.gitlab-ci.yml

include:
  - project: 'kevineu/devex/ci-cd-pipelines'
    file: '/gitlab-utils/.gitlab-ci-globals.yml'
  - project: 'kevineu/appsec/sast-configs'
    file: '/Semgrep.gitlab-ci.yml'
  - project: 'kevineu/devex/ci-cd-pipelines'
    file: '/gitlab-utils/.gitlab-ci-build-push.yml'
    ref: 'no-create-workspace-dir'
  - project: "kevineu/appsec/sast-configs"
    file: "/Semgrep.gitlab-ci.yml"

.rules:
  - &on-merge-request
    if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  - &on-push-to-main
    if: $CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"
  - &on-web-trigger
    if: $CI_PIPELINE_SOURCE == 'web'

.deploy_trigger:
  trigger:
    include:
      - local: .gitlab-ci-deploy.yml

.dev_trigger:
  extends: .deploy_trigger
  stage: deploy_dev
  variables:
    ENV: dev
    AWS_ACCOUNT_ID: $DEV_AWS_ACCOUNT_ID

.uat_trigger:
  extends: .deploy_trigger
  stage: deploy_uat
  variables:
    ENV: uat
    AWS_ACCOUNT_ID: $UAT_AWS_ACCOUNT_ID

.staging_trigger:
  extends: .deploy_trigger
  stage: deploy_staging
  variables:
    ENV: staging
    AWS_ACCOUNT_ID: $STAGING_AWS_ACCOUNT_ID

.prod_trigger:
  extends: .deploy_trigger
  stage: deploy_prod
  variables:
    ENV: prod
    AWS_ACCOUNT_ID: $PROD_AWS_ACCOUNT_ID

variables:
  APP_NAME: db-operator

semgrep:
  stage: semgrep
  extends: .semgrep

stages:
  - semgrep
  - build-ci-image
  - test_n_image_n_kuttl_test
  - helm
  - deploy_dev
  - deploy_staging
  - deploy_uat
  - deploy_prod

test and image and kuttl test:
  services:
  - name: docker:dind
    command: [ "--tls=false" ]
  stage: test_n_image_n_kuttl_test
  tags: [ "k8s-runner" ]
  image:
    # name: $CI_REGISTRY_IMAGE:1.0.0
    name: golang:1.20-buster
    pull_policy: if-not-present
  variables:
    DOCKER_HOST: tcp://localhost:2375
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: ""
    AWS_ROLE_ARN: arn:aws:iam::$MGMT_AWS_ACCOUNT_ID:role/mgmt-gitlab-role
    ECR_URI: $MGMT_AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com
    TAG_COMMIT: $ECR_URI/$APP_NAME:c-$CI_COMMIT_SHA
    TAG_LATEST: $ECR_URI/$APP_NAME:latest
    KUBERNETES_CPU_REQUEST: "3"
    KUBERNETES_CPU_LIMIT: "4"
    KUBERNETES_MEMORY_REQUEST: "1Gi"
    KUBERNETES_MEMORY_LIMIT: "2Gi"
    KUBERNETES_SERVICE_CPU_REQUEST: "3"
    KUBERNETES_SERVICE_CPU_LIMIT: "4"
    KUBERNETES_SERVICE_MEMORY_REQUEST: "3Gi"
    KUBERNETES_SERVICE_MEMORY_LIMIT: "5Gi"
    KUBERNETES_HELPER_CPU_REQUEST: "1"
    KUBERNETES_HELPER_CPU_LIMIT: "1"
    KUBERNETES_HELPER_MEMORY_REQUEST: "1Gi"
    KUBERNETES_HELPER_MEMORY_LIMIT: "1Gi"
  script:
    - apt-get update && apt-get install -y ca-certificates curl gnupg lsb-release unzip
    - mkdir -m 0755 -p /etc/apt/keyrings && curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
    - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
    - apt-get update && apt-get install -y docker-ce-cli
    - docker version
    - docker pull $TAG_LATEST || true
    - curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.17.0/kind-linux-amd64
    - chmod +x ./kind
    - mv ./kind /usr/local/bin/kind
    - curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
    - chmod +x ./kubectl
    - mv ./kubectl /usr/local/bin/kubectl
    - curl -Lo ./yq -s https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
    - chmod +x ./yq
    - mv ./yq /usr/local/bin/yq
    - |
      (
        set -x; cd "$(mktemp -d)" &&
        OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
        ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
        KREW="krew-${OS}_${ARCH}" &&
        curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
        tar zxvf "${KREW}.tar.gz" &&
        ./"${KREW}" install krew
      )
    - export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH" 
    - kubectl krew install kuttl
    - unset KUBERNETES_SERVICE_HOST # kubectl would pick up these and connect to eks in stead
    - unset KUBERNETES_SERVICE_PORT
    - make kind-cluster
    - make deploy-test-infra
    - make kuttl-test
    - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.0.30.zip" -o "awscliv2.zip"
    - unzip -qq awscliv2.zip
    - ./aws/install
    - export AWS_WEB_IDENTITY_TOKEN_FILE="./web-identity-token"
    - echo $CI_JOB_JWT_V2 > $AWS_WEB_IDENTITY_TOKEN_FILE
    - aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $ECR_URI
    - docker build -t $TAG_COMMIT .
    - docker push $TAG_COMMIT
  after_script:
    - kind delete cluster
  rules:
    - <<: *on-merge-request
      allow_failure: true
    - *on-push-to-main

deploy to dev: 
  extends: .dev_trigger
  trigger:
    strategy: depend
  when: manual
  rules:
    - <<: *on-push-to-main
      allow_failure: false
    - <<: *on-web-trigger
      allow_failure: true

deploy to staging: 
  extends: .staging_trigger
  trigger:
    strategy: depend
  when: manual
  rules:
    - <<: *on-push-to-main
      allow_failure: false
    - <<: *on-web-trigger
      allow_failure: true

deploy to uat: 
  extends: .uat_trigger
  trigger:
    strategy: depend
  when: manual
  rules:
    - <<: *on-push-to-main
      allow_failure: false
    - <<: *on-web-trigger
      allow_failure: true

deploy to prod: 
  extends: .prod_trigger
  trigger:
    strategy: depend
  when: manual
  rules:
    - <<: *on-push-to-main
      allow_failure: false
    - <<: *on-web-trigger
      allow_failure: true

build:
  image: docker:20.10.16
  stage: build-ci-image
  services:
    - docker:20.10.16-dind
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:1.0.0 .
    - docker push $CI_REGISTRY_IMAGE:1.0.0
  only:
    changes:
      - Dockerfile.ci

.publish_chart:
  image: golang:1.20-buster
  script:
    - |
      curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | tee /usr/share/keyrings/helm.gpg > /dev/null
      apt-get install apt-transport-https --yes
      echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | tee /etc/apt/sources.list.d/helm-stable-debian.list
      apt-get update
      apt-get install helm
    - helm plugin install https://github.com/chartmuseum/helm-push
    - helm repo add --username gitlab-ci-token --password $CI_JOB_TOKEN app $APP_REPO_URL
    - make helm
    - cd ./helm/charts/$CHART_NAME
    # - helm dependency build .
    - yq '.appVersion = strenv(SHORT_SHA)' Chart.yaml > Chart.yaml.tmp && mv Chart.yaml.tmp Chart.yaml
    - helm package --version $CHART_VERSION --app-version $APP_VERSION .
    - helm cm-push $CHART_NAME-$CHART_VERSION.tgz app

publish helm chart:
  extends: .publish_chart
  stage: helm
  variables:
    APP_REPO_URL: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/stable
    CHART_NAME: db-operator
    CHART_VERSION: 0.3.0-c-$CI_COMMIT_SHORT_SHA
    APP_VERSION: c-$CI_COMMIT_SHA
  rules:
    - *on-merge-request
    - *on-push-to-main