.gitlab-ci.yml

stages:
  - prepare
  - build
  - build_olm
  - test
  - deploy

variables:
  GIT_SUBMODULE_STRATEGY: recursive
  VIRTER_VERSION: v0.25.0
  VMSHED_VERSION: v0.20.1
  K8S_TEST_VERSION: v2.5.0
  # Upstream uses a newer version. This is fine, as we only use this version for building the CSV.
  # Newer versions do not support "operator-sdk generate csv"
  OPERATOR_SDK_VERSION: v0.18.0
  OPM_VERSION: v1.15.3
  HELM_VERSION: v3.4.1
  CRANE_VERSION: v0.8.0
  YQ_VERSION: 3.3.4
  JQ_VERSION: "1.6"

prepare-version:
  image: python:3
  stage: prepare
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
  variables:
    # git describe needs full history access
    GIT_DEPTH: 0
    # git describe does not need the submodule
    GIT_SUBMODULE_STRATEGY: none
  script:
    - SEMVER=$(hack/getsemver.py)
    - echo "SEMVER=${SEMVER}" >> .ci-build.env
    - echo "TAG=v${SEMVER/+/-}" >> .ci-build.env
  artifacts:
    reports:
      dotenv: .ci-build.env

prepare-bins:
  image: ${BUILD_HELPER_IMAGE}
  stage: prepare
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
  script:
    - . /usr/local/bin/gitlab-utils.sh
    - ci_prepare_tools
    - ci_fetch_binary virter virter-$VIRTER_VERSION https://github.com/LINBIT/virter/releases/download/$VIRTER_VERSION/virter-linux-amd64
    - ci_fetch_binary vmshed vmshed-$VMSHED_VERSION https://github.com/LINBIT/vmshed/releases/download/$VMSHED_VERSION/vmshed-linux-amd64
    - ci_fetch_binary create-k8s-test-configs create-k8s-test-configs-$K8S_TEST_VERSION $LINBIT_REGISTRY_URL/repository/tools/create-k8s-test-configs:$K8S_TEST_VERSION
    - ci_fetch_binary operator-sdk operator-sdk-$OPERATOR_SDK_VERSION https://github.com/operator-framework/operator-sdk/releases/download/$OPERATOR_SDK_VERSION/operator-sdk-$OPERATOR_SDK_VERSION-x86_64-linux-gnu
    - ci_fetch_binary opm opm-$OPM_VERSION https://github.com/operator-framework/operator-registry/releases/download/$OPM_VERSION/linux-amd64-opm
    - ci_fetch_binary yq yq-$YQ_VERSION https://github.com/mikefarah/yq/releases/download/$YQ_VERSION/yq_linux_amd64
    - ci_fetch_binary jq jq-$JQ_VERSION https://github.com/stedolan/jq/releases/download/jq-$JQ_VERSION/jq-linux64
    - ci_fetch_tar helm-$HELM_VERSION https://get.helm.sh/helm-$HELM_VERSION-linux-amd64.tar.gz -z
    - ci_fetch_tar crane-$CRANE_VERSION https://github.com/google/go-containerregistry/releases/download/$CRANE_VERSION/go-containerregistry_Linux_x86_64.tar.gz -z
  cache:
    key: $VIRTER_VERSION-$VMSHED_VERSION-$K8S_TEST_VERSION-$OPERATOR_SDK_VERSION-$OPM_VERSION-$YQ_VERSION-$JQ_VERSION-$HELM_VERSION-$CRANE_VERSION
    paths:
      - download
  artifacts:
    paths:
      - bin
      - download

prepare-tools:
  tags:
    - docker
    - amd64
  stage: prepare
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: manual
      allow_failure: true
    - if: $CI_COMMIT_BRANCH == 'master'
      when: manual
      allow_failure: true
  script:
    - ln -snf $DOCKER_AUTH_CONFIG_FILE $HOME/.docker/config.json
    - docker build -f .gitlab/Dockerfile.operator-sdk-tools -t $LINBIT_DOCKER_REGISTRY/linstor-operator-test/operator-sdk:latest .gitlab
    - docker push $LINBIT_DOCKER_REGISTRY/linstor-operator-test/operator-sdk:latest

build_chart:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
  stage: build
  script:
    - export "PATH=$PWD/bin:$PATH"
    - helm repo add linstor https://charts.linstor.io
    - make chart SEMVER=$SEMVER
    - curl --fail --user $LINBIT_REGISTRY_USER:$LINBIT_REGISTRY_PASSWORD --upload-file out/helm/linstor-$SEMVER.tgz $LINBIT_REGISTRY_HELM/
  tags:
    - shell

build_operator:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
  stage: build
  # https://github.com/containerd/containerd/issues/5978
  retry: 1
  script:
    - export "PATH=$PWD/bin:$PATH"
    - if [ -n "$CI_COMMIT_TAG" ]; then NOCACHE=true ; else NOCACHE=false ; fi
    - TARGET=$LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator:$TAG
    - ln -snf $DOCKER_AUTH_CONFIG_FILE $HOME/.docker/config.json
    - make linstor-operator
    - docker buildx build --pull --push --platform $PUBLISH_PLATFORMS -t $TARGET linstor-operator --no-cache=$NOCACHE
    - echo "OPERATOR_IMAGE=$LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator:$TAG" > .build.env
  artifacts:
    reports:
      dotenv:
        - .build.env
  tags:
    - multiarch

build_olm:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
  stage: build_olm
  script:
    - export "PATH=$PWD/bin:$PATH"
    - ln -snf $DOCKER_AUTH_CONFIG_FILE $HOME/.docker/config.json
    - helm repo add linstor https://charts.linstor.io
    - make olm SEMVER=$SEMVER OLM_REGISTRY=$LINBIT_DOCKER_REGISTRY/linstor-operator-test
    - docker build -t $LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator-bundle:$TAG out/olm-bundle/$SEMVER/
    - docker push $LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator-bundle:$TAG
    - opm index add --permissive --mode semver --build-tool docker --from-index $LINBIT_DOCKER_REGISTRY/linstor-operator-test/catalog:latest --bundles $LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator-bundle:$TAG --tag $LINBIT_DOCKER_REGISTRY/linstor-operator-test/catalog:latest --bundles $LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator-bundle:$TAG --tag $LINBIT_DOCKER_REGISTRY/linstor-operator-test/catalog:latest
    - docker push $LINBIT_DOCKER_REGISTRY/linstor-operator-test/catalog:latest
  tags:
    - docker

deploy_olm:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
  stage: test
  image: $LINBIT_DOCKER_REGISTRY/linstor-operator-test/operator-sdk:latest
  script:
    - operator-sdk bundle validate --verbose --image-builder none $LINBIT_DOCKER_REGISTRY/linstor-operator-test/linstor-operator-bundle:$TAG
  dependencies:
    # Explicitly: do not depend on prepare-bins, we want out own version of operator-sdk
    - build_olm
    - prepare-version

.test:
  stage: test
  tags:
    - libvirt
  allow_failure: true
  script:
    - export PATH=$CI_PROJECT_DIR/bin:$PATH
    - create-k8s-test-configs -stable-releases-to-check=4 -include-next=1 -base-image=alma-9
    - cp test-helm-config.yaml virter/operator-to-test.yml
    - cd virter
    - yq write --inplace operator-to-test.yml 'operator.image' "$OPERATOR_IMAGE"
    - >
      vmshed
      --pull-template "${LINBIT_DOCKER_REGISTRY}/vm/{{ .Image }}:latest"
      --nvms $(( ${LINBIT_CI_MAX_CPUS:-20} / 3 ))
      --torun $TO_RUN
      --variant "$VARIANT"
      --set values.DockerRegistryMirror=https://${DOCKER_REGISTRY_MIRROR}
      --set values.DrbdRegistryMirror=https://${DRBD_REGISTRY_MIRROR}
      --set values.K8sGcrIoMirror=https://${K8S_REGISTRY_MIRROR}
      --set values.RegistryK8sIoMirror=https://${REGISTRY_K8S_IO_MIRROR}
      --set values.DrbdIoUser=$PUBLISH_REGISTRY_USER
      --set values.DrbdIoPassword=$PUBLISH_REGISTRY_PASSWORD
      --set values.JustKubeadmImage=$LINBIT_DOCKER_REGISTRY/linstor-kubernetes-tests/just-kubeadm:$K8S_TEST_VERSION
      --set values.HelmImage=$LINBIT_DOCKER_REGISTRY/linstor-kubernetes-tests/helm:$K8S_TEST_VERSION
      --set values.TestImage=$LINBIT_DOCKER_REGISTRY/linstor-kubernetes-tests/tests:$K8S_TEST_VERSION
      --set values.HelmLinstorRepo=$LINBIT_REGISTRY_HELM
      --set values.HelmLinstorVersion=$SEMVER
      --set "values.Skip=$SKIP"
      --set "values.Focus=$FOCUS"
      --set values.LinstorValues=/virter/workspace/operator-to-test.yml
  artifacts:
    when: always
    paths:
      - virter/
    reports:
      junit:
        - virter/tests-out/test-results/*.xml
        - virter/tests-out/log/**/*-report.xml

test-chart:
  extends: .test
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
  stage: test
  tags:
    - libvirt
  timeout: 30m
  variables:
    TO_RUN: chart,operator
    VARIANT: "k8s-backend,etcd-backend,no-helm-install"

test-e2e:
  extends: .test
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - if: $CI_MERGE_REQUEST_ID
      when: manual
    - if: $CI_COMMIT_BRANCH == 'master'
      when: manual
  stage: test
  tags:
    - libvirt
  timeout: 4h
  variables:
    TO_RUN: k8s-e2e-storage
    SKIP: "Slow|LinuxOnly|xfs|ext3|ext4|immediate-binding|retain policy|readOnly|read-only|exec|multiple|subPath"

container_scanning:
  stage: test
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == 'master'
    - if: $CI_COMMIT_TAG
  image:
    name: docker.io/aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy --version
    - trivy image --exit-code 0 --format template --template "@/contrib/html.tpl" -o container-scan.html "$OPERATOR_IMAGE"
    # Prints full report
    - trivy image --exit-code 0 "$OPERATOR_IMAGE"
    # Fail on critical (unfixed) vulnerabilities
    - trivy image --exit-code 1 --ignore-unfixed --severity CRITICAL "$OPERATOR_IMAGE"
  # Ideally, we would use container_scanning for the artifact here. That is currently a paid feature, so we have to use code quality
  artifacts:
    when: always
    expose_as: "Container Scan"
    paths:
      - container-scan.html


publish-image:
  stage: deploy
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
      when: manual
      allow_failure: true
  image:
    # Wait for https://github.com/google/go-containerregistry/issues/1183 before upgrading
    name: gcr.io/go-containerregistry/crane/debug:v0.7.0
    entrypoint: [ "" ]
  script:
    - mkdir -p $HOME/.docker
    - ln -snf $DOCKER_PUBLISH_AUTH_CONFIG_FILE $HOME/.docker/config.json
    - for PLATFORM in $(echo $PUBLISH_PLATFORMS | tr ',' '\n') ; do
    -   ARCH=${PLATFORM#*/}
    -   crane copy --platform $PLATFORM $OPERATOR_IMAGE $PUBLISH_REGISTRY/$ARCH/linstor-operator:$TAG
    -   crane tag $PUBLISH_REGISTRY/$ARCH/linstor-operator:$TAG latest
    - done

publish-chart:
  stage: deploy
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_MERGE_REQUEST_ID
      when: manual
      allow_failure: true
  script:
    - export "PATH=$PWD/bin:$PATH"
    - eval $(ssh-agent -s)
    - trap 'ssh-agent -k' EXIT
    - cat $GITHUB_DEPLOY_KEY | ssh-add -
    - export GIT_AUTHOR_NAME="LinbitPRBot"
    - export GIT_COMMITTER_NAME="LinbitPRBot"
    - export GIT_AUTHOR_EMAIL="linbitprbot@users.noreply.github.com"
    - export GIT_COMMITTER_EMAIL="linbitprbot@users.noreply.github.com"
    - make publish SEMVER=$SEMVER UPSTREAMGIT=git@github.com:LINBIT/linstor-operator-builder.git
  tags:
    - shell