vmware-k3s-infra-public/.gitlab-ci.yml at main · Rodri9o/vmware-k3s-infra-public · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
variables:
  USER_K3S: ubuntu
  K3S_VERSION: v1.21.4+k3s1
  K3S_CONTEXT: k3s-vmware-test
  MASTER_NAMES: "master-test-1 master-test-2 master-test-3"
  WORKER_NAMES: "worker-test-1 worker-test-2 worker-test-3"
  MASTER_IPS: "192.168.1.93 192.168.1.94 192.168.1.95"
  WORKER_IPS: "192.168.1.96 192.168.1.97 192.168.1.98"
  VAULT_ADDR: http://vault-raft-active.vault-raft.svc.cluster.local:8200
  KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: gitlab-public-gitlab-runner
  KUBERNETES_POD_ANNOTATIONS_1: "vault.hashicorp.com/agent-inject=true"
  KUBERNETES_POD_ANNOTATIONS_2: "vault.hashicorp.com/agent-inject-token=true"
  KUBERNETES_POD_ANNOTATIONS_3: "vault.hashicorp.com/agent-pre-populate-only=true"
  KUBERNETES_POD_ANNOTATIONS_4: "vault.hashicorp.com/role=externalapps"
  KUBERNETES_POD_ANNOTATIONS_5: "vault.hashicorp.com/secret-volume-path=/app/secrets/"

destroy-k3s:
  stage: deploy
  script:
    - export USER=$(whoami)
    - mkdir -p /home/${USER}/.terraform.d
    - |-
      cat > /home/${USER}/.terraform.d/credentials.tfrc.json <<-EOF
      {
        "credentials": {
          "app.terraform.io": {
            "token": "${TFC_TOKEN}"
          }
        }
      }
      EOF
    - ./createautovars.sh "${MASTER_NAMES}" "${WORKER_NAMES}" "${MASTER_IPS}" "${WORKER_IPS}"
    - terraform init -backend-config="token=${TFC_TOKEN}"
    - terraform apply --auto-approve -destroy
  tags: [inK8s]

# terraform-build-k3s:
#   stage: build
#   script:
#     - export USER=$(whoami)
#     - echo USER=${USER} > build.env
#     - mkdir -p /home/${USER}/.terraform.d
#     - |-
#       cat > /home/${USER}/.terraform.d/credentials.tfrc.json <<-EOF
#       {
#         "credentials": {
#           "app.terraform.io": {
#             "token": "${TFC_TOKEN}"
#           }
#         }
#       }
#       EOF
#     # We need to make sure the command below passes entire lists so you have to surround them with quotes " "
#     - ./createautovars.sh "${MASTER_NAMES}" "${WORKER_NAMES}" "${MASTER_IPS}" "${WORKER_IPS}"
#     - terraform init -backend-config="token=${TFC_TOKEN}"
#     - terraform fmt
#     - terraform validate
#     - terraform apply --auto-approve
#     - terraform output -json
#   # Use artifacts.reports.dotenv to pass variables in build.env from this job to the next
#   artifacts:
#     reports:
#       dotenv: build.env
#   tags: [inK8s]

# deploy-k3s:
#   stage: deploy
#   script:
#     - export VAULT_TOKEN=$(cat /app/secrets/token)
#     - export VAULT_ADDR=${VAULT_ADDR}
#     - mkdir -p /home/${USER}/.kube
#     - touch /home/${USER}/.kube/config
#     - mkdir -p /home/${USER}/.ssh
#     - cp ${id_rsa} /home/${USER}/.ssh
#     # We need to make sure the command below passes entire lists so you have to surround them with quotes " "
#     - ./installk3s.sh "${MASTER_NAMES}" "${WORKER_NAMES}" "${MASTER_IPS}" "${WORKER_IPS}" "${USER_K3S}" "${K3S_VERSION}" "${K3S_CONTEXT}"
#     # Store the kube config file in Vault
#     - cat /home/${USER}/.kube/config | base64 | vault kv put external/k3sdemo k3s_config_base64=-
#     # Use the command below to get it ready to be sent out of the pipeline as artifact...this is HIGHLY INSECURE
#     # - cp /home/${USER}/.kube/config .
#   needs:
#     - job: terraform-build-k3s
#       artifacts: true
#   # If you don't have vault set up, you can use the artifacts stanza below to get the kube config file...this is HIGHLY INSECURE
#   # artifacts:
#   #     public: false
#   #     paths:
#   #       - config
#   #     expire_in: 1 hour
#   tags: [inK8s]