@catladder/cli 0.0.0-next-1cd29c1f → 0.0.0-next-52feb889

package/dist/runner-images/kubernetes/helm-charts/the-panter-chart/templates/mongodb.backup.cronjob.yml

@@ -0,0 +1,120 @@
+{{- if and (.Values.mongodb.enabled) (.Values.mongodb.backup.enabled) }}
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  
+spec:
+  schedule: {{.Values.mongodb.backup.schedule }}
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName:  {{ template "fullname" . }}-mongodb-backup
+          restartPolicy: OnFailure
+          containers:
+            - name: backup-cron
+            
+              env:
+                - name: M_RELEASE_NAME
+                  value: {{ template "fullname" . }}-mongodb
+                - name: MONGODB_ROOT_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: {{ template "fullname" $ }}-app-secrets
+                      key: MONGODB_ROOT_PASSWORD
+                - name: VSC_NAME
+                  value: {{ .Values.mongodb.backup.volumeSnapshotClass }}
+              image: {{ .Values.mongodb.backup.image }}
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/bash
+                - -i
+                - -c
+                - |
+                    set -e
+                    echo alias M_CMD=\'mongo admin --host {{ .Values.mongodb.backup.hostToBackup }} {{- if .Values.mongodb.auth.enabled }} --authenticationDatabase admin -u root -p "\"${MONGODB_ROOT_PASSWORD}\"" {{- end }} --quiet --eval\' >> ~/.bashrc
+                    source ~/.bashrc
+                    echo -e "[+] Check if it is a Primary node to make it stepDown\n"
+                    if [[ `M_CMD " db.runCommand( { isMaster: 1 } )['ismaster']"` != "false" ]]
+                    then
+                      echo -e "[+] Stepping Down\n"
+                      M_CMD "rs.stepDown()"
+                    fi
+                    echo -e "[+] Send Slave to Freeze\n"
+                    M_CMD "rs.freeze(99999999999)"
+                    export E_TIME=$(date +%s)
+                    echo -e "[+] Creating snapshot object\n"
+                    cat <<EOF | kubectl apply -f -
+                    apiVersion: snapshot.storage.k8s.io/v1beta1
+                    kind: VolumeSnapshot
+                    metadata:
+                      name: snapshot-${M_RELEASE_NAME}-${E_TIME}
+                    spec:
+                      volumeSnapshotClassName: ${VSC_NAME}
+                      source:
+                        persistentVolumeClaimName:  {{ .Values.mongodb.backup.pvcToBackup }}
+                    EOF
+                    echo -e "[+] Waiting for snapshot to finish\n"
+                    while : ; do
+                      result=$(kubectl get volumesnapshot   -o custom-columns='READY:.status.readyToUse' --field-selector metadata.name=snapshot-${M_RELEASE_NAME}-${E_TIME} | grep -v READY)
+                      [[ "${result}" == "true" ]] && break
+                      echo "[-] still waiting for snapshot to be ready .. "
+                      sleep 1
+                    done
+                    echo -e "[+] Snapshot finished, unfreeze Slave\n"
+                    M_CMD "rs.freeze(0)"
+                    echo -e "[+] Snapshotting finished successfully\n"
+                    kubectl get volumesnapshots --no-headers --output=custom-columns="NAME:metadata.name,CREATED:status.creationTime" | while read name creation; do
+                      if [[ "${name}" =~ ^snapshot-$M_RELEASE_NAME-[0-9]*$ ]] && [[ "${creation}" < "$(date --date "now 90 days ago" +%F)" ]]; then
+                        echo "[+] Removing expired snapshot ${name} created on ${creation}"
+                        kubectl delete volumesnapshot "${name}"
+                      fi
+                    done
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "snapshot.storage.k8s.io/v1beta1"
+      - "snapshot.storage.k8s.io"
+    resources:
+      - "volumesnapshots"
+    verbs:
+      - "*"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+roleRef:
+  kind: Role
+  name: {{ template "fullname" . }}-mongodb-backup
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "fullname" . }}-mongodb-backup
+
+
+{{- end }}

package/dist/runner-images/kubernetes/helm-charts/the-panter-chart/values.yaml

@@ -0,0 +1,154 @@
+# Default values for manulstack helm chart.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+global:
+  componentName: web
+  ENV_SHORT: dev
+  BUILD_ID:
+image:
+  repository:
+  name:
+  pullPolicy: Always
+  pullSecret: gitlab-registry
+
+service:
+  type: ClusterIP
+  externalPort: 80
+  internalPort: 8080
+  additionalPorts: []
+
+env:
+  public:
+    NODE_ENV: production
+    TZ: Europe/Zurich
+  secret: {}
+
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/affinity: cookie
+    nginx.ingress.kubernetes.io/affinity-mode: persistent
+    nginx.ingress.kubernetes.io/session-cookie-hash: sha1
+    nginx.ingress.kubernetes.io/session-cookie-name: route
+    nginx.ingress.kubernetes.io/session-cookie-path: /
+  tls: []
+
+jobDefaults:
+  resources:
+    limits:
+      cpu: 1000m
+    requests:
+      cpu: 50m
+      memory: 350Mi
+
+application:
+  enabled: true
+  replicas: 1
+  hostCanonical:
+  command:
+  # these requests are usually overridden by the gitlab include and values
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 600Mi
+    requests:
+      cpu: 50m
+      memory: 150Mi
+  updateStrategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+
+  worker:
+    enabled: false
+    useExclusivePool: false
+    service:
+      enabled: false
+      type: ClusterIP
+      externalPort: 80
+      internalPort: 8080
+      additionalPorts: []
+    livenessProbe: true
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 1000Mi
+      requests:
+        cpu: 50m
+        memory: 350Mi
+  startupProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: startup
+    failureThreshold: 60
+    timeoutSeconds: 3
+    periodSeconds: 5
+  livenessProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: liveness
+    periodSeconds: 5
+    timeoutSeconds: 10
+  readinessProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: readiness
+    failureThreshold: 3
+    timeoutSeconds: 3
+    periodSeconds: 5
+    successThreshold: 1
+
+gitlab:
+  visualReviewEnabled: false
+  app:
+  env:
+  projectPath:
+  mergeRequestId:
+  projectId:
+
+## features
+
+mongodb:
+  enabled: false
+  dbName: app
+  backup:
+    enabled: false
+  # see https://github.com/bitnami/charts/issues/10264#issuecomment-1181574288
+  livenessProbe:
+    enabled: false
+  customLivenessProbe:
+    exec:
+      command:
+        - sh
+        - -c
+        - mongo --port $MONGODB_PORT_NUMBER --eval "db.adminCommand('ping')"
+  readinessProbe:
+    enabled: false
+  customReadinessProbe:
+    exec:
+      command:
+        - sh
+        - -c
+        - mongo --port $MONGODB_PORT_NUMBER --eval 'db.isMaster().ismaster || db.isMaster().secondary' | grep -q 'true'
+
+secretsFromOtherComponent: {}
+mapServiceUrlToEnv: {}
+cloudsql:
+  enabled: false
+
+mailhog:
+  enabled: false
+  useOauth: true

package/dist/runner-images/kubernetes/scripts/kubernetesCreateSecret

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+
+echo "KUBE_NAMESPACE: '$KUBE_NAMESPACE', KUBE_DOCKER_IMAGE_PULL_SECRET: '$KUBE_DOCKER_IMAGE_PULL_SECRET'"
+kubectl create secret -n "$KUBE_NAMESPACE" \
+    docker-registry $KUBE_DOCKER_IMAGE_PULL_SECRET \
+    --docker-server="$DOCKER_REGISTRY" \
+    --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \
+    --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \
+    --docker-email="$GITLAB_USER_EMAIL" \
+    -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -

package/dist/runner-images/kubernetes/scripts/kubernetesDelete

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+echo "Delete $RELEASE_NAME"
+helm uninstall "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"

package/dist/runner-images/kubernetes/scripts/kubernetesDeploy

@@ -0,0 +1,57 @@
+#!/bin/bash
+set -e
+
+echo "Deploy to kubernetes"
+echo "Release: $RELEASE_NAME"
+echo "URL (canonical): $HOSTNAME_INTERNAL"
+
+# this bash-brainfuck simply splits $helmArgs by newline to an array...
+readarray -t helmArgsArray <<<"$HELM_ARGS"
+
+#Log the time until selfdestruct in case of review environment
+if [[ ${ENV_SHORT} == "review" ]]; then echo "NOTE - This deployment will stop itself after 2 weeks"; fi
+
+if [[ ${ENV_SHORT} == "review" ]]; then
+    # auto rollback
+    set +e # disable fail job on error
+    helmStatus=$(helm status --namespace $KUBE_NAMESPACE $RELEASE_NAME 2>/dev/null | awk -F': ' -v key="STATUS" '$1==key {print $2}')
+    helmRevision=$(helm status --namespace $KUBE_NAMESPACE $RELEASE_NAME 2>/dev/null | awk -F': ' -v key="REVISION" '$1==key {print $2}')
+    if [ "$helmStatus" = "failed" ] || [ "$helmStatus" = "pending-install" ] || [ "$helmStatus" = "pending-upgrade" ]; then
+        # rollback
+        echo "helm deployment is pending or failed, rollback (only on review)..."
+        if [ "$helmRevision" = "1" ]; then
+            helm uninstall "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"
+        else
+            helm rollback "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"
+        fi
+
+    fi
+    set -e # reenable
+
+fi
+
+echo "doing helm upgrade"
+helm upgrade --install "$RELEASE_NAME" "$HELM_GITLAB_CHART_NAME" \
+    --timeout="30m0s" \
+    --set global.appName="$KUBE_APP_NAME" \
+    --set global.appPrefix="$KUBE_APP_NAME_PREFIX" \
+    --set global.ENV_SHORT="$ENV_SHORT" \
+    --set global.BUILD_ID="$BUILD_INFO_ID" \
+    --set image.repository="$CI_REGISTRY_IMAGE" \
+    --set image.pullSecret="$KUBE_DOCKER_IMAGE_PULL_SECRET" \
+    --set image.name="$DOCKER_IMAGE_NAME" \
+    --set image.tag="$DOCKER_IMAGE_TAG" \
+    --set image.pullPolicy=IfNotPresent \
+    --set application.hostCanonical="$HOSTNAME_INTERNAL" \
+    --set mongodb.fullnameOverride=$KUBE_APP_NAME-mongodb \
+    --set mailhog.fullnameOverride=$KUBE_APP_NAME-mailhog \
+    --set gitlab.visualReviewEnabled="$GITLAB_VISUAL_REVIEW_ENABLED" \
+    --set gitlab.app="$CI_PROJECT_PATH_SLUG" \
+    --set gitlab.projectPath="$CI_PROJECT_PATH" \
+    --set gitlab.mergeRequestId="$CI_MERGE_REQUEST_IID" \
+    --set gitlab.projectId="$CI_PROJECT_ID" \
+    --set gitlab.env="$CI_ENVIRONMENT_SLUG" \
+    --set namespace="$KUBE_NAMESPACE" \
+    --namespace="$KUBE_NAMESPACE" \
+    ${helmArgsArray[@]} \
+    --values __all_values.yml

package/dist/runner-images/kubernetes/scripts/kubernetesRollback

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+echo "Rolling back $RELEASE_NAME"
+helm rollback "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"

package/dist/runner-images/semantic-release/Dockerfile

@@ -0,0 +1,24 @@
+# build context is the root directory
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git git-lfs
+
+RUN mkdir /packages
+COPY ./cli /packages/cli
+
+# add semantic release
+RUN yarn global add \
+    semantic-release@^19 \
+    @semantic-release/commit-analyzer \
+    @semantic-release/release-notes-generator \
+    https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
+    @semantic-release/changelog \
+    @semantic-release/gitlab@9 \
+    @semantic-release/exec@6 \
+    /packages/cli
+
+RUN mkdir -p /scripts
+COPY ./runner-images/semantic-release/scripts/* /scripts/
+RUN chmod +x /scripts/*
+
+ENV PATH="/scripts:${PATH}"

package/dist/runner-images/semantic-release/scripts/semanticRelease

@@ -0,0 +1,67 @@
+#!/bin/bash
+set -e
+
+# 0. check and evalaute security audit or create MR with security audit template (and exit 1)
+# 1. create "@semantic-release/changelog"
+# 2. commit it to git (and push)
+# 3. optional: update package.json
+
+# better branches settings: https://github.com/semantic-release/semantic-release/issues/1581
+
+echo "doing security audit check"
+catladder security audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+
+echo "doing semantic release"
+
+if [ ! -e .releaserc ]; then
+  cat >.releaserc <<EOF
+{
+  "plugins": [
+      [
+      "@semantic-release/commit-analyzer",
+      {
+        preset: "angular",
+        releaseRules: [
+          { breaking: true, release: "major" },
+          { revert: true, release: "patch" },
+
+          { type: "feat", release: "minor" },
+          { type: "docs", release: "patch" },
+          { type: "fix", release: "patch" },
+          { type: "perf", release: "patch" },
+          # always fall back to a patch release
+          {
+            header: "**",
+            release: "patch",
+          },
+        ],
+      },
+    ],
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/changelog",
+    ["@semantic-release/git", {
+      "message": "chore(\${branch.type}): \${nextRelease.version}\n\n\${nextRelease.notes}"
+    }],
+    ["@semantic-release/gitlab", {
+      "gitlabUrl": "https://git.panter.ch"
+    }]
+    ],
+  "branches": [
+    "+([0-9])?(.{+([0-9]),x}).x",
+    "master",
+    "main",
+    "next",
+    "next-major",
+    {
+      "name": "beta",
+      "prerelease": true
+    },
+    {
+      "name": "alpha",
+      "prerelease": true
+    }
+  ],
+}
+EOF
+fi
+semantic-release