Skip to content
Snippets Groups Projects
Unverified Commit 48fc4fd8 authored by Rémy Huet's avatar Rémy Huet :computer:
Browse files

Correct variables syntax

parent c3f02ca7
No related branches found
No related tags found
1 merge request!35Gestion des secrets
image: docker:stable
services:
- docker:dind
stages:
- metabuild
- build
- static_tests
- dynamic_tests
- static_tests
- dynamic_tests
- deployment
# build the container that further steps will run in in order to avoid duplicating instructions between steps
......@@ -28,7 +28,7 @@ metabuild:
- master
- dev-ci
when: manual
# build the container that was modified
build:
stage: build
......@@ -40,7 +40,7 @@ build:
- docker build -f $MODIFIED_IMAGE/Dockerfile $MODIFIED_IMAGE -t $REGISTRY/ci-builds/$CI_COMMIT_SHA
- docker push $REGISTRY/ci-builds/$CI_COMMIT_SHA
after_script:
- docker logout $REGISTRY
- docker logout $REGISTRY
tags: [build]
only:
changes:
......@@ -65,8 +65,8 @@ clair:
- wget https://github.com/arminc/clair-scanner/releases/download/v8/clair-scanner_linux_amd64
- mv clair-scanner_linux_amd64 clair-scanner
- chmod +x clair-scanner
- while( ! wget -q -O /dev/null http://docker:6060/v1/namespaces ) ; do sleep 1 ; done
- ./clair-scanner -c http://docker:6060 --ip $(hostname -i) -r clair-report.json -l clair.log -w $MODIFIED_IMAGE/clair-whitelist.yml --threshold="High" $REGISTRY/ci-builds/$CI_COMMIT_SHA
- while( ! wget -q -O /dev/null http://docker:6060/v1/namespaces ) ; do sleep 1 ; done
- ./clair-scanner -c http://docker:6060 --ip $(hostname -i) -r clair-report.json -l clair.log -w $MODIFIED_IMAGE/clair-whitelist.yml --threshold="High" $REGISTRY/ci-builds/$CI_COMMIT_SHA
artifacts:
paths:
- clair-report.json
......@@ -90,12 +90,12 @@ docker-bench-security:
- docker logout $REGISTRY
- source /etc/profile.d/ci-variables
- sed -i -e "s/$MODIFIED_IMAGE_FULL/$REGISTRY\/ci-builds\/$CI_COMMIT_SHA:latest/g" $MODIFIED_IMAGE/docker-compose.yml
# remove links to external networks to be able to start the container locally
# remove links to external networks to be able to start the container locally
- sed -i -e '/networks/,+3d' $MODIFIED_IMAGE/docker-compose.yml
# if secrets.example files exist, remove the .example extension to be able to start the container
- if [[ -d $MODIFIED_IMAGE/secrets ]]; then for i in $MODIFIED_IMAGE/secrets/*.example ; do cp $i $(echo $i| cut -d '.' -f1,2); done; fi;
- docker volume create $CONTAINER_NAME
script:
script:
- cd $MODIFIED_IMAGE
- docker-compose up -d
- git clone https://github.com/docker/docker-bench-security.git
......@@ -105,7 +105,7 @@ docker-bench-security:
paths:
- report.txt
after_script:
- docker logout $REGISTRY
- docker logout $REGISTRY
tags: [build]
only:
changes:
......@@ -116,11 +116,11 @@ docker-bench-security:
- dev-ci
# automatically deploy the container on pica01-test
deployment-test:
deployment-test:
stage: deployment
image: $REGISTRY/pica-ci:latest
variables:
- PICA_ENVIRONMENT: "TEST"
PICA_ENVIRONMENT: "TEST"
before_script:
- source /etc/profile.d/ci-variables
- export DOCKER_HOST=tcp://pica01-test.picasoft.net:2376
......@@ -131,7 +131,7 @@ deployment-test:
- echo "$DEV_DOCKER_CLIENT_CERT" > $DOCKER_CERT_PATH/cert.pem
- echo "$DEV_DOCKER_CLIENT_KEY" > $DOCKER_CERT_PATH/key.pem
script:
- echo $REGISTRY_PASSWORD | docker login $REGISTRY -u $REGISTRY_USERNAME --password-stdin
- echo $REGISTRY_PASSWORD | docker login $REGISTRY -u $REGISTRY_USERNAME --password-stdin
- docker pull $REGISTRY/ci-builds/$CI_COMMIT_SHA:latest
- docker tag $REGISTRY/ci-builds/$CI_COMMIT_SHA:latest $MODIFIED_IMAGE_FULL
- cd $MODIFIED_IMAGE
......@@ -152,11 +152,11 @@ deployment-test:
# automatically deploy the container on the production host associated with the modified image
# this will only happen after manually triggering the deployment
deployment-prod:
deployment-prod:
stage: deployment
image: $REGISTRY/pica-ci:latest
variables:
- PICA_ENVIRONMENT: "PRODUCTION"
PICA_ENVIRONMENT: "PRODUCTION"
before_script:
- source /etc/profile.d/ci-variables
- TMP_DOCKER_CA_CERT="${HOST}_DOCKER_CA_CERT" && eval DOCKER_CA_CERT_VARIABLE=\$$TMP_DOCKER_CA_CERT
......@@ -169,9 +169,9 @@ deployment-prod:
- echo "$DOCKER_CA_CERT_VARIABLE" > $DOCKER_CERT_PATH/ca.pem
- echo "$DOCKER_CLIENT_CERT_VARIABLE" > $DOCKER_CERT_PATH/cert.pem
- echo "$DOCKER_CLIENT_KEY_VARIABLE" > $DOCKER_CERT_PATH/key.pem
script:
script:
- echo $REGISTRY_PASSWORD | docker login $REGISTRY -u $REGISTRY_USERNAME --password-stdin
- docker pull $REGISTRY/ci-builds/$CI_COMMIT_SHA:latest
- docker pull $REGISTRY/ci-builds/$CI_COMMIT_SHA:latest
- docker tag $REGISTRY/ci-builds/$CI_COMMIT_SHA:latest $MODIFIED_IMAGE_FULL
- cd $MODIFIED_IMAGE
- if [[ $(docker container ls --format "{{.Names}}" | grep $CONTAINER_NAME) ]]; then docker stop $CONTAINER_NAME | xargs docker rm; fi
......@@ -189,4 +189,4 @@ deployment-prod:
refs:
- master
- dev-ci
when: manual
\ No newline at end of file
when: manual
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment