Commit a050d30d authored by Andres Anaya Amariels's avatar Andres Anaya Amariels 🚀
Browse files

deploy ocf main & >>: main_dnd

parent 495576d7

capif/.gitlab-ci.yml

+39 −155
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ stages: 
  - main_container_scanning

  - sast

  - merge_request_staging_into_main

  - testing

  - staging_cancel_previous_action

  - dev_cancel_previous_action

#  - staging_pulling_repo
@@ -18,6 +19,8 @@ stages: 
  - dev_linting_code

  - dev_linting_docker

  - dev_build_and_push

  - deploy_ocf_main

  - delete_ocf_main

  - deploy_ocf_staging

  - delete_ocf_staging

  - deploy_ocf_dev
@@ -44,6 +47,17 @@ variables: 
  tags:

    - shell



.main_dnd: &main_dnd

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker



.staging_common: &staging_common

  only:

    - merge_requests
@@ -249,16 +263,7 @@ main_semgrep_sast: 
    DOCKER_HOST: tcp://docker:2375

#    SAST_EXCLUDED_ANALYZERS: "nodejs-scan-sast"

    SAST_DEFAULT_ANALYZERS: bandit

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

# - if: '$CI_COMMIT_REF_NAME == "staging"'  # must be staging when staging into main MR

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



main_kubesec_sast:

  stage: main_sast
@@ -273,45 +278,21 @@ main_kubesec_sast: 
    DOCKER_HOST: tcp://docker:2375

    SCAN_KUBERNETES_MANIFESTS: "true"

    KUBESEC_HELM_CHARTS_PATH: helm/capif/

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



main_gemnasium_python_dependency_scanning:

  stage: main_sast

  extends: gemnasium-python-dependency_scanning

  variables:

    DS_ANALYZER_NAME: "gemnasium-python"

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



main_serect_detection:

  stage: main_sast

  extends: secret_detection

  variables:

    SECRET_DETECTION_HISTORIC_SCAN: "true"

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_nginx:

  stage: main_container_scanning
@@ -330,15 +311,7 @@ cvs_nginx: 
#    GIT_STRATEGY: fetch

#    CS_DOCKERFILE_PATH: capif/services/nginx/

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_register:

  stage: main_container_scanning
@@ -354,15 +327,7 @@ cvs_register: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_access_control_policy_api:

  stage: main_container_scanning
@@ -378,15 +343,7 @@ cvs_ocf_access_control_policy_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_api_invoker_management_api:

  stage: main_container_scanning
@@ -402,15 +359,7 @@ cvs_ocf_api_invoker_management_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_api_provider_management_api:

  stage: main_container_scanning
@@ -426,15 +375,7 @@ cvs_ocf_api_provider_management_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_auditing_api:

  stage: main_container_scanning
@@ -450,15 +391,7 @@ cvs_ocf_auditing_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_discover_service_api:

  stage: main_container_scanning
@@ -474,15 +407,7 @@ cvs_ocf_discover_service_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_events_api:

  stage: main_container_scanning
@@ -498,15 +423,7 @@ cvs_ocf_events_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_logging_api_invocation_api:

  stage: main_container_scanning
@@ -522,15 +439,7 @@ cvs_ocf_logging_api_invocation_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_publish_service_api:

  stage: main_container_scanning
@@ -546,15 +455,7 @@ cvs_ocf_publish_service_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_routing_info_api:

  stage: main_container_scanning
@@ -570,15 +471,7 @@ cvs_ocf_routing_info_api: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_ocf_security_api:

  stage: main_container_scanning
@@ -593,16 +486,7 @@ cvs_ocf_security_api: 
    CS_IMAGE: "$CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-security-api:$CI_COMMIT_REF_SLUG"

    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



cvs_vault:

  stage: main_container_scanning
@@ -618,15 +502,15 @@ cvs_vault: 
    CS_REGISTRY_USER: $CI_REGISTRY_USER

    CS_REGISTRY_PASSWORD: $CAPIF_DOCKER_REGISTRY

    SECURE_LOG_LEVEL: debug

  allow_failure: true

  services:

    - docker:24.0.5-dind

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  tags:

    - docker-in-docker

  <<: *main_dnd



robot_framework_testing:

  needs: ["deploy_ocf_main"]

  stage: testing

  script: 

   - |

    echo "------ Robot Framework Testing ------"

  <<: *main_common



#ci_in_staging:

#  stage: ci_in_staging

capif/templates/cd-deploy-ocf.gitlab-ci.yml

+73 −0
Original line number Diff line number Diff line 
stages:

  - deploy_ocf_main

  - delete_ocf_main

  - deploy_ocf_staging

  - delete_ocf_staging

  - deploy_ocf_dev
@@ -14,6 +16,15 @@ variables: 
  IMAGE_TAG_DEV: $CI_COMMIT_REF_SLUG

  IMAGE_TAG_STAGING: $CI_COMMIT_REF_SLUG



.main_common: &main_common

  only:

    - merge_requests

  except:

    variables:

      - $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "main"

  tags:

    - shell



.staging_common: &staging_common

  only:

    - merge_requests
@@ -27,6 +38,68 @@ variables: 
  tags:

    - shell



deploy_ocf_main:

  stage: deploy_ocf_main

  <<: *main_common

  environment:

    name: review/main

    url: https://$NAMESPACE_STAGING.$DOMAIN_STAGING

    on_stop: delete_ocf_main

    auto_stop_in: 3 day

#  rules:

#    - if: $CI_COMMIT_BRANCH == "staging"

#      when: never

#    - if: $CI_COMMIT_BRANCH == "main"

  script:

#    - echo "### git clone OCF repo ###" 

#    - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git

    - echo "### install helm###"

    - curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3

#    - chmod 700 get_helm.sh

#    - ./get_helm.sh

#    - helm version

#    - echo "### install kubectl###" 

#    - curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"

#    - chmod +x kubectl

#    - sudo mv kubectl /usr/local/bin

#    - kubectl version --output=yaml

#    - echo "### setting kubeconfig###"

#    - echo $KUBECONFIG | base64 -d > ~/cluster.kubeconfig

#    - kubectl get nodes --kubeconfig ~/cluster.kubeconfig

#    - kubectl cluster-info --kubeconfig ~/cluster.kubeconfig #comment that when is working

#    - echo "### install yq###"

#    - sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64

#    - sudo chmod a+x /usr/local/bin/yq

#    - yq --version

#    - yq e -i '.version = "$IMAGE_TAG_STAGING"' helm/capif/Chart.yaml

#    - yq e -i '.appVersion = "$IMAGE_TAG_STAGING"' helm/capif/Chart.yaml

#    - cat helm/capif/Chart.yaml

#    - echo "### download dependencies###"

#    - helm dependency build helm/capif

#    - echo "### updating capif###"

#    - helm uninstall -n $NAMESPACE_STAGING ocf --kubeconfig ~/cluster.kubeconfig || true

#    - helm upgrade --install -n $NAMESPACE_STAGING ocf helm/capif/ \

#      --set nginx.nginx.env.capifHostname=capif.$DOMAIN_STAGING \

#      --set ingress_ip.oneke="$INGRESS" --atomic \

#      --set monitoring.prometheus.enable="" \

#      --set monitoring.grafana.ingress.hosts[0].host="grafana.$DOMAIN_STAGING" \

#      --set monitoring.grafana.ingress.hosts[0].paths[0].path="/" \

#      --set monitoring.grafana.ingress.hosts[0].paths[0].pathType="Prefix" \

#      --wait --timeout=10m \

#      --create-NAMESPACE_STAGING --kubeconfig ~/cluster.kubeconfig





delete_ocf_main:

  stage: delete_ocf_main

  <<: *main_common

  script:

    - echo "### deleting environment $NAMESPACE_STAGING###"

#    - helm uninstall -n $NAMESPACE_STAGING ocf --kubeconfig ~/cluster.kubeconfig

  when: manual

  environment:

    name: review/staging

    action: stop



deploy_ocf_staging:

  stage: deploy_ocf_staging

  <<: *staging_common