.gitlab-ci.yml

stages:
  - prepare
  - build
  - test
  - deploy

variables:
  GIT_SUBMODULE_STRATEGY: recursive
  VIRTER_VERSION: v0.27.0
  VMSHED_VERSION: v0.22.1
  KUSTOMIZE_VERSION: v5.4.2
  K8S_TEST_VERSION: v2.7.2
  HELM_VERSION: v3.14.2

prepare-bins:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
    - if: $CI_COMMIT_BRANCH == 'v2'
  image: ${LINBIT_DOCKER_REGISTRY}/build-helpers:latest
  stage: prepare
  script:
    - . /usr/local/bin/gitlab-utils.sh
    - ci_prepare_tools
    - ci_fetch_binary virter virter-$VIRTER_VERSION https://github.com/LINBIT/virter/releases/download/$VIRTER_VERSION/virter-linux-amd64
    - ci_fetch_binary vmshed vmshed-$VMSHED_VERSION https://github.com/LINBIT/vmshed/releases/download/$VMSHED_VERSION/vmshed-linux-amd64
    - ci_fetch_binary create-k8s-test-configs create-k8s-test-configs-$K8S_TEST_VERSION $LINBIT_REGISTRY_URL/repository/tools/create-k8s-test-configs:$K8S_TEST_VERSION
    - ci_fetch_tar kustomize-$KUSTOMIZE_VERSION "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz" -z
    - ci_fetch_tar helm-$HELM_VERSION "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz" -z
  cache:
    key: bin-$VIRTER_VERSION-$VMSHED_VERSION-$K8S_TEST_VERSION-$KUSTOMIZE_VERSION-$HELM_VERSION
    paths:
      - download
  artifacts:
    paths:
      - download
      - bin

build_operator:
  image: ${LINBIT_DOCKER_REGISTRY}/container-tools:latest
  variables:
    TAG: v2-dev-${CI_COMMIT_SHORT_SHA}
    VERSION: $TAG-$CI_COMMIT_SHA
    NOCACHE: "false"
    PLATFORMS: ${PUBLISH_PLATFORMS}
    REGISTRY: ${LINBIT_DOCKER_REGISTRY}/linstor-operator-test
  rules:
    - if: $CI_COMMIT_TAG
      variables:
        TAG: $CI_COMMIT_TAG
        NOCACHE: "true"
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
    - if: $CI_COMMIT_BRANCH == 'v2'
  stage: build
  script:
    - docker buildx bake --pull --push --no-cache=$NOCACHE
    - echo "OPERATOR_IMAGE=$LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator:$TAG" > .build.env
  artifacts:
    reports:
      dotenv:
        - .build.env

build_static_deployment:
  image:
    name: python:3
    entrypoint: [""]
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
    - if: $CI_COMMIT_BRANCH == 'v2'
  stage: build
  before_script:
    - mkdir -p .cache/pip
    - pip install --cache-dir .cache/pip pyyaml
  script:
    - bin/kustomize build ./deploy/default > static-deployment.yaml
    - hack/get-image-list.py static-deployment.yaml > image.list
  cache:
    paths:
      - .cache/pip
  artifacts:
    paths:
      - static-deployment.yaml
      - image.list

build_helm_deployment:
  image:
    name: python:3
    entrypoint: [""]
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
    - if: $CI_COMMIT_BRANCH == 'v2'
  stage: build
  script:
    - bin/helm package charts/linbit-sds charts/linstor-operator
  cache:
  artifacts:
    paths:
      - "*.tgz"

container_scanning:
  stage: test
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
    - if: $CI_COMMIT_BRANCH == 'v2'
    - if: $CI_COMMIT_TAG
  image:
    name: docker.io/aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy --version
    - trivy image --exit-code 0 --format template --template "@/contrib/html.tpl" -o container-scan.html "$OPERATOR_IMAGE"
    # Prints full report
    - trivy image --exit-code 0 "$OPERATOR_IMAGE"
    # Fail on critical (unfixed) vulnerabilities
    - trivy image --exit-code 1 --ignore-unfixed --severity CRITICAL "$OPERATOR_IMAGE"
  # Ideally, we would use container_scanning for the artifact here. That is currently a paid feature, so we have to use code quality
  artifacts:
    when: always
    expose_as: "Container Scan"
    paths:
      - container-scan.html

.test:
  stage: test
  script:
    - set -ex
    - export PATH=$CI_PROJECT_DIR/bin:$PATH
    - create-k8s-test-configs -stable-releases-to-check=$RELEASES_TO_CHECK -include-next=$INCLUDE_NEXT -base-image=alma-9 -output-dir=.
    - ( cd deploy/default ; kustomize edit set image controller=$OPERATOR_IMAGE ; kustomize edit add patch --kind Deployment --name controller-manager --patch '[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--linstor-node-cache-duration=15s"}]' )
    - >
      vmshed
      --error-details=false
      --nvms $(( ${LINBIT_CI_MAX_CPUS:-20} / 3 ))
      --pull-template "${LINBIT_DOCKER_REGISTRY}/vm/{{ .Image }}:latest"
      --variant "$VARIANT"
      --torun "$TO_RUN"
      --set values.DockerRegistryMirror=https://${DOCKER_REGISTRY_MIRROR}
      --set values.DrbdRegistryMirror=https://${DRBD_REGISTRY_MIRROR}
      --set values.K8sGcrIoMirror=https://${K8S_REGISTRY_MIRROR}
      --set values.RegistryK8sIoMirror=https://${REGISTRY_K8S_IO_MIRROR}
      --set values.DrbdIoUser=${PUBLISH_REGISTRY_USER}
      --set values.DrbdIoPassword=${PUBLISH_REGISTRY_PASSWORD}
      --set values.JustKubeadmImage=${LINBIT_DOCKER_REGISTRY}/linstor-kubernetes-tests/just-kubeadm:${K8S_TEST_VERSION}
      --set values.HelmImage=${LINBIT_DOCKER_REGISTRY}/linstor-kubernetes-tests/helm:${K8S_TEST_VERSION}
      --set values.TestImage=${LINBIT_DOCKER_REGISTRY}/linstor-kubernetes-tests/tests:${K8S_TEST_VERSION}
      --set values.DeploymentVersion=v2
      --set values.DeploymentV2Source=/virter/workspace/deploy/default
      --set "values.Skip=$SKIP"
      --set "values.Focus=$FOCUS"
  artifacts:
    when: always
    paths:
      - tests-out/
    reports:
      junit:
        # These reports are created by vmshed, reporting if the test command itself succeeded.
        - tests-out/test-results/*.xml
        # These reports are created by the test binaries, holding details about all tests that ran.
        - tests-out/log/**/*-report.xml

test-fast:
  tags:
  - libvirt-xs
  extends: .test
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
    - if: $CI_COMMIT_BRANCH == 'v2'
    - if: $CI_COMMIT_TAG
  timeout: 1h
  variables:
    TO_RUN: operator
    VARIANT: dualstack
    RELEASES_TO_CHECK: "4"
    INCLUDE_NEXT: "true"

test-full:
  tags:
  - libvirt
  timeout: 8h
  extends: .test
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: manual
      allow_failure: true
    - if: $CI_COMMIT_BRANCH == 'v2'
      when: manual
      allow_failure: true
    - if: $CI_COMMIT_TAG
      when: manual
      allow_failure: true
  variables:
    RELEASES_TO_CHECK: "4"
    INCLUDE_NEXT: "true"
    SKIP: "Slow|LinuxOnly|xfs|ext3|ext4|immediate-binding|retain policy|readOnly|read-only|exec|multiple|subPath"
    VARIANT: "ipv4,ipv6,dualstack"

publish-image:
  stage: deploy
  image: ${LINBIT_DOCKER_REGISTRY}/container-tools:latest
  variables:
    DOCKER_AUTH_CONFIG_FROM: DOCKER_PUBLISH_AUTH_CONFIG_FILE
    REGISTRY: ${PUBLISH_REGISTRY}
    PLATFORMS: ${PUBLISH_PLATFORMS}
    TAG: v2-dev-${CI_COMMIT_SHORT_SHA}
    VERSION: $TAG-$CI_COMMIT_SHA
  rules:
  - if: $CI_COMMIT_BRANCH == 'v2'
    when: manual
    allow_failure: true
  - if: $CI_COMMIT_TAG
    variables:
      TAG: $CI_COMMIT_TAG
  script:
    - docker buildx bake --pull --push

publish-config:
  stage: deploy
  image:
    name: python:3
  rules:
    - if: $CI_COMMIT_TAG
      variables:
        RELEASE_VERSION: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == 'v2'
      when: manual
      allow_failure: true
      variables:
        RELEASE_VERSION: v2.99.0+$CI_COMMIT_REF_SLUG.$CI_COMMIT_SHORT_SHA
    - if: $CI_MERGE_REQUEST_ID
      when: manual
      allow_failure: true
      variables:
        RELEASE_VERSION: v2.99.0+$CI_COMMIT_REF_SLUG.$CI_COMMIT_SHORT_SHA
  variables:
    UPSTREAM: git@github.com:LINBIT/linstor-operator-builder.git
    GIT_AUTHOR_NAME: LinbitPRBot
    GIT_COMMITTER_NAME: LinbitPRBot
    GIT_AUTHOR_EMAIL: linbitprbot@users.noreply.github.com
    GIT_COMMITTER_EMAIL: linbitprbot@users.noreply.github.com
  before_script:
    - mkdir -p .cache/pip
    - pip install --cache-dir .cache/pip pyyaml semver
  script:
    - mkdir -p $HOME/.ssh
    - ln -snf $GITHUB_KNOWN_HOSTS $HOME/.ssh/known_hosts
    - eval $(ssh-agent -s)
    - cat $GITHUB_DEPLOY_KEY | ssh-add -
    - git clone -b gh-pages --single-branch --depth=1 "$UPSTREAM" gh-pages
    - mkdir -p gh-pages/static
    - cp --no-clobber -t gh-pages *.tgz
    - cp static-deployment.yaml "gh-pages/static/$RELEASE_VERSION.yaml"
    - cp image.list "gh-pages/static/$RELEASE_VERSION.image-list.txt"
    - ln -snf "$RELEASE_VERSION.yaml" "gh-pages/static/latest.yaml"
    - ln -snf "$RELEASE_VERSION.image-list.txt" "gh-pages/static/latest.image-list.txt"
    - hack/generate-release-info.py gh-pages/static | tee gh-pages/content/releases.json
    - bin/helm repo index --url https://charts.linstor.io gh-pages
    - git -C gh-pages add .
    - git -C gh-pages diff --staged
    - if [ -n "$CI_COMMIT_TAG" ]; then
    -   git -C gh-pages commit -m "Release $RELEASE_VERSION"
    -   git -C gh-pages push "$UPSTREAM" gh-pages:gh-pages
    - fi
  cache:
    paths:
      - .cache/pip
  artifacts:
    paths:
      - gh-pages/static
      - gh-pages/content