From 1e9ad36cb7dd43ed06261fe8a0b5592c1ea9f41b Mon Sep 17 00:00:00 2001 From: James Hochadel Date: Thu, 19 Sep 2024 17:09:43 -0400 Subject: [PATCH 1/2] Format pipeline with prettier --- ci/pipeline.yml | 2028 ++++++++++++++++++++++++----------------------- 1 file changed, 1017 insertions(+), 1011 deletions(-) diff --git a/ci/pipeline.yml b/ci/pipeline.yml index 9eb7f30f..9f18b674 100644 --- a/ci/pipeline.yml +++ b/ci/pipeline.yml @@ -5,1070 +5,1076 @@ meta: region_name: ((aws-region)) private: true groups: -- name: all - jobs: - - deploy-master-bosh - - deploy-tooling-bosh - - deploy-development-bosh - - deploy-staging-bosh - - deploy-production-bosh - - common-releases-master - - common-releases-tooling - - common-releases-development - - common-releases-staging - - common-releases-production -- name: bosh - jobs: - - deploy-master-bosh - - deploy-tooling-bosh - - deploy-development-bosh - - deploy-staging-bosh - - deploy-production-bosh -- name: releases - jobs: - - common-releases-master - - common-releases-tooling - - common-releases-development - - common-releases-staging - - common-releases-production + - name: all + jobs: + - deploy-master-bosh + - deploy-tooling-bosh + - deploy-development-bosh + - deploy-staging-bosh + - deploy-production-bosh + - common-releases-master + - common-releases-tooling + - common-releases-development + - common-releases-staging + - common-releases-production + - name: bosh + jobs: + - deploy-master-bosh + - deploy-tooling-bosh + - deploy-development-bosh + - deploy-staging-bosh + - deploy-production-bosh + - name: releases + jobs: + - common-releases-master + - common-releases-tooling + - common-releases-development + - common-releases-staging + - common-releases-production jobs: -- name: deploy-master-bosh - serial: true - plan: - - in_parallel: - - get: bosh-deployment - trigger: true - - get: bosh-config-old - resource: bosh-create-env-config - trigger: true - - get: bosh-config - resource: bosh-create-env-config - trigger: true - - get: common - trigger: true - resource: common-master - - get: terraform-yaml - trigger: true - resource: terraform-yaml-tooling - - get: bosh-state - resource: masterbosh-state - - get: bosh-creds - resource: masterbosh-creds - - get: ca-cert-store - trigger: true - - get: nessus-agent-release - resource: cg-s3-nessus-agent-release - trigger: true - - get: general-task - - put: stemcell-lock-pool - params: - claim: updating-stemcells - - task: terraform-secrets - image: general-task - file: bosh-config/ci/terraform-secrets.yml - params: - VARS_FILE: terraform-master.yml - - task: bosh-create-env - image: general-task - file: bosh-config/bosh-create-env.yml - tags: [iaas] - params: - COMMON_FILE: common/master-bosh.yml - BOSH_NAME: master - vars: - nessus_agent_release_url: nessus-agent-release:url - - task: update-cloud-config - image: general-task - file: bosh-config/ci/update-cloud-config.yml - params: - OPS_PATHS: "bosh-config/cloud-config/master.yml" - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((masterbosh-target)) - BOSH_CLIENT: admin - BOSH_CLIENT_SECRET: ((master_bosh_admin_password)) - ensure: - do: - - put: masterbosh-state - params: - file: updated-bosh-state/*.json - - put: masterbosh-creds + - name: deploy-master-bosh + serial: true + plan: + - in_parallel: + - get: bosh-deployment + trigger: true + - get: bosh-config-old + resource: bosh-create-env-config + trigger: true + - get: bosh-config + resource: bosh-create-env-config + trigger: true + - get: common + trigger: true + resource: common-master + - get: terraform-yaml + trigger: true + resource: terraform-yaml-tooling + - get: bosh-state + resource: masterbosh-state + - get: bosh-creds + resource: masterbosh-creds + - get: ca-cert-store + trigger: true + - get: nessus-agent-release + resource: cg-s3-nessus-agent-release + trigger: true + - get: general-task + - put: stemcell-lock-pool + params: + claim: updating-stemcells + - task: terraform-secrets + image: general-task + file: bosh-config/ci/terraform-secrets.yml + params: + VARS_FILE: terraform-master.yml + - task: bosh-create-env + image: general-task + file: bosh-config/bosh-create-env.yml + tags: [iaas] + params: + COMMON_FILE: common/master-bosh.yml + BOSH_NAME: master + vars: + nessus_agent_release_url: nessus-agent-release:url + - task: update-cloud-config + image: general-task + file: bosh-config/ci/update-cloud-config.yml + params: + OPS_PATHS: "bosh-config/cloud-config/master.yml" + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((masterbosh-target)) + BOSH_CLIENT: admin + BOSH_CLIENT_SECRET: ((master_bosh_admin_password)) + ensure: + do: + - put: masterbosh-state + params: + file: updated-bosh-state/*.json + - put: masterbosh-creds + params: + file: updated-bosh-creds/*.yml + - put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_failure: + put: slack params: - file: updated-bosh-creds/*.yml - - put: stemcell-lock-pool + text: | + :x: FAILED to deploy Master BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + on_success: + put: slack params: - release: stemcell-lock-pool - on_failure: - put: slack - params: - text: | - :x: FAILED to deploy Master BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform' - username: ((slack-username)) - icon_url: ((slack-icon-url)) - on_success: - put: slack - params: - text: | - :white_check_mark: Successfully deployed Master BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform-news' - username: ((slack-username)) - icon_url: ((slack-icon-url)) + text: | + :white_check_mark: Successfully deployed Master BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) -- name: common-releases-master - serial: true - plan: - - in_parallel: - - get: certificate - resource: ca-cert-store - - get: bosh-deployment - passed: - - deploy-master-bosh - trigger: true - - get: bosh-config - trigger: true - - get: terraform-yaml - resource: terraform-yaml-production - trigger: true - - get: common-master - trigger: true - - get: cg-s3-fisma-jammy-release - trigger: true - - get: cg-s3-awslogs-jammy-release - trigger: true - - get: cg-s3-nessus-agent-release - trigger: true - - get: cg-s3-clamav-release - trigger: true - - get: cg-s3-jammy-snort-release - trigger: true - - get: aide-release - trigger: true - - get: cron-release - trigger: true - - get: syslog-release - trigger: true - - get: node-exporter-release - trigger: true - - get: masterbosh-state - passed: [deploy-master-bosh] - - get: general-task - - task: upload-releases - config: &upload-releases-config - platform: linux - image_resource: - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: general-task - aws_region: us-gov-west-1 - tag: latest - inputs: - - {name: certificate} - - {name: cg-s3-fisma-jammy-release, path: releases/fisma-jammy} - - {name: cg-s3-awslogs-jammy-release, path: releases/awslogs-jammy} - - {name: cg-s3-nessus-agent-release, path: releases/nessus-agent} - - {name: cg-s3-clamav-release, path: releases/clamav} - - {name: cg-s3-jammy-snort-release, path: releases/jammy-snort} - - {name: aide-release, path: releases/aide} - - {name: cron-release, path: releases/cron} - - {name: node-exporter-release, path: releases/node-exporter} - - {name: syslog-release, path: releases/syslog} + - name: common-releases-master + serial: true + plan: + - in_parallel: + - get: certificate + resource: ca-cert-store + - get: bosh-deployment + passed: + - deploy-master-bosh + trigger: true + - get: bosh-config + trigger: true + - get: terraform-yaml + resource: terraform-yaml-production + trigger: true + - get: common-master + trigger: true + - get: cg-s3-fisma-jammy-release + trigger: true + - get: cg-s3-awslogs-jammy-release + trigger: true + - get: cg-s3-nessus-agent-release + trigger: true + - get: cg-s3-clamav-release + trigger: true + - get: cg-s3-jammy-snort-release + trigger: true + - get: aide-release + trigger: true + - get: cron-release + trigger: true + - get: syslog-release + trigger: true + - get: node-exporter-release + trigger: true + - get: masterbosh-state + passed: [deploy-master-bosh] + - get: general-task + - task: upload-releases + config: &upload-releases-config + platform: linux + image_resource: + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: general-task + aws_region: us-gov-west-1 + tag: latest + inputs: + - { name: certificate } + - { name: cg-s3-fisma-jammy-release, path: releases/fisma-jammy } + - { + name: cg-s3-awslogs-jammy-release, + path: releases/awslogs-jammy, + } + - { name: cg-s3-nessus-agent-release, path: releases/nessus-agent } + - { name: cg-s3-clamav-release, path: releases/clamav } + - { name: cg-s3-jammy-snort-release, path: releases/jammy-snort } + - { name: aide-release, path: releases/aide } + - { name: cron-release, path: releases/cron } + - { name: node-exporter-release, path: releases/node-exporter } + - { name: syslog-release, path: releases/syslog } + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_CLIENT: admin + BOSH_CLIENT_SECRET: ((master_bosh_admin_password)) + BOSH_ENVIRONMENT: ((masterbosh-target)) + run: + path: sh + args: + - -exc + - | + for release in releases/**/*.tgz; do + bosh upload-release "${release}" + done + bosh -n clean-up + - task: update-runtime-config + image: general-task + file: bosh-config/ci/update-runtime-config.yml + input_mapping: + common: common-master + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((masterbosh-target)) + BOSH_CLIENT: admin + BOSH_CLIENT_SECRET: ((master_bosh_admin_password)) + BOSH_ENV_NAME: master + + - name: deploy-tooling-bosh + serial: true + plan: + - in_parallel: + - get: ca-cert-store + trigger: true + - get: bosh-deployment + trigger: true + passed: + - deploy-master-bosh + - get: bosh-config + trigger: true + passed: + - common-releases-master + - get: bosh-stemcell-jammy + trigger: true + - get: terraform-yaml + trigger: true + resource: terraform-yaml-tooling + - get: terraform-yaml-development + trigger: true + - get: terraform-yaml-staging + trigger: true + - get: terraform-yaml-production + trigger: true + - get: toolbelt-release + - get: general-task + - task: terraform-secrets + image: general-task + file: bosh-config/ci/terraform-secrets.yml + - put: toolingbosh-deployment + params: &bosh-deployment + manifest: bosh-deployment/bosh.yml + stemcells: + - bosh-stemcell-jammy/*.tgz + ops_files: + - bosh-deployment/uaa.yml + - bosh-deployment/credhub.yml + - bosh-deployment/aws/cpi.yml + - bosh-deployment/aws/iam-instance-profile.yml + - bosh-deployment/misc/source-releases/bosh.yml + - bosh-deployment/misc/source-releases/uaa.yml + - bosh-deployment/misc/source-releases/credhub.yml + - bosh-deployment/aws/s3-blobstore-instance-profile.yml + - bosh-config/operations/name.yml + - bosh-config/operations/s3-blobstore.yml + - bosh-config/operations/external-db.yml + - bosh-config/operations/uaa-clients.yml + - bosh-config/operations/cloud-config.yml + - bosh-config/operations/update.yml + - bosh-config/operations/cron.yml + - bosh-config/operations/cpi.yml + - bosh-config/operations/dns.yml + - bosh-config/operations/nist-ntp.yml + - bosh-config/operations/add-new-saml-key.yml + - bosh-config/operations/add-cloud-gov-root-certificate.yml + - bosh-config/operations/nats-payload.yml + vars_files: + - bosh-config/variables/tooling.yml + - terraform-secrets/terraform.yml + - terraform-yaml/state.yml + releases: + - toolbelt-release/*.tgz + - task: update-cloud-config + image: general-task + file: bosh-config/ci/update-cloud-config-tooling.yml + params: + OPS_PATHS: "bosh-config/cloud-config/tooling.yml" + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((toolingbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) + on_failure: + put: slack + params: + text: | + :x: FAILED to deploy Tooling BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + on_success: + put: slack params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_CLIENT: admin - BOSH_CLIENT_SECRET: ((master_bosh_admin_password)) - BOSH_ENVIRONMENT: ((masterbosh-target)) - run: - path: sh - args: - - -exc - - | - for release in releases/**/*.tgz; do - bosh upload-release "${release}" - done - bosh -n clean-up - - task: update-runtime-config - image: general-task - file: bosh-config/ci/update-runtime-config.yml - input_mapping: - common: common-master - params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((masterbosh-target)) - BOSH_CLIENT: admin - BOSH_CLIENT_SECRET: ((master_bosh_admin_password)) - BOSH_ENV_NAME: master + text: | + :white_check_mark: Successfully deployed Tooling BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) -- name: deploy-tooling-bosh - serial: true - plan: - - in_parallel: - - get: ca-cert-store - trigger: true - - get: bosh-deployment - trigger: true - passed: - - deploy-master-bosh - - get: bosh-config - trigger: true - passed: - - common-releases-master - - get: bosh-stemcell-jammy - trigger: true - - get: terraform-yaml - trigger: true - resource: terraform-yaml-tooling - - get: terraform-yaml-development - trigger: true - - get: terraform-yaml-staging - trigger: true - - get: terraform-yaml-production - trigger: true - - get: toolbelt-release - - get: general-task - - task: terraform-secrets - image: general-task - file: bosh-config/ci/terraform-secrets.yml - - put: toolingbosh-deployment - params: &bosh-deployment - manifest: bosh-deployment/bosh.yml - stemcells: - - bosh-stemcell-jammy/*.tgz - ops_files: - - bosh-deployment/uaa.yml - - bosh-deployment/credhub.yml - - bosh-deployment/aws/cpi.yml - - bosh-deployment/aws/iam-instance-profile.yml - - bosh-deployment/misc/source-releases/bosh.yml - - bosh-deployment/misc/source-releases/uaa.yml - - bosh-deployment/misc/source-releases/credhub.yml - - bosh-deployment/aws/s3-blobstore-instance-profile.yml - - bosh-config/operations/name.yml - - bosh-config/operations/s3-blobstore.yml - - bosh-config/operations/external-db.yml - - bosh-config/operations/uaa-clients.yml - - bosh-config/operations/cloud-config.yml - - bosh-config/operations/update.yml - - bosh-config/operations/cron.yml - - bosh-config/operations/cpi.yml - - bosh-config/operations/dns.yml - - bosh-config/operations/nist-ntp.yml - - bosh-config/operations/add-new-saml-key.yml - - bosh-config/operations/add-cloud-gov-root-certificate.yml - - bosh-config/operations/nats-payload.yml - vars_files: - - bosh-config/variables/tooling.yml - - terraform-secrets/terraform.yml - - terraform-yaml/state.yml - releases: - - toolbelt-release/*.tgz - - task: update-cloud-config - image: general-task - file: bosh-config/ci/update-cloud-config-tooling.yml - params: - OPS_PATHS: "bosh-config/cloud-config/tooling.yml" - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((toolingbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) - on_failure: - put: slack - params: - text: | - :x: FAILED to deploy Tooling BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform' - username: ((slack-username)) - icon_url: ((slack-icon-url)) - on_success: - put: slack - params: - text: | - :white_check_mark: Successfully deployed Tooling BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform-news' - username: ((slack-username)) - icon_url: ((slack-icon-url)) + - name: common-releases-tooling + serial: true + plan: + - in_parallel: + - get: certificate + resource: ca-cert-store + - get: bosh-deployment + trigger: true + - get: bosh-config + trigger: true + passed: + - deploy-tooling-bosh + - get: terraform-yaml + trigger: true + resource: terraform-yaml-production + - get: cg-s3-fisma-jammy-release + trigger: true + passed: + - common-releases-master + - get: cg-s3-awslogs-jammy-release + trigger: true + passed: + - common-releases-master + - get: cg-s3-nessus-agent-release + trigger: true + passed: + - common-releases-master + - get: cg-s3-clamav-release + trigger: true + passed: + - common-releases-master + - get: cg-s3-jammy-snort-release + trigger: true + passed: + - common-releases-master + - get: aide-release + trigger: true + passed: + - common-releases-master + - get: cron-release + trigger: true + passed: + - common-releases-master + - get: node-exporter-release + trigger: true + passed: + - common-releases-master + - get: syslog-release + trigger: true + passed: + - common-releases-master + - get: toolingbosh-deployment + trigger: true + passed: + - deploy-tooling-bosh + - get: general-task + - task: upload-releases + config: + <<: *upload-releases-config + inputs: + - { name: certificate } + - { name: cg-s3-fisma-jammy-release, path: releases/fisma-jammy } + - { + name: cg-s3-awslogs-jammy-release, + path: releases/awslogs-jammy, + } + - { name: cg-s3-nessus-agent-release, path: releases/nessus-agent } + - { name: cg-s3-clamav-release, path: releases/clamav } + - { name: cg-s3-jammy-snort-release, path: releases/jammy-snort } + - { name: aide-release, path: releases/aide } + - { name: cron-release, path: releases/cron } + - { name: node-exporter-release, path: releases/node-exporter } + - { name: syslog-release, path: releases/syslog } + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) + BOSH_ENVIRONMENT: ((toolingbosh-target)) + - task: update-runtime-config + image: general-task + file: bosh-config/ci/update-runtime-config.yml + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((toolingbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) + BOSH_ENV_NAME: tooling -- name: common-releases-tooling - serial: true - plan: - - in_parallel: - - get: certificate - resource: ca-cert-store - - get: bosh-deployment - trigger: true - - get: bosh-config - trigger: true - passed: - - deploy-tooling-bosh - - get: terraform-yaml - trigger: true - resource: terraform-yaml-production - - get: cg-s3-fisma-jammy-release - trigger: true - passed: - - common-releases-master - - get: cg-s3-awslogs-jammy-release - trigger: true - passed: - - common-releases-master - - get: cg-s3-nessus-agent-release - trigger: true - passed: - - common-releases-master - - get: cg-s3-clamav-release - trigger: true - passed: - - common-releases-master - - get: cg-s3-jammy-snort-release - trigger: true - passed: - - common-releases-master - - get: aide-release - trigger: true - passed: - - common-releases-master - - get: cron-release - trigger: true - passed: - - common-releases-master - - get: node-exporter-release - trigger: true - passed: - - common-releases-master - - get: syslog-release - trigger: true - passed: - - common-releases-master - - get: toolingbosh-deployment - trigger: true - passed: - - deploy-tooling-bosh - - get: general-task - - task: upload-releases - config: - <<: *upload-releases-config - inputs: - - {name: certificate} - - {name: cg-s3-fisma-jammy-release, path: releases/fisma-jammy} - - {name: cg-s3-awslogs-jammy-release, path: releases/awslogs-jammy} - - {name: cg-s3-nessus-agent-release, path: releases/nessus-agent} - - {name: cg-s3-clamav-release, path: releases/clamav} - - {name: cg-s3-jammy-snort-release, path: releases/jammy-snort} - - {name: aide-release, path: releases/aide} - - {name: cron-release, path: releases/cron} - - {name: node-exporter-release, path: releases/node-exporter} - - {name: syslog-release, path: releases/syslog} + - name: deploy-development-bosh + serial: true + plan: + - in_parallel: + - get: ca-cert-store + trigger: true + - get: bosh-deployment + trigger: true + passed: + - deploy-tooling-bosh + - get: bosh-config + trigger: true + passed: + - common-releases-tooling + - get: bosh-stemcell-jammy + trigger: true + passed: + - deploy-tooling-bosh + - get: terraform-yaml + trigger: true + resource: terraform-yaml-development + - get: toolbelt-release + passed: + - deploy-tooling-bosh + - get: general-task + - task: terraform-secrets + image: general-task + file: bosh-config/ci/terraform-secrets.yml + - put: developmentbosh-deployment + params: + <<: *bosh-deployment + vars_files: + - bosh-config/variables/development.yml + - terraform-secrets/terraform.yml + - terraform-yaml/state.yml + - task: update-cloud-config + image: general-task + file: bosh-config/ci/update-cloud-config.yml + params: + OPS_PATHS: "bosh-config/cloud-config/main.yml bosh-config/cloud-config/cf.yml bosh-config/cloud-config/development.yml" + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((developmentbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) + on_failure: + put: slack params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) - BOSH_ENVIRONMENT: ((toolingbosh-target)) - - task: update-runtime-config - image: general-task - file: bosh-config/ci/update-runtime-config.yml - params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((toolingbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) - BOSH_ENV_NAME: tooling + text: | + :x: FAILED to deploy development BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + on_success: + put: slack + params: + text: | + :white_check_mark: Successfully deployed development BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) -- name: deploy-development-bosh - serial: true - plan: - - in_parallel: - - get: ca-cert-store - trigger: true - - get: bosh-deployment - trigger: true - passed: - - deploy-tooling-bosh - - get: bosh-config - trigger: true - passed: - - common-releases-tooling - - get: bosh-stemcell-jammy - trigger: true - passed: - - deploy-tooling-bosh - - get: terraform-yaml - trigger: true - resource: terraform-yaml-development - - get: toolbelt-release - passed: - - deploy-tooling-bosh - - get: general-task - - task: terraform-secrets - image: general-task - file: bosh-config/ci/terraform-secrets.yml - - put: developmentbosh-deployment - params: - <<: *bosh-deployment - vars_files: - - bosh-config/variables/development.yml - - terraform-secrets/terraform.yml - - terraform-yaml/state.yml - - task: update-cloud-config - image: general-task - file: bosh-config/ci/update-cloud-config.yml - params: - OPS_PATHS: "bosh-config/cloud-config/main.yml bosh-config/cloud-config/cf.yml bosh-config/cloud-config/development.yml" - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((developmentbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) - on_failure: - put: slack - params: - text: | - :x: FAILED to deploy development BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform-news' - username: ((slack-username)) - icon_url: ((slack-icon-url)) - on_success: - put: slack - params: - text: | - :white_check_mark: Successfully deployed development BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform-news' - username: ((slack-username)) - icon_url: ((slack-icon-url)) + - name: common-releases-development + serial: true + plan: + - in_parallel: + - get: certificate + resource: ca-cert-store + - get: bosh-deployment + trigger: true + passed: + - deploy-development-bosh + - get: bosh-config + trigger: true + passed: + - deploy-development-bosh + - get: terraform-yaml + resource: terraform-yaml-development + - get: cg-s3-fisma-jammy-release + trigger: true + passed: + - common-releases-tooling + - get: cg-s3-awslogs-jammy-release + trigger: true + passed: + - common-releases-tooling + - get: cg-s3-nessus-agent-release + trigger: true + passed: + - common-releases-tooling + - get: cg-s3-clamav-release + trigger: true + passed: + - common-releases-tooling + - get: cg-s3-jammy-snort-release + trigger: true + passed: + - common-releases-tooling + - get: aide-release + trigger: true + passed: + - common-releases-tooling + - get: cron-release + trigger: true + passed: + - common-releases-tooling + - get: node-exporter-release + trigger: true + passed: + - common-releases-tooling + - get: syslog-release + trigger: true + passed: + - common-releases-tooling + - get: developmentbosh-deployment + passed: [deploy-development-bosh] + - get: general-task + - task: upload-releases + config: + <<: *upload-releases-config + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) + BOSH_ENVIRONMENT: ((developmentbosh-target)) + - task: update-runtime-config + image: general-task + file: bosh-config/ci/update-runtime-config.yml + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((developmentbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) + BOSH_ENV_NAME: development -- name: common-releases-development - serial: true - plan: - - in_parallel: - - get: certificate - resource: ca-cert-store - - get: bosh-deployment - trigger: true - passed: - - deploy-development-bosh - - get: bosh-config - trigger: true - passed: - - deploy-development-bosh - - get: terraform-yaml - resource: terraform-yaml-development - - get: cg-s3-fisma-jammy-release - trigger: true - passed: - - common-releases-tooling - - get: cg-s3-awslogs-jammy-release - trigger: true - passed: - - common-releases-tooling - - get: cg-s3-nessus-agent-release - trigger: true - passed: - - common-releases-tooling - - get: cg-s3-clamav-release - trigger: true - passed: - - common-releases-tooling - - get: cg-s3-jammy-snort-release - trigger: true - passed: - - common-releases-tooling - - get: aide-release - trigger: true - passed: - - common-releases-tooling - - get: cron-release - trigger: true - passed: - - common-releases-tooling - - get: node-exporter-release - trigger: true - passed: - - common-releases-tooling - - get: syslog-release - trigger: true - passed: - - common-releases-tooling - - get: developmentbosh-deployment - passed: [deploy-development-bosh] - - get: general-task - - task: upload-releases - config: - <<: *upload-releases-config + - name: deploy-staging-bosh + serial: true + plan: + - in_parallel: + - get: ca-cert-store + trigger: true + - get: bosh-deployment + trigger: true + passed: + - common-releases-development + - get: bosh-config + trigger: true + passed: + - common-releases-development + - get: bosh-stemcell-jammy + trigger: true + passed: + - deploy-development-bosh + - get: terraform-yaml + trigger: true + resource: terraform-yaml-staging + - get: toolbelt-release + passed: + - deploy-development-bosh + - get: general-task + - task: terraform-secrets + image: general-task + file: bosh-config/ci/terraform-secrets.yml + - put: stagingbosh-deployment + params: + <<: *bosh-deployment + vars_files: + - bosh-config/variables/staging.yml + - terraform-secrets/terraform.yml + - terraform-yaml/state.yml + - task: update-cloud-config + image: general-task + file: bosh-config/ci/update-cloud-config.yml + params: + OPS_PATHS: "bosh-config/cloud-config/main.yml bosh-config/cloud-config/cf.yml bosh-config/cloud-config/staging.yml" + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((stagingbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) + on_failure: + put: slack + params: + text: | + :x: FAILED to deploy Staging BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + on_success: + put: slack params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) - BOSH_ENVIRONMENT: ((developmentbosh-target)) - - task: update-runtime-config - image: general-task - file: bosh-config/ci/update-runtime-config.yml - params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((developmentbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) - BOSH_ENV_NAME: development + text: | + :white_check_mark: Successfully deployed Staging BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) -- name: deploy-staging-bosh - serial: true - plan: - - in_parallel: - - get: ca-cert-store - trigger: true - - get: bosh-deployment - trigger: true - passed: - - common-releases-development - - get: bosh-config - trigger: true - passed: - - common-releases-development - - get: bosh-stemcell-jammy - trigger: true - passed: - - deploy-development-bosh - - get: terraform-yaml - trigger: true - resource: terraform-yaml-staging - - get: toolbelt-release - passed: - - deploy-development-bosh - - get: general-task - - task: terraform-secrets - image: general-task - file: bosh-config/ci/terraform-secrets.yml - - put: stagingbosh-deployment - params: - <<: *bosh-deployment - vars_files: - - bosh-config/variables/staging.yml - - terraform-secrets/terraform.yml - - terraform-yaml/state.yml - - task: update-cloud-config - image: general-task - file: bosh-config/ci/update-cloud-config.yml - params: - OPS_PATHS: "bosh-config/cloud-config/main.yml bosh-config/cloud-config/cf.yml bosh-config/cloud-config/staging.yml" - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((stagingbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) - on_failure: - put: slack - params: - text: | - :x: FAILED to deploy Staging BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform-news' - username: ((slack-username)) - icon_url: ((slack-icon-url)) - on_success: - put: slack - params: - text: | - :white_check_mark: Successfully deployed Staging BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform-news' - username: ((slack-username)) - icon_url: ((slack-icon-url)) + - name: common-releases-staging + serial: true + plan: + - in_parallel: + - get: certificate + resource: ca-cert-store + - get: bosh-deployment + trigger: true + passed: + - deploy-staging-bosh + - get: bosh-config + trigger: true + passed: + - deploy-staging-bosh + - get: terraform-yaml + resource: terraform-yaml-staging + - get: cg-s3-fisma-jammy-release + trigger: true + passed: + - common-releases-development + - get: cg-s3-awslogs-jammy-release + trigger: true + passed: + - common-releases-development + - get: cg-s3-nessus-agent-release + trigger: true + passed: + - common-releases-development + - get: cg-s3-clamav-release + trigger: true + passed: + - common-releases-development + - get: cg-s3-jammy-snort-release + trigger: true + passed: + - common-releases-development -- name: common-releases-staging - serial: true - plan: - - in_parallel: - - get: certificate - resource: ca-cert-store - - get: bosh-deployment - trigger: true - passed: - - deploy-staging-bosh - - get: bosh-config - trigger: true - passed: - - deploy-staging-bosh - - get: terraform-yaml - resource: terraform-yaml-staging - - get: cg-s3-fisma-jammy-release - trigger: true - passed: - - common-releases-development - - get: cg-s3-awslogs-jammy-release - trigger: true - passed: - - common-releases-development - - get: cg-s3-nessus-agent-release - trigger: true - passed: - - common-releases-development - - get: cg-s3-clamav-release - trigger: true - passed: - - common-releases-development - - get: cg-s3-jammy-snort-release - trigger: true - passed: - - common-releases-development + - get: aide-release + trigger: true + passed: + - common-releases-development + - get: cron-release + trigger: true + passed: + - common-releases-development + - get: node-exporter-release + trigger: true + passed: + - common-releases-development + - get: syslog-release + trigger: true + passed: + - common-releases-development + - get: stagingbosh-deployment + passed: [deploy-staging-bosh] + - get: general-task + - task: upload-releases + config: + <<: *upload-releases-config + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) + BOSH_ENVIRONMENT: ((stagingbosh-target)) + - task: update-runtime-config + image: general-task + file: bosh-config/ci/update-runtime-config.yml + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((stagingbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) + BOSH_ENV_NAME: staging - - get: aide-release - trigger: true - passed: - - common-releases-development - - get: cron-release - trigger: true - passed: - - common-releases-development - - get: node-exporter-release - trigger: true - passed: - - common-releases-development - - get: syslog-release - trigger: true - passed: - - common-releases-development - - get: stagingbosh-deployment - passed: [deploy-staging-bosh] - - get: general-task - - task: upload-releases - config: - <<: *upload-releases-config + - name: deploy-production-bosh + serial: true + plan: + - in_parallel: + - get: ca-cert-store + trigger: true + - get: bosh-deployment + passed: + - common-releases-staging + trigger: true + - get: bosh-config + passed: + - common-releases-staging + trigger: true + - get: bosh-stemcell-jammy + passed: + - deploy-staging-bosh + trigger: true + - get: terraform-yaml + trigger: true + resource: terraform-yaml-production + - get: toolbelt-release + passed: + - deploy-staging-bosh + - get: general-task + - task: terraform-secrets + image: general-task + file: bosh-config/ci/terraform-secrets.yml + - put: productionbosh-deployment + params: + <<: *bosh-deployment + vars_files: + - bosh-config/variables/production.yml + - terraform-secrets/terraform.yml + - terraform-yaml/state.yml + - task: update-cloud-config + image: general-task + file: bosh-config/ci/update-cloud-config.yml + params: + OPS_PATHS: "bosh-config/cloud-config/main.yml bosh-config/cloud-config/cf.yml" + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((productionbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) + on_failure: + put: slack params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) - BOSH_ENVIRONMENT: ((stagingbosh-target)) - - task: update-runtime-config - image: general-task - file: bosh-config/ci/update-runtime-config.yml - params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((stagingbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) - BOSH_ENV_NAME: staging - -- name: deploy-production-bosh - serial: true - plan: - - in_parallel: - - get: ca-cert-store - trigger: true - - get: bosh-deployment - passed: - - common-releases-staging - trigger: true - - get: bosh-config - passed: - - common-releases-staging - trigger: true - - get: bosh-stemcell-jammy - passed: - - deploy-staging-bosh - trigger: true - - get: terraform-yaml - trigger: true - resource: terraform-yaml-production - - get: toolbelt-release - passed: - - deploy-staging-bosh - - get: general-task - - task: terraform-secrets - image: general-task - file: bosh-config/ci/terraform-secrets.yml - - put: productionbosh-deployment - params: - <<: *bosh-deployment - vars_files: - - bosh-config/variables/production.yml - - terraform-secrets/terraform.yml - - terraform-yaml/state.yml - - task: update-cloud-config - image: general-task - file: bosh-config/ci/update-cloud-config.yml - params: - OPS_PATHS: "bosh-config/cloud-config/main.yml bosh-config/cloud-config/cf.yml" - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((productionbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) - on_failure: - put: slack - params: - text: | - :x: FAILED to deploy production BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform' - username: ((slack-username)) - icon_url: ((slack-icon-url)) - on_success: - put: slack - params: - text: | - :white_check_mark: Successfully deployed production BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: '#cg-platform-news' - username: ((slack-username)) - icon_url: ((slack-icon-url)) - -- name: common-releases-production - serial: true - plan: - - in_parallel: - - get: certificate - resource: ca-cert-store - - get: bosh-deployment - trigger: true - - get: bosh-config - - get: terraform-yaml - resource: terraform-yaml-production - - get: cg-s3-fisma-jammy-release - trigger: true - passed: - - common-releases-staging - - get: cg-s3-awslogs-jammy-release - trigger: true - passed: - - common-releases-staging - - get: cg-s3-nessus-agent-release - trigger: true - passed: - - common-releases-staging - - get: cg-s3-clamav-release - trigger: true - passed: - - common-releases-staging - - get: cg-s3-jammy-snort-release - trigger: true - passed: - - common-releases-staging - - get: aide-release - trigger: true - passed: - - common-releases-staging - - get: cron-release - trigger: true - passed: - - common-releases-staging - - get: node-exporter-release - trigger: true - passed: - - common-releases-staging - - get: syslog-release - trigger: true - passed: - - common-releases-staging - - get: productionbosh-deployment - passed: [deploy-production-bosh] - - get: general-task - - task: upload-releases - config: - <<: *upload-releases-config + text: | + :x: FAILED to deploy production BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + on_success: + put: slack params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) - BOSH_ENVIRONMENT: ((productionbosh-target)) - - task: update-runtime-config - image: general-task - file: bosh-config/ci/update-runtime-config.yml - params: - BOSH_CA_CERT: ((common_ca_cert_store)) - BOSH_ENVIRONMENT: ((productionbosh-target)) - BOSH_CLIENT: ci - BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) - BOSH_ENV_NAME: production + text: | + :white_check_mark: Successfully deployed production BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + + - name: common-releases-production + serial: true + plan: + - in_parallel: + - get: certificate + resource: ca-cert-store + - get: bosh-deployment + trigger: true + - get: bosh-config + - get: terraform-yaml + resource: terraform-yaml-production + - get: cg-s3-fisma-jammy-release + trigger: true + passed: + - common-releases-staging + - get: cg-s3-awslogs-jammy-release + trigger: true + passed: + - common-releases-staging + - get: cg-s3-nessus-agent-release + trigger: true + passed: + - common-releases-staging + - get: cg-s3-clamav-release + trigger: true + passed: + - common-releases-staging + - get: cg-s3-jammy-snort-release + trigger: true + passed: + - common-releases-staging + - get: aide-release + trigger: true + passed: + - common-releases-staging + - get: cron-release + trigger: true + passed: + - common-releases-staging + - get: node-exporter-release + trigger: true + passed: + - common-releases-staging + - get: syslog-release + trigger: true + passed: + - common-releases-staging + - get: productionbosh-deployment + passed: [deploy-production-bosh] + - get: general-task + - task: upload-releases + config: + <<: *upload-releases-config + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) + BOSH_ENVIRONMENT: ((productionbosh-target)) + - task: update-runtime-config + image: general-task + file: bosh-config/ci/update-runtime-config.yml + params: + BOSH_CA_CERT: ((common_ca_cert_store)) + BOSH_ENVIRONMENT: ((productionbosh-target)) + BOSH_CLIENT: ci + BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) + BOSH_ENV_NAME: production resources: -- name: ca-cert-store - type: s3-iam - source: - bucket: ((secrets-bucket)) - region_name: ((aws-region)) - versioned_file: ca-cert-store.crt + - name: ca-cert-store + type: s3-iam + source: + bucket: ((secrets-bucket)) + region_name: ((aws-region)) + versioned_file: ca-cert-store.crt -- name: common-master - type: s3-iam - source: - bucket: ((secrets-bucket)) - region_name: ((aws-region)) - versioned_file: master-bosh.yml + - name: common-master + type: s3-iam + source: + bucket: ((secrets-bucket)) + region_name: ((aws-region)) + versioned_file: master-bosh.yml -- name: masterbosh-state - type: s3-iam - source: - bucket: ((secrets-bucket)) - region_name: ((aws-region)) - versioned_file: master-bosh-state.json - server_side_encryption: AES256 + - name: masterbosh-state + type: s3-iam + source: + bucket: ((secrets-bucket)) + region_name: ((aws-region)) + versioned_file: master-bosh-state.json + server_side_encryption: AES256 -- name: masterbosh-creds - type: s3-iam - source: - bucket: ((secrets-bucket)) - region_name: ((aws-region)) - versioned_file: master-bosh-creds.yml - server_side_encryption: AES256 + - name: masterbosh-creds + type: s3-iam + source: + bucket: ((secrets-bucket)) + region_name: ((aws-region)) + versioned_file: master-bosh-creds.yml + server_side_encryption: AES256 -- name: cron-release - type: s3-iam - source: - regexp: cron-(.*).tgz - <<: *s3-release-params + - name: cron-release + type: s3-iam + source: + regexp: cron-(.*).tgz + <<: *s3-release-params -- name: syslog-release - type: bosh-io-release - source: - repository: cloudfoundry/syslog-release + - name: syslog-release + type: bosh-io-release + source: + repository: cloudfoundry/syslog-release -- name: bosh-deployment - type: git - source: - uri: https://github.com/cloudfoundry/bosh-deployment.git - branch: master + - name: bosh-deployment + type: git + source: + uri: https://github.com/cloudfoundry/bosh-deployment.git + branch: master -- name: bosh-config - type: git - source: - commit_verification_keys: ((cloud-gov-pgp-keys)) - uri: ((bosh-config-git-url)) - branch: ((bosh-config-git-branch)) + - name: bosh-config + type: git + source: + commit_verification_keys: ((cloud-gov-pgp-keys)) + uri: ((bosh-config-git-url)) + branch: ((bosh-config-git-branch)) -- name: bosh-create-env-config - type: git - source: - commit_verification_keys: ((cloud-gov-pgp-keys)) - uri: ((bosh-config-git-url)) - branch: ((bosh-config-git-branch)) - paths: - - bosh-create-env* - - cloud-config/* - - operations/* + - name: bosh-create-env-config + type: git + source: + commit_verification_keys: ((cloud-gov-pgp-keys)) + uri: ((bosh-config-git-url)) + branch: ((bosh-config-git-branch)) + paths: + - bosh-create-env* + - cloud-config/* + - operations/* -- name: bosh-stemcell-jammy - type: bosh-io-stemcell - source: - name: bosh-aws-xen-hvm-ubuntu-jammy-go_agent + - name: bosh-stemcell-jammy + type: bosh-io-stemcell + source: + name: bosh-aws-xen-hvm-ubuntu-jammy-go_agent -- name: toolingbosh-deployment - type: bosh-deployment - source: - target: ((masterbosh-target)) - client: admin - client_secret: ((master_bosh_admin_password)) - ca_cert: ((common_ca_cert_store)) - deployment: toolingbosh + - name: toolingbosh-deployment + type: bosh-deployment + source: + target: ((masterbosh-target)) + client: admin + client_secret: ((master_bosh_admin_password)) + ca_cert: ((common_ca_cert_store)) + deployment: toolingbosh -- name: developmentbosh-deployment - type: bosh-deployment - source: - target: ((toolingbosh-target)) - client: ci - client_secret: ((tooling_bosh_uaa_ci_client_secret)) - ca_cert: ((common_ca_cert_store)) - deployment: developmentbosh + - name: developmentbosh-deployment + type: bosh-deployment + source: + target: ((toolingbosh-target)) + client: ci + client_secret: ((tooling_bosh_uaa_ci_client_secret)) + ca_cert: ((common_ca_cert_store)) + deployment: developmentbosh -- name: stagingbosh-deployment - type: bosh-deployment - source: - target: ((toolingbosh-target)) - client: ci - client_secret: ((tooling_bosh_uaa_ci_client_secret)) - ca_cert: ((common_ca_cert_store)) - deployment: stagingbosh + - name: stagingbosh-deployment + type: bosh-deployment + source: + target: ((toolingbosh-target)) + client: ci + client_secret: ((tooling_bosh_uaa_ci_client_secret)) + ca_cert: ((common_ca_cert_store)) + deployment: stagingbosh -- name: productionbosh-deployment - type: bosh-deployment - source: - target: ((toolingbosh-target)) - client: ci - client_secret: ((tooling_bosh_uaa_ci_client_secret)) - ca_cert: ((common_ca_cert_store)) - deployment: productionbosh + - name: productionbosh-deployment + type: bosh-deployment + source: + target: ((toolingbosh-target)) + client: ci + client_secret: ((tooling_bosh_uaa_ci_client_secret)) + ca_cert: ((common_ca_cert_store)) + deployment: productionbosh -- name: slack - type: slack-notification - source: - url: ((slack-webhook-url)) + - name: slack + type: slack-notification + source: + url: ((slack-webhook-url)) -- name: cg-s3-fisma-jammy-release - type: s3-iam - source: - regexp: fisma-jammy-(.*).tgz - <<: *s3-release-params + - name: cg-s3-fisma-jammy-release + type: s3-iam + source: + regexp: fisma-jammy-(.*).tgz + <<: *s3-release-params -- name: cg-s3-awslogs-jammy-release - type: s3-iam - source: - regexp: awslogs-jammy-(.*).tgz - <<: *s3-release-params + - name: cg-s3-awslogs-jammy-release + type: s3-iam + source: + regexp: awslogs-jammy-(.*).tgz + <<: *s3-release-params -- name: cg-s3-nessus-agent-release - type: s3-iam - source: - regexp: nessus-agent-(.*).tgz - <<: *s3-release-params + - name: cg-s3-nessus-agent-release + type: s3-iam + source: + regexp: nessus-agent-(.*).tgz + <<: *s3-release-params -- name: cg-s3-clamav-release - type: s3-iam - source: - regexp: clamav-(.*).tgz - <<: *s3-release-params + - name: cg-s3-clamav-release + type: s3-iam + source: + regexp: clamav-(.*).tgz + <<: *s3-release-params -- name: cg-s3-jammy-snort-release - type: s3-iam - source: - regexp: jammy-snort-(.*).tgz - <<: *s3-release-params + - name: cg-s3-jammy-snort-release + type: s3-iam + source: + regexp: jammy-snort-(.*).tgz + <<: *s3-release-params -- name: aide-release - type: s3-iam - source: - regexp: aide-(.*).tgz - <<: *s3-release-params + - name: aide-release + type: s3-iam + source: + regexp: aide-(.*).tgz + <<: *s3-release-params -- name: node-exporter-release - type: bosh-io-release - source: - repository: cloudfoundry-community/node-exporter-boshrelease + - name: node-exporter-release + type: bosh-io-release + source: + repository: cloudfoundry-community/node-exporter-boshrelease -- name: terraform-yaml-tooling - type: s3-iam - source: - bucket: ((tf-state-bucket)) - versioned_file: ((tf-state-file-tooling)) - region_name: ((aws-region)) + - name: terraform-yaml-tooling + type: s3-iam + source: + bucket: ((tf-state-bucket)) + versioned_file: ((tf-state-file-tooling)) + region_name: ((aws-region)) -- name: terraform-yaml-development - type: s3-iam - source: - bucket: ((tf-state-bucket)) - versioned_file: ((tf-state-file-development)) - region_name: ((aws-region)) + - name: terraform-yaml-development + type: s3-iam + source: + bucket: ((tf-state-bucket)) + versioned_file: ((tf-state-file-development)) + region_name: ((aws-region)) -- name: terraform-yaml-staging - type: s3-iam - source: - bucket: ((tf-state-bucket)) - versioned_file: ((tf-state-file-staging)) - region_name: ((aws-region)) + - name: terraform-yaml-staging + type: s3-iam + source: + bucket: ((tf-state-bucket)) + versioned_file: ((tf-state-file-staging)) + region_name: ((aws-region)) -- name: terraform-yaml-production - type: s3-iam - source: - bucket: ((tf-state-bucket)) - versioned_file: ((tf-state-file-production)) - region_name: ((aws-region)) + - name: terraform-yaml-production + type: s3-iam + source: + bucket: ((tf-state-bucket)) + versioned_file: ((tf-state-file-production)) + region_name: ((aws-region)) -- name: toolbelt-release - type: bosh-io-release - source: - repository: cloudfoundry-community/toolbelt-boshrelease + - name: toolbelt-release + type: bosh-io-release + source: + repository: cloudfoundry-community/toolbelt-boshrelease -- name: stemcell-lock-pool - type: pool - source: - uri: git@github.com:cloud-gov/concourse-locks.git - branch: concourse # main is protected, so use a topic branch - pool: stemcell - username: cg-ci-bot - private_key: ((cg-ci-bot-sshkey.private_key)) - git_config: - - name: "user.name" - value: "cg-ci-bot" - - name: "user.email" - value: "no-reply@cloud.gov" + - name: stemcell-lock-pool + type: pool + source: + uri: git@github.com:cloud-gov/concourse-locks.git + branch: concourse # main is protected, so use a topic branch + pool: stemcell + username: cg-ci-bot + private_key: ((cg-ci-bot-sshkey.private_key)) + git_config: + - name: "user.name" + value: "cg-ci-bot" + - name: "user.email" + value: "no-reply@cloud.gov" -- name: general-task - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: general-task - aws_region: us-gov-west-1 - tag: latest + - name: general-task + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: general-task + aws_region: us-gov-west-1 + tag: latest resource_types: -- name: registry-image - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: registry-image-resource - aws_region: us-gov-west-1 - tag: latest + - name: registry-image + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: registry-image-resource + aws_region: us-gov-west-1 + tag: latest -- name: bosh-deployment - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: bosh-deployment-resource - aws_region: us-gov-west-1 - tag: latest + - name: bosh-deployment + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: bosh-deployment-resource + aws_region: us-gov-west-1 + tag: latest -- name: slack-notification - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: slack-notification-resource - aws_region: us-gov-west-1 - tag: latest + - name: slack-notification + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: slack-notification-resource + aws_region: us-gov-west-1 + tag: latest -- name: s3-iam - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: s3-resource - aws_region: us-gov-west-1 - tag: latest + - name: s3-iam + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: s3-resource + aws_region: us-gov-west-1 + tag: latest -- name: semver-iam - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: semver-resource - aws_region: us-gov-west-1 - tag: latest + - name: semver-iam + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: semver-resource + aws_region: us-gov-west-1 + tag: latest -- name: bosh-io-release - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: bosh-io-release-resource - aws_region: us-gov-west-1 - tag: latest + - name: bosh-io-release + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: bosh-io-release-resource + aws_region: us-gov-west-1 + tag: latest -- name: bosh-io-stemcell - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: bosh-io-stemcell-resource - aws_region: us-gov-west-1 - tag: latest + - name: bosh-io-stemcell + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: bosh-io-stemcell-resource + aws_region: us-gov-west-1 + tag: latest -- name: git - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: git-resource - aws_region: us-gov-west-1 - tag: latest + - name: git + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: git-resource + aws_region: us-gov-west-1 + tag: latest -- name: pool - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: pool-resource - aws_region: us-gov-west-1 - tag: latest + - name: pool + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: pool-resource + aws_region: us-gov-west-1 + tag: latest From fa0dc417ad921dfa59f08d079686b4ca47f94a45 Mon Sep 17 00:00:00 2001 From: James Hochadel Date: Thu, 19 Sep 2024 17:28:15 -0400 Subject: [PATCH 2/2] Hold a lock through pipeline execution, until failure or completion Related: https://github.com/cloud-gov/product/issues/3130 --- ci/pipeline.yml | 167 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 126 insertions(+), 41 deletions(-) diff --git a/ci/pipeline.yml b/ci/pipeline.yml index 9f18b674..540f8863 100644 --- a/ci/pipeline.yml +++ b/ci/pipeline.yml @@ -94,18 +94,27 @@ jobs: - put: masterbosh-creds params: file: updated-bosh-creds/*.yml + on_error: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_abort: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_failure: + do: + - put: slack + params: + text: | + :x: FAILED to deploy Master BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform" + username: ((slack-username)) + icon_url: ((slack-icon-url)) - put: stemcell-lock-pool params: release: stemcell-lock-pool - on_failure: - put: slack - params: - text: | - :x: FAILED to deploy Master BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: "#cg-platform" - username: ((slack-username)) - icon_url: ((slack-icon-url)) on_success: put: slack params: @@ -204,6 +213,18 @@ jobs: BOSH_CLIENT: admin BOSH_CLIENT_SECRET: ((master_bosh_admin_password)) BOSH_ENV_NAME: master + on_error: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_abort: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_failure: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool - name: deploy-tooling-bosh serial: true @@ -277,15 +298,27 @@ jobs: BOSH_ENVIRONMENT: ((toolingbosh-target)) BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) - on_failure: - put: slack + on_error: + put: stemcell-lock-pool params: - text: | - :x: FAILED to deploy Tooling BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: "#cg-platform" - username: ((slack-username)) - icon_url: ((slack-icon-url)) + release: stemcell-lock-pool + on_abort: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_failure: + do: + - put: slack + params: + text: | + :x: FAILED to deploy Tooling BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + - put: stemcell-lock-pool + params: + release: stemcell-lock-pool on_success: put: slack params: @@ -383,6 +416,18 @@ jobs: BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((tooling_bosh_uaa_ci_client_secret)) BOSH_ENV_NAME: tooling + on_error: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_abort: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_failure: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool - name: deploy-development-bosh serial: true @@ -429,14 +474,18 @@ jobs: BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) on_failure: - put: slack - params: - text: | - :x: FAILED to deploy development BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: "#cg-platform-news" - username: ((slack-username)) - icon_url: ((slack-icon-url)) + do: + - put: slack + params: + text: | + :x: FAILED to deploy development BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + - put: stemcell-lock-pool + params: + release: stemcell-lock-pool on_success: put: slack params: @@ -519,6 +568,18 @@ jobs: BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((development_bosh_uaa_ci_client_secret)) BOSH_ENV_NAME: development + on_error: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_abort: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_failure: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool - name: deploy-staging-bosh serial: true @@ -565,14 +626,18 @@ jobs: BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) on_failure: - put: slack - params: - text: | - :x: FAILED to deploy Staging BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: "#cg-platform-news" - username: ((slack-username)) - icon_url: ((slack-icon-url)) + do: + - put: slack + params: + text: | + :x: FAILED to deploy Staging BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform-news" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + - put: stemcell-lock-pool + params: + release: stemcell-lock-pool on_success: put: slack params: @@ -656,6 +721,18 @@ jobs: BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((staging_bosh_uaa_ci_client_secret)) BOSH_ENV_NAME: staging + on_error: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_abort: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool + on_failure: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool - name: deploy-production-bosh serial: true @@ -702,14 +779,18 @@ jobs: BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) on_failure: - put: slack - params: - text: | - :x: FAILED to deploy production BOSH - <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> - channel: "#cg-platform" - username: ((slack-username)) - icon_url: ((slack-icon-url)) + do: + - put: slack + params: + text: | + :x: FAILED to deploy production BOSH + <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME|View build details> + channel: "#cg-platform" + username: ((slack-username)) + icon_url: ((slack-icon-url)) + - put: stemcell-lock-pool + params: + release: stemcell-lock-pool on_success: put: slack params: @@ -787,6 +868,10 @@ jobs: BOSH_CLIENT: ci BOSH_CLIENT_SECRET: ((production_bosh_uaa_ci_client_secret)) BOSH_ENV_NAME: production + ensure: + put: stemcell-lock-pool + params: + release: stemcell-lock-pool resources: - name: ca-cert-store