Compare commits

..

11 Commits

27 changed files with 363 additions and 133 deletions

9
.gitignore vendored
View File

@ -1,4 +1,5 @@
kustomization/base/tekton/secret/git-secret.yaml
kustomization/base/tekton/secret/ssh-secret.yaml
kustomization/base/tekton/secret/dockerconfig/config.json
kustomization/base/tekton/secret/gitea-access-token.yaml
kustomization/base/tekton/secret/gitea/access_token
kustomization/base/tekton/secret/gitea/basicauth
kustomization/base/tekton/secret/dockerconfig/.dockerconfigjson
kustomization/base/tekton/secret/ssh/id_ed25519
kustomization/base/tekton/secret/ssh/known_hosts

View File

@ -11,12 +11,11 @@ help:
.PHONY: deploy
create-cluster: ## Créer un cluster kubernetes avec Kind
kind create cluster --name tekton --config kind/kind-tekton.yaml
make setup-cluster
@echo "SubNet Docker :" $(SUBNET)
@echo -e " \x1b[32m✓\x1b[0m Cluster Kind déployé"
.PHONY: setup-cluster
setup-cluster:
setup-cluster: create cluster
kubectl apply -k kind/cluster --server-side
kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller
kubectl --namespace metallb-system rollout status --timeout 5m deployment controller
@ -27,19 +26,22 @@ setup-cluster:
@yq -i ".spec.addresses = [\"$(SUBNET)\"]" kind/cluster/lb/resources/ipaddresspoool.yaml
kubectl apply -k kind/cluster/lb --server-side
docker-secret:
docker login reg.cadoles.com
mkdir -p kustomization/base/tekton/secret/dockerconfig
docker --config kustomization/base/tekton/secret/dockerconfig login reg.cadoles.com
kubectl create secret generic regcred --from-file=config.json=kustomization/base/tekton/secret/dockerconfig/config.json -n tekton-pipelines
kubectl patch cm feature-flags -n tekton-pipelines -p '{"data":{"enable-api-fields":"alpha"}}'
deploy-dev: ## Déploie le projet dans le cluster (nécessite la variable $HARBOR_USER_NAME)
skaffold dev -p dev --cleanup=false --default-repo reg.cadoles.com/${HARBOR_USER_NAME}
skaffold dev --cleanup=false
delete-cluster: ## Supprime le cluster kubernetes Kind
kind delete clusters tekton
docker-secret:
cp kustomization/base/tekton/secret/gitea/access_token.dist kustomization/base/tekton/secret/gitea/access_token
cp kustomization/base/tekton/secret/gitea/basicauth.dist kustomization/base/tekton/secret/gitea/basicauth
cp kustomization/base/tekton/secret/ssh/id_ed25519.dist kustomization/base/tekton/secret/ssh/id_ed25519
cp kustomization/base/tekton/secret/ssh/known_hosts.dist kustomization/base/tekton/secret/ssh/known_hosts
docker login reg.cadoles.com
docker --config kustomization/base/tekton/secret/dockerconfig login reg.cadoles.com
mv kustomization/base/tekton/secret/dockerconfig/config.json kustomization/base/tekton/secret/dockerconfig/.dockerconfigjson
.mktools:
rm -rf .mktools
curl -q https://forge.cadoles.com/Cadoles/mktools/raw/branch/master/install.sh | $(SHELL)

View File

@ -8,7 +8,6 @@ CI du projet MSE
```
make create-cluster
skaffold dev --cleanup=false
```
Si vous disposez déjà d'un environnement kubernetes, appliquez uniquement les CRDs :
@ -17,11 +16,20 @@ Si vous disposez déjà d'un environnement kubernetes, appliquez uniquement les
kubectl apply -k kind/cluster --server-side
```
Il se peut qu'il y ait besoin de relancer la commande s'il n'arrive pas a charger `TektonConfig` correctement
Puis
```
make deploy-dev
```
#### Préparer les secrets
Créer les fichiers en renseignant et en copiant les fichiers `.dist` correspondants:
- `kustomization/base/tekton/secret/git-secret.yaml`
- `kustomization/base/tekton/secret/ssh-secret.yaml`
- `kustomization/base/tekton/secret/gitea-access-token.yaml`
- `kustomization/base/tekton/secret/gitea/access_token`
- `kustomization/base/tekton/secret/gitea/basicauth`
- `kustomization/base/tekton/secret/ssh/id_ed25519`
- `kustomization/base/tekton/secret/ssh/known_hosts`
Générer le secret docker
```

10
doc/mesproject.md Normal file
View File

@ -0,0 +1,10 @@
# Mse Project
## Evénements et triggers
Lors de l'émission d'un événement par Gitea, selon la nature de l'événement, les pipelines `symfonycheck` ou `buildimage` seront déclenchés.
- Pull request créé, ou push sur une pull request : `symfonycheck`
- merge d'une PR : `buildimage`

76
doc/tekton.md Normal file
View File

@ -0,0 +1,76 @@
# Tekton CI
## Webhook, Événements et Triggers
Un webhook Gitea configuré, envoi des événements sur un endpoint défini par en `EventListener`.
Cet `EventListener`, selon les filtres et overlays définis, peut alors déclencher des `TriggerTemplates` (configuré selon un `TriggerBinding`), qui alors configurerons a leur tour des `PipelineRun`, qui exécuterons des `Pipelines`, qui configurerons des `TaskRun`, qui alors exécuterons des `Task`.
```mermaid
flowchart LR
A[Webhook Event] --> B(EventListener
filter et overlays)
B --> D(Pipeline Binding)
B --> E(Pipeline Template)
D --> E
E --> F(PipelineRun)
F --> G(Pipeline)
```
Les `Webhooks`, événements et triggers dans Tekton CI permettent de déclencher des actions automatisées en réponse à des événements spécifiques dans un système de gestion de code source.
### Filter et overlay
Le `filter` permet de déclencher les Triggers pour les événements répondant au critère du filtre
Les `overlays` permettent de récupérer une valeur de la requête pour la passer en paramètre
### Workspaces
Les workspaces sont des volumes qui sont monté à la demande dans les conteneurs des différentes `Task` dans le répertoire `/workspace`.
### Exemples
- [EventListener MSE](kustomization/base/tekton/event/mseproject.yaml)
- [TriggerBinding MSE](kustomization/base/tekton/event/msebuild-binding.yaml)
- [TriggerTemplate MSE](kustomization/base/tekton/event/msebuild-template.yaml)
## Pipelines
Les `Pipeline` dans Tekton CI décrivent une série d'étapes ou de tâches à exécuter pour automatiser un processus de déploiement ou de test logiciel.
Un `PipelineRun` permet d'exécuter un `Pipeline` en lui donnant des paramètres
L'option `runAfter:` permet de définir si une `Task` doit s'exécuter une fois qu'une autre Task est terminé. Si `runAfter` n'est par défini, la `Task` sera exécuté en parallèle
```mermaid
flowchart LR
G(PipelineRun) --> H(Pipeline)
H --> I(TaskRun)
I --> J(Task)
```
### Exemples
- [SymfonyCheck](../kustomization/base/tekton/pipeline/symfonycheck.yaml)
## Tasks
Les `Task` dans Tekton CI représentent des actions individuelles à effectuer dans un pipeline. Elles peuvent inclure des opérations telles que la construction, le déploiement, les tests, etc.
Une `TaskRun` permet d'exécuter une `Task` en lui donnant des paramètres.
Les `Task` vont alors enchainer les différentes steps.
Les `Task` peuvent émettre des résultats, qui seront alors accessible par d'autres `Task`
L'option `OnError` permet de déclencher un évenement à la suite d'une erreur d'une `step`.
On peut alors s'en servir pour passer à la st`ep suivante, sans bloquer l'exécution de la `Task`.
### Exemple
- [ImageFormater](kustomization/base/tekton/task/common/imageformater.yaml)

View File

@ -3,3 +3,4 @@ kind: Kustomization
resources:
- tekton/
- tekton-pipelines/ingress/dashboard.yaml

View File

@ -2,6 +2,7 @@ apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: dashboard
namespace: tekton-pipelines
spec:
ingressClassName: nginx
rules:
@ -15,10 +16,10 @@ spec:
name: tekton-dashboard
port:
number: 9097
- path: /msebuild
- path: /mseproject
pathType: Prefix
backend:
service:
name: el-msebuild
name: el-mseproject
port:
number: 9000

View File

@ -0,0 +1,39 @@
apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
name: mseproject
spec:
serviceAccountName: tekton-robot
triggers:
- name: mse-symfonycheck-trigger
interceptors:
- ref:
name: "cel"
params:
# Filtre par événement
- name: "filter"
value: "body.action in ['opened', 'synchronized']"
bindings:
- ref: symfonycheck-binding
template:
ref: symfonycheck-template
- name: mse-build-trigger
interceptors:
- ref:
name: "cel"
params:
# Filtre par événement
- name: "filter"
value: "body.pull_request.merged == true"
# Récupération du queryParam registry
- name: "overlays"
value:
- key: registry
expression: "requestURL.parseURL().query['registry']"
bindings:
- ref: msebuild-binding
- name: registry
value: $(extensions.registry)
template:
ref: msebuild-template

View File

@ -1,15 +1,14 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: tekton-pipelines
namespace: tekton
resources:
- namespace/namespace.yaml
- secret/git-secret.yaml
- secret/ssh-secret.yaml
- secret/gitea-access-token.yaml
- serviceaccount/service-account.yaml
- serviceaccount/rbac.yaml
- configmap/configmap-phpcsfixer.yaml
- resources/
# Tasks
- https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.9/git-clone.yaml
- https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.6/raw
@ -22,6 +21,7 @@ resources:
- task/symfonyapp/phpsecuritycheck.yaml
- task/symfonyapp/phpstan.yaml
- task/symfonyapp/phpunittest.yaml
- task/symfonyapp/phpfunctionaltest.yaml
# Pipelines
- pipeline/imagebuild.yaml
@ -36,9 +36,33 @@ resources:
- trigger/symfonycheck-template.yaml
# Events
- event/msebuild.yaml
- event/imagebuild.yaml
- event/symfonycheck.yaml
- event/mseproject.yaml
# Ingress
# # Ingress
# - ingress/dashboard.yaml
generatorOptions:
disableNameSuffixHash: true
secretGenerator:
- name: regcred
type: kubernetes.io/dockerconfigjson
files:
- secret/dockerconfig/.dockerconfigjson
- name: basic-auth
type: kubernetes.io/basic-auth
options:
annotations:
tekton.dev/git-0: https://forge.cadoles.com
envs:
- secret/gitea/basicauth
- name: gitea-access-token
files:
- secret/gitea/access_token
- name: git-credentials
files:
- secret/ssh/id_ed25519
- secret/ssh/known_hosts

View File

@ -1,4 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: tekton-pipelines
name: tekton

View File

@ -87,7 +87,7 @@ spec:
- name: destination
value: $(params.destination)
# ⭐ Execution des tests unitaires avec une BDD en sidecar
# ⭐ Execution des tests unitaires et fonctionnels
- name: phpunittest
runAfter: ["gitclone"]
taskRef:

View File

@ -1,39 +0,0 @@
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
generateName: msebuild-run-
namespace: tekton
spec:
serviceAccountName: build-bot
pipelineRef:
name: msebuild
podTemplate:
securityContext:
fsGroup: 65532
workspaces:
- name: shared-data
volumeClaimTemplate:
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
- name: config
configmap:
name: config-php-cs-fixer
- name: docker-credentials
secret:
secretName: regcred
params:
- name: image
value: reg.cadoles.com/mlamalle/testtekton
- name: tag
value: test
- name: dockerfile
value: ./misc/k8s/images/job-base/Dockerfile
- name: url
value: https://forge.cadoles.com/CNOUS/mse.git
- name: revision
value: sprint-6

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./redis/redis-cluster.yaml

View File

@ -0,0 +1,22 @@
apiVersion: databases.spotahome.com/v1
kind: RedisFailover
metadata:
name: tekton-redis
spec:
sentinel:
replicas: 3
resources:
requests:
cpu: 100m
limits:
memory: 100Mi
redis:
image: reg.cadoles.com/proxy_cache/library/redis:6.2.6-alpine
replicas: 3
resources:
requests:
cpu: 100m
memory: 100Mi
limits:
cpu: 400m
memory: 500Mi

View File

@ -1,10 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
tekton.dev/git-0: https://forge.cadoles.com
name: basic-auth
type: kubernetes.io/basic-auth
stringData:
username: <login>
password: <password>

View File

@ -1,6 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: gitea-access-token
data:
access_token: <base64 gitea access token>

View File

@ -0,0 +1 @@
TOKEN_HERE

View File

@ -0,0 +1,2 @@
username=<login>
password=<password>

View File

@ -1,7 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: git-credentials
data:
id_ed25519: <base64 ssh private key>
known_hosts: <base64 known_host>

View File

@ -0,0 +1 @@
YOUR_PRIVATE_KEY_HERE

View File

@ -0,0 +1 @@
KNOWN_HOST_HERE

View File

@ -0,0 +1,70 @@
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: phpfunctionaltest
spec:
description: PHP functional test with bdd sidecar
workspaces:
- name: source
sidecars:
- name: database
image: postgres:16
env:
- name: POSTGRES_PASSWORD
value: not_so_secret
- name: POSTGRES_HOST_AUTH_METHOD
value: trust
- name: redis
image: redis:4.0
steps:
- name: exec
image: reg.cadoles.com/cadoles/symfony:alpine-php-7.4-base-20230926
env:
- name: PHP_FPM_MEMORY_LIMIT
value: 512m
- name: MSE_DATABASE_DRIVER
value: pdo_pgsql
- name: MSE_DATABASE_HOST
value: localhost
- name: MSE_DATABASE_PORT
value: '5432'
- name: MSE_DATABASE_NAME
value: postgres
- name: MSE_DATABASE_USER
value: postgres
- name: MSE_DATABASE_PASSWORD
value: not_so_secret
- name: MSE_REDIS_SERVER
value: localhost
- name: MSE_REDIS_PORT
value: '6379'
- name: MSE_REDIS_SERVER
value: rfs-tekton-redis
command:
- /bin/sh
args:
- '-c'
- |
set -e
apk add bash=5.1.16-r0 \
postgresql-client \
php7-gd=7.4.33-r1 \
php7-xsl=7.4.33-r1 \
php7-pdo=7.4.33-r1 \
php7-pgsql=7.4.33-r1 \
php7-pdo_pgsql=7.4.33-r1 \
php7-soap=7.4.33-r1 \
php7-ldap=7.4.33-r1 \
php7-pdo_mysql=7.4.33-r1 \
php7-bcmath=7.4.33-r1 \
php7-intl=7.4.33-r1 \
php7-fileinfo=7.4.33-r1 \
php7-iconv=7.4.33-r1 \
php7-pecl-amqp=1.11.0-r0 \
php7-pecl-redis=5.3.6-r0
cd $(workspaces.source.path)
app/console doctrine:migrations:migrate -n
./scripts/run-php-tests.sh --group integration --stderr --testdox -d memory_limit=512M

View File

@ -3,41 +3,18 @@ kind: Task
metadata:
name: phpstan
spec:
description: PHP-CS-Fixer on modified code
description: Phpstan on modified code
workspaces:
- name: source
params:
- name: apiurl
- name: requestid
steps:
- name: exec
image: ghcr.io/phpstan/phpstan:1
command:
- /bin/sh
args:
- '-c'
- |
#set -e
echo ""
echo "== INSTALL PHPSTAN ======================================="
composer require phpstan/phpstan-symfony
composer require phpstan/phpstan-doctrine
cat << EOF > /app/phpstan.neon
includes:
- /app/vendor/phpstan/phpstan-symfony/extension.neon
- /app/vendor/phpstan/phpstan-doctrine/extension.neon
- /app/vendor/phpstan/phpstan-doctrine/rules.neon
EOF
echo ""
- name: analyse
image: reg.cadoles.com/cadoles/phpstan
script: |
#!/bin/sh
echo "== RUN PHPSTAN ==========================================="
cd $(workspaces.source.path)
php $(which phpstan) analyse -l 1 --error-format=table src/ > temp_phpstan.txt
RESULT=$(cat temp_phpstan.txt)
echo "${RESULT}"
echo ""
echo ""
phpstan analyse -l 5 --configuration phpstan-pipeline.neon --error-format table --no-progress > temp_phpstan.txt 2>&1
cat temp_phpstan.txt

View File

@ -3,7 +3,7 @@ kind: Task
metadata:
name: phpunittest
spec:
description: PHP unit test with bdd sidecar
description: PHP unit test
workspaces:
- name: source
sidecars:
@ -14,11 +14,9 @@ spec:
value: not_so_secret
- name: POSTGRES_HOST_AUTH_METHOD
value: trust
- name: redis
image: redis:4.0
steps:
- name: exec
- name: php-unit
image: reg.cadoles.com/cadoles/symfony:alpine-php-7.4-base-20230926
env:
- name: PHP_FPM_MEMORY_LIMIT
@ -61,8 +59,61 @@ spec:
php7-iconv=7.4.33-r1 \
php7-pecl-amqp=1.11.0-r0 \
php7-pecl-redis=5.3.6-r0
echo "memory_limit = 512M" >> /etc/php7/conf.d/03_base.ini
echo "memory_limit = 512M" >> /etc/php8/conf.d/03_base.ini
cd $(workspaces.source.path)
app/console doctrine:migrations:migrate -n
./scripts/run-php-tests.sh --group unit --stderr --testdox -d memory_limit=512M
./bin/phpunit -c ./app --group unit --stderr --testdox -d memory_limit=1024M $(PHPUNIT_ARGS)
onError: continue
- name: php-functional
image: reg.cadoles.com/cadoles/symfony:alpine-php-7.4-base-20230926
env:
- name: PHP_FPM_MEMORY_LIMIT
value: 512m
- name: MSE_DATABASE_DRIVER
value: pdo_pgsql
- name: MSE_DATABASE_HOST
value: localhost
- name: MSE_DATABASE_PORT
value: '5432'
- name: MSE_DATABASE_NAME
value: postgres
- name: MSE_DATABASE_USER
value: postgres
- name: MSE_DATABASE_PASSWORD
value: not_so_secret
- name: MSE_REDIS_SERVER
value: rfs-portal-redis
- name: MSE_REDIS_PORT
value: '26379'
- name: MSE_REDIS_SERVER
value: rfs-tekton-redis
command:
- /bin/sh
args:
- '-c'
- |
set -e
apk add bash=5.1.16-r0 \
postgresql-client \
php7-gd=7.4.33-r1 \
php7-xsl=7.4.33-r1 \
php7-pdo=7.4.33-r1 \
php7-pgsql=7.4.33-r1 \
php7-pdo_pgsql=7.4.33-r1 \
php7-soap=7.4.33-r1 \
php7-ldap=7.4.33-r1 \
php7-pdo_mysql=7.4.33-r1 \
php7-bcmath=7.4.33-r1 \
php7-intl=7.4.33-r1 \
php7-fileinfo=7.4.33-r1 \
php7-iconv=7.4.33-r1 \
php7-pecl-amqp=1.11.0-r0 \
php7-pecl-redis=5.3.6-r0
echo "memory_limit = 512M" >> /etc/php7/conf.d/03_base.ini
echo "memory_limit = 512M" >> /etc/php8/conf.d/03_base.ini
cd $(workspaces.source.path)
/bin/sh ./sidecar-scripts/init_database.sh
./bin/phpunit -c ./app --group integration --stderr --testdox -d memory_limit=1024M $(PHPUNIT_ARGS)

View File

@ -7,7 +7,7 @@ spec:
- name: url
value: $(body.repository.clone_url)
- name: revision
value: $(body.pull_request.head.ref)
value: $(body.pull_request.base.ref)
- name: image
value: $(body.repository.full_name)
- name: tag

View File

@ -7,7 +7,7 @@ spec:
- name: url
value: $(body.repository.clone_url)
- name: revision
value: $(body.pull_request.head.ref)
value: $(body.pull_request.base.ref)
- name: image
value: $(body.repository.full_name)
- name: apiurl

View File

@ -2,7 +2,7 @@ apiVersion: skaffold/v3
kind: Config
metadata:
name: tekton-pipelines
name: tekton
manifests:
kustomize: