# Auto DevOps # This CI/CD configuration provides a standard pipeline for # * building a Docker image (using a buildpack if necessary), # * storing the image in the container registry, # * running tests from a buildpack, # * running code quality analysis, # * creating a review app for each topic branch, # * and continuous deployment to production # # Test jobs may be disabled by setting environment variables: # * test: TEST_DISABLED # * code_quality: CODE_QUALITY_DISABLED # * license_management: LICENSE_MANAGEMENT_DISABLED # * performance: PERFORMANCE_DISABLED # * sast: SAST_DISABLED # * dependency_scanning: DEPENDENCY_SCANNING_DISABLED # * container_scanning: CONTAINER_SCANNING_DISABLED # * dast: DAST_DISABLED # * review: REVIEW_DISABLED # * stop_review: REVIEW_DISABLED # # In order to deploy, you must have a Kubernetes cluster configured either # via a project integration, or via group/project variables. # AUTO_DEVOPS_DOMAIN must also be set as a variable at the group or project # level, or manually added below. # # Continuous deployment to production is enabled by default. # If you want to deploy to staging first, or enable incremental rollouts, # set STAGING_ENABLED or INCREMENTAL_ROLLOUT_ENABLED environment variables. # If you want to use canary deployments, set CANARY_ENABLED environment variable. # # If Auto DevOps fails to detect the proper buildpack, or if you want to # specify a custom buildpack, set a project variable `BUILDPACK_URL` to the # repository URL of the buildpack. # e.g. BUILDPACK_URL=https://github.com/heroku/heroku-buildpack-ruby.git#v142 # If you need multiple buildpacks, add a file to your project called # `.buildpacks` that contains the URLs, one on each line, in order. # Note: Auto CI does not work with multiple buildpacks yet image: alpine:latest variables: # AUTO_DEVOPS_DOMAIN is the application deployment domain and should be set as a variable at the group or project level. # AUTO_DEVOPS_DOMAIN: domain.example.com POSTGRES_USER: user POSTGRES_PASSWORD: testing-password POSTGRES_ENABLED: "true" POSTGRES_DB: $CI_ENVIRONMENT_SLUG KUBERNETES_VERSION: 1.8.6 HELM_VERSION: 2.6.1 stages: - build - test - review - dast - staging - canary - production - performance - cleanup build: stage: build image: docker:stable-git services: - docker:stable-dind variables: DOCKER_DRIVER: overlay2 script: - setup_docker - build only: - branches test: services: - postgres:latest variables: POSTGRES_DB: test stage: test image: gliderlabs/herokuish:latest script: - setup_test_db - cp -R . /tmp/app - /bin/herokuish buildpack test only: - branches except: variables: - $TEST_DISABLED code_quality: stage: test image: docker:stable variables: DOCKER_DRIVER: overlay2 allow_failure: true services: - docker:stable-dind script: - setup_docker - code_quality artifacts: paths: [gl-code-quality-report.json] only: - branches except: variables: - $CODE_QUALITY_DISABLED license_management: stage: test image: docker:stable variables: DOCKER_DRIVER: overlay2 allow_failure: true services: - docker:stable-dind script: - setup_docker - license_management artifacts: paths: [gl-license-management-report.json] only: - branches except: variables: - $LICENSE_MANAGEMENT_DISABLED performance: stage: performance image: docker:stable variables: DOCKER_DRIVER: overlay2 allow_failure: true services: - docker:stable-dind script: - setup_docker - performance artifacts: paths: - performance.json - sitespeed-results/ only: refs: - branches kubernetes: active except: variables: - $PERFORMANCE_DISABLED sast: stage: test image: docker:stable variables: DOCKER_DRIVER: overlay2 allow_failure: true services: - docker:stable-dind script: - setup_docker - sast artifacts: paths: [gl-sast-report.json] only: - branches except: variables: - $SAST_DISABLED dependency_scanning: stage: test image: docker:stable variables: DOCKER_DRIVER: overlay2 allow_failure: true services: - docker:stable-dind script: - setup_docker - dependency_scanning artifacts: paths: [gl-dependency-scanning-report.json] only: - branches except: variables: - $DEPENDENCY_SCANNING_DISABLED container_scanning: stage: test image: docker:stable variables: DOCKER_DRIVER: overlay2 allow_failure: true services: - docker:stable-dind script: - setup_docker - container_scanning artifacts: paths: [gl-container-scanning-report.json] only: - branches except: variables: - $CONTAINER_SCANNING_DISABLED dast: stage: dast allow_failure: true image: registry.gitlab.com/gitlab-org/security-products/zaproxy variables: POSTGRES_DB: "false" script: - dast artifacts: paths: [gl-dast-report.json] only: refs: - branches kubernetes: active except: refs: - master variables: - $DAST_DISABLED review: stage: review script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - install_tiller - create_secret - deploy - persist_environment_url environment: name: review/$CI_COMMIT_REF_NAME url: http://$CI_PROJECT_PATH_SLUG-$CI_ENVIRONMENT_SLUG.$AUTO_DEVOPS_DOMAIN on_stop: stop_review artifacts: paths: [environment_url.txt] only: refs: - branches kubernetes: active except: refs: - master variables: - $REVIEW_DISABLED stop_review: stage: cleanup variables: GIT_STRATEGY: none script: - install_dependencies - delete environment: name: review/$CI_COMMIT_REF_NAME action: stop when: manual allow_failure: true only: refs: - branches kubernetes: active except: refs: - master variables: - $REVIEW_DISABLED # Keys that start with a dot (.) will not be processed by GitLab CI. # Staging and canary jobs are disabled by default, to enable them # remove the dot (.) before the job name. # https://docs.gitlab.com/ee/ci/yaml/README.html#hidden-keys # Staging deploys are disabled by default since # continuous deployment to production is enabled by default # If you prefer to automatically deploy to staging and # only manually promote to production, enable this job by setting # STAGING_ENABLED. staging: stage: staging script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - install_tiller - create_secret - deploy environment: name: staging url: http://$CI_PROJECT_PATH_SLUG-staging.$AUTO_DEVOPS_DOMAIN only: refs: - master kubernetes: active variables: - $STAGING_ENABLED # Canaries are also disabled by default, but if you want them, # and know what the downsides are, you can enable this by setting # CANARY_ENABLED. canary: stage: canary script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - install_tiller - create_secret - deploy canary environment: name: production url: http://$CI_PROJECT_PATH_SLUG.$AUTO_DEVOPS_DOMAIN when: manual only: refs: - master kubernetes: active variables: - $CANARY_ENABLED .production: &production_template stage: production script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - install_tiller - create_secret - deploy - delete canary - delete rollout - persist_environment_url environment: name: production url: http://$CI_PROJECT_PATH_SLUG.$AUTO_DEVOPS_DOMAIN artifacts: paths: [environment_url.txt] production: <<: *production_template only: refs: - master kubernetes: active except: variables: - $STAGING_ENABLED - $CANARY_ENABLED - $INCREMENTAL_ROLLOUT_ENABLED production_manual: <<: *production_template when: manual allow_failure: false only: refs: - master kubernetes: active variables: - $STAGING_ENABLED - $CANARY_ENABLED except: variables: - $INCREMENTAL_ROLLOUT_ENABLED # This job implements incremental rollout on for every push to `master`. .rollout: &rollout_template stage: production script: - check_kube_domain - install_dependencies - download_chart - ensure_namespace - install_tiller - create_secret - deploy rollout $ROLLOUT_PERCENTAGE - scale stable $((100-ROLLOUT_PERCENTAGE)) - delete canary - persist_environment_url environment: name: production url: http://$CI_PROJECT_PATH_SLUG.$AUTO_DEVOPS_DOMAIN artifacts: paths: [environment_url.txt] rollout 10%: <<: *rollout_template variables: ROLLOUT_PERCENTAGE: 10 when: manual only: refs: - master kubernetes: active variables: - $INCREMENTAL_ROLLOUT_ENABLED rollout 25%: <<: *rollout_template variables: ROLLOUT_PERCENTAGE: 25 when: manual only: refs: - master kubernetes: active variables: - $INCREMENTAL_ROLLOUT_ENABLED rollout 50%: <<: *rollout_template variables: ROLLOUT_PERCENTAGE: 50 when: manual only: refs: - master kubernetes: active variables: - $INCREMENTAL_ROLLOUT_ENABLED rollout 100%: <<: *production_template when: manual allow_failure: false only: refs: - master kubernetes: active variables: - $INCREMENTAL_ROLLOUT_ENABLED # --------------------------------------------------------------------------- .auto_devops: &auto_devops | # Auto DevOps variables and functions [[ "$TRACE" ]] && set -x auto_database_url=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${CI_ENVIRONMENT_SLUG}-postgres:5432/${POSTGRES_DB} export DATABASE_URL=${DATABASE_URL-$auto_database_url} export CI_APPLICATION_REPOSITORY=$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG export CI_APPLICATION_TAG=$CI_COMMIT_SHA export CI_CONTAINER_NAME=ci_job_build_${CI_JOB_ID} export TILLER_NAMESPACE=$KUBE_NAMESPACE # Extract "MAJOR.MINOR" from CI_SERVER_VERSION and generate "MAJOR-MINOR-stable" for Security Products export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/') function container_scanning() { if [[ -n "$CI_REGISTRY_USER" ]]; then echo "Logging to GitLab Container Registry with CI credentials..." docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY" echo "" fi docker run -d --name db arminc/clair-db:latest docker run -p 6060:6060 --link db:postgres -d --name clair --restart on-failure arminc/clair-local-scan:v2.0.1 apk add -U wget ca-certificates docker pull ${CI_APPLICATION_REPOSITORY}:${CI_APPLICATION_TAG} wget https://github.com/arminc/clair-scanner/releases/download/v8/clair-scanner_linux_amd64 mv clair-scanner_linux_amd64 clair-scanner chmod +x clair-scanner touch clair-whitelist.yml retries=0 echo "Waiting for clair daemon to start" while( ! wget -T 10 -q -O /dev/null http://docker:6060/v1/namespaces ) ; do sleep 1 ; echo -n "." ; if [ $retries -eq 10 ] ; then echo " Timeout, aborting." ; exit 1 ; fi ; retries=$(($retries+1)) ; done ./clair-scanner -c http://docker:6060 --ip $(hostname -i) -r gl-container-scanning-report.json -l clair.log -w clair-whitelist.yml ${CI_APPLICATION_REPOSITORY}:${CI_APPLICATION_TAG} || true } function code_quality() { docker run --env SOURCE_CODE="$PWD" \ --volume "$PWD":/code \ --volume /var/run/docker.sock:/var/run/docker.sock \ "registry.gitlab.com/gitlab-org/security-products/codequality:$SP_VERSION" /code } function license_management() { if echo $GITLAB_FEATURES |grep license_management > /dev/null ; then # Extract "MAJOR.MINOR" from CI_SERVER_VERSION and generate "MAJOR-MINOR-stable" LICENSE_MANAGEMENT_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/') docker run --volume "$PWD:/code" \ "registry.gitlab.com/gitlab-org/security-products/license-management:$LICENSE_MANAGEMENT_VERSION" analyze /code else echo "License management is not available in your subscription" fi } function sast() { case "$CI_SERVER_VERSION" in *-ee) # Deprecation notice for CONFIDENCE_LEVEL variable if [ -z "$SAST_CONFIDENCE_LEVEL" -a "$CONFIDENCE_LEVEL" ]; then SAST_CONFIDENCE_LEVEL="$CONFIDENCE_LEVEL" echo "WARNING: CONFIDENCE_LEVEL is deprecated and MUST be replaced with SAST_CONFIDENCE_LEVEL" fi docker run --env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}" \ --volume "$PWD:/code" \ --volume /var/run/docker.sock:/var/run/docker.sock \ "registry.gitlab.com/gitlab-org/security-products/sast:$SP_VERSION" /app/bin/run /code ;; *) echo "GitLab EE is required" ;; esac } function dependency_scanning() { case "$CI_SERVER_VERSION" in *-ee) docker run --env DEP_SCAN_DISABLE_REMOTE_CHECKS="${DEP_SCAN_DISABLE_REMOTE_CHECKS:-false}" \ --volume "$PWD:/code" \ --volume /var/run/docker.sock:/var/run/docker.sock \ "registry.gitlab.com/gitlab-org/security-products/dependency-scanning:$SP_VERSION" /code ;; *) echo "GitLab EE is required" ;; esac } function get_replicas() { track="${1:-stable}" percentage="${2:-100}" env_track=$( echo $track | tr -s '[:lower:]' '[:upper:]' ) env_slug=$( echo ${CI_ENVIRONMENT_SLUG//-/_} | tr -s '[:lower:]' '[:upper:]' ) if [[ "$track" == "stable" ]] || [[ "$track" == "rollout" ]]; then # for stable track get number of replicas from `PRODUCTION_REPLICAS` eval new_replicas=\$${env_slug}_REPLICAS if [[ -z "$new_replicas" ]]; then new_replicas=$REPLICAS fi else # for all tracks get number of replicas from `CANARY_PRODUCTION_REPLICAS` eval new_replicas=\$${env_track}_${env_slug}_REPLICAS if [[ -z "$new_replicas" ]]; then eval new_replicas=\${env_track}_REPLICAS fi fi replicas="${new_replicas:-1}" replicas="$(($replicas * $percentage / 100))" # always return at least one replicas if [[ $replicas -gt 0 ]]; then echo "$replicas" else echo 1 fi } function deploy() { track="${1-stable}" percentage="${2:-100}" name="$CI_ENVIRONMENT_SLUG" replicas="1" service_enabled="true" postgres_enabled="$POSTGRES_ENABLED" # if track is different than stable, # re-use all attached resources if [[ "$track" != "stable" ]]; then name="$name-$track" service_enabled="false" postgres_enabled="false" fi replicas=$(get_replicas "$track" "$percentage") if [[ "$CI_PROJECT_VISIBILITY" != "public" ]]; then secret_name='gitlab-registry' else secret_name='' fi helm upgrade --install \ --wait \ --set service.enabled="$service_enabled" \ --set releaseOverride="$CI_ENVIRONMENT_SLUG" \ --set image.repository="$CI_APPLICATION_REPOSITORY" \ --set image.tag="$CI_APPLICATION_TAG" \ --set image.pullPolicy=IfNotPresent \ --set image.secrets[0].name="$secret_name" \ --set application.track="$track" \ --set application.database_url="$DATABASE_URL" \ --set service.url="$CI_ENVIRONMENT_URL" \ --set replicaCount="$replicas" \ --set postgresql.enabled="$postgres_enabled" \ --set postgresql.nameOverride="postgres" \ --set postgresql.postgresUser="$POSTGRES_USER" \ --set postgresql.postgresPassword="$POSTGRES_PASSWORD" \ --set postgresql.postgresDatabase="$POSTGRES_DB" \ --namespace="$KUBE_NAMESPACE" \ --version="$CI_PIPELINE_ID-$CI_JOB_ID" \ "$name" \ chart/ } function scale() { track="${1-stable}" percentage="${2-100}" name="$CI_ENVIRONMENT_SLUG" if [[ "$track" != "stable" ]]; then name="$name-$track" fi replicas=$(get_replicas "$track" "$percentage") if [[ -n "$(helm ls -q "^$name$")" ]]; then helm upgrade --reuse-values \ --wait \ --set replicaCount="$replicas" \ --namespace="$KUBE_NAMESPACE" \ "$name" \ chart/ fi } function install_dependencies() { apk add -U openssl curl tar gzip bash ca-certificates git wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.23-r3/glibc-2.23-r3.apk apk add glibc-2.23-r3.apk rm glibc-2.23-r3.apk curl "https://kubernetes-helm.storage.googleapis.com/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | tar zx mv linux-amd64/helm /usr/bin/ helm version --client curl -L -o /usr/bin/kubectl "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl" chmod +x /usr/bin/kubectl kubectl version --client } function setup_docker() { if ! docker info &>/dev/null; then if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then export DOCKER_HOST='tcp://localhost:2375' fi fi } function setup_test_db() { if [ -z ${KUBERNETES_PORT+x} ]; then DB_HOST=postgres else DB_HOST=localhost fi export DATABASE_URL="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${DB_HOST}:5432/${POSTGRES_DB}" } function download_chart() { if [[ ! -d chart ]]; then auto_chart=${AUTO_DEVOPS_CHART:-gitlab/auto-deploy-app} auto_chart_name=$(basename $auto_chart) auto_chart_name=${auto_chart_name%.tgz} auto_chart_name=${auto_chart_name%.tar.gz} else auto_chart="chart" auto_chart_name="chart" fi helm init --client-only helm repo add gitlab https://charts.gitlab.io if [[ ! -d "$auto_chart" ]]; then helm fetch ${auto_chart} --untar fi if [ "$auto_chart_name" != "chart" ]; then mv ${auto_chart_name} chart fi helm dependency update chart/ helm dependency build chart/ } function ensure_namespace() { kubectl describe namespace "$KUBE_NAMESPACE" || kubectl create namespace "$KUBE_NAMESPACE" } function check_kube_domain() { if [ -z ${AUTO_DEVOPS_DOMAIN+x} ]; then echo "In order to deploy or use Review Apps, AUTO_DEVOPS_DOMAIN variable must be set" echo "You can do it in Auto DevOps project settings or defining a variable at group or project level" echo "You can also manually add it in .gitlab-ci.yml" false else true fi } function build() { if [[ -n "$CI_REGISTRY_USER" ]]; then echo "Logging to GitLab Container Registry with CI credentials..." docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY" echo "" fi if [[ -f Dockerfile ]]; then echo "Building Dockerfile-based application..." docker build -t "$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG" . else echo "Building Heroku-based application using gliderlabs/herokuish docker image..." docker run -i -e BUILDPACK_URL --name="$CI_CONTAINER_NAME" -v "$(pwd):/tmp/app:ro" gliderlabs/herokuish /bin/herokuish buildpack build docker commit "$CI_CONTAINER_NAME" "$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG" docker rm "$CI_CONTAINER_NAME" >/dev/null echo "" echo "Configuring $CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG docker image..." docker create --expose 5000 --env PORT=5000 --name="$CI_CONTAINER_NAME" "$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG" /bin/herokuish procfile start web docker commit "$CI_CONTAINER_NAME" "$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG" docker rm "$CI_CONTAINER_NAME" >/dev/null echo "" fi echo "Pushing to GitLab Container Registry..." docker push "$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG" echo "" } function install_tiller() { echo "Checking Tiller..." helm init --upgrade kubectl rollout status -n "$TILLER_NAMESPACE" -w "deployment/tiller-deploy" if ! helm version --debug; then echo "Failed to init Tiller." return 1 fi echo "" } function create_secret() { echo "Create secret..." if [[ "$CI_PROJECT_VISIBILITY" == "public" ]]; then return fi kubectl create secret -n "$KUBE_NAMESPACE" \ docker-registry gitlab-registry \ --docker-server="$CI_REGISTRY" \ --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \ --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \ --docker-email="$GITLAB_USER_EMAIL" \ -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f - } function dast() { export CI_ENVIRONMENT_URL=$(cat environment_url.txt) mkdir /zap/wrk/ /zap/zap-baseline.py -J gl-dast-report.json -t "$CI_ENVIRONMENT_URL" || true cp /zap/wrk/gl-dast-report.json . } function performance() { export CI_ENVIRONMENT_URL=$(cat environment_url.txt) mkdir gitlab-exporter wget -O gitlab-exporter/index.js https://gitlab.com/gitlab-org/gl-performance/raw/10-5/index.js mkdir sitespeed-results if [ -f .gitlab-urls.txt ] then sed -i -e 's@^@'"$CI_ENVIRONMENT_URL"'@' .gitlab-urls.txt docker run --shm-size=1g --rm -v "$(pwd)":/sitespeed.io sitespeedio/sitespeed.io:6.3.1 --plugins.add ./gitlab-exporter --outputFolder sitespeed-results .gitlab-urls.txt else docker run --shm-size=1g --rm -v "$(pwd)":/sitespeed.io sitespeedio/sitespeed.io:6.3.1 --plugins.add ./gitlab-exporter --outputFolder sitespeed-results "$CI_ENVIRONMENT_URL" fi mv sitespeed-results/data/performance.json performance.json } function persist_environment_url() { echo $CI_ENVIRONMENT_URL > environment_url.txt } function delete() { track="${1-stable}" name="$CI_ENVIRONMENT_SLUG" if [[ "$track" != "stable" ]]; then name="$name-$track" fi if [[ -n "$(helm ls -q "^$name$")" ]]; then helm delete "$name" fi } before_script: - *auto_devops