-
Notifications
You must be signed in to change notification settings - Fork 44
/
Jenkinsfile
169 lines (154 loc) · 6.74 KB
/
Jenkinsfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
def secrets = [
[path: params.VAULT_PATH_SVC_ACCOUNT_EPHEMERAL, secretValues: [
[envVar: 'OC_LOGIN_TOKEN_DEV', vaultKey: 'oc-login-token-dev'],
[envVar: 'OC_LOGIN_SERVER_DEV', vaultKey: 'oc-login-server-dev'],
[envVar: 'OC_LOGIN_TOKEN', vaultKey: 'oc-login-token'],
[envVar: 'OC_LOGIN_SERVER', vaultKey: 'oc-login-server']]],
[path: params.VAULT_PATH_QUAY_PUSH, secretValues: [
[envVar: 'QUAY_USER', vaultKey: 'user'],
[envVar: 'QUAY_TOKEN', vaultKey: 'token']]],
[path: params.VAULT_PATH_RHR_PULL, secretValues: [
[envVar: 'RH_REGISTRY_USER', vaultKey: 'user'],
[envVar: 'RH_REGISTRY_TOKEN', vaultKey: 'token']]],
[path: params.VAULT_PATH_QUAY_TOKEN, secretValues: [
[envVar: 'QUAY_API_TOKEN', vaultKey: 'api-token']]]
]
def configuration = [vaultUrl: params.VAULT_ADDRESS, vaultCredentialId: params.VAULT_CREDS_ID]
pipeline {
agent { label 'rhel8' }
options {
timestamps()
}
environment {
APP_NAME="vulnerability" // name of app-sre "application" folder this component lives in
COMPONENT_NAME="vulnerability-engine" // name of app-sre "resourceTemplate" in deploy.yaml for this component
IMAGE="quay.io/cloudservices/vulnerability-engine-app"
COMPONENTS_W_RESOURCES="rbac"
CACHE_FROM_LATEST_IMAGE="true"
IQE_PLUGINS="vulnerability"
IQE_MARKER_EXPRESSION="smoke and api"
IQE_FILTER_EXPRESSION="not (advisories or patch or remediation_manual or test_edge_leak or test_invalid_rpm_list)"
IQE_REQUIREMENTS_PRIORITY=""
IQE_TEST_IMPORTANCE=""
IQE_CJI_TIMEOUT="60m"
DEPLOY_TIMEOUT=900
LABELS_DIR="github_labels"
ARTIFACTS_DIR="artifacts"
CICD_INSTALL_SCRIPT='https://raw.githubusercontent.com/RedHatInsights/bonfire/master/cicd/bootstrap.sh'
}
stages {
stage('Initial setup') {
steps {
sh '''#!/bin/bash
source "ci/functions.sh"
set_label_flags
> github_pr_labels
echo "RELEASE_NAMESPACE:$RELEASE_NAMESPACE" >> github_pr_labels
echo "SKIP_DEPLOY_EPHEMERAL:$SKIP_DEPLOY_EPHEMERAL" >> github_pr_labels
echo "SKIP_IMAGE_BUILD:$SKIP_IMAGE_BUILD" >> github_pr_labels
echo "SKIP_SMOKE_TEST:$SKIP_SMOKE_TEST" >> github_pr_labels
'''
script {
FILE_CONTENTS = readFile('github_pr_labels')
my_var_map = [:]
my_vars = FILE_CONTENTS.split()
for (i in my_vars) {
s=i.split(':')
if (s.length == 2) {
my_var_map[s[0]] = s[1]
} else {
my_var_map[s[0]] = ""
}
}
env.RELEASE_NAMESPACE = my_var_map['RELEASE_NAMESPACE']
env.SKIP_IMAGE_BUILD = my_var_map['SKIP_IMAGE_BUILD']
env.SKIP_DEPLOY_EPHEMERAL = my_var_map['SKIP_DEPLOY_EPHEMERAL']
env.SKIP_SMOKE_TEST = my_var_map['SKIP_SMOKE_TEST']
}
}
post {
always {
archiveArtifacts artifacts: 'github_pr_labels', fingerprint: true
}
}
}
stage('Build test image') {
when {
expression {
return (! env.SKIP_IMAGE_BUILD)
}
}
steps {
script {
withVault([configuration: configuration, vaultSecrets: secrets]) {
sh '''#!/bin/bash
curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
export DOCKER_BUILDKIT=1
source $CICD_ROOT/build.sh
'''
}
}
}
}
stage('Deploy Ephemeral Environment') {
when {
expression {
return (! env.SKIP_DEPLOY_EPHEMERAL)
}
}
steps {
script {
withVault([configuration: configuration, vaultSecrets: secrets]) {
sh '''#!/bin/bash
curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
RELEASE_NAMESPACE="false"
source $CICD_ROOT/deploy_ephemeral_env.sh
echo -n "$NAMESPACE" > .eph_namespace
'''
script {
env.NAMESPACE = readFile('.eph_namespace')
}
sh 'rm .eph_namespace'
}
}
}
}
stage('Run Smoke Tests') {
when {
expression {
return (! env.SKIP_DEPLOY_EPHEMERAL && ! env.SKIP_SMOKE_TEST)
}
}
steps {
withVault([configuration: configuration, vaultSecrets: secrets]) {
sh '''#!/bin/bash
mkdir -p "$ARTIFACTS_DIR"
source ./ci/functions.sh
set +e
process_requirements_labels
set -e
curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
source $CICD_ROOT/_common_deploy_logic.sh
source $CICD_ROOT/cji_smoke_test.sh
# Update IQE plugin config to run floorist plugin tests.
export COMPONENT_NAME="vulnerability-engine"
export IQE_CJI_NAME="floorist"
# Pass in COMPONENT_NAME.
export IQE_ENV_VARS="COMPONENT_NAME=$COMPONENT_NAME"
export IQE_PLUGINS="floorist"
export IQE_MARKER_EXPRESSION="floorist_smoke"
export IQE_IMAGE_TAG="floorist"
# Run smoke tests with ClowdJobInvocation
source "${CICD_ROOT}/cji_smoke_test.sh"
'''
}
}
post {
always {
junit skipPublishingChecks: true, testResults: 'artifacts/junit-*.xml'
archiveArtifacts artifacts: 'artifacts/**/*', fingerprint: true
}
}
}
}
}