.gitlab-ci.yml

stages:
  - setup
  - lint
  - unit-tests
  - common-stg
  - common-stg-test
  - promote-common-to-prd
  - common-prd
  - dev
  - plan-all-stg
  - promote-to-stg
  - stg
  - plan-all-prd
  - promote-to-prd
  - prd

common-setup:
  stage: setup
  tags:
    - common
  script:
    - terraform -version
    - terragrunt -version
    - docker version
    - docker-compose version
    - docker images | grep exekube
    - ruby --version
    - bundle version
    - rake --version
  only:
    - master@gpii-ops/gpii-infra

gcp-setup:
  stage: setup
  tags:
    - gcp
  script:
    - docker version
    - docker-compose version
    - docker images | grep exekube
    - ruby --version
    - bundle version
    - rake --version
  only:
    - master@gpii-ops/gpii-infra

terraform-fmt-check:
  stage: lint
  tags:
    - common
  script:
    - docker run --rm -v "$(pwd):/data" -w /data gcr.io/gpii-common-prd/gpii__exekube:0.9.13-google_gpii.0 -- terraform fmt --check=true
  only:
    - master@gpii-ops/gpii-infra

gcp-unit-tests:
  stage: unit-tests
  tags:
    - gcp
  script:
    - docker run --rm -v "$(pwd):/data" -w /data/shared/rakefiles/tests gcr.io/gpii-common-prd/gpii__exekube:0.9.13-google_gpii.0 -- sh -c "bundle install --with test && rake"
  only:
    - master@gpii-ops/gpii-infra

common-stg:
  stage: common-stg
  tags:
    - common
  script:
    - cd common/live/stg
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    - rake apply_common_infra
    - rake init_registry
    - rake apply_infra
  after_script:
    - cd common/live/stg
    - rake destroy_sa_keys
  environment:
    name: stg
  only:
    - master@gpii-ops/gpii-infra

common-stg-test-gcp-dev:
  stage: common-stg-test
  tags:
    - common
  variables:
    # These variables are duplicated in common/live/stg/Rakefile
    ORGANIZATION_ID: "327626828918"
    TF_VAR_organization_name: "gpii2test"
    TF_VAR_organization_domain: "test.gpii.net"
    TF_VAR_common_project_id: "gpii2test-common-stg"
    # We override default infra region for dev environments
    # due to GCP resource exhaustion issues:
    # https://issues.gpii.net/browse/GPII-3697
    TF_VAR_infra_region: "us-east4"
    USER: "doe"
    # Normally we don't enforce binauth in dev environments, e.g. since it makes
    # it harder for developers to test custom images which they can't upload to
    # GCR. However, we want to know as early as possible if a developer
    # introduced a new image that will fail in environments like stg and prd
    # with binauth enforcement enabled. So, we override the setting for CI dev
    # envs.
    TF_VAR_binary_authorization_evaluation_mode: "ALWAYS_DENY"
  script:
    - cd gcp/live/dev
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    - rake destroy_hard_and_deploy_ci
  after_script:
    - cd gcp/live/dev
    # Remove all SA keys except current one to prevent hitting 10 keys per SA limit (GPII-3299)
    - rake destroy_sa_keys || true
    - rake clobber || true
  only:
    - master@gpii-ops/gpii-infra

common-promote-common-to-prd:
  stage: promote-common-to-prd
  tags:
    - common
  script:
    - export DATESTAMP="$(date -u '+%Y%m%d%H%M%S')"  # e.g. 20170603220542. Uses UTC.
    - echo "DATESTAMP is $DATESTAMP"  # So it's visible in the log
    - git tag "deploy-common-stg-$DATESTAMP"
    # gitlab is not clever enough to clean up an added remote and git complains
    # if we add a remote that already exists.
    - git remote | grep -q "^origin-rw" || git remote add origin-rw git@github.com:gpii-ops/gpii-infra
    - git push --tags origin-rw
  when: manual
  allow_failure: false
  only:
    - master@gpii-ops/gpii-infra

common-prd:
  stage: common-prd
  tags:
    - common
  variables:
    RAKE_REALLY_RUN_IN_PRD: "true"
  script:
    - cd common/live/prd
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    - rake apply_common_infra
    - rake init_registry
    - rake apply_infra
  after_script:
    - cd common/live/prd
    - rake destroy_sa_keys RAKE_REALLY_DESTROY_IN_PRD=true
  environment:
    name: prd
  only:
    - master@gpii-ops/gpii-infra

gcp-dev:
  stage: dev
  tags:
    - gcp
  variables:
    # We override default infra region for dev environments
    # due to GCP resource exhaustion issues:
    # https://issues.gpii.net/browse/GPII-3697
    TF_VAR_infra_region: "us-east1"
    # Normally we don't enforce binauth in dev environments, e.g. since it makes
    # it harder for developers to test custom images which they can't upload to
    # GCR. However, we want to know as early as possible if a developer
    # introduced a new image that will fail in environments like stg and prd
    # with binauth enforcement enabled. So, we override the setting for CI dev
    # envs.
    TF_VAR_binary_authorization_evaluation_mode: "ALWAYS_DENY"
  script:
    - cd gcp/live/dev
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    - rake destroy_hard_and_deploy_ci
  after_script:
    - cd gcp/live/dev
    # Remove all SA keys except current one to prevent hitting 10 keys per SA limit (GPII-3299)
    - rake destroy_sa_keys || true
    - rake clobber || true
  only:
    - master@gpii-ops/gpii-infra

gcp-plan-all-stg:
  stage: plan-all-stg
  tags:
    - gcp
  environment:
    name: stg
  script:
    - cd gcp/live/stg
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    # Next step is required to restore local tiller certs and prevent
    # terraform from failing during helm_release.release status checks
    - rake fetch_helm_certs
    # Infra requires special treatment because of secrets configuration
    - rake plain_sh['rake plan_infra'] || true
    # Sync GKE Istio state so that the plan reflects real changes
    - rake plain_sh['rake sync_gke_istio_state'] || true
    - rake sh['xk plan-all live/stg/k8s 2> /dev/null'] || true
  only:
    - master@gpii-ops/gpii-infra

gcp-promote-to-stg:
  stage: promote-to-stg
  tags:
    - gcp
  script:
    - export DATESTAMP="$(date -u '+%Y%m%d%H%M%S')"  # e.g. 20170603220542. Uses UTC.
    - echo "DATESTAMP is $DATESTAMP"  # So it's visible in the log
    - git tag "deploy-gcp-stg-$DATESTAMP"
    # gitlab is not clever enough to clean up an added remote and git complains
    # if we add a remote that already exists.
    - git remote | grep -q "^origin-rw" || git remote add origin-rw git@github.com:gpii-ops/gpii-infra
    - git push --tags origin-rw
  only:
    - master@gpii-ops/gpii-infra

gcp-stg:
  stage: stg
  tags:
    - gcp
  environment:
    name: stg
  script:
    - cd gcp/live/stg
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    # Rotate Terraform state key and secrets KMS key to excercise secrets management
    - rake rotate_tfstate_key
    - rake rotate_secrets_key
    - rake
    - rake test_preferences_read
    - rake test_flowmanager
    - rake test_morphic_write
    - rake test_morphic_read
  after_script:
    # Clean up even if something failed.
    - cd gcp/live/stg
    - rake display_cluster_state
    - rake display_universal_image_info || true
    # Remove all SA keys except current one to prevent hitting 10 keys per SA limit (GPII-3299)
    - rake destroy_sa_keys || true
  only:
    - master@gpii-ops/gpii-infra

gcp-plan-all-prd:
  stage: plan-all-prd
  variables:
    RAKE_REALLY_RUN_IN_PRD: "true"
  tags:
    - gcp
  environment:
    name: prd
  script:
    - cd gcp/live/prd
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    # Next step is required to restore local tiller certs and prevent
    # terraform from failing during helm_release.release status checks
    - rake fetch_helm_certs
    # Infra requires special treatment because of secrets configuration
    - rake plain_sh['rake plan_infra'] || true
    # Sync GKE Istio state so that the plan reflects real changes
    - rake plain_sh['rake sync_gke_istio_state'] || true
    - rake sh['xk plan-all live/prd/k8s 2> /dev/null'] || true
  only:
    - master@gpii-ops/gpii-infra


gcp-promote-to-prd:
  stage: promote-to-prd
  tags:
    - gcp
  script:
    - export DATESTAMP="$(date -u '+%Y%m%d%H%M%S')"  # e.g. 20170603220542. Uses UTC.
    - echo "DATESTAMP is $DATESTAMP"  # So it's visible in the log
    - git tag "deploy-gcp-prd-$DATESTAMP"
    # gitlab is not clever enough to clean up an added remote and git complains
    # if we add a remote that already exists.
    - git remote | grep -q "^origin-rw" || git remote add origin-rw git@github.com:gpii-ops/gpii-infra
    - git push --tags origin-rw
  when: manual
  allow_failure: false
  only:
    - master@gpii-ops/gpii-infra

gcp-prd:
  stage: prd
  variables:
    RAKE_REALLY_RUN_IN_PRD: "true"
  tags:
    - gcp
  environment:
    name: prd
  script:
    - cd gcp/live/prd
    - rake clobber
    - rake configure_serviceaccount_ci_restore
    # Rotate Terraform state key and secrets KMS key to exercise secrets management
    - rake rotate_tfstate_key RAKE_REALLY_DESTROY_IN_PRD=true
    - rake rotate_secrets_key RAKE_REALLY_DESTROY_IN_PRD=true
    - rake
    - rake test_preferences_read RAKE_REALLY_DESTROY_IN_PRD=true
    - rake test_flowmanager RAKE_REALLY_DESTROY_IN_PRD=true
    - rake test_morphic_write RAKE_REALLY_DESTROY_IN_PRD=true
    - rake test_morphic_read RAKE_REALLY_DESTROY_IN_PRD=true
  after_script:
    # Clean up even if something failed.
    - cd gcp/live/prd
    - rake display_cluster_state
    - rake display_universal_image_info || true
    # Remove all SA keys except current one to prevent hitting 10 keys per SA limit (GPII-3299)
    - rake destroy_sa_keys RAKE_REALLY_DESTROY_IN_PRD=true || true
  only:
    - master@gpii-ops/gpii-infra