chrishoban / ssg-openshift-meta-templates

Templates to be used by Meta Pipeline Bootstrap

OpenShift Meta Template

OpenShift Meta Template is an effort to bootstrap in a full openshift build pipeline in the BCGov space with minimal upfront effort. The idea is being able to configure everything upfront and have what you need get spun up and created. Really handy in MicroService development.

Features includes:

• Build S2I from standard nodeJS/.NET/Java source code repository
• Setup for Infrastructure As Code, but will create BuildConfig/DeploymentConfig/Route/Service objects if they don't yet exist in your repo
• Configure Build and Deployment pod Resources (Time Limited Resource Pool)
• LifeCycle Webhook used to deliver caught Pipeline Exceptions

Getting Started

Deploy a jenkins server using BC Gov Pathfinder Jenkins (Persistent) image from the service catalog.

If you're building a Dotnet application, deploy the appropriate Jenkins slave:

• dotnet core

Click import YAML in openshift tools namespace

paste contents of /openshift/meta-templates/pipeline-build-template.yaml

Fill out requested parameters

Upcoming Features!

• SonarQube scanning for any project
• LifeCycle WebHooks
• HealthCheck Configs
• One Time Bootstrap Tools Services - Deploy and Configure Jenkins - Deploy and Configure SonarQube - Network Security Policy Configuration - image puller role for dev/test/prod namespace default user for tools namespace imagestream deployments

Notes

• Current tool requires the following is already done before it works (Future versions will work on a blank slate):

  1. Persistent Jenkins Template installed
  2. Network Security Policies loosened (Template to do so contained within)
  3. default user for dev/test/prod has image:puller role in tools namespace

• Pipeline build comes with jenkinsfile inline, for rapid prototyping before eventually placing pipeline in your repository.

Contributing

If you want to discuss a new feature or found a bug, please open a new issue here.

ssg-openshift-meta-templates's Issues

[Deployment Config] - Health Checks

Add Healthchecks to the DC

[Service-Route] - Add TLS

Relatively minor template changes

[Feature] RedHat Container Image Import Tool

Write a pipeline template that creates a local Image Registry, and does the first time pull of a user defined container image from RedHat.

Should also set source type of image to local after first pull until RedHat credential use is also automated.

[Deployment Config] - ConfigMap as Environment

Need a method to add a ConfigMap as JSON/Yaml attached to DC Environment

[Deployment Config] - Set App: property

Minor fix but needs doin, deployments are currently under "Other Resources"

[Network Policy] network policies are not setup correctly and have badly formatted namespace references

Parameter missing in service-route.yaml

The ${suffix} parameter is missing

https://github.com/ChrisHoban/ssg-openshift-meta-templates/blob/master/openshift/meta-templates/service-route.yaml

[Deployment Config] - OpenShift Secret as Environment

Need to add OpenShift Secret as an Environment Variable

** Bonus **
Add the Secret in a Secure manner in the same process, otherwise require that it already exists and reference by name

type

ssg-openshift-meta-templates/openshift/meta-templates/pipeline-build-template.yaml

Line 132 in eab3873

- description: Sonarqube Analysis Command (For Jenkins Stage, will pull down code and run the command given (IE 'maven sonar:sonar'))

is the command not mvn sonar:sonar in your comments ?

[Service Routes] Enable for React

React apps open on localhost:3000, service-route.yaml currently has it's target port set to 8080.

Possibly look to parameterize the target port to a env var setup in the initial template process form?

[Deployment Config] - Add LifeCycle Hooks

Add LifeCycle Hooks to the DC

[One Time Bootstrap] - First Version

• Setup Network Security Policies in Tools/Dev/Test/Prod
• Spin Up SonarQube
• Spin Up Persistent Jenkins
• Default User for Dev/Test/Prod given Tools image:puller role

Enable to specify a maven profile when building the maven apps

When building a maven application, it is common to specify a profile. the meta template should allow you to pass a profile via configuration and run the following command mvn clean install -P${Proflies}

[Jenkins Pipeline] - Timeout only fires when aborting promotion stage

Timeout loop is nested in an improper area, pipeline never times out, and if waiting on a promotion gate will hit a timeout exception only after hitting abort, strangely not after hitting proceed 1 hour later.

[Pipeline] { (Promotion gate)
[Pipeline] script
[Pipeline] {
[Pipeline] input
Promote application to Prod?
Proceed or Abort
[Pipeline] }
[Pipeline] // script
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] echo
in catch block
[Pipeline] node
Caught: org.jenkinsci.plugins.workflow.steps.FlowInterruptedException```