-dev:1.0.10
tty: true
command: ["/bin/bash"]
workingDir: ${workingDir}
env:
- name: HOME
value: /home/devops
envFrom:
- configMapRef:
name: gitops-repo
optional: true
- secretRef:
name: git-credentials
optional: true
- name: sonarqube-cli
image: docker.io/sonarsource/sonar-scanner-cli:4.4
tty: true
command: ["/bin/bash"]
workingDir: ${workingDir}
envFrom:
- configMapRef:
name: sonarqube-config
optional: true
- secretRef:
name: sonarqube-access
optional: true
"""
) {
node(buildLabel) {
container(name: 'jdk11', shell: '/bin/bash') {
checkout scm
stage('Setup') {
sh '''
echo "IMAGE_NAME=$(basename -s .git `git config --get remote.origin.url` | tr '[:upper:]' '[:lower:]' | sed 's/_/-/g')" > ./env-config
echo "REPO_URL=$(git config --get remote.origin.url)" >> ./env-config
chmod a+rw ./env-config
'''
}
stage('Build') {
sh '''
./gradlew assemble --no-daemon
'''
}
stage('Test') {
sh '''#!/bin/bash
./gradlew testClasses --no-daemon
'''
}
}
container(name: 'sonarqube-cli', shell: '/bin/bash') {
stage('Sonar scan') {
sh '''#!/bin/bash
if ! command -v sonar-scanner &> /dev/null
then
echo "Skipping SonarQube step, no task defined"
exit 0
fi
if [ -n "${SONARQUBE_URL}" ]; then
sonar-scanner \
-Dsonar.login=${SONARQUBE_USER} \
-Dsonar.password=${SONARQUBE_PASSWORD} \
-Dsonar.host.url=${SONARQUBE_URL}
else
echo "Skipping Sonar Qube step"
fi
'''
}
}
container(name: 'node', shell: '/bin/bash') {
stage('Tag release') {
sh '''#!/bin/bash
set -x
set -e
if [[ -z "$GIT_AUTH_USER" ]] || [[ -z "$GIT_AUTH_PWD" ]]; then
echo "Git credentials not found. The pipeline expects to find them in a secret named 'git-credentials'."
echo " Update your CLI and register the pipeline again"
exit 1
fi
git config --local credential.helper "!f() { echo username=\\$GIT_AUTH_USER; echo password=\\$GIT_AUTH_PWD; }; f"
git fetch
git fetch --tags
git tag -l
git fetch
git fetch --tags
git tag -l
COMMIT_HASH=$(git rev-parse HEAD)
git checkout -b ${BRANCH} --track origin/${BRANCH}
git branch --set-upstream-to=origin/${BRANCH} ${BRANCH}
git reset --hard ${COMMIT_HASH}
git config --global user.name "Jenkins Pipeline"
git config --global user.email "[email protected]"
if [[ "${BRANCH}" == "master" ]] && [[ $(git describe --tag `git rev-parse HEAD`) =~ (^[0-9]+.[0-9]+.[0-9]+$) ]] || \
[[ $(git describe --tag `git rev-parse HEAD`) =~ (^[0-9]+.[0-9]+.[0-9]+-${BRANCH}[.][0-9]+$) ]]
then
echo "Latest commit is already tagged"
echo "IMAGE_NAME=$(basename -s .git `git config --get remote.origin.url` | tr '[:upper:]' '[:lower:]' | sed 's/_/-/g')" > ./env-config
echo "IMAGE_VERSION=$(git describe --abbrev=0 --tags)" >> ./env-config
exit 0
fi
mkdir -p ~/.npm
npm config set prefix ~/.npm
export PATH=$PATH:~/.npm/bin
npm i -g release-it
if [[ "${BRANCH}" != "master" ]]; then
PRE_RELEASE="--preRelease=${BRANCH}"
fi
release-it patch ${PRE_RELEASE} \
--ci \
--no-npm \
--no-git.push \
--no-git.requireCleanWorkingDir \
--verbose \
-VV
git push --follow-tags -v
echo "IMAGE_VERSION=$(git describe --abbrev=0 --tags)" > ./env-config
echo "IMAGE_NAME=$(basename -s .git `git config --get remote.origin.url` | tr '[:upper:]' '[:lower:]' | sed 's/_/-/g')" >> ./env-config
echo "REPO_URL=$(git config --get remote.origin.url)" >> ./env-config
cat ./env-config
'''
}
}
container(name: 'buildah', shell: '/bin/bash') {
stage('Build image') {
sh '''#!/bin/bash
set -e
. ./env-config
echo TLSVERIFY=${TLSVERIFY}
echo CONTEXT=${CONTEXT}
if [[ -z "${REGISTRY_PASSWORD}" ]]; then
REGISTRY_PASSWORD="${APIKEY}"
fi
APP_IMAGE="${REGISTRY_URL}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}:${IMAGE_VERSION}"
buildah bud --tls-verify=${TLSVERIFY} --format=docker -f ${DOCKERFILE} -t ${APP_IMAGE} ${CONTEXT}
if [[ -n "${REGISTRY_USER}" ]] && [[ -n "${REGISTRY_PASSWORD}" ]]; then
buildah login -u "${REGISTRY_USER}" -p "${REGISTRY_PASSWORD}" "${REGISTRY_URL}"
fi
buildah push --tls-verify=${TLSVERIFY} "${APP_IMAGE}" "docker://${APP_IMAGE}"
'''
}
}
container(name: 'ibmcloud', shell: '/bin/bash') {
stage('Deploy to DEV env') {
sh '''#!/bin/bash
. ./env-config
set +x
if [[ "${CHART_NAME}" != "${IMAGE_NAME}" ]]; then
cp -R "${CHART_ROOT}/${CHART_NAME}" "${CHART_ROOT}/${IMAGE_NAME}"
cat "${CHART_ROOT}/${CHART_NAME}/Chart.yaml" | \
yq w - name "${IMAGE_NAME}" > "${CHART_ROOT}/${IMAGE_NAME}/Chart.yaml"
fi
CHART_PATH="${CHART_ROOT}/${IMAGE_NAME}"
echo "KUBECONFIG=${KUBECONFIG}"
RELEASE_NAME="${IMAGE_NAME}"
echo "RELEASE_NAME: $RELEASE_NAME"
echo "INITIALIZING helm with client-only (no Tiller)"
helm init --client-only 1> /dev/null 2> /dev/null
echo "CHECKING CHART (lint)"
helm lint ${CHART_PATH}
IMAGE_REPOSITORY="${REGISTRY_URL}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}"
PIPELINE_IMAGE_URL="${REGISTRY_URL}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}:${IMAGE_VERSION}"
INGRESS_ENABLED="true"
ROUTE_ENABLED="false"
if [[ "${CLUSTER_TYPE}" == "openshift" ]]; then
INGRESS_ENABLED="false"
ROUTE_ENABLED="true"
fi
# Update helm chart with repository and tag values
cat ${CHART_PATH}/values.yaml | \
yq w - vcsInfo.repoUrl "${REPO_URL}" | \
yq w - vcsInfo.branch "${BRANCH}" | \
yq w - image.repository "${IMAGE_REPOSITORY}" | \
yq w - image.tag "${IMAGE_VERSION}" | \
yq w - ingress.enabled "${INGRESS_ENABLED}" | \
yq w - route.enabled "${ROUTE_ENABLED}" > ./values.yaml.tmp
cp ./values.yaml.tmp ${CHART_PATH}/values.yaml
cat ${CHART_PATH}/values.yaml
# Using 'upgrade --install" for rolling updates. Note that subsequent updates will occur in the same namespace the release is currently deployed in, ignoring the explicit--namespace argument".
helm template ${CHART_PATH} \
--name ${RELEASE_NAME} \
--namespace ${ENVIRONMENT_NAME} \
--set ingress.tlsSecretName="${TLS_SECRET_NAME}" \
--set ingress.subdomain="${INGRESS_SUBDOMAIN}" > ./release.yaml
echo -e "Generated release yaml for: ${CLUSTER_NAME}/${ENVIRONMENT_NAME}."
cat ./release.yaml
echo -e "Deploying into: ${CLUSTER_NAME}/${ENVIRONMENT_NAME}."
kubectl apply -n ${ENVIRONMENT_NAME} -f ./release.yaml --validate=false
'''
}
stage('Health Check') {
sh '''#!/bin/bash
. ./env-config
if [[ "${CLUSTER_TYPE}" == "openshift" ]]; then
PROTOCOL="https"
HOST=$(kubectl get route/${IMAGE_NAME} --namespace ${ENVIRONMENT_NAME} --output=jsonpath='{ .spec.host }')
PORT="443"
else
PROTOCOL="http"
HOST=$(kubectl get ingress.networking.k8s.io/${IMAGE_NAME} --namespace ${ENVIRONMENT_NAME} --output=jsonpath='{ .spec.rules[0].host }')
PORT="80"
fi
echo "PROTOCOL=${PROTOCOL}" >> ./env-config
echo "HOST=${HOST}" >> ./env-config
echo "PORT=${PORT}" >> ./env-config
cat ./env-config
URL="${PROTOCOL}://${HOST}"
sleep_countdown=5
# sleep for 10 seconds to allow enough time for the server to start
sleep 10
echo "Health check start"
while [[ $(curl -sL -w "%{http_code}\\n" "${URL}/health" -o /dev/null --connect-timeout 3 --max-time 5 --retry 3 --retry-max-time 30) != "200" ]]; do
sleep 30
echo "Health check failure. Remaining retries: $sleep_countdown"
sleep_countdown=$((sleep_countdown-1))
if [[ $sleep_countdown -eq 0 ]]; then
echo "Could not reach health endpoint: ${URL}/health"
exit 1;
fi
done
echo "Successfully reached health endpoint: ${URL}/health"
echo "====================================================================="
'''
}
}
container(name: 'jdk11', shell: '/bin/bash') {
stage('Pact verify') {
sh '''#!/bin/bash
if [[ -z "${PACTBROKER_URL}" ]]; then
echo "PactBroker url not set. Skipping pact verification"
exit 0
fi
set -x
set -e
. ./env-config
if ./gradlew tasks --all | grep -Eq "^pactVerify"; then
echo "Pact Verify task found"
else
echo "Skipping Pact Verify step, no task defined"
exit 0
fi
./gradlew pactVerify \
-PpactBrokerUrl=${PACTBROKER_URL} \
-PpactProtocol=https \
-PpactHost=pact-inventory-svc-dev.gct-showcase-ocp4-cluster-0143c5dd31acd8e030a1d6e0ab1380e3-0000.us-east.containers.appdomain.cloud \
-PpactPort=443 \
-Ppact.verifier.publishResults=true
'''
}
}
container(name: 'ibmcloud', shell: '/bin/bash') {
stage('Package Helm Chart') {
sh '''#!/bin/bash
set -x
if [[ -z "${ARTIFACTORY_URL}" ]]; then
echo "Skipping Artifactory step as Artifactory is not installed or configured"
exit 0
fi
. ./env-config
if [[ -z "${ARTIFACTORY_ENCRYPT}" ]]; then
echo "It looks like your Artifactory installation is not complete. Please complete the steps found here - http://ibm.biz/complete-setup"
exit 1
fi
export URL=$(curl -u${ARTIFACTORY_USER}:${ARTIFACTORY_PASSWORD} -X GET "${ARTIFACTORY_URL}/artifactory/api/repositories?type=LOCAL" | jq '.[0].url' | tr -d \\")
echo ${URL}
# Check if the URL is valid and we can continue
if [ -n "${URL}" ]; then
echo "Successfully read Repo ${URL}"
else
echo "No Repository Created"
exit 1;
fi;
# Package Helm Chart
helm package --version ${IMAGE_VERSION} ${CHART_ROOT}/${IMAGE_NAME}
# Get the index and re index it with current Helm Chart
curl -u${ARTIFACTORY_USER}:${ARTIFACTORY_ENCRYPT} -O "${URL}/${REGISTRY_NAMESPACE}/index.yaml"
if [[ $(cat index.yaml | jq '.errors[0].status') != "404" ]]; then
# Merge the chart index with the current index.yaml held in Artifactory
echo "Merging Chart into index.yaml for Chart Repository"
helm repo index . --url ${URL}/${REGISTRY_NAMESPACE} --merge index.yaml
else
# Dont Merge this is first time one is being created
echo "Creating a new index.yaml for Chart Repository"
rm index.yaml
helm repo index . --url ${URL}/${REGISTRY_NAMESPACE}
fi;
# Persist the Helm Chart in Artifactory for us by ArgoCD
curl -u${ARTIFACTORY_USER}:${ARTIFACTORY_ENCRYPT} -i -vvv -T ${IMAGE_NAME}-${IMAGE_VERSION}.tgz "${URL}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}-${IMAGE_VERSION}.tgz"
# Persist the Helm Chart in Artifactory for us by ArgoCD
curl -u${ARTIFACTORY_USER}:${ARTIFACTORY_ENCRYPT} -i -vvv -T index.yaml "${URL}/${REGISTRY_NAMESPACE}/index.yaml"
'''
}
}
container(name: 'trigger-cd', shell: '/bin/bash') {
stage('Trigger CD Pipeline') {
sh '''#!/bin/bash
if [[ -z "${url}" ]]; then
echo "'url' not set. Not triggering CD pipeline"
exit 0
fi
if [[ -z "${host}" ]]; then
echo "'host' not set. Not triggering CD pipeline"
exit 0
fi
if [[ -z "${branch}" ]]; then
branch="master"
fi
. ./env-config
# This email is not used and is not valid, you can ignore but git requires it
git config --global user.email "[email protected]"
git config --global user.name "Jenkins Pipeline"
GIT_URL="https://${username}:${password}@${host}/${org}/${repo}"
git clone -b ${branch} ${GIT_URL} gitops_cd
cd gitops_cd
echo "Requirements before update"
cat "./${IMAGE_NAME}/requirements.yaml"
npm i -g @garage-catalyst/ibm-garage-cloud-cli
igc yq w ./${IMAGE_NAME}/requirements.yaml "dependencies[?(@.name == '${IMAGE_NAME}')].version" ${IMAGE_VERSION} -i
echo "Requirements after update"
cat "./${IMAGE_NAME}/requirements.yaml"
git add -u
git commit -m "Updates ${IMAGE_NAME} to ${IMAGE_VERSION}"
git push -v
'''
}
}
}
}