.gitlab-ci.yml

stages:
  - test
  - review_build
  - review
  - build
  - staging
  - production

# Our custom image: https://github.com/zoltan-nz/python-with-gcloud
image: zoltannz/python-with-gcloud:latest

services:
  - docker:dind

cache:
  paths:
    - .cache/pip
    - .cache/pipenv
    - .venv/

# Find more about CI prefixed variables here: https://docs.gitlab.com/ee/ci/variables/#syntax-of-environment-variables-in-job-scripts
# CI_COMMIT_REF_NAME is injected by the GitLab Runner and contains the actual branch name.
# CI_COMMIT_REF_SLUG is injected by the GitLab Runner and contains the optimized version of REF_NAME.
# Expected env variables. They have to be manually setup in GitLab > Settings > CI/CD > Variables:
# - GC_SERVICE_ACCOUNT_KEY - Google Cloud account key in json format. Setup it in GitLab environment.
# - GC_PROJECT_ID
# - GC_CLUSTER_NAME
# - GC_ZONE
# - GC_BASE_DOMAIN
# - GC_EXAMPLE_SECRET
variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  PIPENV_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pipenv"
  PIPENV_VENV_IN_PROJECT: "true"
  LANG: "en_NZ.UTF-8"
  LC_ALL: "en_NZ.UTF-8"
  FLASK_APP: "my_hello_world_app"
  FLASK_ENV: "production"
  DEBUG: "false"
  # APP_NAME is used as docker image name
  APP_NAME: "my-hello-world-app"

  # Please note job level variables get precedence over global variables
  # Setup KUBE_NAMESPACE in job, e.g. KUBE_NAMESPACE: my-hello-world-app-review
  KUBE_APP_NAME: $APP_NAME
  KUBE_SERVICE_NAME: $KUBE_NAMESPACE-service
  KUBE_INGRESS_NAME: $KUBE_NAMESPACE-ingress
  KUBE_CONTAINER_PORT: "8080"
  KUBE_SERVICE_EXTERNAL_PORT: "9090"
  KUBE_IMAGE_PULL_POLICY: "Always"

  # Note that if you're using the Kubernetes executor, the variable should be set to
  # tcp://localhost:2375/ because of how the Kubernetes executor connects services
  # to the job container
  DOCKER_HOST: tcp://localhost:2375

  # For non-Kubernetes executors, we use tcp://docker:2375/
  # DOCKER_HOST: tcp://docker:2375

  # When using dind (docker in docker), it is wise to use the overlayfs driver for
  # improved performance.
  DOCKER_DRIVER: overlay2

  # The usage of docker:dind works only if TLS is disabled
  DOCKER_TLS_CERTDIR: ""


.pipenv_setup: &pipenv_setup
  before_script:
    - export SUBDOMAIN=$CI_BUILD_REF_SLUG
    - export KUBE_DEPLOYMENT_NAME=$KUBE_NAMESPACE-$SUBDOMAIN-deployment
    - export KUBE_PUBLIC_APP_DOMAIN=$SUBDOMAIN.$GC_BASE_DOMAIN
    - export CI_COMMIT_SHORT_SHA=$(git rev-parse --short HEAD)
    - export DOCKER_IMAGE_TAG=$CI_COMMIT_SHORT_SHA
    - export DOCKER_IMAGE=gcr.io/$GC_PROJECT_ID/$APP_NAME:$DOCKER_IMAGE_TAG
    - export KUBE_IMAGE_NAME=$DOCKER_IMAGE
    - python -V
    - pip install pipenv
    - pipenv run setup
    - pipenv run lint

test:
  <<: *pipenv_setup
  stage: test
  script:
    - pipenv run test
    - pipenv run cov-report

.auth: &auth
  image: zoltannz/python-with-gcloud
  services:
    - docker:dind
  before_script:
    - export SUBDOMAIN=$CI_BUILD_REF_SLUG
    - export KUBE_DEPLOYMENT_NAME=$KUBE_NAMESPACE-$SUBDOMAIN-deployment
    - export KUBE_PUBLIC_APP_DOMAIN=$SUBDOMAIN.$GC_BASE_DOMAIN
    - export CI_COMMIT_SHORT_SHA=$(git rev-parse --short HEAD)
    - export DOCKER_IMAGE_TAG=$CI_COMMIT_SHORT_SHA
    - export DOCKER_IMAGE=gcr.io/$GC_PROJECT_ID/$APP_NAME:$DOCKER_IMAGE_TAG
    - export KUBE_IMAGE_NAME=$DOCKER_IMAGE
    - export KUBE_EXAMPLE_SECRET_NAME=example-secret
    - export KUBE_EXAMPLE_SECRET=$(echo $GC_EXAMPLE_SECRET | base64 -w 0)
    - echo $GC_SERVICE_ACCOUNT_KEY > /tmp/gc-service-account-key.json
    - gcloud auth activate-service-account --key-file /tmp/gc-service-account-key.json
    - gcloud config set project $GC_PROJECT_ID
    - gcloud container clusters get-credentials $GC_CLUSTER_NAME --zone $GC_ZONE
    - gcloud auth configure-docker --quiet
  after_script:
    - rm /tmp/gc-service-account-key.json
    - rm -rf ~/.kube

.build_image: &build_image
  script:
    - pipenv run build
    - cat /tmp/gc-service-account-key.json | docker login -u _json_key --password-stdin https://gcr.io
    - docker build --build-arg docker_image_tag=$DOCKER_IMAGE_TAG -t $DOCKER_IMAGE .
    - docker push $DOCKER_IMAGE

review_build:
  <<: *auth
  <<: *build_image
  stage: review_build
  only:
    - branches
  except:
    - master

review_deploy:
  <<: *auth
  variables:
    KUBE_NAMESPACE: my-hello-world-app-preview
  stage: review
  script:
    - envsubst < ./kubernetes/namespace.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/secret.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/deployment.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/service.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/ingress.yaml | kubectl apply -f -
    - echo "Review url:" $KUBE_PUBLIC_APP_DOMAIN
  allow_failure: true
  environment:
    name: review/$CI_BUILD_REF_SLUG
    url: http://$CI_BUILD_REF_SLUG.$GC_BASE_DOMAIN
    on_stop: review_clean
  only:
    - branches
  except:
    - master

review_clean:
  <<: *auth
  variables:
    KUBE_NAMESPACE: my-hello-world-app-preview
  stage: review
  script:
    - envsubst < ./kubernetes/ingress.yaml | kubectl delete -f -
    - envsubst < ./kubernetes/service.yaml | kubectl delete -f -
    - envsubst < ./kubernetes/deployment.yaml | kubectl delete -f -
    - envsubst < ./kubernetes/secret.yaml | kubectl delete -f -
    - envsubst < ./kubernetes/namespace.yaml | kubectl delete -f -
    - gcloud container images delete ${DOCKER_IMAGE} --force-delete-tags --quiet
  allow_failure: true
  when: manual
  environment:
    name: review/$CI_BUILD_REF_SLUG
    action: stop
  only:
    - branches
  except:
    - master

build:
  <<: *auth
  <<: *build_image
  stage: build
  only:
    - master

staging_deploy:
  <<: *auth
  stage: staging
  variables:
    KUBE_NAMESPACE: my-hello-world-app-staging
    KUBE_DEPLOYMENT_NAME: $KUBE_NAMESPACE-staging-deployment
    KUBE_SERVICE_NAME: $KUBE_NAMESPACE-staging-service
  script:
    - export KUBE_PUBLIC_APP_DOMAIN=staging.$GC_BASE_DOMAIN
    - envsubst < ./kubernetes/namespace.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/secret.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/deployment.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/service.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/ingress.yaml | kubectl apply -f -
    - echo "Staging url:" $KUBE_PUBLIC_APP_DOMAIN
  environment:
    name: staging
    url: http://staging.$GC_BASE_DOMAIN
    on_stop: staging_clean
  only:
    - master

staging_clean:
  <<: *auth
  stage: staging
  variables:
    KUBE_NAMESPACE: my-hello-world-app-staging
    KUBE_DEPLOYMENT_NAME: $KUBE_NAMESPACE-staging-deployment
    KUBE_SERVICE_NAME: $KUBE_NAMESPACE-staging-service
  script:
    - export KUBE_PUBLIC_APP_DOMAIN=staging.$GC_BASE_DOMAIN
    - envsubst < ./kubernetes/ingress.yaml | kubectl delete -f -
    - envsubst < ./kubernetes/service.yaml | kubectl delete -f -
    - envsubst < ./kubernetes/deployment.yaml | kubectl delete -f -
    - envsubst < ./kubernetes/secret.yaml | kubectl delete -f -
  allow_failure: true
  when: manual
  environment:
    name: staging
    action: stop
  only:
    - master

production:
  <<: *auth
  stage: production
  variables:
    KUBE_NAMESPACE: my-hello-world-app-production
    KUBE_DEPLOYMENT_NAME: $KUBE_NAMESPACE-production-deployment
    KUBE_SERVICE_NAME: $KUBE_NAMESPACE-production-service
  script:
    - export KUBE_PUBLIC_APP_DOMAIN=$GC_BASE_DOMAIN
    - envsubst < ./kubernetes/namespace.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/secret.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/deployment.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/service.yaml | kubectl apply -f -
    - envsubst < ./kubernetes/ingress.yaml | kubectl apply -f -
    - echo "Production url:" $KUBE_PUBLIC_APP_DOMAIN
  when: manual
  environment:
    name: production
    url: http://$GC_BASE_DOMAIN
  only:
    - master