Skip to content

Commit 6bc1c5b

Browse files
cloudnativetoolkitcloudnativetoolkit
committed
updates to use mas-devops
1 parent 53dc006 commit 6bc1c5b

3 files changed

Lines changed: 339 additions & 14 deletions

File tree

‎8.11.x/pipeline-masdevops.yaml‎

Lines changed: 297 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,297 @@
1+
---
2+
apiVersion: tekton.dev/v1beta1
3+
kind: Pipeline
4+
metadata:
5+
name: mas-masdevops-deploy
6+
namespace: default
7+
spec:
8+
workspaces:
9+
- name: ws
10+
params:
11+
- name: namespace
12+
type: string
13+
default: "maximo-suite"
14+
- name: mas-instance-id
15+
type: string
16+
default: "maximo"
17+
- name: mas-workspace-id
18+
type: string
19+
default: "maxworkspace"
20+
- name: mas-workspace-name
21+
type: string
22+
default: "My Maximo Workspace"
23+
- name: mas-catalog-version
24+
type: string
25+
description: "Do not change this unless you know what you are doing"
26+
default: "v8-amd64"
27+
- name: mas-channel
28+
type: string
29+
description: "Controls version of Maximo Operators. Do not change this unless you know what you are doing."
30+
default: "8.11.x"
31+
- name: license-file-secret-name
32+
description: "Store your BYOL license key stored as a base64 encoded arbitrary secret in the kube-system namespace. provide the name of the secret here. the defaul is false which means the pipeline will attempt to download a techzone license"
33+
type: string
34+
default: "false"
35+
- name: use-letsencrypt-certs
36+
description: "use generated letsencrypt certs stored as a secret in the openshift-config namespace under letsencrypt-certs, if false, will generate self-signed certs"
37+
type: string
38+
default: "true"
39+
- name: ibm-entitlement-key
40+
description: "IBM entitlement key. If not set, will use secret manager."
41+
type: string
42+
default: "false"
43+
- name: uds-email
44+
description: "Contact Email"
45+
type: string
46+
- name: uds-firstname
47+
description: "Contact first name"
48+
type: string
49+
- name: uds-lastname
50+
description: "Contact last name"
51+
type: string
52+
- name: storage-rwo
53+
description: "RWO Storage Class"
54+
type: string
55+
default: "ocs-storagecluster-cephfs"
56+
- name: storage-rwx
57+
description: "RWX Storage Class"
58+
type: string
59+
default: "ocs-storagecluster-cephfs"
60+
- name: storage-pipeline
61+
description: "Pipeline Storage Class"
62+
type: string
63+
default: "ocs-storagecluster-cephfs"
64+
- name: storage-accessmode
65+
description: "Install Pipeline storage class access mode (ReadWriteMany or ReadWriteOnce)"
66+
type: string
67+
default: "ReadWriteMany"
68+
finally:
69+
- name: update-configmap-failure
70+
when:
71+
- input: $(tasks.install-mas.status)
72+
operator: notin
73+
values: ["Succeeded"]
74+
taskRef:
75+
kind: Task
76+
name: ibm-pak
77+
params:
78+
- name: SCRIPT
79+
value: |
80+
oc patch configmap/pipeline-output -p '{"data":{"Status":"Pipeline run failed. See Pipeline run for more details and consider running the pipeline again."}}'
81+
- name: update-configmap-success
82+
when:
83+
- input: $(tasks.install-mas.status)
84+
operator: in
85+
values: ["Succeeded"]
86+
taskRef:
87+
kind: Task
88+
name: ibm-pak
89+
params:
90+
- name: SCRIPT
91+
value: |
92+
# get and echo the pipeline the mas installer created
93+
oc patch configmap/pipeline-output -p '{"data":{"Status":"Deployment Pipeline Running."}}'
94+
tasks:
95+
- name: get-ibm-entitlement-key
96+
taskRef:
97+
name: ibmcloud-secrets-manager-get
98+
kind: Task
99+
params:
100+
- name: KEY_ID
101+
value: 968d7819-f2c5-7b67-c420-3c6bfd51521e
102+
- name: SECRETS_MANAGER_ENDPOINT_URL
103+
value: >-
104+
https://afa20521-cd75-4864-843f-e59fd0ffd49d.us-south.secrets-manager.appdomain.cloud
105+
- name: set-retrieved-entitlement-key
106+
when:
107+
- input: "$(params.ibm-entitlement-key)"
108+
operator: in
109+
values: ["false"]
110+
runAfter:
111+
- get-ibm-entitlement-key
112+
params:
113+
- name: retrieved-entitlement-key
114+
value: $(tasks.get-ibm-entitlement-key.results.secret-value)
115+
workspaces:
116+
- name: ws
117+
taskSpec:
118+
workspaces:
119+
- name: ws
120+
params:
121+
- name: retrieved-entitlement-key
122+
steps:
123+
- name: set-entitlement-key
124+
image: quay.io/openshift/origin-cli:4.10
125+
script: |
126+
#!/usr/bin/env bash
127+
echo $(params.retrieved-entitlement-key) > $(workspaces.ws.path)/ek.dat
128+
echo "ek.dat created"
129+
exit
130+
- name: set-provided-entitlement-key
131+
workspaces:
132+
- name: ws
133+
params:
134+
- name: provided-entitlement-key
135+
value: "$(params.ibm-entitlement-key)"
136+
taskSpec:
137+
workspaces:
138+
- name: ws
139+
params:
140+
- name: provided-entitlement-key
141+
steps:
142+
- name: set-entitlement
143+
image: quay.io/openshift/origin-cli:4.10
144+
script: |
145+
#!/usr/bin/env bash
146+
echo $(params.provided-entitlement-key) > $(workspaces.ws.path)/ek.dat
147+
echo "ek.dat created"
148+
exit
149+
- name: get-maximo-licensefile
150+
workspaces:
151+
- name: ws
152+
runAfter:
153+
- set-provided-entitlement-key
154+
- set-retrieved-entitlement-key
155+
params:
156+
- name: KEY_ID
157+
value: 0ae3295c-95dd-c323-82af-1be5587d998f
158+
- name: SECRETS_MANAGER_ENDPOINT_URL
159+
value: >-
160+
https://afa20521-cd75-4864-843f-e59fd0ffd49d.us-south.secrets-manager.appdomain.cloud
161+
- name: LICENSE_FILE_SECRET_NAME
162+
value: "$(params.license-file-secret-name)"
163+
taskSpec:
164+
workspaces:
165+
- name: ws
166+
params:
167+
- name: KEY_ID
168+
- name: SECRETS_MANAGER_ENDPOINT_URL
169+
- name: LICENSE_FILE_SECRET_NAME
170+
steps:
171+
- name: write-maximo-licensefile
172+
image: quay.io/openshift/origin-cli:4.12
173+
script: |
174+
#!/usr/bin/env bash
175+
176+
if [[ $(params.LICENSE_FILE_SECRET_NAME) == "false" ]]; then
177+
# Retrieve the IBM Cloud API Key configured in a `deployer` cluster
178+
export IBMCLOUD_API_KEY=$(oc get secret ibm-secret -n kube-system -o jsonpath='{.data.apiKey}' | base64 -d)
179+
export AUTH_RESPONSE_JSON=$(curl -s -X POST \
180+
"https://iam.cloud.ibm.com/identity/token" \
181+
--header 'Content-Type: application/x-www-form-urlencoded' \
182+
--header 'Accept: application/json' \
183+
--data-urlencode 'grant_type=urn:ibm:params:oauth:grant-type:apikey' \
184+
--data-urlencode "apikey=${IBMCLOUD_API_KEY}")
185+
export ACCESS_TOKEN=$(echo $AUTH_RESPONSE_JSON | grep -o '"access_token":"[^"]*' | grep -o '[^"]*$')
186+
export SECRET_JSON=$(curl -s -X GET --location --header "Authorization: Bearer ${ACCESS_TOKEN}" --header "Accept: application/json" "$(params.SECRETS_MANAGER_ENDPOINT_URL)/api/v2/secrets/$(params.KEY_ID)")
187+
echo $SECRET_JSON | grep -o '"payload":"[^"]*' | grep -o '[^"]*$' | base64 -d > $(workspaces.ws.path)/license.dat
188+
189+
else
190+
oc get secret $(params.LICENSE_FILE_SECRET_NAME) -n default -o jsonpath='{.data.licensefile}' | base64 -d | base64 -d > $(workspaces.ws.path)/license.dat
191+
fi
192+
193+
cat $(workspaces.ws.path)/license.dat
194+
- name: get-tls-certs
195+
when:
196+
- input: "$(params.use-letsencrypt-certs)"
197+
operator: in
198+
values: ["true"]
199+
retries: 2
200+
runAfter:
201+
- get-maximo-licensefile
202+
workspaces:
203+
- name: ws
204+
taskSpec:
205+
workspaces:
206+
- name: ws
207+
steps:
208+
- name: get-tls-certs
209+
image: quay.io/congxdev/ibm-pak-ubi:latest
210+
script: |
211+
### this is the method to load certs to the mas installer
212+
mkdir -p $(workspaces.ws.path)/masconfig/certs/core/
213+
wget -qO - https://letsencrypt.org/certs/lets-encrypt-r3.pem > $(workspaces.ws.path)/masconfig/certs/core/ca.crt
214+
oc get secret letsencrypt-certs -n openshift-config -o jsonpath="{.data['tls\.key']}" | base64 -d > $(workspaces.ws.path)/masconfig/certs/core/tls.key
215+
oc get secret letsencrypt-certs -n openshift-config -o jsonpath="{.data['tls\.crt']}" | base64 -d > $(workspaces.ws.path)/masconfig/certs/core/tls.crt
216+
ls $(workspaces.ws.path)/masconfig/certs/core/
217+
cat $(workspaces.ws.path)/masconfig/certs/core/tls.key
218+
cat $(workspaces.ws.path)/masconfig/certs/core/tls.crt
219+
220+
# copy letsencrypt-certs secret to the name where maximo is expecting to find it.
221+
if oc get secret -n openshift-ingress router-certs-default; then
222+
echo "router-certs-default secret already exists"
223+
else
224+
oc get secret letsencrypt-certs -n openshift-ingress -o yaml | yq '.metadata["name"]="router-certs-default"' | oc apply -n openshift-ingress -f -
225+
fi
226+
- name: install-mas
227+
retries: 2
228+
runAfter:
229+
- get-tls-certs
230+
- get-maximo-licensefile
231+
workspaces:
232+
- name: ws
233+
params:
234+
- name: mas-instance-id
235+
value: "$(params.mas-instance-id)"
236+
- name: mas-workspace-id
237+
value: "$(params.mas-workspace-id)"
238+
- name: mas-workspace-name
239+
value: "$(params.mas-workspace-name)"
240+
- name: mas-catalog-version
241+
value: "$(params.mas-catalog-version)"
242+
- name: mas-channel
243+
value: "$(params.mas-channel)"
244+
- name: uds-email
245+
value: "$(params.uds-email)"
246+
- name: uds-firstname
247+
value: "$(params.uds-firstname)"
248+
- name: uds-lastname
249+
value: "$(params.uds-lastname)"
250+
- name: storage-rwo
251+
value: "$(params.storage-rwo)"
252+
- name: storage-rwx
253+
value: "$(params.storage-rwx)"
254+
- name: storage-pipeline
255+
value: "$(params.storage-pipeline)"
256+
- name: storage-accessmode
257+
value: "$(params.storage-accessmode)"
258+
taskSpec:
259+
workspaces:
260+
- name: ws
261+
params:
262+
- name: mas-instance-id
263+
- name: mas-workspace-id
264+
- name: mas-workspace-name
265+
- name: mas-catalog-version
266+
- name: mas-channel
267+
- name: uds-email
268+
- name: uds-firstname
269+
- name: uds-lastname
270+
- name: storage-rwo
271+
- name: storage-rwx
272+
- name: storage-pipeline
273+
- name: storage-accessmode
274+
steps:
275+
- name: run-mas-cli
276+
image: quay.io/ibmmas/cli:latest
277+
script: |
278+
#!/usr/bin/env bash
279+
# extract license id from license.dat
280+
export SLS_LICENSE_ID=$(cat $(workspaces.ws.path)/license.dat | head -1 | cut -d ' ' -f3)
281+
export SLS_LICENSE_FILE=$(workspaces.ws.path)/license.dat
282+
283+
export IBM_ENTITLEMENT_KEY=$(cat $(workspaces.ws.path)/ek.dat)
284+
285+
export MAS_INSTANCE_ID=$(params.mas-instance-id)
286+
287+
export MAS_CONFIG_DIR=$(workspaces.ws.path)/masconfig
288+
export MAS_MANUAL_CERT_MGMT=True
289+
290+
export UDS_CONTACT_EMAIL=$(params.uds-email)
291+
export UDS_CONTACT_FIRSTNAME=$(params.uds-firstname)
292+
export UDS_CONTACT_LASTNAME=$(params.uds-lastname)
293+
294+
export MAS_WORKSPACE_ID=$(params.mas-workspace-id)
295+
export MAS_WORKSPACE_NAME=$(params.mas-workspace-name)
296+
297+
ansible-playbook ibm.mas_devops.oneclick_core

‎8.11.x/pipeline-run-masdevops.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: tekton.dev/v1beta1
3+
kind: PipelineRun
4+
metadata:
5+
generateName: pr-mas-devops-
6+
spec:
7+
params:
8+
- name: uds-email
9+
value: "dev-techzone@ibm.com"
10+
- name: uds-firstname
11+
value: "TechZone"
12+
- name: uds-lastname
13+
value: "Developer"
14+
workspaces:
15+
- name: ws
16+
volumeClaimTemplate:
17+
spec:
18+
accessModes:
19+
- ReadWriteMany
20+
resources:
21+
requests:
22+
storage: 1Gi
23+
pipelineRef:
24+
name: mas-masdevops-deploy
25+
podTemplate:
26+
securityContext:
27+
fsGroup: 65532

‎8.11.x/pipeline.yaml‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -206,18 +206,19 @@ spec:
206206
- name: ws
207207
steps:
208208
- name: get-tls-certs
209-
image: quay.io/openshift/origin-cli:4.12
209+
image: quay.io/congxdev/ibm-pak-ubi:latest
210210
script: |
211-
mkdir -p $(workspaces.ws.path)/masconfig/certs
212-
wget -qO - https://letsencrypt.org/certs/lets-encrypt-r3.pem > $(workspaces.ws.path)/masconfig/certs/ca.crt
213-
oc get secret letsencrypt-certs -n openshift-config -o jsonpath="{.data['tls\.key']}" | base64 -d > $(workspaces.ws.path)/masconfig/certs/tls.key
214-
oc get secret letsencrypt-certs -n openshift-config -o jsonpath="{.data['tls\.crt']}" | base64 -d > $(workspaces.ws.path)/masconfig/certs/tls.crt
215-
echo "certs downloaded to masconfig"
216-
ls $(workspaces.ws.path)/masconfig/certs/
217-
echo "tls.key:"
218-
cat $(workspaces.ws.path)/masconfig/certs/tls.key
219-
echo "tls.crt:"
220-
cat $(workspaces.ws.path)/masconfig/certs/tls.crt
211+
### this is the method to load certs to the mas installer
212+
#mkdir -p $(workspaces.ws.path)/masconfig/certs
213+
#wget -qO - https://letsencrypt.org/certs/lets-encrypt-r3.pem > $(workspaces.ws.path)/masconfig/certs/ca.crt
214+
#oc get secret letsencrypt-certs -n openshift-config -o jsonpath="{.data['tls\.key']}" | base64 -d > $(workspaces.ws.path)/masconfig/certs/tls.key
215+
#oc get secret letsencrypt-certs -n openshift-config -o jsonpath="{.data['tls\.crt']}" | base64 -d > $(workspaces.ws.path)/masconfig/certs/tls.crt
216+
#ls $(workspaces.ws.path)/masconfig/certs/
217+
#cat $(workspaces.ws.path)/masconfig/certs/tls.key
218+
#cat $(workspaces.ws.path)/masconfig/certs/tls.crt
219+
220+
# copy letsencrypt-certs secret to the name where maximo is expecting to find it.
221+
oc get secret letsencrypt-certs -n openshift-ingress -o yaml | yq '.metadata["name"]="router-certs-default"' | oc apply -n openshift-ingress -f -
221222
- name: install-mas
222223
retries: 2
223224
runAfter:
@@ -276,10 +277,10 @@ spec:
276277
277278
export ENTITLEMENT_KEY=$(cat $(workspaces.ws.path)/ek.dat)
278279
279-
#this sets things up for manual cert management
280+
#possible setup for manual cert management
280281
# got this via https://github.com/ibm-mas/ansible-devops/pull/501
281-
export MAS_CONFIG_DIR=$(workspaces.ws.path)/masconfig
282-
export MAS_MANUAL_CERT_MGMT=True
282+
#export MAS_CONFIG_DIR=$(workspaces.ws.path)/masconfig
283+
#export MAS_MANUAL_CERT_MGMT=True
283284
284285
#run mas install non-interactively
285286
mas install -i $(params.mas-instance-id) \

0 commit comments

Comments
 (0)