mirror of
https://github.com/google/nomulus.git
synced 2025-05-22 04:09:46 +02:00
ce2f98f680
* Work around Spinnaker issue wrt variables
Cloud Build variable reference need to stay from the ${var} pattern
to prevent Spinnaker from trying to resolve it. In all files that
are used by Spinnaker, we change variable reference to the $var form.
We made the minimum amount of change possible, and will review this
issue after the permanent solution is available.
89 lines
3.4 KiB
YAML
89 lines
3.4 KiB
YAML
# To run the build locally, install cloud-build-local first.
|
|
# Then run:
|
|
# cloud-build-local --config=cloudbuild-schema-deploy.yaml --dryrun=false \
|
|
# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
|
|
#
|
|
# This will deploy Cloud SQL schema release with tag value ${TAG_NAME} to
|
|
# the environment specified by ${_ENV}.
|
|
#
|
|
# To manually trigger a build on GCB, run:
|
|
# gcloud builds submit --config=cloudbuild-schema-deploy.yaml \
|
|
# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
|
|
#
|
|
# To trigger a build automatically, follow the instructions below and add a trigger:
|
|
# https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
|
|
#
|
|
# Note that the release process hardens the tags and variables in this file:
|
|
# - The 'latest' tag on docker images will be replaced by their image digests.
|
|
# - The ${TAG_NAME} pattern will be replaced by the actual release tag.
|
|
# - The ${_ENV} pattern will be replaced by the actual environment name.
|
|
# Please refer to ./cloudbuild-release.yaml for more details.
|
|
|
|
# Note 2: to work around issue in Spinnaker's 'Deployment Manifest' stage,
|
|
# variable references must avoid the ${var} format. Valid formats include
|
|
# $var or ${"${var}"}. This file use the former. Since TAG_NAME and _ENV are
|
|
# expanded in the copies sent to Spinnaker, we preserve the brackets around
|
|
# them for safe pattern matching during release.
|
|
# See https://github.com/spinnaker/spinnaker/issues/3028 for more information.
|
|
steps:
|
|
# Download and decrypt the nomulus tool credential, which has the privilege to
|
|
# start Cloud SQL proxy to all environments.
|
|
# Also download and decrypt the admin_credential file, which has the cloud
|
|
# instance name and database login name and password.
|
|
- name: 'gcr.io/$PROJECT_ID/builder:latest'
|
|
volumes:
|
|
- name: 'secrets'
|
|
path: '/secrets'
|
|
entrypoint: /bin/bash
|
|
args:
|
|
- -c
|
|
- |
|
|
set -e
|
|
gsutil cp gs://$PROJECT_ID-deploy/secrets/tool-credential.json.enc - \
|
|
| base64 -d \
|
|
| gcloud kms decrypt \
|
|
--ciphertext-file=- \
|
|
--plaintext-file=/secrets/cloud_sql_credential.json \
|
|
--location=global --keyring=nomulus-tool-keyring --key=nomulus-tool-key
|
|
gsutil cp gs://$PROJECT_ID-deploy/cloudsql-credentials/${_ENV}/admin_credential.enc - \
|
|
| base64 -d \
|
|
| gcloud kms decrypt \
|
|
--ciphertext-file=- \
|
|
--plaintext-file=/secrets/admin_credential.dec \
|
|
--location global --keyring=nomulus-tool-keyring \
|
|
--key=nomulus-tool-key
|
|
# Download the schema jar to be deployed.
|
|
- name: 'gcr.io/$PROJECT_ID/builder:latest'
|
|
volumes:
|
|
- name: 'flyway'
|
|
path: '/flyway/jars'
|
|
entrypoint: /bin/bash
|
|
args:
|
|
- -c
|
|
- |
|
|
set -e
|
|
gsutil cp gs://$PROJECT_ID-deploy/${TAG_NAME}/schema.jar \
|
|
/flyway/jars
|
|
# Deploy SQL schema
|
|
- name: 'gcr.io/$PROJECT_ID/schema_deployer:latest'
|
|
volumes:
|
|
- name: 'secrets'
|
|
path: '/secrets'
|
|
- name: 'flyway'
|
|
path: '/flyway/jars'
|
|
args: ['migrate']
|
|
# Save the deployed tag for the current environment on GCS to a well-known.
|
|
# location. Do not use the 'artifacts' section for this since it will
|
|
# upload an extra metadata file every time and pollute the folder.
|
|
# TODO(weiminyu): modify this step so that TAG_NAME may be 'live'.
|
|
- name: 'gcr.io/$PROJECT_ID/builder:latest'
|
|
entrypoint: /bin/bash
|
|
args:
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo ${TAG_NAME} | \
|
|
gsutil cp - gs://$PROJECT_ID-deployed-tags/sql.${_ENV}.tag\
|
|
timeout: 3600s
|
|
options:
|
|
machineType: 'N1_HIGHCPU_8'
|