Feature/support helm in release manager

CHANGELOG.md

@@ -1,6 +1,7 @@
 # Changelog
 
 ## Unreleased
+-   Add Helm Support to Release Manager ([#866](https://github.com/opendevstack/ods-jenkins-shared-library/issues/866))
 
 ## [4.1] - 2022-11-17
 

Makefile

@@ -9,3 +9,6 @@ test:
 doc:
 	./gradlew groovydoc
 	go run render-adoc.go
+
+.PHONY: docs
+docs: doc

docs/modules/jenkins-shared-library/pages/component-pipeline.adoc

@@ -77,3 +77,7 @@ include::partial$odsComponentStageRolloutOpenShiftDeployment.adoc[leveloffset=+2
 === odsComponentStageUploadToNexus
 
 include::partial$odsComponentStageUploadToNexus.adoc[leveloffset=+2]
+
+=== odsComponentStageCopyImage
+
+include::partial$odsComponentStageCopyImage.adoc[leveloffset=+2]

docs/modules/jenkins-shared-library/pages/labelling.adoc

@@ -1,6 +1,13 @@
-= OpenShift resource labelling
+= OpenShift resource labelling with tailor
 
-== Overview
+When a rollout happens via tailor there are labels that are added regardless of whether they are in any template or not.
+This is in contrast to helm which relies on the charts setting the right labels.
+This decision avoids an unexpected pause or resume during a rollout.
+A helm rollout will have only the labels that were specified and OpenDevStack will not try to add, remove or change any labels.
+If your cluster has operators there could still be some label changes.
+
+
+== Overview of tailor labels
 
 The shared library automatically labels all OpenShift resources created in order to ease their management.
 The labels applied are based on the recommendations by:

docs/modules/jenkins-shared-library/partials/odsComponentStageCopyImage.adoc

@@ -0,0 +1,53 @@
+// Document generated by render-adoc.go from odsComponentStageCopyImage.adoc.tmpl; DO NOT EDIT.
+
+Copies a source image into the project.
+
+This is useful to get images into the OpenShift registry so that release manager will accept all images.
+
+The primary intention is for helm charts so that external images can be imported.
+
+== Options
+
+[cols="1,2"]
+|===
+| Option | Description
+
+
+| *branch* +
+_String_
+|Branch to run stage for.
+ Example: `'master'`.
+ Next to exact matches, it also supports prefixes (e.g. `feature/`) and all branches (`*`).
+
+
+| *branches* +
+_List<String>_
+|Branches to run stage for.
+ Example: `['master', 'develop']`.
+ Next to exact matches, it also supports prefixes (e.g. `feature/`) and all branches (`*`).
+
+
+| *sourceCredential* +
+_String_
+|sourceCredential is the token to use, if any, to access the source registry
+
+
+| *sourceImageUrlIncludingRegistry* +
+_String_
+|Source image to import
+
+ This needs to be in the following format: [REGISTRY/]REPO/IMAGE[:TAG]
+
+
+| *tagIntoTargetEnv* +
+_Boolean_
+|true will tag the image from the -cd namespace into the targetEnvironment that the pipeline is running for
+
+
+| *verifyTLS* +
+_Boolean_
+|verifyTLS allows the stage to ignore certificate validation errors.
+
+ The default is to verify certificate paths
+
+|===

docs/modules/jenkins-shared-library/partials/odsComponentStageCopyImage.adoc.tmpl

@@ -0,0 +1,18 @@
+Copies a source image into the project.
+
+This is useful to get images into the OpenShift registry so that release manager will accept all images.
+
+The primary intention is for helm charts so that external images can be imported.
+
+== Options
+
+[cols="1,2"]
+|===
+| Option | Description
+{{range .Options}}
+
+| *{{.Name}}* +
+_{{.Type}}_
+|{{.Description}}
+{{end}}
+|===

docs/modules/jenkins-shared-library/partials/odsComponentStageRolloutOpenShiftDeployment.adoc

@@ -67,6 +67,19 @@ _boolean_
  referenced by `chartDir` exists.
 
 
+| *helmEnvBasedValuesFiles* +
+_List<String>_
+|List of paths to values files (empty by default). Only relevant if the
+ directory referenced by `chartDir` exists.
+ These must contain a suffix called '.env.yml' - which will be replaced
+ during rollout and deployment, and then added to helmValueFiles
+
+ Passing a string literal of 'values.env.yaml' will be expanded to their respective environments.
+
+ For example: 'values.env.yaml' will become 'values.dev.yaml', 'values.test.yaml' or 'values.prod.yaml'.
+ That means creating the usual files that are named after their respective environment are parsed as usual.
+
+
 | *helmPrivateKeyCredentialsId* +
 _String_
 |Credentials name of the private key used by helm-secrets (defaults to
@@ -158,6 +171,10 @@ _boolean_
 
 |===
 
-All the created or updated OpenShift resources are automatically labeled to ease their management.
+== Differences between tailor and helm deployments
+
+When tailor does the rollout, all the created or updated OpenShift resources are automatically labeled to ease their management.
+This is in contrast to helm rollouts which rely on the chart providing the desired labels.
+Add labels either via the chart directly or via supplying them in the values or values files.
 
 Detailed information about the labelling can be found xref:jenkins-shared-library:labelling.adoc[here].

docs/modules/jenkins-shared-library/partials/odsComponentStageRolloutOpenShiftDeployment.adoc.tmpl

@@ -18,6 +18,10 @@ _{{.Type}}_
 {{end}}
 |===
 
-All the created or updated OpenShift resources are automatically labeled to ease their management.
+== Differences between tailor and helm deployments
+
+When tailor does the rollout, all the created or updated OpenShift resources are automatically labeled to ease their management.
+This is in contrast to helm rollouts which rely on the chart providing the desired labels.
+Add labels either via the chart directly or via supplying them in the values or values files.
 
 Detailed information about the labelling can be found xref:jenkins-shared-library:labelling.adoc[here].

docs/modules/jenkins-shared-library/partials/odsComponentStageScanWithSonar.adoc

@@ -56,4 +56,12 @@ _boolean_
 |Whether to fail the build if the quality gate defined in the SonarQube
  project is not reached. Defaults to `false`.
 
+
+| *resourceName* +
+_String_
+|Name of `BuildConfig`/`ImageStream` of the image that we want to scan (defaults to `context.componentId`).
+ BuildOpenShiftImageStage puts the imageRef into a map with the `resourceName` as key.
+ In order to be able to receive the imageRef for scanning, the `resourceName` needs
+ to be the same as in BuildOpenShiftImageStage.
+
 |===

src/org/ods/component/AbstractDeploymentStrategy.groovy

@@ -0,0 +1,55 @@
+package org.ods.component
+
+import groovy.transform.TypeChecked
+import groovy.transform.TypeCheckingMode
+import org.ods.services.OpenShiftService
+import org.ods.util.PodData
+
+abstract class AbstractDeploymentStrategy implements IDeploymentStrategy {
+
+    protected final List<String> DEPLOYMENT_KINDS = [
+        OpenShiftService.DEPLOYMENT_KIND, OpenShiftService.DEPLOYMENTCONFIG_KIND,
+    ]
+
+    @Override
+    abstract Map<String, List<PodData>> deploy()
+
+    protected Map<String, Map<String, Integer>> fetchOriginalVersions(Map<String, List<String>> deploymentResources) {
+        def originalVersions = [:]
+        deploymentResources.each { resourceKind, resourceNames ->
+            if (!originalVersions.containsKey(resourceKind)) {
+                originalVersions[resourceKind] = [:]
+            }
+            resourceNames.each { resourceName ->
+                originalVersions[resourceKind][resourceName] = openShift.getRevision(
+                    context.targetProject, resourceKind, resourceName
+                )
+            }
+        }
+        originalVersions
+    }
+
+    protected findOrCreateImageStream(String targetProject, String image) {
+        try {
+            openShift.findOrCreateImageStream(targetProject, image)
+        } catch (Exception ex) {
+            steps.error "Could not find/create ImageStream ${image} in ${targetProject}. Error was: ${ex}"
+        }
+    }
+
+    protected void retagImages(String targetProject, Set<String> images) {
+        images.each { image ->
+            findOrCreateImageStream(targetProject, image)
+            openShift.importImageTagFromProject(
+                targetProject, image, context.cdProject, options.imageTag, options.imageTag
+            )
+        }
+    }
+
+    @TypeChecked(TypeCheckingMode.SKIP)
+    protected Set<String> getBuiltImages() {
+        context.buildArtifactURIs.builds.keySet().findAll { it ->
+            !it.startsWith("imported-")
+        }
+    }
+}

src/org/ods/component/Context.groovy

@@ -74,6 +74,7 @@ class Context implements IContext {
         config.buildUrl = script.env.BUILD_URL
         config.buildTag = script.env.BUILD_TAG
         config.buildTime = new Date()
+        config.dockerRegistry = script.env.DOCKER_REGISTRY
         config.openshiftHost = script.env.OPENSHIFT_API_URL
         config << BitbucketService.readConfigFromEnv(script.env)
         config << NexusService.readConfigFromEnv(script.env)
@@ -86,6 +87,8 @@ class Context implements IContext {
         config.globalExtensionImageLabels = getExtensionBuildParams()
         config.globalExtensionImageLabels.putAll(getEnvParamsAndAddPrefix('OPENSHIFT_BUILD',
             'JENKINS_MASTER_'))
+        config.globalExtensionImageLabels.putAll(getEnvParamsAndAddPrefix('BUILD_',
+            ''))
 
         logger.debug("Got external build labels: ${config.globalExtensionImageLabels}")
 
@@ -614,6 +617,11 @@ class Context implements IContext {
         config.commitGitWorkingTree
     }
 
+    @NonCPS
+    String getClusterRegistryAddress () {
+        config.dockerRegistry
+    }
+
     private String retrieveGitUrl() {
         def gitUrl = script.sh(
             returnStdout: true,

src/org/ods/component/CopyImageOptions.groovy

@@ -0,0 +1,40 @@
+package org.ods.component
+
+import groovy.transform.TypeChecked
+
+@TypeChecked
+class CopyImageOptions extends Options {
+
+    /**
+     * Source image to import
+     *
+     * This needs to be in the following format: [REGISTRY/]REPO/IMAGE[:TAG]
+     */
+    String sourceImageUrlIncludingRegistry
+
+    /**
+     * true will tag the image from the -cd namespace into the targetEnvironment that the pipeline is running for
+     */
+    Boolean tagIntoTargetEnv
+
+    /**
+     * sourceCredential is the token to use, if any, to access the source registry
+     */
+    String sourceCredential
+
+    /**
+     * verifyTLS allows the stage to ignore certificate validation errors.
+     *
+     * The default is to verify certificate paths
+     */
+    Boolean verifyTLS
+
+    @SuppressWarnings('UnusedPrivateField')
+    private String registry
+    @SuppressWarnings('UnusedPrivateField')
+    private String repo
+    @SuppressWarnings('UnusedPrivateField')
+    private String image
+    @SuppressWarnings('UnusedPrivateField')
+    private String imageTag
+}