iam.yml

#
# Copyright (c) 2021 Microsoft (Catena-X Consortium)
#
# See the AUTHORS file(s) distributed with this work for additional
# information regarding authorship.
#
# See the LICENSE file(s) distributed with this work for
# additional information regarding license terms.
#

name: IAM

on: 
  push:
    paths:
      # this workflow file
      - '.github/workflows/iam.yml'
      # deployment manifest files
      - 'infrastructure/manifests/iamcentralidp.yaml'
      - 'infrastructure/manifests/iamsharedidp.yaml'
      # ingress manifest file
      - 'infrastructure/manifests/iamcentralidp-ingress.yaml'
      - 'infrastructure/manifests/iamsharedidp-ingress.yaml'
      # KeyCloak Docker files
      - 'coreservices/iam/docker/**'
      - 'coreservices/iam/themes/**'
    branches:
      # Integration environment
      - main
      # DevOps and IAM team integration branch
      - feature/CAX-12-devops
      # Onboarding and Portal Dev Space
      - feature/CAX-portal
  workflow_dispatch:

jobs:
  ########################################
  # First job to determine the environment
  ########################################

  environment:
    # name of the job starts with a "run-level" subordinate to the workflow such that we can
    # depend on them in order to implement workflow dependencies
    name: 90 IAM Determine Target Environment
    runs-on: ubuntu-latest
    outputs:
      workspace: ${{ steps.setvars.outputs.workspace }}

    steps:
      - name: Set variables
        id: setvars
        run: |
          if [[ "${{github.repository}}" == eclipse/tractusx ]]; then
             if [[ "${{github.ref}}" == refs/heads/main ]]; then
                echo "Determined PRODUCTION"
                echo "::set-output name=workspace::prod"
             else
                echo "Unsupported Environment on ECLIPSE. Leaving Workspace empty."
             fi
          elif [[ "${{github.repository}}" == catenax/tractusx ]]; then
              if [[ "${{github.ref}}" == refs/heads/main ]]; then
                echo "Determined INTEGRATION"
                echo "::set-output name=workspace::int"
              else
                echo "Unsupported Branch on CATENAX. Leaving Workspace empty."
              fi
          elif [[ "${{github.repository}}" == tractusx-team-portal-onboarding/tractusx ]]; then
            if [[ "${{github.ref}}" == refs/heads/feature/CAX-portal ]]; then
                echo "Determined dev003"
                echo "::set-output name=workspace::dev003"
            else 
                echo "Unsupported Branch on tractusx-team-portal-onboarding. Leaving Workspace empty."
            fi
          else
            echo "Unsupported Environment/Repository. Leaving Workspace empty."
          fi

  ##########################################
  # Second job does the deployment to AKS
  ##########################################
  # FROM HERE ON: NO ADAPTION NEEDED ANYMORE

  deploy:
    # name of the job starts with a "run-level" subordinate to the workflow such that we can
    # depend on them in order to implement workflow dependencies
    name: 91 IAM Deployment
    runs-on: ubuntu-latest
    # rely on the first job
    needs: environment
    # rely on successful detection of the workspace, ignore if empty
    if: ${{needs.environment.outputs.workspace}}
    env:
      WORKSPACE: ${{needs.environment.outputs.workspace}}
      CLUSTER_ISSUER: service
      CATENA_SERVICE_URL: https://catenax${{needs.environment.outputs.workspace}}akssrv.germanywestcentral.cloudapp.azure.com
      CATENA_SERVICE_HOST: catenax${{needs.environment.outputs.workspace}}akssrv.germanywestcentral.cloudapp.azure.com
      CATENA_REGISTRATION_URL: https://catenax-${{needs.environment.outputs.workspace}}-app-onboarding.azurewebsites.net
      DB_HOST: catenax${{needs.environment.outputs.workspace}}database
      DB_USER: ${{secrets.CATENAX_USER}}
      DB_PASSWORD: ${{secrets.CATENAX_PASSWORD}}
      CONTAINER_REGISTRY: catenaxacr.azurecr.io
      CONTAINER_IMAGE_CENTRALIDP: catenaxacr.azurecr.io/keycloak/centralidp${{needs.environment.outputs.workspace}}:latest
      CONTAINER_IMAGE_SHAREDIDP: catenaxacr.azurecr.io/keycloak/sharedidp${{needs.environment.outputs.workspace}}:latest
      KEYCLOAK_ADMIN_USER: ${{secrets.KEYCLOAK_ADMIN_USER}}
      KEYCLOAK_ADMIN_PASSWORD: ${{secrets.KEYCLOAK_ADMIN_PASSWORD}}
      
    steps:
      # Wait for infrastructure deployments to terminate
      - name: Wait for Infrastructure
        uses: lewagon/wait-on-check-action@v1.0.0
        with:
          ref: ${{github.ref}}
          check-regexp: 0.*
          repo-token: ${{secrets.GITHUB_TOKEN}}
          wait-interval: 30
          allowed-conclusions: success,skipped,cancelled

      # This is needed to interact with the subscription
      - name: Login via Azure CLI
        uses: azure/login@v1
        with:
          creds: ${{secrets.AZURE_CREDENTIALS}}

      # Get the latest sources
      - name: Checkout
        uses: actions/checkout@v2

      # Build and push KeyCloak custom images for central and shared idp instances
      - name: 'Build and push KeyCloak images'
        uses: azure/docker-login@v1
        with:
          login-server: ${{env.CONTAINER_REGISTRY}}
          username: ${{secrets.AZURE_REGISTRY_USERNAME}}
          password: ${{secrets.AZURE_REGISTRY_PASSWORD}}
      - run: |      
          docker build -f ./coreservices/iam/docker/Dockerfile.centralidp -t ${{env.CONTAINER_IMAGE_CENTRALIDP}} ./coreservices/iam/
          docker push ${{env.CONTAINER_IMAGE_CENTRALIDP}}
          docker build -f ./coreservices/iam/docker/Dockerfile.sharedidp -t ${{env.CONTAINER_IMAGE_SHAREDIDP}} ./coreservices/iam/
          docker push ${{env.CONTAINER_IMAGE_SHAREDIDP}}

      # Login to K8
      - name: Kubernetes Login
        uses: azure/aks-set-context@v1
        with:
          creds: '${{secrets.AZURE_CREDENTIALS}}' # Azure credentials
          resource-group: 'catenax-${{needs.environment.outputs.workspace}}-rg'
          cluster-name: 'catenax-${{needs.environment.outputs.workspace}}-aks-services'
        id: login

      # Deploy central idp service
      - name: Deploy central idp service on AKS
        working-directory: ./infrastructure/manifests        
        run: |
          cat iamcentralidp.yaml | envsubst | kubectl apply -f -
          cat iamcentralidp-ingress.yaml | envsubst | kubectl apply -f -         

      # Deploy shared idp service
      - name: Deploy shared idp service on AKS
        working-directory: ./infrastructure/manifests        
        run: |
          cat iamsharedidp.yaml | envsubst | kubectl apply -f -
          cat iamsharedidp-ingress.yaml | envsubst | kubectl apply -f - 
        
      # cert-manager <1.18 bugfix: Get Pending Solver, we have to wait a bit as it may take some time for the solver to come up
      - name: Kubernetes Try To Find Pending Solver
        id: try_solver
        working-directory: ./infrastructure/terraform
        run: |
          sleep 15s
          echo "::set-output name=SOLVER::$(kubectl describe ingress -n iam cm-acme | sed -n 's/Name:[\w]*\([\S]*\)/\1/p')"

      # cert-manager <1.18 bugfix: Patch any pending solver
      - name: Modify a pending <1.18 cert-manager solver
        working-directory: ./infrastructure/manifests
        if: "${{steps.try_solver.outputs.SOLVER}}"
        run: |
          echo "Found a pending solver ${{steps.try_solver.outputs.SOLVER}} which we need to patch"
          kubectl get ingress ${{steps.try_solver.outputs.SOLVER}} -n iam -o yaml | sed '/^\w.*kubernetes.io\/ingress.class: service\w*$/d' | sed "/spec:$/a\  ingressClassName: service" | kubectl apply -f -

      - name: Rollout the idp instances
        working-directory: ./infrastructure/manifests
        run: |
          kubectl rollout restart deployment iamcentralidp -n iam
          kubectl rollout restart deployment iamsharedidp -n iam