.estafette.yaml

builder:
  track: dev

labels:
  app-group: estafette-ci-extensions
  team: estafette-team
  language: golang

version:
  semver:
    major: 0
    minor: 1

stages:
  build:
    image: golang:1.21-alpine
    env:
      CGO_ENABLED: 0
      GOOS: linux
      GOGC: off
    commands:
      - go test ./...
      - go build -a -installsuffix cgo -ldflags "-X main.appgroup=${ESTAFETTE_LABEL_APP_GROUP} -X main.app=${ESTAFETTE_GIT_NAME} -X main.version=${ESTAFETTE_BUILD_VERSION} -X main.revision=${ESTAFETTE_GIT_REVISION} -X main.branch=${ESTAFETTE_GIT_BRANCH} -X main.buildDate=${ESTAFETTE_BUILD_DATETIME}" -o ./publish/${ESTAFETTE_GIT_NAME} .

  bake:
    image: extensions/docker:dev
    action: build
    inline: |
      FROM alpine:3.18

      ENV KUBECTL_VERSION="v1.26.14"

      RUN apk add --update --upgrade --no-cache \
            curl \
          && rm -rf /var/cache/apk/*

      RUN curl -L "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" --output /usr/bin/kubectl \
          && curl -LO "https://dl.k8s.io/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
          && echo "$(cat kubectl.sha256)  /usr/bin/kubectl" | sha256sum -c - \
          && chmod +x /usr/bin/kubectl \
          && kubectl version --client

      FROM google/cloud-sdk:476.0.0-alpine

      RUN apk add --update --upgrade --no-cache \
          && rm -rf google-cloud-sdk/bin/anthoscli \
          && rm -rf /var/cache/apk/* 

      RUN gcloud components install gke-gcloud-auth-plugin

      LABEL maintainer="estafette.io" \
            description="The ${ESTAFETTE_GIT_NAME} component is an Estafette extension to deploy applications to a Kubernetes Engine cluster"

      COPY --from=0 /usr/bin/kubectl /usr/bin/kubectl
      COPY ${ESTAFETTE_GIT_NAME} /
      COPY templates /templates

      RUN mkdir -p ~/.kube

      ENV ESTAFETTE_LOG_FORMAT="console" \
          GOOGLE_APPLICATION_CREDENTIALS="/key-file.json" \
          KUBECONFIG="/root/.kube/config"

      ENTRYPOINT ["/${ESTAFETTE_GIT_NAME}"]
    container: gke
    repositories:
      - extensions
    path: ./publish
    copy:
      - templates
      - /etc/ssl/certs/ca-certificates.crt

  check-container:
    parallelStages:
      check-efficiency:
        image: extensions/docker:dev
        action: dive
        container: gke
        repositories:
          - extensions

      vulnerability-scan:
        image: extensions/docker:dev
        action: trivy
        container: gke
        severity: low
        repositories:
          - extensions

  integration-tests:
    parallelStages:
      test-with-defaults:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: deploy-simple
        kind: deployment
        app: gke
        namespace: estafette
        visibility: public-whitelist
        workloadIdentity: true
        whitelist:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16
        container:
          repository: extensions
          name: gke
          tag: alpha
          port: 5000
          additionalports:
            - name: grpc
              port: 8085
              protocol: TCP
              visibility: private
            - name: snmp
              port: 8086
              protocol: UDP
              visibility: public
          env:
            MY_CUSTOM_ENV: value1
            MY_OTHER_CUSTOM_ENV: value2
            MY_BOOL_ENV: true
            MY_INT_ENV: 123123
            KUBERNETES_LABELS_APP:
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels['app']
          secretEnv:
            MY_SECRET: mysecretvalue
          cpu:
            request: 100m
          memory:
            request: 256Mi
            limit: 256Mi
          liveness:
            path: /liveness
            port: 5001
            delay: 30
            timeout: 1
            period: 10
          readiness:
            path: /readiness
            port: 5002
            delay: 30
            timeout: 1
            period: 10
          metrics:
            scrape: true
            path: /metrics
            port: 5003
          lifecycle:
            prestopsleep: true
            prestopsleepseconds: 15
        sidecar:
          type: openresty
          image: estafette/openresty-sidecar:1.13.6.1-alpine
          healthcheckpath: /readiness
          env:
            CORS_ALLOWED_ORIGINS: "*"
            CORS_MAX_AGE: "86400"
            MY_BOOL_ENV: true
            MY_INT_ENV: 123123
            KUBERNETES_LABELS_APP:
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels['app']
          secretEnv:
            MY_SIDECAR_SECRET: mysecondsecretvalue
          cpu:
            request: 10m
          memory:
            request: 10Mi
            limit: 50Mi
        initcontainers:
          - name: sysctl
            image: busybox:1.31.0
            imagePullPolicy: IfNotPresent
            command:
              - sh
              - -c
              - sysctl -w net.core.somaxconn=32768; sysctl -w net.ipv4.ip_local_port_range="1024 65535"
            securityContext:
              privileged: true
        sidecars:
          - type: cloudsqlproxy
            dbinstanceconnectionname: my-gcloud-project:europe-west1:my-database
            sqlproxyport: 5043
            sqlproxyterminationtimeoutseconds: 30
            env:
              MY_BOOL_ENV: true
              MY_INT_ENV: 123123
              KUBERNETES_LABELS_APP:
                valueFrom:
                  fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.labels['app']
              ClientCertificatePassword:
                valueFrom:
                  secretKeyRef:
                    key: ClientCertificatePassword
                    name: '{{.NameWithTrack}}-secrets'
            secretEnv:
              MY_OTHER_SIDECAR_SECRET: myothersecretvalue
            cpu:
              request: 10m
            memory:
              request: 10Mi
              limit: 50Mi
          - type: custom
            image: estafette/estafette-docker-cache-heater:dev
            imagePullPolicy: IfNotPresent
            env:
              MY_BOOL_ENV: true
              MY_INT_ENV: 123123
              KUBERNETES_LABELS_APP:
                valueFrom:
                  fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.labels['app']
            secretEnv:
              MY_CUSTOM_SIDECAR_SECRET: 123
            cpu:
              request: 10m
              limit: 50m
            memory:
              request: 10Mi
              limit: 50Mi
        autoscale:
          min: 3
          max: 50
          cpu: 80
          safety:
            enabled: true
            promquery: "sum(rate(nginx_http_requests_total{app='my-app'}[5m])) by (app)"
            ratio: 2.5
            delta: -0.5
            scaledownratio: 0.2
        vpa:
          enabled: false
          updateMode: "Off"
        request:
          ingressbackendprotocol: HTTPS
          timeout: 60s
          maxbodysize: 128m
          proxybuffersize: 4k
          proxybuffersnumber: 4
          clientbodybuffersize: 8k
          loadbalance: round_robin
          configurationSnippet: |-
            more_set_headers "Test-Header: header-value";
            more_set_headers "Test-Header-2: header-value-2";
        secrets:
          keys:
            secret-file-1.json: c29tZSBzZWNyZXQgdmFsdWU=
            secret-file-2.yaml: YW5vdGhlciBzZWNyZXQgdmFsdWU=
            bool-file: dHJ1ZQo=
            int-file: MTIzMTIzCg==
          mountpath: /secrets
        configs:
          # these are local files with golang template style placeholders, replaced with the values specified in the data section;
          # set clone: true on the release target to ensure you have access to these files stored in your repository
          files:
            - config/config.json
            - config/anotherconfig.yaml
          # these are the values for the placeholders specified as {{.property1}} to be replaced in the config files
          data:
            property1: value 1
            property2: value 2
            property4: true
            property5: 123123
          # if you want to avoid cloning your repository and just need to pass a very short config you can inline full files here
          inline:
            inline-config.properties: |
              enemies=aliens
              lives=3
          mountpath: /configs
        volumemounts:
          - name: client-certs
            mountpath: /cockroach-certs
            volume:
              secret:
                secretName: estafette.client.estafette
                items:
                  - key: key
                    path: key
                    mode: 0600
                  - key: cert
                    path: cert
        manifests:
          files:
            - override/service.yaml
          data:
            property3: value-3
            property6: true
            property7: 123123
        hosts:
          - gke.estafette.io
          - gke-deploy.estafette.io
        internalhosts:
          - gke.estafette.internal
          - gke-deploy.estafette.local
        basepath: /
        enablePayloadLogging: true
        useGoogleCloudCredentials: true
        disableServiceAccountKeyRotation: false
        probeService: true
        topologyAwareHints: true
        googleCloudCredentialsApp: gke
        chaosproof: true
        rollingupdate:
          maxsurge: 25%
          maxunavailable: 25%
          timeout: 2m
        trustedips:
          - 103.21.244.0/22
          - 103.22.200.0/22
          - 103.31.4.0/22
        dryrun: true

      test-deployment-affinity:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: deploy-simple
        kind: deployment
        app: test-affinity
        container:
          repository: extensions
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 50
                podAffinityTerm:
                  labelSelector:
                    matchExpressions:
                      - key: app
                        operator: In
                        values:
                          - test-affinity
                  topologyKey: kubernetes.io/hostname
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-statefulset-affinity:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: statefulset
        app: test-affinity
        container:
          repository: extensions
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 50
                podAffinityTerm:
                  labelSelector:
                    matchExpressions:
                      - key: app
                        operator: In
                        values:
                          - test-affinity
                  topologyKey: kubernetes.io/hostname
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-job-affinity:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: job
        app: test-affinity
        container:
          repository: extensions
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 50
                podAffinityTerm:
                  labelSelector:
                    matchExpressions:
                      - key: app
                        operator: In
                        values:
                          - test-affinity
                  topologyKey: kubernetes.io/hostname
        dryrun: true

      test-cronjob-affinity:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: cronjob
        schedule: "*/5 * * * *"
        app: test-affinity
        container:
          repository: extensions
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 50
                podAffinityTerm:
                  labelSelector:
                    matchExpressions:
                      - key: app
                        operator: In
                        values:
                          - test-affinity
                  topologyKey: kubernetes.io/hostname
        dryrun: true

      test-minimal-alpha-version:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-without-secret-but-with-secretenv:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
          secretEnv:
            MY_SECRET: mysecretvalue
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-routeonly-hosts:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        hostsrouteonly:
          - gkerouteonly.estafette.io
        internalhosts:
          - gke.estafette.internal
        internalhostsrouteonly:
          - gkerouteonly.estafette.internal
        dryrun: true

      test-os-windows:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        os: windows
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-visibility-esp:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        visibility: esp
        espEndpointsProjectID: some-project-id
        espConfigID: 2019-04-24r0
        espOpenapiYamlPath: test/openapi.yaml
        container:
          repository: extensions
        useGoogleCloudCredentials: true
        workloadIdentity: true
        disableServiceAccountKeyRotation: true
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-visibility-espv2:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        visibility: espv2
        espEndpointsProjectID: some-project-id
        espConfigID: 2019-04-24r0
        espOpenapiYamlPath: test/openapi.yaml
        container:
          repository: extensions
        useGoogleCloudCredentials: true
        disableServiceAccountKeyRotation: true
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-kind-job:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: job
        tolerations:
          - key: "test-key"
            operator: "Equal"
            value: "test-value"
            effect: "NoExecute"
            tolerationSeconds: 1200
        container:
          repository: extensions
          env:
            MY_CUSTOM_ENV: value1
            MY_OTHER_CUSTOM_ENV: value2
            MY_BOOL_ENV: true
            MY_INT_ENV: 123123
            KUBERNETES_LABELS_APP:
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels['app']
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-kind-cronjob:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: cronjob
        schedule: "*/5 * * * *"
        concurrencypolicy: Forbid
        tolerations:
          - key: "test-key"
            operator: "Equal"
            value: "test-value"
            effect: "NoExecute"
            tolerationSeconds: 1200
        container:
          repository: extensions
          env:
            MY_CUSTOM_ENV: value1
            MY_OTHER_CUSTOM_ENV: value2
            MY_BOOL_ENV: true
            MY_INT_ENV: 123123
            KUBERNETES_LABELS_APP:
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels['app']
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-kind-statefulset:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: statefulset
        podManagementpolicy: OrderedReady
        storageclass: fast
        storagesize: 10Gi
        container:
          repository: extensions
          env:
            MY_CUSTOM_ENV: value1
            MY_OTHER_CUSTOM_ENV: value2
            MY_BOOL_ENV: true
            MY_INT_ENV: 123123
            KUBERNETES_LABELS_APP:
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels['app']
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-kind-headless-deployment:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: headless-deployment
        strategytype: Recreate
        tolerations:
          - key: "test-key"
            operator: "Equal"
            value: "test-value"
            effect: "NoExecute"
            tolerationSeconds: 1200
        container:
          repository: extensions
          env:
            MY_CUSTOM_ENV: value1
            MY_OTHER_CUSTOM_ENV: value2
            MY_BOOL_ENV: true
            MY_INT_ENV: 123123
            KUBERNETES_LABELS_APP:
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels['app']
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-strategytype-atomic-update:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: deployment
        strategytype: AtomicUpdate
        container:
          repository: extensions
          env:
            MY_CUSTOM_ENV: value1
            MY_OTHER_CUSTOM_ENV: value2
            MY_BOOL_ENV: true
            MY_INT_ENV: 123123
            KUBERNETES_LABELS_APP:
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels['app']
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-kind-config:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        kind: config
        app: gke
        namespace: estafette
        configs:
          # these are local files with golang template style placeholders, replaced with the values specified in the data section;
          # set clone: true on the release target to ensure you have access to these files stored in your repository
          files:
            - config/config.json
            - config/anotherconfig.yaml
          # these are the values for the placeholders specified as {{.property1}} to be replaced in the config files
          data:
            property1: value 1
            property2: value 2
            property4: true
            property5: 123123
          # if you want to avoid cloning your repository and just need to pass a very short config you can inline full files here
          inline:
            inline-config.properties: |
              enemies=aliens
              lives=3
          mountpath: /configs
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-deploy-canary:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: deploy-canary
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-deploy-stable:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: deploy-stable
        container:
          repository: extensions
        allowhttp: true
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-rollback-canary:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: rollback-canary
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-diff-simple:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: diff-simple
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-diff-canary:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: diff-canary
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-diff-stable:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: diff-stable
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-delete:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: delete
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-action-diff-delete:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        action: diff-delete
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal

      test-legacy-gcp-service-account:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.internal.estafette.io
        dryrun: true
        legacyGoogleCloudServiceAccountKeyFile: YWJjCg==

      test-vertical-pod-autoscaler:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
        vpa:
          enabled: true
          updateMode: "Auto"
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-pod-security-context:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
        securityContext:
          runAsUser: 1000
          runAsGroup: 3000
          fsGroup: 2000
          fsGroupChangePolicy: "OnRootMismatch"
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-container-security-context:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
          securityContext:
            runAsUser: 1000
            runAsGroup: 3000
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

      test-container-lifecycle-hook:
        image: extensions/gke:${ESTAFETTE_BUILD_VERSION}
        credentials: gke-dev-common
        container:
          repository: extensions
        containerLifecycle:
          preStop:
            exec:
              command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
        hosts:
          - gke.estafette.io
        internalhosts:
          - gke.estafette.internal
        dryrun: true

  push-to-docker-hub:
    image: extensions/docker:dev
    action: push
    container: gke
    repositories:
      - extensions

  slack-notify:
    image: extensions/slack-build-status:dev
    workspace: estafette
    channels:
      - '#build-status'
    when:
      status == 'succeeded' ||
      status == 'failed'

releases:
  dev:
    triggers:
      - pipeline:
          name: self
          branch: .+
    stages:
      tag-container-image:
        image: extensions/docker:stable
        action: tag
        container: gke
        repositories:
          - extensions
        tags:
          - dev

  beta:
    stages:
      tag-container-image:
        image: extensions/docker:stable
        action: tag
        container: gke
        repositories:
          - extensions
        tags:
          - beta

      slack-notify:
        image: extensions/slack-build-status:dev
        workspace: estafette
        channels:
          - '#release-status'
        when:
          status == 'succeeded' ||
          status == 'failed'

  stable:
    stages:
      tag-container-image:
        image: extensions/docker:stable
        action: tag
        container: gke
        repositories:
          - extensions
        tags:
          - stable
          - latest

      slack-notify:
        image: extensions/slack-build-status:dev
        workspace: estafette
        channels:
          - '#release-status'
        when:
          status == 'succeeded' ||
          status == 'failed'