review: stage: review script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - initialize_tiller - create_secret - deploy - persist_environment_url environment: name: review/$CI_COMMIT_REF_NAME url: http://$CI_PROJECT_ID-$CI_ENVIRONMENT_SLUG.$KUBE_INGRESS_BASE_DOMAIN on_stop: stop_review artifacts: paths: [environment_url.txt] only: refs: - branches - tags kubernetes: active except: refs: - master variables: - $REVIEW_DISABLED stop_review: stage: cleanup variables: GIT_STRATEGY: none script: - install_dependencies - initialize_tiller - delete environment: name: review/$CI_COMMIT_REF_NAME action: stop when: manual allow_failure: true only: refs: - branches - tags kubernetes: active except: refs: - master variables: - $REVIEW_DISABLED # Staging deploys are disabled by default since # continuous deployment to production is enabled by default # If you prefer to automatically deploy to staging and # only manually promote to production, enable this job by setting # STAGING_ENABLED. staging: stage: staging script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - initialize_tiller - create_secret - deploy environment: name: staging url: http://$CI_PROJECT_PATH_SLUG-staging.$KUBE_INGRESS_BASE_DOMAIN only: refs: - master kubernetes: active variables: - $STAGING_ENABLED # Canaries are disabled by default, but if you want them, # and know what the downsides are, you can enable this by setting # CANARY_ENABLED. canary: stage: canary script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - initialize_tiller - create_secret - deploy canary environment: name: production url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN when: manual only: refs: - master kubernetes: active variables: - $CANARY_ENABLED .production: &production_template stage: production script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - initialize_tiller - create_secret - deploy - delete canary - delete rollout - persist_environment_url environment: name: production url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN artifacts: paths: [environment_url.txt] production: <<: *production_template only: refs: - master kubernetes: active except: variables: - $STAGING_ENABLED - $CANARY_ENABLED - $INCREMENTAL_ROLLOUT_ENABLED - $INCREMENTAL_ROLLOUT_MODE production_manual: <<: *production_template when: manual allow_failure: false only: refs: - master kubernetes: active variables: - $STAGING_ENABLED - $CANARY_ENABLED except: variables: - $INCREMENTAL_ROLLOUT_ENABLED - $INCREMENTAL_ROLLOUT_MODE # This job implements incremental rollout on for every push to `master`. .rollout: &rollout_template script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - initialize_tiller - create_secret - deploy rollout $ROLLOUT_PERCENTAGE - scale stable $((100-ROLLOUT_PERCENTAGE)) - delete canary - persist_environment_url environment: name: production url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN artifacts: paths: [environment_url.txt] .manual_rollout_template: &manual_rollout_template <<: *rollout_template stage: production when: manual # This selectors are backward compatible mode with $INCREMENTAL_ROLLOUT_ENABLED (before 11.4) only: refs: - master kubernetes: active variables: - $INCREMENTAL_ROLLOUT_MODE == "manual" - $INCREMENTAL_ROLLOUT_ENABLED except: variables: - $INCREMENTAL_ROLLOUT_MODE == "timed" .timed_rollout_template: &timed_rollout_template <<: *rollout_template when: delayed start_in: 5 minutes only: refs: - master kubernetes: active variables: - $INCREMENTAL_ROLLOUT_MODE == "timed" timed rollout 10%: <<: *timed_rollout_template stage: incremental rollout 10% variables: ROLLOUT_PERCENTAGE: 10 timed rollout 25%: <<: *timed_rollout_template stage: incremental rollout 25% variables: ROLLOUT_PERCENTAGE: 25 timed rollout 50%: <<: *timed_rollout_template stage: incremental rollout 50% variables: ROLLOUT_PERCENTAGE: 50 timed rollout 100%: <<: *timed_rollout_template <<: *production_template stage: incremental rollout 100% variables: ROLLOUT_PERCENTAGE: 100 rollout 10%: <<: *manual_rollout_template variables: ROLLOUT_PERCENTAGE: 10 rollout 25%: <<: *manual_rollout_template variables: ROLLOUT_PERCENTAGE: 25 rollout 50%: <<: *manual_rollout_template variables: ROLLOUT_PERCENTAGE: 50 rollout 100%: <<: *manual_rollout_template <<: *production_template allow_failure: false .deploy_helpers: &deploy_helpers | [[ "$TRACE" ]] && set -x auto_database_url=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${CI_ENVIRONMENT_SLUG}-postgres:5432/${POSTGRES_DB} export DATABASE_URL=${DATABASE_URL-$auto_database_url} export TILLER_NAMESPACE=$KUBE_NAMESPACE # Extract "MAJOR.MINOR" from CI_SERVER_VERSION and generate "MAJOR-MINOR-stable" for Security Products function get_replicas() { track="${1:-stable}" percentage="${2:-100}" env_track=$( echo $track | tr -s '[:lower:]' '[:upper:]' ) env_slug=$( echo ${CI_ENVIRONMENT_SLUG//-/_} | tr -s '[:lower:]' '[:upper:]' ) if [[ "$track" == "stable" ]] || [[ "$track" == "rollout" ]]; then # for stable track get number of replicas from `PRODUCTION_REPLICAS` eval new_replicas=\$${env_slug}_REPLICAS if [[ -z "$new_replicas" ]]; then new_replicas=$REPLICAS fi else # for all tracks get number of replicas from `CANARY_PRODUCTION_REPLICAS` eval new_replicas=\$${env_track}_${env_slug}_REPLICAS if [[ -z "$new_replicas" ]]; then eval new_replicas=\${env_track}_REPLICAS fi fi replicas="${new_replicas:-1}" replicas="$(($replicas * $percentage / 100))" # always return at least one replicas if [[ $replicas -gt 0 ]]; then echo "$replicas" else echo 1 fi } # Extracts variables prefixed with K8S_SECRET_ # and creates a Kubernetes secret. # # e.g. If we have the following environment variables: # K8S_SECRET_A=value1 # K8S_SECRET_B=multi\ word\ value # # Then we will create a secret with the following key-value pairs: # data: # A: dmFsdWUxCg== # B: bXVsdGkgd29yZCB2YWx1ZQo= function create_application_secret() { track="${1-stable}" export APPLICATION_SECRET_NAME=$(application_secret_name "$track") env | sed -n "s/^K8S_SECRET_\(.*\)$/\1/p" > k8s_prefixed_variables kubectl create secret \ -n "$KUBE_NAMESPACE" generic "$APPLICATION_SECRET_NAME" \ --from-env-file k8s_prefixed_variables -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f - export APPLICATION_SECRET_CHECKSUM=$(cat k8s_prefixed_variables | sha256sum | cut -d ' ' -f 1) rm k8s_prefixed_variables } function deploy_name() { name="$CI_ENVIRONMENT_SLUG" track="${1-stable}" if [[ "$track" != "stable" ]]; then name="$name-$track" fi echo $name } function application_secret_name() { track="${1-stable}" name=$(deploy_name "$track") echo "${name}-secret" } function deploy() { track="${1-stable}" percentage="${2:-100}" name=$(deploy_name "$track") if [[ -z "$CI_COMMIT_TAG" ]]; then image_repository=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG} image_tag=${CI_APPLICATION_TAG:-$CI_COMMIT_SHA} else image_repository=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE} image_tag=${CI_APPLICATION_TAG:-$CI_COMMIT_TAG} fi replicas="1" service_enabled="true" postgres_enabled="$POSTGRES_ENABLED" # if track is different than stable, # re-use all attached resources if [[ "$track" != "stable" ]]; then service_enabled="false" postgres_enabled="false" fi replicas=$(get_replicas "$track" "$percentage") if [[ "$CI_PROJECT_VISIBILITY" != "public" ]]; then secret_name='gitlab-registry' else secret_name='' fi create_application_secret "$track" env_slug=$(echo ${CI_ENVIRONMENT_SLUG//-/_} | tr -s '[:lower:]' '[:upper:]') eval env_ADDITIONAL_HOSTS=\$${env_slug}_ADDITIONAL_HOSTS if [ -n "$env_ADDITIONAL_HOSTS" ]; then additional_hosts="{$env_ADDITIONAL_HOSTS}" elif [ -n "$ADDITIONAL_HOSTS" ]; then additional_hosts="{$ADDITIONAL_HOSTS}" fi if [[ -n "$DB_INITIALIZE" && -z "$(helm ls -q "^$name$")" ]]; then echo "Deploying first release with database initialization..." helm upgrade --install \ --wait \ --set service.enabled="$service_enabled" \ --set gitlab.app="$CI_PROJECT_PATH_SLUG" \ --set gitlab.env="$CI_ENVIRONMENT_SLUG" \ --set releaseOverride="$CI_ENVIRONMENT_SLUG" \ --set image.repository="$image_repository" \ --set image.tag="$image_tag" \ --set image.pullPolicy=IfNotPresent \ --set image.secrets[0].name="$secret_name" \ --set application.track="$track" \ --set application.database_url="$DATABASE_URL" \ --set application.secretName="$APPLICATION_SECRET_NAME" \ --set application.secretChecksum="$APPLICATION_SECRET_CHECKSUM" \ --set service.commonName="le.$KUBE_INGRESS_BASE_DOMAIN" \ --set service.url="$CI_ENVIRONMENT_URL" \ --set service.additionalHosts="$additional_hosts" \ --set replicaCount="$replicas" \ --set postgresql.enabled="$postgres_enabled" \ --set postgresql.nameOverride="postgres" \ --set postgresql.postgresUser="$POSTGRES_USER" \ --set postgresql.postgresPassword="$POSTGRES_PASSWORD" \ --set postgresql.postgresDatabase="$POSTGRES_DB" \ --set postgresql.imageTag="$POSTGRES_VERSION" \ --set application.initializeCommand="$DB_INITIALIZE" \ --namespace="$KUBE_NAMESPACE" \ "$name" \ chart/ echo "Deploying second release..." helm upgrade --reuse-values \ --wait \ --set application.initializeCommand="" \ --set application.migrateCommand="$DB_MIGRATE" \ --namespace="$KUBE_NAMESPACE" \ "$name" \ chart/ else echo "Deploying new release..." helm upgrade --install \ --wait \ --set service.enabled="$service_enabled" \ --set gitlab.app="$CI_PROJECT_PATH_SLUG" \ --set gitlab.env="$CI_ENVIRONMENT_SLUG" \ --set releaseOverride="$CI_ENVIRONMENT_SLUG" \ --set image.repository="$image_repository" \ --set image.tag="$image_tag" \ --set image.pullPolicy=IfNotPresent \ --set image.secrets[0].name="$secret_name" \ --set application.track="$track" \ --set application.database_url="$DATABASE_URL" \ --set application.secretName="$APPLICATION_SECRET_NAME" \ --set application.secretChecksum="$APPLICATION_SECRET_CHECKSUM" \ --set service.commonName="le.$KUBE_INGRESS_BASE_DOMAIN" \ --set service.url="$CI_ENVIRONMENT_URL" \ --set service.additionalHosts="$additional_hosts" \ --set replicaCount="$replicas" \ --set postgresql.enabled="$postgres_enabled" \ --set postgresql.nameOverride="postgres" \ --set postgresql.postgresUser="$POSTGRES_USER" \ --set postgresql.postgresPassword="$POSTGRES_PASSWORD" \ --set postgresql.postgresDatabase="$POSTGRES_DB" \ --set application.migrateCommand="$DB_MIGRATE" \ --namespace="$KUBE_NAMESPACE" \ "$name" \ chart/ fi kubectl rollout status -n "$KUBE_NAMESPACE" -w "$ROLLOUT_RESOURCE_TYPE/$name" } function scale() { track="${1-stable}" percentage="${2-100}" name=$(deploy_name "$track") replicas=$(get_replicas "$track" "$percentage") if [[ -n "$(helm ls -q "^$name$")" ]]; then helm upgrade --reuse-values \ --wait \ --set replicaCount="$replicas" \ --namespace="$KUBE_NAMESPACE" \ "$name" \ chart/ fi } function install_dependencies() { apk add -U openssl curl tar gzip bash ca-certificates git curl -sSL -o /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub curl -sSL -O https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.28-r0/glibc-2.28-r0.apk apk add glibc-2.28-r0.apk rm glibc-2.28-r0.apk curl -sS "https://kubernetes-helm.storage.googleapis.com/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | tar zx mv linux-amd64/helm /usr/bin/ mv linux-amd64/tiller /usr/bin/ helm version --client tiller -version curl -sSL -o /usr/bin/kubectl "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl" chmod +x /usr/bin/kubectl kubectl version --client } function download_chart() { if [[ ! -d chart ]]; then auto_chart=${AUTO_DEVOPS_CHART:-gitlab/auto-deploy-app} auto_chart_name=$(basename $auto_chart) auto_chart_name=${auto_chart_name%.tgz} auto_chart_name=${auto_chart_name%.tar.gz} else auto_chart="chart" auto_chart_name="chart" fi helm init --client-only helm repo add gitlab ${AUTO_DEVOPS_CHART_REPOSITORY:-https://charts.gitlab.io} if [[ ! -d "$auto_chart" ]]; then helm fetch ${auto_chart} --untar fi if [ "$auto_chart_name" != "chart" ]; then mv ${auto_chart_name} chart fi helm dependency update chart/ helm dependency build chart/ } function ensure_namespace() { kubectl describe namespace "$KUBE_NAMESPACE" || kubectl create namespace "$KUBE_NAMESPACE" } # Function to ensure backwards compatibility with AUTO_DEVOPS_DOMAIN function ensure_kube_ingress_base_domain() { if [ -z ${KUBE_INGRESS_BASE_DOMAIN+x} ] && [ -n "$AUTO_DEVOPS_DOMAIN" ] ; then export KUBE_INGRESS_BASE_DOMAIN=$AUTO_DEVOPS_DOMAIN fi } function check_kube_domain() { ensure_kube_ingress_base_domain if [[ -z "$KUBE_INGRESS_BASE_DOMAIN" ]]; then echo "In order to deploy or use Review Apps," echo "AUTO_DEVOPS_DOMAIN or KUBE_INGRESS_BASE_DOMAIN variables must be set" echo "From 11.8, you can set KUBE_INGRESS_BASE_DOMAIN in cluster settings" echo "or by defining a variable at group or project level." echo "You can also manually add it in .gitlab-ci.yml" echo "AUTO_DEVOPS_DOMAIN support will be dropped on 12.0" false else true fi } function initialize_tiller() { echo "Checking Tiller..." export HELM_HOST="localhost:44134" tiller -listen ${HELM_HOST} -alsologtostderr > /dev/null 2>&1 & echo "Tiller is listening on ${HELM_HOST}" if ! helm version --debug; then echo "Failed to init Tiller." return 1 fi echo "" } function create_secret() { echo "Create secret..." if [[ "$CI_PROJECT_VISIBILITY" == "public" ]]; then return fi kubectl create secret -n "$KUBE_NAMESPACE" \ docker-registry gitlab-registry \ --docker-server="$CI_REGISTRY" \ --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \ --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \ --docker-email="$GITLAB_USER_EMAIL" \ -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f - } function persist_environment_url() { echo $CI_ENVIRONMENT_URL > environment_url.txt } function delete() { track="${1-stable}" name=$(deploy_name "$track") if [[ -n "$(helm ls -q "^$name$")" ]]; then helm delete --purge "$name" fi secret_name=$(application_secret_name "$track") kubectl delete secret --ignore-not-found -n "$KUBE_NAMESPACE" "$secret_name" } before_script: - *deploy_helpers