Compare commits

..

No commits in common. "develop" and "triggers" have entirely different histories.

27 changed files with 133 additions and 363 deletions

9
.gitignore vendored
View File

@ -1,5 +1,4 @@
kustomization/base/tekton/secret/gitea/access_token kustomization/base/tekton/secret/git-secret.yaml
kustomization/base/tekton/secret/gitea/basicauth kustomization/base/tekton/secret/ssh-secret.yaml
kustomization/base/tekton/secret/dockerconfig/.dockerconfigjson kustomization/base/tekton/secret/dockerconfig/config.json
kustomization/base/tekton/secret/ssh/id_ed25519 kustomization/base/tekton/secret/gitea-access-token.yaml
kustomization/base/tekton/secret/ssh/known_hosts

View File

@ -11,11 +11,12 @@ help:
.PHONY: deploy .PHONY: deploy
create-cluster: ## Créer un cluster kubernetes avec Kind create-cluster: ## Créer un cluster kubernetes avec Kind
kind create cluster --name tekton --config kind/kind-tekton.yaml kind create cluster --name tekton --config kind/kind-tekton.yaml
make setup-cluster
@echo "SubNet Docker :" $(SUBNET) @echo "SubNet Docker :" $(SUBNET)
@echo -e " \x1b[32m✓\x1b[0m Cluster Kind déployé" @echo -e " \x1b[32m✓\x1b[0m Cluster Kind déployé"
.PHONY: setup-cluster .PHONY: setup-cluster
setup-cluster: create cluster setup-cluster:
kubectl apply -k kind/cluster --server-side kubectl apply -k kind/cluster --server-side
kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller
kubectl --namespace metallb-system rollout status --timeout 5m deployment controller kubectl --namespace metallb-system rollout status --timeout 5m deployment controller
@ -26,22 +27,19 @@ setup-cluster: create cluster
@yq -i ".spec.addresses = [\"$(SUBNET)\"]" kind/cluster/lb/resources/ipaddresspoool.yaml @yq -i ".spec.addresses = [\"$(SUBNET)\"]" kind/cluster/lb/resources/ipaddresspoool.yaml
kubectl apply -k kind/cluster/lb --server-side kubectl apply -k kind/cluster/lb --server-side
docker-secret:
docker login reg.cadoles.com
mkdir -p kustomization/base/tekton/secret/dockerconfig
docker --config kustomization/base/tekton/secret/dockerconfig login reg.cadoles.com
kubectl create secret generic regcred --from-file=config.json=kustomization/base/tekton/secret/dockerconfig/config.json -n tekton-pipelines
kubectl patch cm feature-flags -n tekton-pipelines -p '{"data":{"enable-api-fields":"alpha"}}'
deploy-dev: ## Déploie le projet dans le cluster (nécessite la variable $HARBOR_USER_NAME) deploy-dev: ## Déploie le projet dans le cluster (nécessite la variable $HARBOR_USER_NAME)
skaffold dev --cleanup=false skaffold dev -p dev --cleanup=false --default-repo reg.cadoles.com/${HARBOR_USER_NAME}
delete-cluster: ## Supprime le cluster kubernetes Kind delete-cluster: ## Supprime le cluster kubernetes Kind
kind delete clusters tekton kind delete clusters tekton
docker-secret:
cp kustomization/base/tekton/secret/gitea/access_token.dist kustomization/base/tekton/secret/gitea/access_token
cp kustomization/base/tekton/secret/gitea/basicauth.dist kustomization/base/tekton/secret/gitea/basicauth
cp kustomization/base/tekton/secret/ssh/id_ed25519.dist kustomization/base/tekton/secret/ssh/id_ed25519
cp kustomization/base/tekton/secret/ssh/known_hosts.dist kustomization/base/tekton/secret/ssh/known_hosts
docker login reg.cadoles.com
docker --config kustomization/base/tekton/secret/dockerconfig login reg.cadoles.com
mv kustomization/base/tekton/secret/dockerconfig/config.json kustomization/base/tekton/secret/dockerconfig/.dockerconfigjson
.mktools: .mktools:
rm -rf .mktools rm -rf .mktools
curl -q https://forge.cadoles.com/Cadoles/mktools/raw/branch/master/install.sh | $(SHELL) curl -q https://forge.cadoles.com/Cadoles/mktools/raw/branch/master/install.sh | $(SHELL)

View File

@ -8,6 +8,7 @@ CI du projet MSE
``` ```
make create-cluster make create-cluster
skaffold dev --cleanup=false
``` ```
Si vous disposez déjà d'un environnement kubernetes, appliquez uniquement les CRDs : Si vous disposez déjà d'un environnement kubernetes, appliquez uniquement les CRDs :
@ -16,20 +17,11 @@ Si vous disposez déjà d'un environnement kubernetes, appliquez uniquement les
kubectl apply -k kind/cluster --server-side kubectl apply -k kind/cluster --server-side
``` ```
Il se peut qu'il y ait besoin de relancer la commande s'il n'arrive pas a charger `TektonConfig` correctement
Puis
```
make deploy-dev
```
#### Préparer les secrets #### Préparer les secrets
Créer les fichiers en renseignant et en copiant les fichiers `.dist` correspondants: Créer les fichiers en renseignant et en copiant les fichiers `.dist` correspondants:
- `kustomization/base/tekton/secret/gitea/access_token` - `kustomization/base/tekton/secret/git-secret.yaml`
- `kustomization/base/tekton/secret/gitea/basicauth` - `kustomization/base/tekton/secret/ssh-secret.yaml`
- `kustomization/base/tekton/secret/ssh/id_ed25519` - `kustomization/base/tekton/secret/gitea-access-token.yaml`
- `kustomization/base/tekton/secret/ssh/known_hosts`
Générer le secret docker Générer le secret docker
``` ```

View File

@ -1,10 +0,0 @@
# Mse Project
## Evénements et triggers
Lors de l'émission d'un événement par Gitea, selon la nature de l'événement, les pipelines `symfonycheck` ou `buildimage` seront déclenchés.
- Pull request créé, ou push sur une pull request : `symfonycheck`
- merge d'une PR : `buildimage`

View File

@ -1,76 +0,0 @@
# Tekton CI
## Webhook, Événements et Triggers
Un webhook Gitea configuré, envoi des événements sur un endpoint défini par en `EventListener`.
Cet `EventListener`, selon les filtres et overlays définis, peut alors déclencher des `TriggerTemplates` (configuré selon un `TriggerBinding`), qui alors configurerons a leur tour des `PipelineRun`, qui exécuterons des `Pipelines`, qui configurerons des `TaskRun`, qui alors exécuterons des `Task`.
```mermaid
flowchart LR
A[Webhook Event] --> B(EventListener
filter et overlays)
B --> D(Pipeline Binding)
B --> E(Pipeline Template)
D --> E
E --> F(PipelineRun)
F --> G(Pipeline)
```
Les `Webhooks`, événements et triggers dans Tekton CI permettent de déclencher des actions automatisées en réponse à des événements spécifiques dans un système de gestion de code source.
### Filter et overlay
Le `filter` permet de déclencher les Triggers pour les événements répondant au critère du filtre
Les `overlays` permettent de récupérer une valeur de la requête pour la passer en paramètre
### Workspaces
Les workspaces sont des volumes qui sont monté à la demande dans les conteneurs des différentes `Task` dans le répertoire `/workspace`.
### Exemples
- [EventListener MSE](kustomization/base/tekton/event/mseproject.yaml)
- [TriggerBinding MSE](kustomization/base/tekton/event/msebuild-binding.yaml)
- [TriggerTemplate MSE](kustomization/base/tekton/event/msebuild-template.yaml)
## Pipelines
Les `Pipeline` dans Tekton CI décrivent une série d'étapes ou de tâches à exécuter pour automatiser un processus de déploiement ou de test logiciel.
Un `PipelineRun` permet d'exécuter un `Pipeline` en lui donnant des paramètres
L'option `runAfter:` permet de définir si une `Task` doit s'exécuter une fois qu'une autre Task est terminé. Si `runAfter` n'est par défini, la `Task` sera exécuté en parallèle
```mermaid
flowchart LR
G(PipelineRun) --> H(Pipeline)
H --> I(TaskRun)
I --> J(Task)
```
### Exemples
- [SymfonyCheck](../kustomization/base/tekton/pipeline/symfonycheck.yaml)
## Tasks
Les `Task` dans Tekton CI représentent des actions individuelles à effectuer dans un pipeline. Elles peuvent inclure des opérations telles que la construction, le déploiement, les tests, etc.
Une `TaskRun` permet d'exécuter une `Task` en lui donnant des paramètres.
Les `Task` vont alors enchainer les différentes steps.
Les `Task` peuvent émettre des résultats, qui seront alors accessible par d'autres `Task`
L'option `OnError` permet de déclencher un évenement à la suite d'une erreur d'une `step`.
On peut alors s'en servir pour passer à la st`ep suivante, sans bloquer l'exécution de la `Task`.
### Exemple
- [ImageFormater](kustomization/base/tekton/task/common/imageformater.yaml)

View File

@ -3,4 +3,3 @@ kind: Kustomization
resources: resources:
- tekton/ - tekton/
- tekton-pipelines/ingress/dashboard.yaml

View File

@ -1,39 +0,0 @@
apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
name: mseproject
spec:
serviceAccountName: tekton-robot
triggers:
- name: mse-symfonycheck-trigger
interceptors:
- ref:
name: "cel"
params:
# Filtre par événement
- name: "filter"
value: "body.action in ['opened', 'synchronized']"
bindings:
- ref: symfonycheck-binding
template:
ref: symfonycheck-template
- name: mse-build-trigger
interceptors:
- ref:
name: "cel"
params:
# Filtre par événement
- name: "filter"
value: "body.pull_request.merged == true"
# Récupération du queryParam registry
- name: "overlays"
value:
- key: registry
expression: "requestURL.parseURL().query['registry']"
bindings:
- ref: msebuild-binding
- name: registry
value: $(extensions.registry)
template:
ref: msebuild-template

View File

@ -2,7 +2,6 @@ apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
name: dashboard name: dashboard
namespace: tekton-pipelines
spec: spec:
ingressClassName: nginx ingressClassName: nginx
rules: rules:
@ -16,10 +15,10 @@ spec:
name: tekton-dashboard name: tekton-dashboard
port: port:
number: 9097 number: 9097
- path: /mseproject - path: /msebuild
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: el-mseproject name: el-msebuild
port: port:
number: 9000 number: 9000

View File

@ -1,14 +1,15 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
namespace: tekton namespace: tekton-pipelines
resources: resources:
- namespace/namespace.yaml - namespace/namespace.yaml
- secret/git-secret.yaml
- secret/ssh-secret.yaml
- secret/gitea-access-token.yaml
- serviceaccount/service-account.yaml - serviceaccount/service-account.yaml
- serviceaccount/rbac.yaml - serviceaccount/rbac.yaml
- configmap/configmap-phpcsfixer.yaml - configmap/configmap-phpcsfixer.yaml
- resources/
# Tasks # Tasks
- https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.9/git-clone.yaml - https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.9/git-clone.yaml
- https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.6/raw - https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.6/raw
@ -21,7 +22,6 @@ resources:
- task/symfonyapp/phpsecuritycheck.yaml - task/symfonyapp/phpsecuritycheck.yaml
- task/symfonyapp/phpstan.yaml - task/symfonyapp/phpstan.yaml
- task/symfonyapp/phpunittest.yaml - task/symfonyapp/phpunittest.yaml
- task/symfonyapp/phpfunctionaltest.yaml
# Pipelines # Pipelines
- pipeline/imagebuild.yaml - pipeline/imagebuild.yaml
@ -36,33 +36,9 @@ resources:
- trigger/symfonycheck-template.yaml - trigger/symfonycheck-template.yaml
# Events # Events
- event/mseproject.yaml - event/msebuild.yaml
- event/imagebuild.yaml
- event/symfonycheck.yaml
# Ingress
# # Ingress
# - ingress/dashboard.yaml # - ingress/dashboard.yaml
generatorOptions:
disableNameSuffixHash: true
secretGenerator:
- name: regcred
type: kubernetes.io/dockerconfigjson
files:
- secret/dockerconfig/.dockerconfigjson
- name: basic-auth
type: kubernetes.io/basic-auth
options:
annotations:
tekton.dev/git-0: https://forge.cadoles.com
envs:
- secret/gitea/basicauth
- name: gitea-access-token
files:
- secret/gitea/access_token
- name: git-credentials
files:
- secret/ssh/id_ed25519
- secret/ssh/known_hosts

View File

@ -1,4 +1,4 @@
apiVersion: v1 apiVersion: v1
kind: Namespace kind: Namespace
metadata: metadata:
name: tekton name: tekton-pipelines

View File

@ -87,7 +87,7 @@ spec:
- name: destination - name: destination
value: $(params.destination) value: $(params.destination)
# ⭐ Execution des tests unitaires et fonctionnels # ⭐ Execution des tests unitaires avec une BDD en sidecar
- name: phpunittest - name: phpunittest
runAfter: ["gitclone"] runAfter: ["gitclone"]
taskRef: taskRef:

View File

@ -0,0 +1,39 @@
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
generateName: msebuild-run-
namespace: tekton
spec:
serviceAccountName: build-bot
pipelineRef:
name: msebuild
podTemplate:
securityContext:
fsGroup: 65532
workspaces:
- name: shared-data
volumeClaimTemplate:
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
- name: config
configmap:
name: config-php-cs-fixer
- name: docker-credentials
secret:
secretName: regcred
params:
- name: image
value: reg.cadoles.com/mlamalle/testtekton
- name: tag
value: test
- name: dockerfile
value: ./misc/k8s/images/job-base/Dockerfile
- name: url
value: https://forge.cadoles.com/CNOUS/mse.git
- name: revision
value: sprint-6

View File

@ -1,5 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./redis/redis-cluster.yaml

View File

@ -1,22 +0,0 @@
apiVersion: databases.spotahome.com/v1
kind: RedisFailover
metadata:
name: tekton-redis
spec:
sentinel:
replicas: 3
resources:
requests:
cpu: 100m
limits:
memory: 100Mi
redis:
image: reg.cadoles.com/proxy_cache/library/redis:6.2.6-alpine
replicas: 3
resources:
requests:
cpu: 100m
memory: 100Mi
limits:
cpu: 400m
memory: 500Mi

View File

@ -0,0 +1,10 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
tekton.dev/git-0: https://forge.cadoles.com
name: basic-auth
type: kubernetes.io/basic-auth
stringData:
username: <login>
password: <password>

View File

@ -0,0 +1,6 @@
apiVersion: v1
kind: Secret
metadata:
name: gitea-access-token
data:
access_token: <base64 gitea access token>

View File

@ -1 +0,0 @@
TOKEN_HERE

View File

@ -1,2 +0,0 @@
username=<login>
password=<password>

View File

@ -0,0 +1,7 @@
apiVersion: v1
kind: Secret
metadata:
name: git-credentials
data:
id_ed25519: <base64 ssh private key>
known_hosts: <base64 known_host>

View File

@ -1 +0,0 @@
YOUR_PRIVATE_KEY_HERE

View File

@ -1 +0,0 @@
KNOWN_HOST_HERE

View File

@ -1,70 +0,0 @@
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: phpfunctionaltest
spec:
description: PHP functional test with bdd sidecar
workspaces:
- name: source
sidecars:
- name: database
image: postgres:16
env:
- name: POSTGRES_PASSWORD
value: not_so_secret
- name: POSTGRES_HOST_AUTH_METHOD
value: trust
- name: redis
image: redis:4.0
steps:
- name: exec
image: reg.cadoles.com/cadoles/symfony:alpine-php-7.4-base-20230926
env:
- name: PHP_FPM_MEMORY_LIMIT
value: 512m
- name: MSE_DATABASE_DRIVER
value: pdo_pgsql
- name: MSE_DATABASE_HOST
value: localhost
- name: MSE_DATABASE_PORT
value: '5432'
- name: MSE_DATABASE_NAME
value: postgres
- name: MSE_DATABASE_USER
value: postgres
- name: MSE_DATABASE_PASSWORD
value: not_so_secret
- name: MSE_REDIS_SERVER
value: localhost
- name: MSE_REDIS_PORT
value: '6379'
- name: MSE_REDIS_SERVER
value: rfs-tekton-redis
command:
- /bin/sh
args:
- '-c'
- |
set -e
apk add bash=5.1.16-r0 \
postgresql-client \
php7-gd=7.4.33-r1 \
php7-xsl=7.4.33-r1 \
php7-pdo=7.4.33-r1 \
php7-pgsql=7.4.33-r1 \
php7-pdo_pgsql=7.4.33-r1 \
php7-soap=7.4.33-r1 \
php7-ldap=7.4.33-r1 \
php7-pdo_mysql=7.4.33-r1 \
php7-bcmath=7.4.33-r1 \
php7-intl=7.4.33-r1 \
php7-fileinfo=7.4.33-r1 \
php7-iconv=7.4.33-r1 \
php7-pecl-amqp=1.11.0-r0 \
php7-pecl-redis=5.3.6-r0
cd $(workspaces.source.path)
app/console doctrine:migrations:migrate -n
./scripts/run-php-tests.sh --group integration --stderr --testdox -d memory_limit=512M

View File

@ -3,18 +3,41 @@ kind: Task
metadata: metadata:
name: phpstan name: phpstan
spec: spec:
description: Phpstan on modified code description: PHP-CS-Fixer on modified code
workspaces: workspaces:
- name: source - name: source
params: params:
- name: apiurl - name: apiurl
- name: requestid - name: requestid
steps: steps:
- name: analyse - name: exec
image: reg.cadoles.com/cadoles/phpstan image: ghcr.io/phpstan/phpstan:1
script: | command:
#!/bin/sh - /bin/sh
echo "== RUN PHPSTAN ===========================================" args:
cd $(workspaces.source.path) - '-c'
phpstan analyse -l 5 --configuration phpstan-pipeline.neon --error-format table --no-progress > temp_phpstan.txt 2>&1 - |
cat temp_phpstan.txt #set -e
echo ""
echo "== INSTALL PHPSTAN ======================================="
composer require phpstan/phpstan-symfony
composer require phpstan/phpstan-doctrine
cat << EOF > /app/phpstan.neon
includes:
- /app/vendor/phpstan/phpstan-symfony/extension.neon
- /app/vendor/phpstan/phpstan-doctrine/extension.neon
- /app/vendor/phpstan/phpstan-doctrine/rules.neon
EOF
echo ""
echo "== RUN PHPSTAN ==========================================="
cd $(workspaces.source.path)
php $(which phpstan) analyse -l 1 --error-format=table src/ > temp_phpstan.txt
RESULT=$(cat temp_phpstan.txt)
echo "${RESULT}"
echo ""
echo ""

View File

@ -3,7 +3,7 @@ kind: Task
metadata: metadata:
name: phpunittest name: phpunittest
spec: spec:
description: PHP unit test description: PHP unit test with bdd sidecar
workspaces: workspaces:
- name: source - name: source
sidecars: sidecars:
@ -14,9 +14,11 @@ spec:
value: not_so_secret value: not_so_secret
- name: POSTGRES_HOST_AUTH_METHOD - name: POSTGRES_HOST_AUTH_METHOD
value: trust value: trust
- name: redis
image: redis:4.0
steps: steps:
- name: php-unit - name: exec
image: reg.cadoles.com/cadoles/symfony:alpine-php-7.4-base-20230926 image: reg.cadoles.com/cadoles/symfony:alpine-php-7.4-base-20230926
env: env:
- name: PHP_FPM_MEMORY_LIMIT - name: PHP_FPM_MEMORY_LIMIT
@ -59,61 +61,8 @@ spec:
php7-iconv=7.4.33-r1 \ php7-iconv=7.4.33-r1 \
php7-pecl-amqp=1.11.0-r0 \ php7-pecl-amqp=1.11.0-r0 \
php7-pecl-redis=5.3.6-r0 php7-pecl-redis=5.3.6-r0
echo "memory_limit = 512M" >> /etc/php7/conf.d/03_base.ini
echo "memory_limit = 512M" >> /etc/php8/conf.d/03_base.ini
cd $(workspaces.source.path) cd $(workspaces.source.path)
./bin/phpunit -c ./app --group unit --stderr --testdox -d memory_limit=1024M $(PHPUNIT_ARGS) app/console doctrine:migrations:migrate -n
onError: continue ./scripts/run-php-tests.sh --group unit --stderr --testdox -d memory_limit=512M
- name: php-functional
image: reg.cadoles.com/cadoles/symfony:alpine-php-7.4-base-20230926
env:
- name: PHP_FPM_MEMORY_LIMIT
value: 512m
- name: MSE_DATABASE_DRIVER
value: pdo_pgsql
- name: MSE_DATABASE_HOST
value: localhost
- name: MSE_DATABASE_PORT
value: '5432'
- name: MSE_DATABASE_NAME
value: postgres
- name: MSE_DATABASE_USER
value: postgres
- name: MSE_DATABASE_PASSWORD
value: not_so_secret
- name: MSE_REDIS_SERVER
value: rfs-portal-redis
- name: MSE_REDIS_PORT
value: '26379'
- name: MSE_REDIS_SERVER
value: rfs-tekton-redis
command:
- /bin/sh
args:
- '-c'
- |
set -e
apk add bash=5.1.16-r0 \
postgresql-client \
php7-gd=7.4.33-r1 \
php7-xsl=7.4.33-r1 \
php7-pdo=7.4.33-r1 \
php7-pgsql=7.4.33-r1 \
php7-pdo_pgsql=7.4.33-r1 \
php7-soap=7.4.33-r1 \
php7-ldap=7.4.33-r1 \
php7-pdo_mysql=7.4.33-r1 \
php7-bcmath=7.4.33-r1 \
php7-intl=7.4.33-r1 \
php7-fileinfo=7.4.33-r1 \
php7-iconv=7.4.33-r1 \
php7-pecl-amqp=1.11.0-r0 \
php7-pecl-redis=5.3.6-r0
echo "memory_limit = 512M" >> /etc/php7/conf.d/03_base.ini
echo "memory_limit = 512M" >> /etc/php8/conf.d/03_base.ini
cd $(workspaces.source.path)
/bin/sh ./sidecar-scripts/init_database.sh
./bin/phpunit -c ./app --group integration --stderr --testdox -d memory_limit=1024M $(PHPUNIT_ARGS)

View File

@ -7,7 +7,7 @@ spec:
- name: url - name: url
value: $(body.repository.clone_url) value: $(body.repository.clone_url)
- name: revision - name: revision
value: $(body.pull_request.base.ref) value: $(body.pull_request.head.ref)
- name: image - name: image
value: $(body.repository.full_name) value: $(body.repository.full_name)
- name: tag - name: tag

View File

@ -7,7 +7,7 @@ spec:
- name: url - name: url
value: $(body.repository.clone_url) value: $(body.repository.clone_url)
- name: revision - name: revision
value: $(body.pull_request.base.ref) value: $(body.pull_request.head.ref)
- name: image - name: image
value: $(body.repository.full_name) value: $(body.repository.full_name)
- name: apiurl - name: apiurl

View File

@ -2,7 +2,7 @@ apiVersion: skaffold/v3
kind: Config kind: Config
metadata: metadata:
name: tekton name: tekton-pipelines
manifests: manifests:
kustomize: kustomize: