mirror of
https://github.com/google/nomulus.git
synced 2025-08-04 00:42:12 +02:00
b7f3154f4e
* Update GCB beam deployment pipeline Some of the texts are not really secerts because they are per-project. Also changed the location of the credential file to `secerts` so that in the future we may add more secerts in that folder. The encrypted file is base64 encoded, consistent with how the proxy certificates are encoded. Also made some changes to the other pipelines to facilitate automation with Spinnaker
51 lines
1.6 KiB
YAML
51 lines
1.6 KiB
YAML
# To run the build locally, install cloud-build-local first.
|
|
# Then run:
|
|
# cloud-build-local --config=cloudbuild-deploy-beam.yaml --dryrun=false \
|
|
# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
|
|
#
|
|
# This will deploy Beam pipelines to GCS for the PROJECT_ID defined in gcloud
|
|
# tool.
|
|
#
|
|
# To manually trigger a build on GCB, run:
|
|
# gcloud builds submit --config=cloudbuild-deploy-beam.yaml \
|
|
# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
|
|
#
|
|
# To trigger a build automatically, follow the instructions below and add a trigger:
|
|
# https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
|
|
steps:
|
|
# Pull the latest nomulus.jar to local
|
|
- name: 'gcr.io/${PROJECT_ID}/builder:latest'
|
|
args:
|
|
- gsutil
|
|
- cp
|
|
- gs://${PROJECT_ID}-deploy/${TAG_NAME}/nomulus.jar
|
|
- .
|
|
# Pull the credential for nomulus tool
|
|
- name: 'gcr.io/${PROJECT_ID}/builder:latest'
|
|
args:
|
|
- gsutil
|
|
- cp
|
|
- gs://${PROJECT_ID}-deploy/secrets/tool-credential.json.enc
|
|
- .
|
|
# Decrypt the credential
|
|
- name: 'gcr.io/${PROJECT_ID}/builder:latest'
|
|
entrypoint: /bin/bash
|
|
args:
|
|
- -c
|
|
- |
|
|
cat tool-credential.json.enc | base64 -d | gcloud kms decrypt \
|
|
--ciphertext-file=- --plaintext-file=tool-credential.json \
|
|
--location=global --keyring=nomulus-tool-keyring --key=nomulus-tool-key
|
|
# Deploy spec11 and invoicing pipeline to GCS
|
|
- name: 'gcr.io/${PROJECT_ID}/builder:latest'
|
|
entrypoint: /bin/bash
|
|
args:
|
|
- -c
|
|
- |
|
|
java -jar nomulus.jar -e ${_ENV} --credential tool-credential.json \
|
|
deploy_spec11_pipeline
|
|
java -jar nomulus.jar -e ${_ENV} --credential tool-credential.json \
|
|
deploy_invoicing_pipeline
|
|
timeout: 3600s
|
|
options:
|
|
machineType: 'N1_HIGHCPU_8'
|