pipeline.yml

#@ load("@ytt:data", "data")
#@ load("@ytt:template", "template")
---
resource_types:
- name: pivnet
  type: registry-image
  source:
    repository: pivotalcf/pivnet-resource
    tag: latest-final

resources:
- name: repo
  type: git
  source:
    uri: https://github.com/pivotal/concourse-for-platform-automation

- name: platform-automation
  type: pivnet
  source:
    product_slug: platform-automation
    api_token: ((pivnet-token))

- name: paving
  type: git
  source:
    uri: https://github.com/pivotal/paving

- name: concourse-bosh-deployment
  type: git
  source:
    uri: https://github.com/concourse/concourse-bosh-deployment
    branch: #@ data.values.concourse_release_branch
    tag_filter: v*

- name: deployments
  type: git
  source:
    branch: #@ data.values.deployments_branch
    private_key: ((deployments-repo-deploy-key))
    uri: #@ data.values.deployments_uri

- name: opsman-image
  type: pivnet
  source:
    testing: 123
    api_token: ((pivnet-token))
    product_slug: ops-manager
    product_version: ^2\.9\.\d+$

- name: ubuntu-xenial-stemcell
  type: pivnet
  source:
    api_token: ((pivnet-token))
    product_slug: stemcells-ubuntu-xenial
    product_version: ^621\..*

- name: pivnet-rc
  type: pivnet
  source:
    api_token: ((pivnet-token))
    product_slug: p-concourse
    product_version: \d+\.\d+\.\d+\.*

#@ def iaas_terraform_vars(iaas):
  #@ if iaas == "gcp":
  TF_VAR_service_account_key: ((gcp-service-account-key))
  #@ end
  #@ if iaas == "aws":
  TF_VAR_secret_key: ((aws-secret-key))
  TF_VAR_access_key: ((aws-access-key))
  #@ end
  #@ if iaas == "azure":
  TF_VAR_client_id: ((azure-client-id))
  TF_VAR_client_secret: ((azure-client-secret))
  TF_VAR_tenant_id: ((azure-tenant-id))
  TF_VAR_subscription_id: ((azure-subscription-id))
  #@ end
  #@ if iaas == "nsxt":
  TF_VAR_nsxt_username: ((nsxt-username))
  TF_VAR_nsxt_password: ((nsxt-password))
  #@ end
#@ end

#@ def generate_config(deployment):
task: generate-config
tags: #@ deployment.tags
config:
  platform: linux
  image_resource:
    type: registry-image
    source:
      repository: internalpcfplatformautomation/ci
      tag: testing
  inputs:
    - name: deployments
    - name: paving
    - name: repo
  outputs:
    - name: config
    - name: env
    - name: vars
    - name: state
  params:
    DEPLOYMENT: #@ "cpa-" + deployment.iaas
    IAAS: #@ deployment.iaas
    OM_PASSWORD: ((om-password))
  run:
    path: bash
    args:
      - -c
      - |
        set -eu

        output_path=$PWD/deployments/"$DEPLOYMENT"/terraform-outputs.yml

        echo "Attempting to copy optional files to outputs..."
        cp deployments/"$DEPLOYMENT"/state.yml state/ || true

        bosh int -l "$output_path" paving/ci/configuration/"$IAAS"/ops-manager.yml > config/opsman.yml
        cat repo/vm-extensions/"$IAAS".yml >> paving/ci/configuration/"$IAAS"/director.yml
        bosh int -l "$output_path" paving/ci/configuration/"$IAAS"/director.yml > config/director.yml
        bosh int -l "$output_path" paving/ci/configuration/env.yml \
          -v om_password="$OM_PASSWORD" \
          -v om_decryption_passphrase="$OM_PASSWORD" \
          -v om_username=admin > env/env.yml

        cp $output_path vars/terraform-outputs.yml
        cp $PWD/deployments/"$DEPLOYMENT"/concourse-url.txt vars/concourse-url.txt

        echo "Config generation nominal"
#@ end

jobs:
#@ for deployment in data.values.deployments:
- name: #@ "create-opsman-" + deployment.iaas
  serial_groups:
  - #@ "install-" + deployment.iaas
  serial: true
  plan:
  - in_parallel:
    - get: concourse-bosh-deployment
      tags: #@ deployment.tags
      trigger: true
    - get: opsman-image
      params:
        globs:
        - #@ deployment.opsman_glob
      tags: #@ deployment.tags
    - get: paving
      tags: #@ deployment.tags
    - get: platform-automation-tasks
      resource: platform-automation
      params:
        unpack: true
        globs: ["*.zip"]
      tags: #@ deployment.tags
    - get: platform-automation-image
      resource: platform-automation
      params:
        unpack: true
        globs: ["*.tgz"]
      tags: #@ deployment.tags
    - get: deployments
      tags: #@ deployment.tags
    - get: repo
      tags: #@ deployment.tags
  - task: run-terraform
    tags: #@ deployment.tags
    config:
      platform: linux
      image_resource:
        type: registry-image
        source:
          repository: hashicorp/terraform
          tag: 0.14.5
      inputs:
      - name: paving
      - name: deployments
      - name: repo
      outputs:
      - name: deployments
      params:
        DEPLOYMENT: #@ "cpa-" + deployment.iaas
        IAAS: #@ deployment.iaas
        _: #@ template.replace(iaas_terraform_vars(deployment.iaas))
      run:
        path: sh
        args:
        - -c
        - |
          set -eux

          terraform_path=$PWD/paving-$IAAS
          deployment_path=$PWD/deployments/$DEPLOYMENT

          commit() {
            cp $terraform_path/terraform.tfstate $deployment_path
            CWD=$(pwd)
            cd $deployment_path
              git config --global user.name "platform-automation-ci"
              git config --global user.email "pcf-platform-automation@pivotal.io"
              git add terraform.tfstate

              cp $terraform_path/../terraform-outputs.yml $deployment_path || true
              cp $terraform_path/concourse-url.txt $deployment_path || true
              git add terraform-outputs.yml || true
              git add concourse-url.txt || true
              git commit -m "created a new deployment to test $IAAS" || true
            cd $CWD
          }

          trap commit EXIT

          # code_snippet cpa-copy-terraform start bash
          # cp -Ra paving/${IAAS} paving-${IAAS}
          mkdir paving-${IAAS}
          cp -a paving/$IAAS/. paving-$IAAS
          cd paving-${IAAS}
          rm -f pas-*.tf
          rm -f pks-*.tf
          # code_snippet cpa-copy-terraform end bash

          cp ../repo/terraform-templates/${IAAS}.tf $terraform_path
          cp $deployment_path/terraform.tfstate $terraform_path || true
          cp $deployment_path/terraform.tfvars $terraform_path

          # code_snippet cpa-terraform-init start bash
          terraform init
          # code_snippet cpa-terraform-init end bash

          # code_snippet cpa-terraform-refresh start bash
          terraform refresh \
            -var-file=terraform.tfvars
          # code_snippet cpa-terraform-refresh end bash

          # code_snippet cpa-terraform-plan start bash
          terraform plan \
            -out=terraform.tfplan \
            -var-file=terraform.tfvars
          # code_snippet cpa-terraform-plan end bash

          # code_snippet cpa-terraform-apply start bash
          terraform apply \
            -parallelism=5 \
            terraform.tfplan
          # code_snippet cpa-terraform-apply end bash

          # code_snippet cpa-terraform-vars start bash
          terraform output --raw stable_config_opsmanager > ../terraform-outputs.yml
          # code_snippet cpa-terraform-vars end bash

          # code_snippet cpa-terraform-concourse-url start bash
          export CONCOURSE_URL="$(terraform output concourse_url)"
          # code_snippet cpa-terraform-concourse-url end bash

          terraform output --raw concourse_url > concourse-url.txt

    ensure:
      put: deployments
      tags: #@ deployment.tags
      params:
        rebase: true
        repository: deployments
  - #@ generate_config(deployment)
  - task: create-vm
    tags: #@ deployment.tags
    file: platform-automation-tasks/tasks/create-vm.yml
    params:
      RECREATE: true
    input_mapping:
      image: opsman-image
    image: platform-automation-image
    ensure:
      do:
      - task: state-file
        tags: #@ deployment.tags
        file: platform-automation-tasks/tasks/make-git-commit.yml
        image: platform-automation-image
        params:
          GIT_AUTHOR_NAME: platform-automation-ci
          GIT_AUTHOR_EMAIL: platform-automation@pivotal.io
          COMMIT_MESSAGE: #@ "create-vm update state file for cpa-" + deployment.iaas
          FILE_SOURCE_PATH: state.yml
          FILE_DESTINATION_PATH: #@ "cpa-" + deployment.iaas + "/state.yml"
        input_mapping:
          repository: deployments
          file-source: generated-state
      - put: deployments
        tags: #@ deployment.tags
        params:
          rebase: true
          repository: repository-commit
- name: #@ "deploy-and-test-" + deployment.iaas
  serial_groups:
  - #@ "install-" + deployment.iaas
  serial: true
  plan:
  - in_parallel:
    - get: concourse-bosh-deployment
      tags: #@ deployment.tags
      trigger: true
      passed:
        - #@ "create-opsman-" + deployment.iaas
    - get: platform-automation-image
      resource: platform-automation
      params:
        unpack: true
        globs: ["*.tgz"]
      tags: #@ deployment.tags
    - get: deployments
      tags: #@ deployment.tags
    - get: paving
      tags: #@ deployment.tags
    - get: ubuntu-xenial-stemcell
      params:
        globs:
        - #@ deployment.stemcell_glob
      tags: #@ deployment.tags
    - get: repo
      tags: #@ deployment.tags

  - #@ generate_config(deployment)

  - &download-bosh-releases
    tags: #@ deployment.tags
    task: download-all-bosh-releases
    image: platform-automation-image
    config:
      inputs:
        - name: concourse-bosh-deployment
      outputs:
        - name: releases
      platform: linux
      run:
        path: bash
        args:
        - -c
        - |
          set -eux

          # at some point /sbin was removed from PATH, which breaks apt-get since it relies on
          # /sbin/ldconfig and /sbin/start-stop-daemon
          export PATH=/usr/local/sbin:/usr/sbin:/sbin:$PATH

          apt-get -y install wget

          bosh interpolate concourse-bosh-deployment/cluster/concourse.yml \
            -o concourse-bosh-deployment/cluster/operations/uaa.yml \
            -o concourse-bosh-deployment/cluster/operations/credhub-colocated.yml \
            -o concourse-bosh-deployment/cluster/operations/backup-atc-colocated-web.yml \
            -l concourse-bosh-deployment/versions.yml | \
          om interpolate --path /releases --skip-missing | \
          grep url | \
          awk '{ print $2 }' | \
          xargs wget -nc --content-disposition -P releases

  - task: deploy-it
    tags: #@ deployment.tags
    image: platform-automation-image
    config:
      params:
        IAAS: #@ deployment.iaas
      inputs:
      - name: deployments
      - name: env
      - name: vars
      - name: releases
      - name: ubuntu-xenial-stemcell
      - name: config
      - name: concourse-bosh-deployment
      - name: repo
      platform: linux
      run:
        path: bash
        args:
        - -c
        - |
          #!/usr/bin/env bash
          set -euxo pipefail

          cp env/env.yml env.yml
          cp config/director.yml director-config.yml
          cp vars/terraform-outputs.yml terraform-outputs.yml
          mv releases/concourse-bosh-release*.tgz concourse-release.tgz
          mv releases/bpm-release*.tgz bpm-release.tgz
          mv releases/backup-and-restore-sdk-release*.tgz backup-and-restore-sdk-release.tgz
          mv releases/postgres-release*.tgz postgres-release.tgz
          mv releases/credhub-release*.tgz credhub-release.tgz
          mv releases/uaa-release*.tgz uaa-release.tgz
          mv ubuntu-xenial-stemcell/*.tgz stemcell.tgz
          mv repo/ops-files/"$IAAS".yml operations.yml
          mv repo/test-pipeline.yml pipeline.yml

          # code_snippet cpa-write-private-key start bash
          om interpolate \
            -c terraform-outputs.yml \
            --path /ops_manager_ssh_private_key > /tmp/private_key
          # code_snippet cpa-write-private-key end bash

          export CONCOURSE_URL=$(cat vars/concourse-url.txt)

          # code_snippet cpa-terraform-ops-manager-url start bash
          export OM_TARGET="$(om interpolate -c terraform-outputs.yml --path /ops_manager_dns)"
          # code_snippet cpa-terraform-ops-manager-url end bash

          OM_USERNAME=$(om interpolate -c env.yml --path /username)
          OM_PASSWORD=$(om interpolate -c env.yml --path /password)
          OM_DECRYPTION_PASSPHRASE=$(om interpolate -c env.yml --path /decryption-passphrase)

          # code_snippet cpa-configure-auth start bash
          om --env env.yml configure-authentication \
             --username ${OM_USERNAME} \
             --password ${OM_PASSWORD} \
             --decryption-passphrase ${OM_DECRYPTION_PASSPHRASE}
          # code_snippet cpa-configure-auth end bash

          # code_snippet cpa-apply-changes start bash
          om --env env.yml configure-director \
             --config director-config.yml \
             --vars-file terraform-outputs.yml

          om --env env.yml apply-changes \
             --skip-deploy-products
          # code_snippet cpa-apply-changes end bash


          # code_snippet cpa-bosh-target start bash
          eval "$(om --env env.yml bosh-env --ssh-private-key=/tmp/private_key)"

          # Will return a non-error if properly targeted
          bosh curl /info
          # code_snippet cpa-bosh-target end bash

          # code_snippet cpa-upload-releases start bash
          # upload releases
          bosh upload-release concourse-release*.tgz
          bosh upload-release bpm-release*.tgz
          bosh upload-release postgres-release*.tgz
          bosh upload-release uaa-release*.tgz
          bosh upload-release credhub-release*.tgz
          bosh upload-release backup-and-restore-sdk-release*.tgz
          # code_snippet cpa-upload-releases end bash

          # code_snippet cpa-upload-stemcell start bash
          bosh upload-stemcell *stemcell*.tgz
          # code_snippet cpa-upload-stemcell end bash


          cat repo/vars/"$IAAS".yml | envsubst > vars.yml

          # code_snippet create-user start bash
          export ADMIN_USERNAME=admin
          export ADMIN_PASSWORD=password

          credhub set \
             -n /p-bosh/concourse/local_user \
             -t user \
             -z "${ADMIN_USERNAME}" \
             -w "${ADMIN_PASSWORD}"
          # code_snippet create-user end bash

          # code_snippet cpa-deploy-concourse start bash
          bosh -n -d concourse deploy concourse-bosh-deployment/cluster/concourse.yml \
            -o concourse-bosh-deployment/cluster/operations/privileged-http.yml \
            -o concourse-bosh-deployment/cluster/operations/privileged-https.yml \
            -o concourse-bosh-deployment/cluster/operations/basic-auth.yml \
            -o concourse-bosh-deployment/cluster/operations/tls-vars.yml \
            -o concourse-bosh-deployment/cluster/operations/tls.yml \
            -o concourse-bosh-deployment/cluster/operations/uaa.yml \
            -o concourse-bosh-deployment/cluster/operations/credhub-colocated.yml \
            -o concourse-bosh-deployment/cluster/operations/offline-releases.yml \
            -o concourse-bosh-deployment/cluster/operations/backup-atc-colocated-web.yml \
            -o concourse-bosh-deployment/cluster/operations/secure-internal-postgres.yml \
            -o concourse-bosh-deployment/cluster/operations/secure-internal-postgres-bbr.yml \
            -o concourse-bosh-deployment/cluster/operations/secure-internal-postgres-uaa.yml \
            -o concourse-bosh-deployment/cluster/operations/secure-internal-postgres-credhub.yml \
            -o repo/ops-files/credhub-on-port-8000.yml \
            -o operations.yml \
            -l <(om interpolate --config vars.yml --vars-file terraform-outputs.yml) \
            -l concourse-bosh-deployment/versions.yml
          # code_snippet cpa-deploy-concourse end bash

          # code_snippet cpa-credhub-credentials start bash
          export CONCOURSE_CREDHUB_SECRET="$(credhub get -n /p-bosh/concourse/credhub_admin_secret -q)"
          export CONCOURSE_CA_CERT="$(credhub get -n /p-bosh/concourse/atc_tls -k ca)"
          # code_snippet cpa-credhub-credentials end bash

          # code_snippet cpa-credhub-unset start bash
          unset CREDHUB_SECRET CREDHUB_CLIENT CREDHUB_SERVER CREDHUB_PROXY CREDHUB_CA_CERT
          # code_snippet cpa-credhub-unset end bash

          # code_snippet cpa-credhub-login start bash
          credhub login \
            --server "https://${CONCOURSE_URL}:8000" \
            --client-name=credhub_admin \
            --client-secret="${CONCOURSE_CREDHUB_SECRET}" \
            --ca-cert "${CONCOURSE_CA_CERT}"
          # code_snippet cpa-credhub-login end bash

          # code_snippet cpa-credhub-add-value start bash
          credhub set \
            -n /concourse/main/test-pipeline/provided-by-credhub \
            -t value \
            -v "World"
          # code_snippet cpa-credhub-add-value end bash

          PLATFORM=linux
          # code_snippet cpa-fly-download start bash
          curl "https://${CONCOURSE_URL}/api/v1/cli?arch=amd64&platform=${PLATFORM}" \
            --output fly \
            --cacert <(echo "${CONCOURSE_CA_CERT}")
          chmod +x fly
          # code_snippet cpa-fly-download end bash

          # code_snippet cpa-fly-login start bash
          ./fly -t ci login \
            -c "https://${CONCOURSE_URL}" \
            -u "${ADMIN_USERNAME}" \
            -p "${ADMIN_PASSWORD}" \
            --ca-cert <(echo "${CONCOURSE_CA_CERT}")
          # code_snippet cpa-fly-login end bash

          # code_snippet cpa-fly-set-pipeline start bash
          ./fly -t ci set-pipeline \
            -n \
            -p test-pipeline \
            -c pipeline.yml \
            --check-creds
          # code_snippet cpa-fly-set-pipeline end bash

          # code_snippet cpa-fly-unpause-run start bash
          ./fly -t ci unpause-pipeline -p test-pipeline

          ./fly -t ci trigger-job -j test-pipeline/test-job --watch
          # code_snippet cpa-fly-unpause-run end bash

          output=$(./fly -t ci trigger-job -j test-pipeline/test-job --watch)
          if [[ $output == *"Hello, World"* ]]; then
            exit 0
          fi

          echo "Did not find expected output of 'Hello, World'. Instead saw:"
          echo "${output}"
          exit 1
- name: #@ "delete-" + deployment.iaas
  serial_groups:
  - #@ "install-" + deployment.iaas
  serial: true
  plan:
  - in_parallel:
    - get: concourse-bosh-deployment
      trigger: true
      tags: #@ deployment.tags
      passed:
        - #@ "deploy-and-test-" + deployment.iaas
    - get: repo
      tags: #@ deployment.tags
    - get: deployments
      tags: #@ deployment.tags
    - get: platform-automation-image
      resource: platform-automation
      params:
        unpack: true
        globs: ["*.tgz"]
      tags: #@ deployment.tags
    - get: platform-automation-tasks
      resource: platform-automation
      params:
        unpack: true
        globs: ["*.zip"]
      tags: #@ deployment.tags
    - get: paving
      tags: #@ deployment.tags
  - #@ generate_config(deployment)
  - try:
      task: delete-deployment
      tags: #@ deployment.tags
      image: platform-automation-image
      file: repo/ci/tasks/delete-deployment.yml
      params:
        IAAS: #@ deployment.iaas
  - try:
      task: delete-installation
      tags: #@ deployment.tags
      image: platform-automation-image
      file: platform-automation-tasks/tasks/delete-installation.yml
  - try:
      task: delete-opsman-vm
      tags: #@ deployment.tags
      file: platform-automation-tasks/tasks/delete-vm.yml
      image: platform-automation-image
      ensure:
        do:
        - task: state-file
          tags: #@ deployment.tags
          file: platform-automation-tasks/tasks/make-git-commit.yml
          image: platform-automation-image
          params:
            GIT_AUTHOR_NAME: platform-automation-ci
            GIT_AUTHOR_EMAIL: platform-automation@pivotal.io
            COMMIT_MESSAGE: #@ "delete-vm update state file for cpa-" + deployment.iaas
            FILE_SOURCE_PATH: state.yml
            FILE_DESTINATION_PATH: #@ "cpa-" + deployment.iaas + "/state.yml"
          input_mapping:
            repository: deployments
            file-source: generated-state
        - put: deployments
          tags: #@ deployment.tags
          params:
            rebase: true
            repository: repository-commit
  - try:
      task: delete-terraform
      tags: #@ deployment.tags
      config:
        platform: linux
        image_resource:
          type: registry-image
          source:
            repository: hashicorp/terraform
            tag: 0.14.5
        inputs:
        - name: paving
        - name: deployments
        - name: repo
        outputs:
        - name: deployments
        params:
          DEPLOYMENT: #@ "cpa-" + deployment.iaas
          IAAS: #@ deployment.iaas
          _: #@ template.replace(iaas_terraform_vars(deployment.iaas))
        run:
          path: sh
          args:
          - -c
          - |
            set -eux

            terraform_path=$PWD/paving-$IAAS
            deployment_path=$PWD/deployments/$DEPLOYMENT

            commit() {
              cp $terraform_path/terraform.tfstate $deployment_path
              CWD=$(pwd)
              cd $deployment_path
                git config --global user.name "platform-automation-ci"
                git config --global user.email "platform-automation@pivotal.io"
                git add terraform.tfstate

                git commit -m "deleted infrastructure for $IAAS" || true
              cd $CWD
            }

            trap commit EXIT

            cp -ra paving/$IAAS paving-$IAAS
            cp repo/terraform-templates/"$IAAS".tf $terraform_path
            cp $deployment_path/terraform.tfstate $terraform_path
            cp $deployment_path/terraform.tfvars $terraform_path

            cp -ra paving/$IAAS paving-$IAAS
            CWD=$(pwd)
            cd  paving-$IAAS
              terraform init
              terraform destroy \
                -auto-approve \
                -var-file=terraform.tfvars \
                -state=terraform.tfstate
            cd $CWD
    ensure:
      put: deployments
      params:
        rebase: true
        repository: deployments
      tags: #@ deployment.tags
  - task: remove-state-files
    tags: #@ deployment.tags
    file: repo/ci/tasks/delete-state-file.yml
    params:
      DEPLOYMENT: #@ "cpa-" + deployment.iaas
    ensure:
      put: deployments
      params:
        rebase: true
        repository: deployments
#@ end
- name: release-to-pivnet
  serial: true
  plan:
    - in_parallel:
      - get: concourse-bosh-deployment
        passed:
          #@ for/end deployment in data.values.deployments:
          - #@ "deploy-and-test-" + deployment.iaas
      - get: repo
      - get: platform-automation-image
        resource: platform-automation
        params:
          unpack: true
          globs: ["*.tgz"]
    - *download-bosh-releases
    - task: package-for-release
      file: repo/ci/tasks/package-for-release.yml
    - task: generate-metadata
      file: repo/ci/tasks/generate-pivnet-metadata.yml
    - put: pivnet-rc
      params:
        file_glob: packaged-product/*
        metadata_file: metadata/metadata.yml