cf-onprem

#!/usr/bin/env bash
#

#set -x
DIR=$(dirname $0)

if [ -f "${DIR}/env-vars" ]; then
. ${DIR}/env-vars
fi

HELM=${HELM:-helm}

CHANNEL="${CF_HELM_CHANNEL:-dev}"
source ${DIR}/scripts/helpers.sh


msg "Checking helm binary on your system"
checkHelmInstalled $HELM
readonly RELEASE=cf

readonly WORKING_DIR="$(dirname "$0")"
readonly SERVICE_ACCOUNT_FILE="${WORKING_DIR}/sa.json"
readonly VALUES_FILE="${WORKING_DIR}/values.yaml"
readonly DOCKER_CFG_YAML="${WORKING_DIR}/dockercfg.yaml"
readonly WEBTLS_VALUES_FILE="${WORKING_DIR}/webtls.yaml"
NAMESPACE=${NAMESPACE:-codefresh}

usage() {
  echo "Usage:
  $0 [ options ]

  options:
  --set              - sets helm release values from command line, example --set global.mtu=1400
  --repo-channel     - helm repo channel of http://charts.codefresh.io/
  --helm-chart       - helm chart to use. if not set we will use codefresh-onprem-<REPO-CHANNEL>/codefresh 
  --version          - helm repo version
  --debug            - run helm in debug mode
  --skip-validator   - skip validator running
  --dry-run          - dry-run mode - echo command instead of actual running
  --do-template      - runs helm template and outputs into out/ directory
  --private-registry - pull the images from a private docker registry
  "
}

generateDockerConfig(){
if [[ -n "${PRIVATE_REGISTRY}" ]]; then
  echo "Using custom registry to pull cf images from..."
  if [[ -z ${REG_USER} ]] || [[ -z ${REG_PASSWORD} ]]; then err "Custom docker registry login and/or password are not set"; fi
  DOCKER_CFG_VAR=$(echo -n "${REG_USER}:${REG_PASSWORD}" | $BASE64)
  REGISTRY=$(echo $PRIVATE_REGISTRY | cut -d '/' -f1)
else
  REGISTRY='gcr.io'
  echo "generateDockerConfig: SERVICE_ACCOUNT_FILE=$SERVICE_ACCOUNT_FILE "
  if [[ ! -f ${SERVICE_ACCOUNT_FILE} ]]; then
    echo "Error: Docker registry service account ${SERVICE_ACCOUNT_FILE} is not found"
    return 1
  fi
  DOCKER_CFG_JSON=$(cat ${SERVICE_ACCOUNT_FILE})
  DOCKER_CFG_VAR=$(echo -n "_json_key:${DOCKER_CFG_JSON}" | $BASE64)

  if [[ -z "${DOCKER_CFG_VAR}" ]]; then
    echo "Error: Cannot parse docker registry service account in ${SERVICE_ACCOUNT_FILE}, it is empty"
    return 1
  fi
fi
  cat <<EOF >${DOCKER_CFG_YAML}
---
global:
  dockerconfigjson:
    auths:
      ${REGISTRY}:
        auth: ${DOCKER_CFG_VAR}
dockerconfigjson:
  auths:
    ${REGISTRY}:
      auth: ${DOCKER_CFG_VAR}
cfui:
  dockerconfigjson:
    auths:
      ${REGISTRY}:
        auth: ${DOCKER_CFG_VAR}
runtime-environment-manager:
  dockerconfigjson:
    auths:
      ${REGISTRY}:
        auth: ${DOCKER_CFG_VAR}
onboarding-status:
  dockerconfigjson:
    auths:
      ${REGISTRY}:
        auth: ${DOCKER_CFG_VAR}
cfanalytic:
  dockerconfigjson:
    auths:
      ${REGISTRY}:
        auth: ${DOCKER_CFG_VAR}
EOF
}

generateWebTlsValuesFile() {
  
  eval "$(parse_yaml "${VALUES_FILE}" | grep tls_)"
  echo "generateWebTlsValuesFile: tls_cert=$tls_cert tls_key=$tls_key tls_selfSigned=$tls_selfSigned "
  if [[ "${tls_selfSigned}" == "true" ]]; then
     echo "Using self Signed certificates"
     #rm -fv ${WEBTLS_VALUES_FILE}
     unset SET_WEBTLS_VALUES
     return 0
  fi
  # echo "using tls_cert=$tls_cert tls_key=$tls_key"

  if [[ -z "${tls_cert}" ]]; then
     echo "Error: .Values.tls.cert is empty "
     return 1
  fi

  if [[ -z "${tls_key}" ]]; then
     echo "Error: .Values.tls.key is empty "
     return 1
  fi

  if [[ "$tls_cert" =~ ^/ ]]; then 
    tls_cert_realpath=$(realpath ${tls_cert})
  else
    tls_cert_realpath=$(realpath "${WORKING_DIR}/${tls_cert}" )
  fi

  if [[ "$tls_key" =~ ^/ ]]; then 
    tls_key_realpath=$(realpath ${tls_key})
  else
    tls_key_realpath=$(realpath "${WORKING_DIR}/${tls_key}" )
  fi

  if [[ ! -f "${tls_cert_realpath}" ]]; then
     echo "Error: .Values.tls.cert $tls_cert_realpath file does not exists "
     return 1
  fi

  if [[ ! -f "${tls_key_realpath}" ]]; then
     echo "Error: .Values.tls.key $tls_key_realpath file does not exists "
     return 1
  fi

  WEBTLSCERT=$(cat ${tls_cert_realpath} | sed 's/^/    /')
  WEBTLSKEY=$(cat ${tls_key_realpath} | sed 's/^/    /')

  WEBTLSCERT_CFUI=$(cat ${tls_cert_realpath} | sed 's/^/      /')
  WEBTLSKEY_CFUI=$(cat ${tls_key_realpath} | sed 's/^/      /')

  cat <<-EOF >${WEBTLS_VALUES_FILE}
---
ingress:
  webTlsSecretName: "star.codefresh.io"
nomios:
  ingress:
    webTlsSecretName: "star.codefresh.io"
webTLS:
  secretName: star.codefresh.io
  key: |
${WEBTLSKEY}
  cert: |
${WEBTLSCERT}

cfui:
  webTLS:
    key: |
${WEBTLSKEY_CFUI}
    cert: |
${WEBTLSCERT_CFUI}
EOF

  SET_WEBTLS_VALUES="--values ${WEBTLS_VALUES_FILE} "

}

while [[ $1 =~ ^(-(y|h)|--(help|yes|set|debug|version|repo-channel|helm-chart|tiller-namespace|skip-validator|dry-run|do-template|reg-user|reg-password|private-registry)) ]]
do
  key=$1
  value=$2
  case $key in
    -h|--help)
        usage
        exit 0
      ;;
    -y|--yes)
        YES="true"
      ;;
    --set)
        SET_VALUES="$SET_VALUES --set $value"
        shift
      ;;
    --tiller-namespace)
        TILLER_NAMESPACE="$value"
        shift
      ;;
    --repo-channel)
        CHANNEL="$value"
        shift
      ;;
    --helm-chart)
        HELM_CHART="$value"
        shift
      ;;
    --version)
        SET_VERSION="$SET_VERSION --version $value"
        shift
      ;;
    --debug)
        SET_DEBUG="--debug"
      ;;
    --skip-validator)
        SKIP_VALIDATOR="true"
      ;;
    --dry-run)
        DRY_RUN="true"
      ;;
    --do-template)
        DO_TEMPLATE="true"
      ;;
    --reg-user)
        REG_USER=$value
        shift
      ;;
    --reg-password)
        REG_PASSWORD=$value
        shift
      ;;
    --private-registry)
        PRIVATE_REGISTRY=${value}
        SET_PRIVATE_REGISTRY="--set global.privateRegistry=true --set global.dockerRegistry=${value}"
        shift
      ;;
  esac
  shift # past argument or value
done

if [[ -n "${TILLER_NAMESPACE}" && -n "${IS_HELM2}" ]]; then
   TILLER_NAMESPACE_PARAM="--tiller-namespace=${TILLER_NAMESPACE}"
fi
msg "Starting on-prem Codefresh deployment"
generateDockerConfig || err "Failed to generate docker credentials for image pulling"
generateWebTlsValuesFile || err "Web Tls certificates error"

if [[ -z "${HELM_CHART}" ]]; then
  msg "Adding Helm repo..."
  #addHelmCodefreshRepo
  readonly CODEFRESH_REPOSITORY=http://charts.codefresh.io/${CHANNEL}
  $HELM repo add codefresh-onprem-${CHANNEL} "${CODEFRESH_REPOSITORY}" || err "Failed to add helm repo codefresh-onprem-${CHANNEL} ${CODEFRESH_REPOSITORY}"
  HELM_CHART=codefresh-onprem-${CHANNEL}/codefresh
fi
if [[ -n "${IS_HELM2}" ]]; then
  cf_status=$($HELM $TILLER_NAMESPACE_PARAM status $RELEASE 2>/dev/null | awk -F': ' '$1 == "STATUS" {print $2}')
else
  cf_status=$($HELM -n $NAMESPACE status $RELEASE 2>/dev/null | awk -F': ' '$1 == "STATUS" {print $2}')
fi

if [[ -z "${cf_status}" ]]; then
  SEEDJOBS="--set global.seedJobs=true"
  CERTJOBS="--set global.certsJobs=true"
fi

if [[ -z "${cf_status}" && -z "${SKIP_VALIDATOR}" && -z "${DRY_RUN}" ]]; then
  IN_INSTALLER="true" ${DIR}/run-validator.sh
  if [[ $? != 0 ]]; then
    echo "Validation failed"
    exit 1
  fi
else 
  echo "Skipping validator because of cf_status=$cf_status or SKIP_VALIDATOR=$SKIP_VALIDATOR or DRY_RUN=$DRY_RUN"
fi

if [[ -n ${DRY_RUN} ]]; then
   echo "Dry run mode"
   SET_DRY_RUN=" --dry-run "
fi

msg "Installing/Updating Codefresh..."
# HELM_COMMAND="${HELM} upgrade ${RELEASE} ${HELM_CHART} \
#   --install \
#   --namespace "${NAMESPACE}" \
#   --values "${VALUES_FILE}" \
#   --values "${DOCKER_CFG_YAML}" \
#   --no-hooks \
#   --set cfapi.redeploy=true \
#   ${SET_WEBTLS_VALUES} \
#   ${SEEDJOBS} \
#   ${CERTJOBS} \
#   ${SET_VALUES} \
#   ${SET_VERSION} \
#   ${SET_PRIVATE_REGISTRY} \
#   ${TILLER_NAMESPACE_PARAM} \
#   ${SET_DEBUG} ${SET_DRY_RUN}"

if [[ -z "$DO_TEMPLATE" ]]; then
  HELM_COMMAND="${HELM} upgrade ${RELEASE} ${HELM_CHART} \
    --install \
    --namespace "${NAMESPACE}" \
    --values "${VALUES_FILE}" \
    --values "${DOCKER_CFG_YAML}" \
    --set cfapi.redeploy=true \
    ${SET_WEBTLS_VALUES} \
    ${SEEDJOBS} \
    ${CERTJOBS} \
    ${SET_VALUES} \
    ${SET_VERSION} \
    ${SET_PRIVATE_REGISTRY} \
    ${TILLER_NAMESPACE_PARAM} \
    ${SET_DEBUG} ${SET_DRY_RUN}"
else
  TEMPLATE_OUTPUT_DIR=${DIR}/out
  if [[ -e ${TEMPLATE_OUTPUT_DIR} ]]; then
    rm -rf ${TEMPLATE_OUTPUT_DIR}
  fi
  mkdir -p ${TEMPLATE_OUTPUT_DIR}

  if [[ -n "${IS_HELM2}" ]]; then
    HELM2_TEMPLATE_NAME_PARAM=" --name ${RELEASE} "
  else
    HELM3_TEMPLATE_NAME_ARG=" ${RELEASE} "
  fi
  HELM_COMMAND="${HELM} template ${HELM3_TEMPLATE_NAME_ARG} ${HELM_CHART} \
    ${HELM2_TEMPLATE_NAME_PARAM} \
    --output-dir $TEMPLATE_OUTPUT_DIR \
    --namespace "${NAMESPACE}" \
    --values "${VALUES_FILE}" \
    --values "${DOCKER_CFG_YAML}" \
    --set cfapi.redeploy=true \
    ${SET_WEBTLS_VALUES} \
    ${SEEDJOBS} \
    ${CERTJOBS} \
    ${SET_VALUES} \
    ${SET_PRIVATE_REGISTRY} \
    ${SET_DEBUG}"
fi

echo "Executing:
  $HELM_COMMAND"

if [[ ! "$YES" == 'true' ]]; then
  approveContext
else
  msg "Your kubectl is configured with the following context: "
	kubectl config current-context
fi

$HELM_COMMAND