Page History

#!/bin/bash

VERSION="grouper-v0.1.5"

# IMPORTANT !!!!!!!!!!!!!!!!!!!!!!!!!!
# uncomment the line below for the environment you're building for and the proper tag will be applied
# defaults to dev

ENVIRONMENT="comanage-dev-host-configs"
#ENVIRONMENT="comanage-staging-host-configs"
#ENVIRONMENT="comanage-prod-host-configs"

CONFIG="s3url=s3://$ENVIRONMENT"

SHORTENV=$(echo $ENVIRONMENT | cut -f 2 -d '-')
DOCKERENV="SHORTENV=$SHORTENV"


docker build --no-cache --pull --build-arg $CONFIG --build-arg $DOCKERENV -t grouper.at.internet2.edu:${VERSION}-$SHORTENV .
if [ "$?" -ne "0" ]
then
  echo "# Build failed"
  exit
fi

docker tag grouper.at.internet2.edu:${VERSION}-$SHORTENV 992649280435.dkr.ecr.us-east-2.amazonaws.com/grouper.at.internet2.edu:${VERSION}-$SHORTENV
if [ "$?" -ne "0" ]
then
  echo "# Tag failed"
  exit
fi

`aws ecr get-login --no-include-email --region us-east-2`
if [ "$?" -eq "0" ]
then
  docker push 992649280435.dkr.ecr.us-east-2.amazonaws.com/grouper.at.internet2.edu:${VERSION}-$SHORTENV
else
  echo "# Login to AWS Docker repo failed. If running on an EC2 instance with an IAM role, ensure it has"
  echo "# the right policy attached to it. "
  echo "# To see the IAM Role, issue the following command:"
  echo "curl http://169.254.169.254/latest/meta-data/iam/info"
  echo "# If not using an IAM instance role, make sure the ~/.aws/credential is file configured correctly."
fi

import groovy.json.JsonSlurperClassic
// IMPORTANT: to be able to determine the right S3 bucket to pull the config from (dev, staging or prod)
// The branch name MUST end with either -dev, -staging, or -prod

pipeline {
    agent {
        // This is important, it tells Jenkins what worker nodes to use
        // Nodes with this label have an IAM role that is allowed to assume a role
        // in the ICP account that has a very stripped down IAM policy
        label 'icp_ops'
    }
    environment {
        // AWS Docker Repo for Collab Platform
        maintainer = "************.dkr.ecr.us-east-2.amazonaws.com"
        // name of container, uses the FQDN of the collab host
        imagename = "${env.JOB_NAME.tokenize('/')[1]}"
        // tag, should be based on branch and is defined in the build stage below
        tag = ""
        // environment, used to determine which S3 bucket to pull configuration from
        // e.g. dev is s3://****-dev-host-configs, staging is s3://****-staging-host-configs
        // prod is s3://****-prod-host-configs
        shortenv = env.BRANCH_NAME.substring(env.BRANCH_NAME.lastIndexOf("-") + 1, env.BRANCH_NAME.length())        
        // temp variable which will be replaced soon
        s3url = "s3://****-${shortenv}-host-configs"
        // The role to assume that is allowed to push to the ICP AWS Docker repo and read s3 bucket
        role_to_assume = "arn:aws:iam::************:role/ti-prod-jenkins"
        // Not super important, just a session name to associate with assuming role, value doesn't seem to matter
        role_session_name = "***-ops"
        // placeholder for AWS credentials that will be populated when the sts-assume-role
        // command is issued. This uses the IAM role of the running Jenkins, currently "jenkins-agent-icp-ops"
        // in AWS account ************* (also known as TI Prod)
        // This role is able to assume the role "ti-prod-jenkins" in account ************ 
        AWS_ACCESS_KEY_ID = ""
        AWS_SECRET_ACCESS_KEY = ""
        AWS_SESSION_TOKEN = ""
        region = "us-east-2"
    }
    stages {
        stage('Setting build context') {
            steps {
                script {
                    if (env.BRANCH_NAME == "master") {
                        tag = "latest-test"
                    } else {
                        tag = env.BRANCH_NAME
                    }
                    sh 'mkdir -p tmp && mkdir -p bin'
                    dir('tmp') {
                        git([url: "https://github.internet2.edu/docker/util.git", credentialsId: "jenkins-github-access-token"])
                        sh 'rm -rf ../bin/*'
                        sh 'mv ./bin/* ../bin/.'
                    }
                }
            }
        }
        stage('Clean') {
            steps {
                script {
                    try {
                        sh 'bin/destroy.sh >> debug'
                    } catch (error) {
                        def error_details = readFile('./debug');
                        def message = "BUILD ERROR: There was a problem building the Base Image. \n\n ${error_details}"
                        sh "rm -f ./debug"
                        handleError(message)
                    }
                }
            }
        }
        stage('Build') {
            steps {
                script {
                    // This will return a JSON object with credentials that can be parsed and used to carry out the AWS
                    // operations needed to build and push the container to the Collab AWS account
                    def stsjson= sh (
                        script: "aws sts assume-role --role-arn ${role_to_assume}  --role-session-name ${role_session_name}",
                      returnStdout: true
                      ).trim()
                    def ststoken = new JsonSlurperClassic().parseText(stsjson)
                    AWS_ACCESS_KEY_ID = "${ststoken.Credentials.AccessKeyId}"
                    // print "access key = ${AWS_ACCESS_KEY_ID}"
                    AWS_SECRET_ACCESS_KEY = "${ststoken.Credentials.SecretAccessKey}"
                    // print "secret key = ${AWS_SECRET_ACCESS_KEY}"
                    AWS_SESSION_TOKEN = "${ststoken.Credentials.SessionToken}"
                    // print "session token = ${AWS_SESSION_TOKEN}"
                    try {
                        docker.withRegistry("${maintainer}/${imagename}") {
                            try {
                                baseImg = docker.build("${imagename}", "--no-cache --build-arg AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --build-arg AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} --build-arg AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} --build-arg s3url=${s3url} --build-arg ENVIRON=${shortenv} .")
                            } catch (error) {
                                handleError(error)
                            }
                        }
                     } catch (error) {
                          handleError(error)
                     }
                }
            }
        }
        stage('Test') {
            steps {
                script {
                    try {
                        echo "need to create tests"
                        //sh 'bin/test.sh 2>&1 | tee debug ; test ${PIPESTATUS[0]} -eq 0'
                    } catch (error) {
                        handleError(message)
                    }
                }
            }
        }

        stage('Push') {
            steps {
                script {
                    withEnv(["AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}", "AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}", "AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}"  ]) {   
                        def ecrlogincmd= sh (
                            script: "aws ecr get-login --no-include-email --region ${region}",
                          returnStdout: true
                        ).trim()
     
                        sh "${ecrlogincmd}"
                        docker.withRegistry("https://${maintainer}") {
                            baseImg.push("${tag}")
                        }
                     }
                }
            }
        }
        stage('Notify') {
            steps {
                echo "${imagename}:${tag} pushed to ${maintainer}"
                slackSend color: "good", message: "${maintainer}/${imagename}:${tag} pushed to ECR"
            }
        }
    }
    post {
        always {
            echo "Done Building."
        }
        failure {
            slackSend color: "good", message: "Build failed"
            handleError("BUILD ERROR: There was a problem building ${maintainer}/${imagename}:${tag}.")
        }
    }
}


def handleError(String message) {
    echo "${message}"
    currentBuild.setResult("FAILED")
    slackSend color: "danger", message: "${message}"
    //step([$class: 'Mailer', notifyEveryUnstableBuild: true, recipients: 'chubing@internet2.edu', sendToIndividuals: true])
    sh 'exit 1'
}

ServerName https://grouper.at.internet2.edu:443
UseCanonicalName On

RemoteIPHeader X-Forwarded-For

RewriteEngine On
RewriteCond %{X-Forwarded-Proto}i http
RewriteRule ^ https://%{HTTP_HOST}:443%{REQUEST_URI} [R=302,L,QSA]

RewriteEngine on
RewriteRule   "^/$"  "/grouper/"  [R]

# log the X-Forwarded-For (the real client IP) header if present
LogFormat "httpd;access_log;%{ENV}e;%{USERTOKEN}e;%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
CustomLog "/tmp/logpipe" combined env=!forwarded
CustomLog "/tmp/logpipe" proxy env=forwarded

ErrorLogFormat "httpd;error_log;%{ENV}e;%{USERTOKEN}e;[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"