pipeline.yml

---
resource_types:
- name: pivnet
  type: docker-image
  source:
    repository: pivotalcf/pivnet-resource
    tag: latest-final
resources:
- name: template
  type: git
  source:
    uri: https://github.com/pivotal-cf/terraforming-aws.git
    # tag_filter: v0.24.0
    branch: master
- name: config
  type: git
  source:
    uri: https://github.com/making/pks-pipeline-aws.git
    branch: master
- name: terraform-state
  type: s3
  source:
    disable_ssl: false
    access_key_id: ((aws_access_key_id))
    secret_access_key: ((aws_secret_access_key))
    endpoint: ((s3_endpoint))
    bucket: ((s3_output_bucket))
    region_name: ((aws_region))
    versioned_file: terraform.tfstate
- name: pks
  type: pivnet
  source:
    api_token: ((pivnet_api_token))
    product_slug: pivotal-container-service
    product_version: 1\.3\..*
- name: pcf-pipelines
  type: git
  source:
    uri: https://github.com/pivotal-cf/pcf-pipelines.git
    tag_filter: v0.23.13
- name: pivnet-opsmgr
  type: pivnet
  source:
    api_token: ((pivnet_api_token))
    product_slug: ops-manager
    product_version: 2\.4\.4

jobs:
- name: bootstrap-terraform-state
  build_logs_to_retain: 5
  serial_groups: [terraform]
  plan:
  - get: pcf-pipelines
  - task: create-bucket
    params:
      S3_BUCKET_TERRAFORM: ((s3_output_bucket))
      S3_ENDPOINT: ((s3_endpoint))
      AWS_DEFAULT_REGION: ((aws_region))
      AWS_ACCESS_KEY_ID: ((aws_access_key_id))
      AWS_SECRET_ACCESS_KEY: ((aws_secret_access_key))
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: mesosphere/aws-cli
      run:
        path: sh
        args: 
        - -c
        - |
          LS=$(aws --endpoint-url ${S3_ENDPOINT} s3 ls | grep ${S3_BUCKET_TERRAFORM})
          if [ "${LS}" = "" ];then
            aws --endpoint-url ${S3_ENDPOINT} s3 mb s3://${S3_BUCKET_TERRAFORM}
            aws --endpoint-url ${S3_ENDPOINT} s3api put-bucket-versioning --bucket ${S3_BUCKET_TERRAFORM} --versioning-configuration Status=Enabled            
          else
            echo "${S3_BUCKET_TERRAFORM} already exists."
          fi
  - task: create-terraform-state
    params:
      S3_BUCKET_TERRAFORM: ((s3_output_bucket))
      S3_ENDPOINT: ((s3_endpoint))
      S3_REGION: ((aws_region))
      AWS_ACCESS_KEY_ID: ((aws_access_key_id))
      AWS_SECRET_ACCESS_KEY: ((aws_secret_access_key))
    file: pcf-pipelines/tasks/create-initial-terraform-state/task.yml


- name: pave-aws
  build_logs_to_retain: 5
  serial_groups: [terraform]
  plan:
  - aggregate:
    - get: template
    - get: terraform-state
    - get: pivnet-opsmgr
      params:
        globs: ["*AWS.yml"]
  - task: find-ami
    params:
      REGION: ((aws_region))
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: pivnet-opsmgr
      outputs:
      - name: ami
      run:
        path: bash
        args:
        - -c
        - |
          set -eo pipefail 
          ami=$(grep $REGION pivnet-opsmgr/*.yml | cut -d' ' -f2)
          echo $ami > ami/ami
  - task: terraform-apply
    params:
      TF_VAR_region: ((aws_region))
      TF_VAR_access_key: ((aws_access_key_id))
      TF_VAR_secret_key: ((aws_secret_access_key))
      TF_VAR_availability_zones: ((availability_zones))
      TF_VAR_env_name: ((env_name))
      TF_VAR_dns_suffix: ((dns_suffix))
      TF_VAR_ops_manager_instance_type: ((ops_manager_instance_type))
      TF_VAR_hosted_zone: ((hosted_zone))
      TF_VAR_public_subnet_tags: ((public_subnet_tags))
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: template
      - name: terraform-state
      - name: ami
      outputs:
      - name: tfstate-output
      run:
        path: bash
        args: 
        - -c
        - |
          set -eo pipefail 
          export TF_VAR_ops_manager_ami=$(cat ami/ami)
          
          LF=$(printf '\\\012_')
          LF=${LF%_}
          
          # Fix IAM
          sed -i 's/"elasticloadbalancing:DescribeLoadBalancers"/"elasticloadbalancing:DescribeLoadBalancers","elasticloadbalancing:DeregisterInstancesFromLoadBalancer","elasticloadbalancing:RegisterInstancesWithLoadBalancer"/' template/modules/ops_manager/templates/iam_policy.json
          # For PKS clusters
          sed -i "s|  source = \"../modules/infra\"|  source = \"../modules/infra\"${LF}  public_subnet_tags = \"\${var.public_subnet_tags}\"|" template/terraforming-pks/main.tf
          sed -i 's/var.tags, map("Name", "${var.env_name}-public/var.tags, var.public_subnet_tags, map("Name", "${var.env_name}-public/' template/modules/infra/networking.tf
          cat <<EOF >> tmp.tf
          variable "public_subnet_tags" {
            type        = "map"
            default     = {}
            description = "tags to assign to public subnets. Used to identify pks clusters. See https://docs.pivotal.io/runtimes/pks/1-3/deploy-workloads.html#aws"
          }
          EOF
          cat tmp.tf >> template/terraforming-pks/variables.tf
          cat tmp.tf >> template/modules/infra/variables.tf

          cd template
          git diff | cat
          cd -

          terraform init \
                    template/terraforming-pks
          terraform plan \
                    -out terraform.tfplan \
                    -state terraform-state/terraform.tfstate \
                    template/terraforming-pks
          terraform apply \
                    -state-out tfstate-output/terraform.tfstate \
                    terraform.tfplan
    ensure:
      put: terraform-state
      params:
        file: tfstate-output/terraform.tfstate

- name: config-authentication
  build_logs_to_retain: 5
  serial_groups: [terraform]
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - pave-aws
      trigger: true
    - get: pcf-pipelines
  - task: config-opsman
    params:
      OM_USERNAME: ((ops_mgr_usr))
      OM_PASSWORD: ((ops_mgr_pwd))
      OM_DECRYPTION_PASSPHRASE: ((om_decryption_pwd))
      OM_SKIP_SSL_VALIDATION: true
      OM_CERT_PEM: ((ops_mgr_cert_pem))
      OM_PRIVATE_PEM: ((ops_mgr_private_pem))
      # for pcf-pipeline
      OPS_MGR_USR: ((ops_mgr_usr))
      OPS_MGR_PWD: ((ops_mgr_pwd))
      OM_DECRYPTION_PWD: ((om_decryption_pwd))
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: pcf-pipelines
      run:
        path: bash
        args: 
        - -c
        - |
          set -euo pipefail        
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          echo "OSPMAN: https://${OM_TARGET}"

          # for pcf-pipelines
          export OPSMAN_DOMAIN_OR_IP_ADDRESS=${OM_TARGET}
          ln -s /usr/local/bin/om /usr/local/bin/om-linux
          ./pcf-pipelines/tasks/config-opsman/task.sh

          # Configure TLS
          if [ "${OM_CERT_PEM}" != "" ];then
            cat <<EOF >> cert.pem
          ${OM_CERT_PEM}
          EOF
            cat <<EOF >> private.pem
          ${OM_PRIVATE_PEM}
          EOF
            om update-ssl-certificate \
              --certificate-pem="$(cat cert.pem)" \
              --private-key-pem="$(cat private.pem)"
            until $(curl --output /dev/null -k --silent --head --fail https://${OM_TARGET}/setup); do
              printf '.'
              sleep 5
            done
          fi

- name: config-vm-types
  build_logs_to_retain: 5
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - config-authentication
      trigger: true
    - get: config
  - task: config-vm-types
    params:
      OM_USERNAME: ((ops_mgr_usr))
      OM_PASSWORD: ((ops_mgr_pwd))
      OM_SKIP_SSL_VALIDATION: true
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: config
      run:
        path: bash
        args: 
        - -c
        - |
          set -euo pipefail
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          om curl -s -p /api/v0/vm_types | yq -y . | bosh int - > vm-types-old.yml
          bosh int vm-types-old.yml -o config/config/director/ops-vm-types.yml > vm-types-new.yml
          echo "** Diff **"
          diff vm-types-old.yml vm-types-new.yml | cat || true
          om curl -s -p /api/v0/vm_types -x PUT \
             -d "$(cat vm-types-new.yml | yq .)"

- name: config-director
  build_logs_to_retain: 5
  serial_groups: [terraform]
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - config-vm-types
      trigger: true
    - get: template
    - get: config
  - task: config-director
    params:
      OM_USERNAME: ((ops_mgr_usr))
      OM_PASSWORD: ((ops_mgr_pwd))
      OM_SKIP_SSL_VALIDATION: true
      OM_TRUSTED_CERTS: ((ops_mgr_trusted_certs))
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: template
      - name: config
      run:
        path: bash
        args: 
        - -c
        - |
          set -euo pipefail
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          export TF_DIR=terraform-state
          ./config/config/director/create-vars.sh
          om configure-director \
            --config ./config/config/director/config.yml \
            --vars-file vars.yml

- name: upload-pks
  build_logs_to_retain: 5
  serial_groups: [terraform]
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - config-director
      trigger: true
    - get: pcf-pipelines
    - get: pivnet-product
      resource: pks
      params:
        globs:
        - "pivotal-container-service-*.pivotal"
  - task: upload-tile
    params:
      # for pcf-pipeline
      OPSMAN_CLIENT_ID: ""
      OPSMAN_CLIENT_SECRET: ""
      OPS_MGR_USR: ((ops_mgr_usr))
      OPS_MGR_PWD: ((ops_mgr_pwd))
      PIVNET_API_TOKEN: ((pivnet_api_token))
      NO_PROXY: ""
      OM_IP: ""
      IAAS: aws
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: pcf-pipelines
      - name: pivnet-product
      run:
        path: bash
        args: 
        - -c
        - |
          set -euo pipefail
          ln -s /usr/local/bin/om /usr/local/bin/om-linux
          wget https://github.com/pivotal-cf/pivnet-cli/releases/download/v0.0.55/pivnet-linux-amd64-0.0.55
          install pivnet-linux-amd64-0.0.55 /usr/local/bin/pivnet-cli
          export OPSMAN_DOMAIN_OR_IP_ADDRESS=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          ./pcf-pipelines/tasks/upload-product-and-stemcell/task.sh
  - task: stage-tile
    params:
      # for pcf-pipeline
      OPSMAN_CLIENT_ID: ""
      OPSMAN_CLIENT_SECRET: ""
      OPSMAN_USERNAME: ((ops_mgr_usr))
      OPSMAN_PASSWORD: ((ops_mgr_pwd))
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: pcf-pipelines
      - name: pivnet-product
      run:
        path: bash
        args: 
        - -c
        - |
          set -euo pipefail
          apt-get install -y ruby
          ln -s /usr/local/bin/om /usr/local/bin/om-linux
          export OPSMAN_DOMAIN_OR_IP_ADDRESS=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          ./pcf-pipelines/tasks/stage-product/task.sh || true

- name: config-pks
  build_logs_to_retain: 5
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - upload-pks
      trigger: true
    - get: template
    - get: config
    - get: pcf-pipelines
    - get: pks
      passed:
      - upload-pks
      params:
        globs: 
        - "pks-linux-*"
      trigger: true
  - task: config-pks
    params:
      CERT_PEM: ((ops_mgr_cert_pem))
      KEY_PEM: ((ops_mgr_private_pem))
      # for pcf-pipeline
      OM_USERNAME: ((ops_mgr_usr))
      OM_PASSWORD: ((ops_mgr_pwd))
      OM_SKIP_SSL_VALIDATION: true
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: template
      - name: config
      - name: pcf-pipelines
      - name: pks
      run:
        path: bash
        args: 
        - -c
        - |
          set -eo pipefail
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          export TF_DIR=terraform-state
          export ADDONS_DIR=`pwd`/config/config/pks/addons
          ./config/config/pks/create-vars.sh
          om configure-product \
            --config ./config/config/pks/config.yml \
            --vars-file vars.yml

          PKS_DOMAIN=$(cat $TF_DIR/terraform.tfstate | jq -r '.modules[0].outputs.pks_api_endpoint.value')
          echo "PKS API: https://${PKS_DOMAIN}:9021"
          echo "UAA    : https://${PKS_DOMAIN}:8443"

- name: deploy-pks
  build_logs_to_retain: 5
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - config-pks
      trigger: true
    - get: pcf-pipelines
  - task: apply-changes
    params:
      # for pcf-pipeline
      OPSMAN_USERNAME: ((ops_mgr_usr))
      OPSMAN_PASSWORD: ((ops_mgr_pwd))
      OPSMAN_CLIENT_ID: ""
      OPSMAN_CLIENT_SECRET: ""
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: pcf-pipelines
      run:
        path: bash
        args: 
        - -c
        - |
          set -euo pipefail
          ln -s /usr/local/bin/om /usr/local/bin/om-linux
          export OPSMAN_DOMAIN_OR_IP_ADDRESS=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')          
          ./pcf-pipelines/tasks/apply-changes/task.sh
- name: show-next-instructions
  build_logs_to_retain: 5
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - deploy-pks
      trigger: true
    - get: config
  - task: show-next-instructions
    params:
      OM_USERNAME: ((ops_mgr_usr))
      OM_PASSWORD: ((ops_mgr_pwd))
      OM_SKIP_SSL_VALIDATION: true
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: config
      run:
        path: bash
        args: 
        - -c
        - |
          set -eo pipefail
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          export TF_DIR=$(pwd)/terraform-state
          ./config/config/pks/show-next-instructions.sh
- name: wipe-env
  build_logs_to_retain: 5
  serial_groups: [terraform]
  ensure:
    put: terraform-state
    params:
      file: tfstate-output/terraform.tfstate
  plan:
  - aggregate:
    - get: template
    - get: terraform-state
      # passed:
      # - config-authentication
    - get: pcf-pipelines
  - task: delete-installation
    params:
      OM_USERNAME: ((ops_mgr_usr))
      OM_PASSWORD: ((ops_mgr_pwd))
      OM_SKIP_SSL_VALIDATION: true
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      - name: pcf-pipelines
      run:
        path: bash
        args: 
        - -c
        - |
          set +e  
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          om -r 60 delete-installation || true
  - task: terraform-destory
    params:
      TF_VAR_region: ((aws_region))
      TF_VAR_access_key: ((aws_access_key_id))
      TF_VAR_secret_key: ((aws_secret_access_key))
      TF_VAR_availability_zones: ((availability_zones))
      TF_VAR_env_name: ((env_name))
      TF_VAR_dns_suffix: ((dns_suffix))
      TF_VAR_ops_manager_instance_type: ((ops_manager_instance_type))
      TF_VAR_hosted_zone: ((hosted_zone))
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: template
      - name: terraform-state
      outputs:
      - name: tfstate-output
      run:
        path: sh
        args: 
        - -c
        - |
          set -e
          terraform init \
                    template/terraforming-pks
          terraform destroy \
                    -force \
                    -state terraform-state/terraform.tfstate \
                    -state-out tfstate-output/terraform.tfstate \
                    template/terraforming-pks
- name: show-ssh-opsman-script
  build_logs_to_retain: 5
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - config-director
  - task: show-ssh-opsman-script
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      run:
        path: bash
        args: 
        - -c
        - |
          set -eo pipefail
          cp terraform-state/terraform.tfstate ./
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          OPS_MANAGER_SSH_PRIVATE_KEY=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_ssh_private_key.value')
          
          cat <<EOF
          #!/bin/bash
          cat << KEY > opsman.pem
          ${OPS_MANAGER_SSH_PRIVATE_KEY}
          KEY
          chmod 600 opsman.pem
          ssh -i opsman.pem -o "StrictHostKeyChecking=no" -l ubuntu ${OM_TARGET}
          EOF
- name: configure-bosh-cli
  build_logs_to_retain: 5
  plan:
  - aggregate:
    - get: terraform-state
      passed:
      - config-pks
  - task: configure-bosh-cli
    params:
      OM_USERNAME: ((ops_mgr_usr))
      OM_PASSWORD: ((ops_mgr_pwd))
      OM_SKIP_SSL_VALIDATION: true
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cfinfrastructure/releng-tools
          tag: latest
      inputs:
      - name: terraform-state
      run:
        path: bash
        args: 
        - -c
        - |
          set -eo pipefail
          cp terraform-state/terraform.tfstate ./
          export OM_TARGET=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_dns.value')
          OPS_MANAGER_SSH_PRIVATE_KEY=$(cat terraform-state/terraform.tfstate | jq -r '.modules[0].outputs.ops_manager_ssh_private_key.value')
          
          cat <<EOF > opsman.pem
          ${OPS_MANAGER_SSH_PRIVATE_KEY}
          EOF
          chmod 400 opsman.pem
          GUID=$(om curl -s -p "/api/v0/staged/products" | jq -r '.[] | select(.type == "p-bosh") | .guid')
          BOSH_CLI=$(om curl -s -p "/api/v0/deployed/director/credentials/bosh_commandline_credentials" | jq -r '.credential')
          ssh -q -i opsman.pem \
            -o "StrictHostKeyChecking=no" \
            ubuntu@${OM_TARGET} "echo $BOSH_CLI | sed 's/ /\n/g' | sed 's/^/export /g' | sed '/bosh/d' | sudo tee /etc/profile.d/bosh.sh" > /dev/null