.drone.yml

# Copyright (c) 2017-present SIGHUP s.r.l All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file.

name: qa
kind: pipeline
type: docker

platform:
  os: linux
  arch: amd64

clone:
  depth: 1

steps:
  - name: license-check
    image: quay.io/sighup/golang:1.23.3
    pull: always
    commands:
      - make license-check

  - name: schema-check
    image: quay.io/sighup/golang:1.23.3
    pull: always
    commands:
      - |-
        cat schemas/public/ekscluster-kfd-v1alpha2.json | \
        json-patch -p schemas/private/ekscluster-kfd-v1alpha2.patch.json | \
        jq -r > /tmp/schemas-private-ekscluster-kfd-v1alpha2.json
      - diff schemas/private/ekscluster-kfd-v1alpha2.json /tmp/schemas-private-ekscluster-kfd-v1alpha2.json

  - name: lint
    image: quay.io/sighup/policeman
    pull: always
    environment:
      # Identifies false positives like missing 'selector'.
      # Doing this is valid for Kustomize patches
      VALIDATE_KUBERNETES_KUBEVAL: "false"
      # Some duplicated code is intended.
      VALIDATE_JSCPD: "false"
      # Disable natural language checks
      VALIDATE_NATURAL_LANGUAGE: "false"
      # Disable go linting, we use the one included in the go image
      VALIDATE_GO: "false"
      # Exclude template files from linting. The linter does not understand Go template.
      FILTER_REGEX_EXCLUDE: (templates/|\.github)
    depends_on:
      - license-check
      - schema-check

  # - name: lint-go
  #   image: quay.io/sighup/golang:1.23.3
  #   pull: always
  #   commands:
  #     - make lint-go
  #   depends_on:
  #     - license-check
  #     - schema-check

  - name: test-schema
    image: quay.io/sighup/e2e-testing:1.1.0_1.31.1_3.10.0_4.33.3
    pull: always
    depends_on:
      - license-check
      - schema-check
    environment:
      JV_VERSION: 6.0.1
    commands:
      # we need to download `jv` for running the JSON Schemas tests.
      - curl -L https://github.com/santhosh-tekuri/jsonschema/releases/download/v$${JV_VERSION}/jv-v$${JV_VERSION}-linux-amd64.tar.gz | tar zx --directory /usr/local/bin/
      - bats -t tests/schema.sh

  - name: render
    image: quay.io/sighup/e2e-testing:1.1.0_1.31.1_3.10.0_4.33.3
    pull: always
    depends_on:
      - license-check
      - schema-check
    environment:
      NETRC_FILE:
        from_secret: NETRC_FILE
      FURYCTL_VERSION: v0.31.0
      FURYCTL_CONFIG: tests/e2e/kfddistribution/furyctl-init-cluster.yaml
      FURYCTL_DISTRO_LOCATION: ./
      FURYCTL_OUTDIR: ./
      FURYCTL_DISABLE_ANALYTICS: "true"
      KUBECONFIG: ./dummy
    commands:
      - echo $${NETRC_FILE} > /root/.netrc
      - echo "Installing furyctl version $${FURYCTL_VERSION}..."
      - curl -L "https://github.com/sighupio/furyctl/releases/download/$${FURYCTL_VERSION}/furyctl-$(uname -s)-amd64.tar.gz" | tar xz -C /usr/local/bin/
      - furyctl download dependencies && furyctl dump template
      # Move the folder with the manifests generated from the templates into the right path
      - mv distribution $${FURYTCL_OUTDIR}.furyctl/$$(yq .metadata.name $FURYCTL_CONFIG)
      # Build the whole distribution
      - kustomize build $${FURYTCL_OUTDIR}.furyctl/$$(yq .metadata.name $FURYCTL_CONFIG)/distribution/manifests > distribution.yml

  - name: check-deprecated-apis
    image: us-docker.pkg.dev/fairwinds-ops/oss/pluto:v5
    pull: always
    depends_on:
      - render
    commands:
      # we use --ignore-deprecations because we don't want the CI to fail when the API has not been removed yet.
      - /pluto detect distribution.yml --ignore-deprecations --target-versions=k8s=v1.31.0

---
name: e2e-kubernetes-1.31
kind: pipeline
type: docker

depends_on:
  - qa

clone:
  depth: 1

platform:
  os: linux
  arch: amd64

trigger:
  ref:
    include:
      - refs/tags/**
    exclude:
      - refs/tags/**-docs*

steps:
  - name: create Kind cluster
    image: quay.io/sighup/dind-kind-kubectl-kustomize:0.24.0_1.31.1_3.10.0
    pull: always
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    environment:
      CLUSTER_VERSION: v1.31.0
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}
      # /drone/src is the default workdir for the pipeline
      # using this folder we don't need to mount another
      # shared volume between the steps
      KUBECONFIG: /drone/src/kubeconfig
    commands:
      # create a custom config to disable Kind's default CNI so
      # we can test using KFD's networking module.
      - |
        cat <<EOF > kind-config.yaml
        kind: Cluster
        apiVersion: kind.x-k8s.io/v1alpha4
        networking:
          disableDefaultCNI: true
        nodes:
          - role: control-plane
          - role: worker
          - role: worker
        EOF
      # NOTE: kind's `--wait` flag that waits for the control-plane ot be ready
      # does not work when disabling the default CNI. It will always go in timeout.
      - kind create cluster --name $${CLUSTER_NAME} --image registry.sighup.io/fury/kindest/node:$${CLUSTER_VERSION} --config kind-config.yaml
      # save the kubeconfig so we can use it from other steps.
      - kind get kubeconfig --name $${CLUSTER_NAME} > $${KUBECONFIG}

  - name: e2e-kfddistribution
    image: quay.io/sighup/e2e-testing:1.1.0_1.31.1_3.10.0_4.33.3
    pull: always
    # we need to use host network to access Kind API port that is listening on the worker's loopback
    # beacuse we mount the host's Docker socket to run Kind.
    network_mode: host
    environment:
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}
      KUBECONFIG: /drone/src/kubeconfig
      FURYCTL_VERSION: v0.31.0
    depends_on: [create Kind cluster]
    commands:
      - export KUBECONFIG=/drone/src/kubeconfig
      # We change the loopback IP in the kubeconfig to use the service hostname and keep the port.
      # - 'sed -Ei "s#(server: https://)(.*)(:.*)#\1kind-cluster\3#" $${KUBECONFIG}'
      - echo "Installing the correct furyctl version..."
      - curl -L "https://github.com/sighupio/furyctl/releases/download/$${FURYCTL_VERSION}/furyctl-$(uname -s)-amd64.tar.gz" -o /tmp/furyctl.tar.gz && tar xfz /tmp/furyctl.tar.gz -C /tmp
      # to use furyctl latest, use the following instead:
      # - curl -L "https://github.com/sighupio/furyctl/releases/latest/download/furyctl-$(uname -s)-amd64.tar.gz" -o /tmp/furyctl.tar.gz && tar xfz /tmp/furyctl.tar.gz -C /tmp
      - chmod +x /tmp/furyctl
      # check that the kind cluster is ready before we move on
      # - kubectl wait --timeout=180s --for=condition=ready pod --all -n kube-system
      - until kubectl get serviceaccount default > /dev/null 2>&1; do echo "waiting for control-plane" && sleep 1; done
      # finally, run the e2e tests
      - tests/e2e-kfddistribution.sh

  - name: delete-kind-cluster
    image: quay.io/sighup/dind-kind-kubectl-kustomize:0.24.0_1.31.1_3.10.0
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    environment:
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}
    commands:
      # does not matter if the command fails
      - kind delete cluster --name $${CLUSTER_NAME} || true
    depends_on:
      - e2e-kfddistribution
    when:
      status:
        - success
        - failure

volumes:
  - name: dockersock
    host:
      path: /var/run/docker.sock
---
name: e2e-kubernetes-1.30.0-to-1.31.0
kind: pipeline
type: docker

depends_on:
  - qa
  - e2e-kubernetes-1.31

clone:
  depth: 1

platform:
  os: linux
  arch: amd64

trigger:
  ref:
    include:
      - refs/tags/**
    exclude:
      - refs/tags/**-docs*

steps:
  - name: create Kind cluster
    image: quay.io/sighup/dind-kind-kubectl-kustomize:0.24.0_1.31.1_3.10.0
    pull: always
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    environment:
      CLUSTER_VERSION: v1.31.0
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}-upgrades
      # /drone/src is the default workdir for the pipeline
      # using this folder we don't need to mount another
      # shared volume between the steps
      KUBECONFIG: /drone/src/kubeconfig-upgrades
    commands:
      # create a custom config to disable Kind's default CNI so
      # we can test using KFD's networking module.
      - |
        cat <<EOF > kind-config.yaml
        kind: Cluster
        apiVersion: kind.x-k8s.io/v1alpha4
        networking:
          disableDefaultCNI: true
        nodes:
          - role: control-plane
          - role: worker
          - role: worker
        EOF
      # NOTE: kind's `--wait` flag that waits for the control-plane ot be ready
      # does not work when disabling the default CNI. It will always go in timeout.
      - kind create cluster --name $${CLUSTER_NAME} --image registry.sighup.io/fury/kindest/node:$${CLUSTER_VERSION} --config kind-config.yaml
      # save the kubeconfig so we can use it from other steps.
      - kind get kubeconfig --name $${CLUSTER_NAME} > $${KUBECONFIG}

  - name: e2e-kfddistribution
    image: quay.io/sighup/e2e-testing:1.1.0_1.31.1_3.10.0_4.33.3
    pull: always
    # we need to use host network to access Kind API port that is listening on the worker's loopback
    # beacuse we mount the host's Docker socket to run Kind.
    network_mode: host
    environment:
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}-upgrades
      KUBECONFIG: /drone/src/kubeconfig-upgrades
      FURYCTL_VERSION: v0.31.0
    depends_on: [create Kind cluster]
    commands:
      - export KUBECONFIG=/drone/src/kubeconfig-upgrades
      # We change the loopback IP in the kubeconfig to use the service hostname and keep the port.
      # - 'sed -Ei "s#(server: https://)(.*)(:.*)#\1kind-cluster\3#" $${KUBECONFIG}'
      - echo "Installing the correct furyctl version..."
      - curl -L "https://github.com/sighupio/furyctl/releases/download/$${FURYCTL_VERSION}/furyctl-$(uname -s)-amd64.tar.gz" -o /tmp/furyctl.tar.gz && tar xfz /tmp/furyctl.tar.gz -C /tmp
      # to use furyctl latest, use the following instead:
      # - curl -L "https://github.com/sighupio/furyctl/releases/latest/download/furyctl-$(uname -s)-amd64.tar.gz" -o /tmp/furyctl.tar.gz && tar xfz /tmp/furyctl.tar.gz -C /tmp
      - chmod +x /tmp/furyctl
      # check that the kind cluster is ready before we move on
      # - kubectl wait --timeout=180s --for=condition=ready pod --all -n kube-system
      - until kubectl get serviceaccount default > /dev/null 2>&1; do echo "waiting for control-plane" && sleep 1; done
      # finally, run the e2e tests
      - tests/e2e-kfddistribution-upgrades.sh

  - name: delete-kind-cluster
    image: quay.io/sighup/dind-kind-kubectl-kustomize:0.24.0_1.31.1_3.10.0
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    environment:
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}-upgrades
    commands:
      # does not matter if the command fails
      - kind delete cluster --name $${CLUSTER_NAME} || true
    depends_on:
      - e2e-kfddistribution
    when:
      status:
        - success
        - failure

volumes:
  - name: dockersock
    host:
      path: /var/run/docker.sock
---
name: e2e-ekscluster
kind: pipeline
type: docker

depends_on:
  - qa

clone:
  depth: 1

trigger:
  ref:
    - refs/tags/e2e-full-**
    - refs/tags/v**

steps:
- name: run-tests
  image: quay.io/sighup/e2e-testing:2.24.17_1.1.0_3.12.0_1.31.1_5.6.0_4.33.3
  environment:
    FURYCTL_VERSION: "v0.31.1"
    DISTRIBUTION_VERSION: "v1.31.0"
    DEBIAN_FRONTEND: noninteractive
    CLUSTER_NAME: e2e-eks-${DRONE_BUILD_NUMBER}
    AWS_ACCESS_KEY_ID:
      from_secret: aws_access_key_id
    AWS_SECRET_ACCESS_KEY:
      from_secret: aws_secret_access_key
    AWS_REGION:
      from_secret: aws_region
  commands:
    - apt-get install -y expect
    - echo "Installing the correct furyctl version..."
    - curl -L "https://github.com/sighupio/furyctl/releases/download/$${FURYCTL_VERSION}/furyctl-linux-amd64.tar.gz" | tar -xz
    - mv furyctl /usr/local/bin
    - chmod +x /usr/local/bin/furyctl
    - ./tests/e2e/ekscluster/e2e-ekscluster.sh

- name: cleanup
  image: quay.io/sighup/e2e-testing:2.24.17_1.1.0_3.12.0_1.31.1_5.6.0_4.33.3
  environment:
    FURYCTL_VERSION: "v0.31.1"
    CLUSTER_NAME: e2e-eks-${DRONE_BUILD_NUMBER}
    DEBIAN_FRONTEND: noninteractive
    DISTRIBUTION_VERSION: "v1.31.0"
    AWS_ACCESS_KEY_ID:
      from_secret: aws_access_key_id
    AWS_SECRET_ACCESS_KEY:
      from_secret: aws_secret_access_key
    AWS_REGION:
      from_secret: aws_region
  commands:
    - apt-get install -y expect
    - apt-get install -y expect
    - echo "Installing the correct furyctl version..."
    - curl -L "https://github.com/sighupio/furyctl/releases/download/$${FURYCTL_VERSION}/furyctl-linux-amd64.tar.gz" | tar -xz
    - mv furyctl /usr/local/bin
    - chmod +x /usr/local/bin/furyctl
    - tests/e2e/ekscluster/furyctl_delete.expect $(cat ./last_furyctl_yaml.txt)
    - aws s3 rm s3://e2e-drone-eks/$CLUSTER_NAME --recursive
---
name: e2e-ekscluster-upgrades
kind: pipeline
type: docker

depends_on:
  - qa

clone:
  depth: 1

trigger:
  ref:
    - refs/tags/e2e-full-**
    - refs/tags/v**

steps:
- name: run-tests
  image: quay.io/sighup/e2e-testing:2.24.17_1.1.0_3.12.0_1.31.1_5.6.0_4.33.3
  environment:
    FURYCTL_VERSION: "v0.31.1"
    DISTRIBUTION_VERSION: "v1.31.0"
    CLUSTER_NAME: e2e-eks-${DRONE_BUILD_NUMBER}-upgrades
    DEBIAN_FRONTEND: noninteractive
    AWS_ACCESS_KEY_ID:
      from_secret: aws_access_key_id
    AWS_SECRET_ACCESS_KEY:
      from_secret: aws_secret_access_key
    AWS_REGION:
      from_secret: aws_region
  commands:
    - apt-get install -y expect
    - echo "Installing the correct furyctl version..."
    - curl -L "https://github.com/sighupio/furyctl/releases/download/$${FURYCTL_VERSION}/furyctl-linux-amd64.tar.gz" | tar -xz
    - mv furyctl /usr/local/bin
    - chmod +x /usr/local/bin/furyctl
    - ./tests/e2e/ekscluster-upgrades/e2e-ekscluster-upgrades.sh

- name: cleanup
  image: quay.io/sighup/e2e-testing:2.24.17_1.1.0_3.12.0_1.31.1_5.6.0_4.33.3
  environment:
    FURYCTL_VERSION: "v0.31.1"
    CLUSTER_NAME: e2e-eks-${DRONE_BUILD_NUMBER}-upgrades
    DEBIAN_FRONTEND: noninteractive
    DISTRIBUTION_VERSION: "v1.31.0"
    AWS_ACCESS_KEY_ID:
      from_secret: aws_access_key_id
    AWS_SECRET_ACCESS_KEY:
      from_secret: aws_secret_access_key
    AWS_REGION:
      from_secret: aws_region
  commands:
    - apt-get install -y expect
    - echo "Installing the correct furyctl version..."
    - curl -L "https://github.com/sighupio/furyctl/releases/download/$${FURYCTL_VERSION}/furyctl-linux-amd64.tar.gz" | tar -xz
    - mv furyctl /usr/local/bin
    - chmod +x /usr/local/bin/furyctl
    - tests/e2e/ekscluster/furyctl_delete.expect tests/e2e/ekscluster-upgrades/manifests/furyctl-init-cluster-1.31.0.yaml
    - aws s3 rm s3://e2e-drone-eks/$CLUSTER_NAME --recursive

---
kind: pipeline
type: docker
name: scheduled-aws-nuke

trigger:
  event:
    - cron
    - tag
  cron:
    - "0 23 * * *" # Run at 11 PM every day
  ref:
    include:
      - refs/tags/aws-nuke-ci-**

clone:
  depth: 1

steps:
  - name: run-aws-nuke
    image: amazon/aws-cli:latest
    environment:
      AWS_ACCESS_KEY_ID:
        from_secret: aws_access_key_id
      AWS_SECRET_ACCESS_KEY:
        from_secret: aws_secret_access_key
      AWS_DEFAULT_REGION: eu-west-1
      ACCOUNT_ID_PROD:
        from_secret: aws_account_id_prod
    commands:
      # Install required tools
      - yum update -y
      - yum install -y wget tar gzip jq
      
      # Install AWS Nuke
      - wget https://github.com/rebuy-de/aws-nuke/releases/download/v2.25.0/aws-nuke-v2.25.0-linux-amd64.tar.gz
      - tar -xvf aws-nuke-v2.25.0-linux-amd64.tar.gz
      - mv aws-nuke-v2.25.0-linux-amd64 /usr/local/bin/aws-nuke
      - chmod +x /usr/local/bin/aws-nuke
      - export ACCOUNT_ID=$(aws sts get-caller-identity | jq -r ".Account")
      - sed "s/ACCOUNT_ID_PLACEHOLDER/$ACCOUNT_ID/" tests/e2e/ekscluster/awsnuke/config.yml > ./aws-nuke-config.yml
      - sed -i "s/ACCOUNT_ID_PROD_PLACEHOLDER/$ACCOUNT_ID_PROD/" ./aws-nuke-config.yml
      # Run AWS Nuke
      - aws-nuke -c ./aws-nuke-config.yml --force --no-dry-run
      - aws s3 rm s3://e2e-drone-eks --recursive

---
name: release
kind: pipeline
type: docker

depends_on:
  - e2e-kubernetes-1.31
  - e2e-kubernetes-1.30.0-to-1.31.0

platform:
  os: linux
  arch: amd64

trigger:
  ref:
    include:
      - refs/tags/v**
    exclude:
      - refs/tags/**-docs*

steps:
  - name: prepare-release-notes
    image: quay.io/sighup/fury-release-notes-plugin:3.7_2.8.4
    depends_on: [clone]
    settings:
      release_notes_file_path: release-notes.md
    when:
      ref:
        include:
          - refs/tags/v**
        exclude:
          - refs/tags/**-docs*

  - name: publish-prerelease
    image: plugins/github-release
    pull: always
    depends_on:
      - prepare-release-notes
    settings:
      api_key:
        from_secret: github_token
      file_exists: skip
      files:
        - kfd.yaml
      prerelease: true
      overwrite: true
      title: "Prerelease ${DRONE_TAG}"
      note: release-notes.md
      checksum:
        - md5
        - sha256
    when:
      ref:
        include:
          - refs/tags/v**-rc**
        exclude:
          - refs/tags/**-docs*

  - name: publish-stable
    image: plugins/github-release
    pull: always
    depends_on:
      - prepare-release-notes
    settings:
      api_key:
        from_secret: github_token
      file_exists: skip
      files:
        - kfd.yaml
      prerelease: false
      overwrite: true
      title: "Release ${DRONE_TAG}"
      note: release-notes.md
      checksum:
        - md5
        - sha256
    when:
      ref:
        exclude:
          - refs/tags/v**-rc**
          - refs/tags/**-docs*
        include:
          - refs/tags/v**