You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
295 lines
9.8 KiB
YAML
295 lines
9.8 KiB
YAML
---
|
|
variables:
|
|
AWX_EE_DOCKER_IMAGE_EXTERN: "dev-harbor-01.smardigo.digital/awx/awx-custom-ee"
|
|
ANSIBLE_HOST_KEY_CHECKING: 'false'
|
|
ANSIBLE_FORCE_COLOR: 'true'
|
|
|
|
image: docker.dev-at.de/smardigo/smardigo-ci-ansible
|
|
|
|
services:
|
|
- name: docker-cache.dev-at.de/docker:19-dind
|
|
alias: docker
|
|
|
|
stages:
|
|
- ansible-lint
|
|
- ansible-builder
|
|
- ansible-run-setup
|
|
- ansible-run-kubernetes
|
|
- ansible-update-management
|
|
- ansible-patchday
|
|
|
|
ansible-lint-job:
|
|
stage: ansible-lint
|
|
script:
|
|
- echo "Running ansible-lint to check for linting violations"
|
|
- ansible-lint -c ansible-lint.cfg
|
|
only:
|
|
- branches
|
|
except:
|
|
- schedules
|
|
tags:
|
|
- dind
|
|
|
|
ansible-builder-job:
|
|
# A resource group ensures a job is mutually exclusive across different pipelines for the same project.
|
|
resource_group: deployment
|
|
stage: ansible-builder
|
|
before_script:
|
|
- cd ansible-builder
|
|
script:
|
|
- echo "Running ansible-build to build awx execution environment"
|
|
- ansible-builder build -v 3 --tag $AWX_EE_DOCKER_IMAGE_EXTERN:latest
|
|
- docker push $AWX_EE_DOCKER_IMAGE_EXTERN:latest
|
|
only:
|
|
refs:
|
|
- main
|
|
changes:
|
|
- pip-requirements
|
|
- galaxy-requirements.yml
|
|
- ansible-builder/**/*
|
|
except:
|
|
- schedules
|
|
tags:
|
|
- dind
|
|
- harbor # 05.02.22 TODO some runners run into timeouts
|
|
|
|
########
|
|
### https://patorjk.com/software/taag/#p=display&f=Doom&t=ansible%20-%20run
|
|
###
|
|
### _ _ _ _ _
|
|
### (_) | | | | | | |
|
|
### __ _ _ __ ___ _| |__ | | ___ ______ _ __ _ _ _ __ ______ ___ ___| |_ _ _ _ __ _ _ _ __ ___ | |
|
|
### / _` | '_ \/ __| | '_ \| |/ _ \ |______| | '__| | | | '_ \ |______| / __|/ _ \ __| | | | '_ \| | | | '_ ` _ \| |
|
|
### | (_| | | | \__ \ | |_) | | __/ | | | |_| | | | | \__ \ __/ |_| |_| | |_) | |_| | | | | | | |
|
|
### \__,_|_| |_|___/_|_.__/|_|\___| |_| \__,_|_| |_| |___/\___|\__|\__,_| .__(_)__, |_| |_| |_|_|
|
|
### | | __/ |
|
|
### |_| |___/
|
|
|
|
.ansible-run-setup:
|
|
image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
|
|
stage: ansible-run-setup
|
|
script:
|
|
- 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
|
|
- eval $(ssh-agent -s)
|
|
- 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
|
|
- mkdir -p ~/.ssh
|
|
- chmod 0700 ~/.ssh
|
|
- '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
|
|
- ssh-add -L
|
|
- echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
|
|
- STAGE=dev && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml setup.yml --vault-password-file /tmp/vault-pass -t common -u gitlabci
|
|
after_script:
|
|
- rm /tmp/vault-pass
|
|
tags:
|
|
- dind
|
|
- harbor # 05.02.22 TODO some runners run into timeouts
|
|
|
|
ansible-run-kubernetes-dev:
|
|
extends: .ansible-run-setup
|
|
resource_group: dev
|
|
before_script:
|
|
- export STAGE=dev
|
|
only:
|
|
- main
|
|
- schedules
|
|
|
|
ansible-run-kubernetes-qa:
|
|
extends: .ansible-run-setup
|
|
resource_group: qa
|
|
before_script:
|
|
- export STAGE=qa
|
|
only:
|
|
- qa
|
|
- schedules
|
|
|
|
ansible-run-kubernetes-prodnso:
|
|
extends: .ansible-run-setup
|
|
resource_group: prodnso
|
|
before_script:
|
|
- export STAGE=prodnso
|
|
only:
|
|
- prodnso
|
|
- schedules
|
|
|
|
########
|
|
### https://patorjk.com/software/taag/#p=display&f=Doom&t=ansible%20-%20run
|
|
###
|
|
### _ _ _ _ _ _ _
|
|
### (_) | | | | | | | | | | |
|
|
### __ _ _ __ ___ _| |__ | | ___ ______ _ __ _ _ _ __ ______ | | ___ _| |__ ___ _ __ _ __ ___| |_ ___ ___ _ _ _ __ ___ | |
|
|
### / _` | '_ \/ __| | '_ \| |/ _ \ |______| | '__| | | | '_ \ |______| | |/ / | | | '_ \ / _ \ '__| '_ \ / _ \ __/ _ \/ __|| | | | '_ ` _ \| |
|
|
### | (_| | | | \__ \ | |_) | | __/ | | | |_| | | | | | <| |_| | |_) | __/ | | | | | __/ || __/\__ \| |_| | | | | | | |
|
|
### \__,_|_| |_|___/_|_.__/|_|\___| |_| \__,_|_| |_| |_|\_\\__,_|_.__/ \___|_| |_| |_|\___|\__\___||___(_)__, |_| |_| |_|_|
|
|
### __/ |
|
|
### |___/
|
|
|
|
.ansible-run-kubernetes:
|
|
image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
|
|
stage: ansible-run-kubernetes
|
|
before_script:
|
|
- 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
|
|
- eval $(ssh-agent -s)
|
|
- 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
|
|
- mkdir -p ~/.ssh
|
|
- chmod 0700 ~/.ssh
|
|
- '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
|
|
- ssh-add -L
|
|
- echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
|
|
- STAGE=dev && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml kubernetes.yml --vault-password-file /tmp/vault-pass -u gitlabci
|
|
after_script:
|
|
- rm /tmp/vault-pass
|
|
tags:
|
|
- dind
|
|
- harbor # 05.02.22 TODO some runners run into timeouts
|
|
resource_group: dev
|
|
|
|
ansible-run-kubernetes-dev:
|
|
extends: .ansible-run-kubernetes
|
|
resource_group: deployment
|
|
before_script:
|
|
- export STAGE=dev
|
|
only:
|
|
- main
|
|
- schedules
|
|
|
|
ansible-run-kubernetes-qa:
|
|
extends: .ansible-run-kubernetes
|
|
resource_group: qa
|
|
before_script:
|
|
- export STAGE=qa
|
|
only:
|
|
- qa
|
|
- schedules
|
|
|
|
ansible-run-kubernetes-prodnso:
|
|
extends: .ansible-run-kubernetes
|
|
resource_group: prodnso
|
|
before_script:
|
|
- export STAGE=prodnso
|
|
only:
|
|
- prodnso
|
|
- schedules
|
|
|
|
########
|
|
### https://patorjk.com/software/taag/#p=display&f=Doom&t=management
|
|
### _
|
|
### | |
|
|
### _ __ ___ __ _ _ __ __ _ __ _ ___ _ __ ___ ___ _ __ | |_
|
|
### | '_ ` _ \ / _` | '_ \ / _` |/ _` |/ _ \ '_ ` _ \ / _ \ '_ \| __|
|
|
### | | | | | | (_| | | | | (_| | (_| | __/ | | | | | __/ | | | |_
|
|
### |_| |_| |_|\__,_|_| |_|\__,_|\__, |\___|_| |_| |_|\___|_| |_|\__|
|
|
### __/ |
|
|
### |___/
|
|
|
|
.ansible-management:
|
|
image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
|
|
# A resource group ensures a job is mutually exclusive across different pipelines for the same project.
|
|
stage: ansible-update-management
|
|
script:
|
|
- 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
|
|
- eval $(ssh-agent -s)
|
|
- 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
|
|
- mkdir -p ~/.ssh
|
|
- chmod 0700 ~/.ssh
|
|
- '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
|
|
- ssh-add -L
|
|
- echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
|
|
- export HETZNER_LABEL_SELECTOR="stage=${STAGE}"
|
|
- ansible-playbook -i stage-$STAGE smardigo.yml --vault-password-file=/tmp/vault-pass -l management -t update_configurations -u gitlabci
|
|
only:
|
|
changes:
|
|
- smardigo/**/*
|
|
except:
|
|
- schedules
|
|
tags:
|
|
- dind
|
|
|
|
ansible-management-dev:
|
|
extends: .ansible-management
|
|
resource_group: deployment
|
|
before_script:
|
|
- export STAGE=dev
|
|
only:
|
|
- main
|
|
- schedules
|
|
|
|
ansible-management-qa:
|
|
extends: .ansible-management
|
|
resource_group: qa
|
|
before_script:
|
|
- export STAGE=qa
|
|
only:
|
|
- qa
|
|
- schedules
|
|
|
|
ansible-management-prodnso:
|
|
extends: .ansible-management
|
|
resource_group: prodnso
|
|
before_script:
|
|
- export STAGE=prodnso
|
|
only:
|
|
- prodnso
|
|
- schedules
|
|
|
|
########
|
|
### https://patorjk.com/software/taag/#p=display&f=Doom&t=patchday
|
|
### _ _ _
|
|
### | | | | | |
|
|
### _ __ __ _| |_ ___| |__ __| | __ _ _ _
|
|
### | '_ \ / _` | __/ __| '_ \ / _` |/ _` | | | |
|
|
### | |_) | (_| | || (__| | | | (_| | (_| | |_| |
|
|
### | .__/ \__,_|\__\___|_| |_|\__,_|\__,_|\__, |
|
|
### | | __/ |
|
|
### |_| |___/
|
|
###
|
|
|
|
.ansible-patchday:
|
|
image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
|
|
stage: ansible-patchday
|
|
script:
|
|
- 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
|
|
- eval $(ssh-agent -s)
|
|
- 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
|
|
- mkdir -p ~/.ssh
|
|
- chmod 0700 ~/.ssh
|
|
- '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
|
|
- ssh-add -L
|
|
- echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
|
|
- export HETZNER_LABEL_SELECTOR="stage=${STAGE}"
|
|
- ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml patchday.yml patchday.yml --vault-password-file=/tmp/vault-pass -u gitlabci
|
|
after_script:
|
|
- rm /tmp/vault-pass
|
|
when: manual
|
|
only:
|
|
- main
|
|
tags:
|
|
- dind
|
|
- harbor # 05.02.22 TODO some runners run into timeouts
|
|
|
|
ansible-patchday-dev:
|
|
extends: .ansible-patchday
|
|
resource_group: dev
|
|
before_script:
|
|
- export STAGE=dev
|
|
only:
|
|
- main
|
|
- schedules
|
|
|
|
ansible-patchday-qa:
|
|
extends: .ansible-patchday
|
|
resource_group: qa
|
|
before_script:
|
|
- export STAGE=qa
|
|
only:
|
|
- qa
|
|
- schedules
|
|
|
|
ansible-patchday-prodnso:
|
|
extends: .ansible-patchday
|
|
resource_group: prodnso
|
|
before_script:
|
|
- export STAGE=prodnso
|
|
only:
|
|
- prodnso
|
|
- schedules
|