-
Notifications
You must be signed in to change notification settings - Fork 9
Expand file tree
/
Copy pathJenkinsfile
More file actions
executable file
·297 lines (272 loc) · 13.6 KB
/
Jenkinsfile
File metadata and controls
executable file
·297 lines (272 loc) · 13.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
String tfProject = "nia"
String tfEnvironment = "build1" // change for ptl, vp goes here
String tfComponent = "OneOneOne" // this defines the application - nhais, mhs, 111 etc
Map<String,String> tfOutputs = [:] //map for collecting values from tfOutput
pipeline {
agent{
label 'jenkins-workers'
}
options {
timestamps()
buildDiscarder(logRotator(numToKeepStr: "10")) // keep only last 10 builds
}
environment {
BUILD_TAG = sh label: 'Generating build tag', returnStdout: true, script: 'python3 scripts/tag.py ${GIT_BRANCH} ${BUILD_NUMBER} ${GIT_COMMIT}'
BUILD_TAG_LOWER = sh label: 'Lowercase build tag', returnStdout: true, script: "echo -n ${BUILD_TAG} | tr '[:upper:]' '[:lower:]'"
ENVIRONMENT_ID = "build1"
ECR_REPO_DIR = "111"
ECR_REPO_DIR_NGINX = "111-nginx"
DOCKER_IMAGE = "${DOCKER_REGISTRY}/${ECR_REPO_DIR}:${BUILD_TAG}"
DOCKER_NGINX_IMAGE = "${DOCKER_REGISTRY}/${ECR_REPO_DIR_NGINX}:${BUILD_TAG}"
}
stages {
stage('Test') {
steps {
script {
sh '''
docker network create 111network || true
docker-compose -f docker/docker-compose.yml -f docker/docker-compose-checks.yml build --no-cache integration-adaptor-111 activemq wiremock
docker-compose -f docker/docker-compose.yml -f docker/docker-compose-checks.yml up --exit-code-from integration-adaptor-111 integration-adaptor-111
'''
}
}
post {
always {
sh "docker cp integration-adaptor-111_tests:/home/gradle/service/build integration-adaptor-111-build"
archiveArtifacts artifacts: 'integration-adaptor-111-build/reports/**/*.*', fingerprint: true
junit '**/integration-adaptor-111-build/test-results/**/*.xml'
recordIssues(
enabledForFailure: true,
tools: [
checkStyle(pattern: '**/reports/checkstyle/*.xml'),
spotBugs(pattern: '**/reports/spotbugs/*.xml')
]
)
sh label: 'Remove exited containers', script: 'docker system prune -fa'
}
}
}
stage('Build') {
stages {
stage('Build Docker Images') {
steps {
script {
if (sh(label: 'Running 111 adaptor docker build', script: 'docker build -f docker/service/Dockerfile -t ${DOCKER_IMAGE} .', returnStatus: true) != 0) {error("Failed to build 111 adaptor Docker image")}
if (sh(label: 'Running 111 nginx docker build', script: 'docker build -f docker/nginx/Dockerfile -t ${DOCKER_NGINX_IMAGE} .', returnStatus: true) != 0) {error("Failed to build 111 nginx Docker image")}
}
}
}
stage('Push Image') {
when {
expression { currentBuild.resultIsBetterOrEqualTo('SUCCESS') }
}
steps {
script {
if (ecrLogin(TF_STATE_BUCKET_REGION) != 0 ) { error("Docker login to ECR failed") }
String dockerPushCommand = "docker push ${DOCKER_IMAGE}"
String dockerNginxPushCommand = "docker push ${DOCKER_NGINX_IMAGE}"
if (sh (label: "Pushing image", script: dockerPushCommand, returnStatus: true) !=0) { error("Docker push 111 image failed") }
if (sh (label: "Pushing image", script: dockerNginxPushCommand, returnStatus: true) !=0) { error("Docker push nginx image failed") }
}
}
}
}
}
stage('Deploy') {
when {
//Stage disabled until NIAD-2098 is fixed
//expression { currentBuild.resultIsBetterOrEqualTo('SUCCESS') }
expression { false }
}
options {
lock("${tfProject}-${tfEnvironment}-${tfComponent}")
}
stages {
stage('Deploy using Terraform') {
steps {
script {
String tfCodeBranch = "develop"
String tfCodeRepo = "https://github.com/nhsconnect/integration-adaptors"
String tfRegion = TF_STATE_BUCKET_REGION
List<String> tfParams = []
Map<String,String> tfVariables = ["${tfComponent}_build_id": BUILD_TAG]
dir ("integration-adaptors") {
// Clone repository with terraform
git (branch: tfCodeBranch, url: tfCodeRepo)
dir ("terraform/aws") {
// Run TF Init
if (terraformInit(TF_STATE_BUCKET, tfProject, tfEnvironment, tfComponent, tfRegion) !=0) { error("Terraform init failed")}
// Run TF Plan
if (terraform('plan', TF_STATE_BUCKET, tfProject, tfEnvironment, tfComponent, tfRegion, tfVariables) !=0 ) { error("Terraform Plan failed")}
//Run TF Apply
if (terraform('apply', TF_STATE_BUCKET, tfProject, tfEnvironment, tfComponent, tfRegion, tfVariables) !=0 ) { error("Terraform Apply failed")}
tfOutputs = collectTfOutputs(tfComponent)
}
}
}
}
}
stage ('Verify AWS Deployment') {
steps {
script {
sleep(60)
if (checkLbTargetGroupHealth(tfOutputs["${tfComponent}_lb_target_group_arn"], TF_STATE_BUCKET_REGION) != 0) { error("AWS healthcheck failed, check the CloudWatch logs")}
}
}
}
// stage('Run integration tests') {
// steps {
// echo 'TODO run integration tests'
// echo 'TODO archive test results'
// }
// }
}
}
// stage('Run SonarQube analysis') {
// steps {
// runSonarQubeAnalysis()
// }
// }
}
post {
always {
// sh label: 'Stopping containers', script: 'docker-compose down -v'
sh label: 'Remove all unused images not just dangling ones', script:'docker system prune --force'
sh 'docker image rm -f $(docker images "*/*:*${BUILD_TAG}" -q) $(docker images "*/*/*:*${BUILD_TAG}" -q) || true'
}
}
}
void runSonarQubeAnalysis() {
sh label: 'Running SonarQube analysis', script: "sonar-scanner -Dsonar.host.url=${SONAR_HOST} -Dsonar.login=${SONAR_TOKEN}"
}
String tfEnv(String tfEnvRepo="https://github.com/tfutils/tfenv.git", String tfEnvPath="~/.tfenv") {
sh(label: "Get tfenv" , script: "git clone ${tfEnvRepo} ${tfEnvPath}", returnStatus: true)
sh(label: "Install TF", script: "${tfEnvPath}/bin/tfenv install" , returnStatus: true)
return "${tfEnvPath}/bin/terraform"
}
int terraformInit(String tfStateBucket, String project, String environment, String component, String region) {
String terraformBinPath = tfEnv()
println("Terraform Init for Environment: ${environment} Component: ${component} in region: ${region} using bucket: ${tfStateBucket}")
String command = "${terraformBinPath} init -backend-config='bucket=${tfStateBucket}' -backend-config='region=${region}' -backend-config='key=${project}-${environment}-${component}.tfstate' -input=false -no-color"
dir("components/${component}") {
return( sh( label: "Terraform Init", script: command, returnStatus: true))
} // dir
} // int TerraformInit
int terraform(String action, String tfStateBucket, String project, String environment, String component, String region, Map<String, String> variables=[:], List<String> parameters=[]) {
println("Running Terraform ${action} in region ${region} with: \n Project: ${project} \n Environment: ${environment} \n Component: ${component}")
variablesMap = variables
variablesMap.put('region',region)
variablesMap.put('project', project)
variablesMap.put('environment', environment)
variablesMap.put('tf_state_bucket',tfStateBucket)
parametersList = parameters
parametersList.add("-no-color")
//parametersList.add("-compact-warnings") /TODO update terraform to have this working
// Get the secret variables for global
String secretsFile = "etc/secrets.tfvars"
writeVariablesToFile(secretsFile,getAllSecretsForEnvironment(environment,"nia",region))
String terraformBinPath = tfEnv()
List<String> variableFilesList = [
"-var-file=../../etc/global.tfvars",
"-var-file=../../etc/${region}_${environment}.tfvars",
"-var-file=../../${secretsFile}"
]
if (action == "apply"|| action == "destroy") {parametersList.add("-auto-approve")}
List<String> variablesList=variablesMap.collect { key, value -> "-var ${key}=${value}" }
String command = "${terraformBinPath} ${action} ${variableFilesList.join(" ")} ${parametersList.join(" ")} ${variablesList.join(" ")} "
dir("components/${component}") {
return sh(label:"Terraform: "+action, script: command, returnStatus: true)
} // dir
} // int Terraform
int ecrLogin(String aws_region) {
String dockerLogin = "aws ecr get-login-password --region ${aws_region} | docker login -u AWS --password-stdin \"https://\$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.${aws_region}.amazonaws.com\""
return sh(label: "Logging in with Docker", script: dockerLogin, returnStatus: true)
}
int checkLbTargetGroupHealth(String lbTargetGroupName, String region, int retries=30, int wait=15) {
String getLBsCommand = "aws elbv2 describe-target-health --region ${region} --target-group-arn ${lbTargetGroupName} --query TargetHealthDescriptions[].[Target.Id,TargetHealth.State] --output text"
List<String> lbStatusList = []
int retriesLeft = retries
int lbStatus = 1
while (retriesLeft>0 && lbStatus == 1) {
lbStatusList = sh (script: getLBsCommand, returnStdout: true).split('/n')
int allHosts = lbStatusList.size()
int healthyHosts= lbStatusList.count {it.contains('healthy')}
println lbStatusList
if (allHosts == healthyHosts) {
println("All hosts are healthy")
lbStatus = 0
} else {
retriesLeft = retriesLeft -1
sleep(wait)
}
}
println "Finished checking"
return lbStatus
}
Map<String,String> collectTfOutputs(String component) {
Map<String,String> returnMap = [:]
dir("components/${component}") {
String terraformBinPath = tfEnv()
List<String> outputsList = sh (label: "Listing TF outputs", script: "${terraformBinPath} output", returnStdout: true).split("\n")
outputsList.each {
returnMap.put(it.split("=")[0].trim(),it.split("=")[1].trim())
}
} // dir
return returnMap
}
// Retrieving Secrets from AWS Secrets
String getSecretValue(String secretName, String region) {
String awsCommand = "aws secretsmanager get-secret-value --region ${region} --secret-id ${secretName} --query SecretString --output text"
return sh(script: awsCommand, returnStdout: true).trim()
}
void writeSecretToFile(String secretName, String fileName, String region) {
String secretValue = getSecretValue(secretName, region)
sh (script: "touch ${fileName} && echo '\n' > ${fileName}")
sh (script: "echo '${secretValue}' >> ${fileName}")
}
Map<String,Object> decodeSecretKeyValue(String rawSecret) {
List<String> secretsSplitted = rawSecret.replace("{","").replace("}","").split(",")
Map<String,Object> secretsDecoded = [:]
secretsSplitted.each {
String key = it.split(":")[0].trim().replace("\"","")
Object value = it.split(":")[1]
secretsDecoded.put(key,value)
}
return secretsDecoded
}
List<String> getSecretsByPrefix(String prefix, String region) {
String awsCommand = "aws secretsmanager list-secrets --region ${region} --query SecretList[].Name --output text"
List<String> awsReturnValue = sh(script: awsCommand, returnStdout: true).split()
return awsReturnValue.findAll { it.startsWith(prefix) }
}
Map<String,Object> getAllSecretsForEnvironment(String environment, String secretsPrefix, String region) {
List<String> globalSecrets = getSecretsByPrefix("${secretsPrefix}-global",region)
println "global secrets:" + globalSecrets
List<String> environmentSecrets = getSecretsByPrefix("${secretsPrefix}-${environment}",region)
println "env secrets:" + environmentSecrets
Map<String,Object> secretsMerged = [:]
globalSecrets.each {
String rawSecret = getSecretValue(it,region)
if (it.contains("-kvp")) {
secretsMerged << decodeSecretKeyValue(rawSecret)
} else {
secretsMerged.put(it.replace("${secretsPrefix}-global-",""),rawSecret)
}
}
environmentSecrets.each {
String rawSecret = getSecretValue(it,region)
if (it.contains("-kvp")) {
secretsMerged << decodeSecretKeyValue(rawSecret)
} else {
secretsMerged.put(it.replace("${secretsPrefix}-${environment}-",""),rawSecret)
}
}
return secretsMerged
}
void writeVariablesToFile(String fileName, Map<String,Object> variablesMap) {
List<String> variablesList=variablesMap.collect { key, value -> "${key} = ${value}" }
sh (script: "touch ${fileName} && echo '\n' > ${fileName}")
variablesList.each {
sh (script: "echo '${it}' >> ${fileName}")
}
}