azure-pipelines.yml

trigger:
  branches:
    include:
      - master

pool:
  vmImage: 'ubuntu-latest'

pr:
  branches:
    include:
      - refs/heads/master

resources:
  repositories:
    - repository: cnp-azuredevops-libraries
      type: github
      ref: refs/heads/master
      name: hmcts/cnp-azuredevops-libraries
      endpoint: 'hmcts'
    - repository: sds-flux-config
      type: github
      ref: refs/heads/master
      name: hmcts/sds-flux-config
      endpoint: 'hmcts'

parameters:
  - name: action
    displayName: action
    type: string
    default: plan
    values:
      - plan
      - apply

  - name: cluster
    displayName: Cluster
    type: string
    default: All
    values:
      - 'All'
      - '00'
      - '01'

  - name: location
    displayName: Location
    type: string
    default: "UK South"
    values:
      - "UK South"

  - name: environment_components
    type: object
    default:
      - env: 'sbox'
        serviceConnection: 'OPS-APPROVAL-GATE-SBOX-ENVS'
      - env: 'dev'
        dependsOn: 'sbox'
        serviceConnection: 'OPS-APPROVAL-GATE-DEV-ENVS'
      - env: 'demo'
        dependsOn: 'sbox'
        serviceConnection: 'OPS-APPROVAL-GATE-DEMO-ENVS'
      - env: 'ithc'
        dependsOn: 'sbox'
        serviceConnection: 'OPS-APPROVAL-GATE-ITHC-ENVS'
      - env: 'ptlsbox'
        dependsOn: 'sbox'
        serviceConnection: 'OPS-APPROVAL-GATE-PTLSBOX-ENVS'
      - env: 'test'
        dependsOn: 'sbox'
        serviceConnection: 'OPS-APPROVAL-GATE-TEST-ENVS'
      - env: 'stg'
        dependsOn: 'sbox'
        serviceConnection: 'OPS-APPROVAL-GATE-STG-ENVS'
      - env: 'ptl'
        dependsOn: 'ptlsbox'
        serviceConnection: 'OPS-APPROVAL-GATE-PTL-ENVS'
      - env: 'prod'
        dependsOn: 'stg'
        serviceConnection: 'OPS-APPROVAL-GATE-PROD-ENVS'

variables:
  - name: timeoutInMinutes
    value: '60'
  - name: agentPool
    value: ubuntu-latest
  - name: project
    value: ss
  - name: tfInitSub
    value: "04d27a32-7a07-48b3-95b8-3c8691e1a263"
  - name: product
    value: sds-platform
  - name: action
    value: ${{ parameters.action }}
  - template: vars/input-variables.yaml@cnp-azuredevops-libraries
  - name: finalAction
    ${{ if and(in(variables['Build.SourceBranch'], 'refs/heads/main', 'refs/heads/master'), in(variables['Build.Reason'], 'BatchedCI', 'IndividualCI', 'PullRequest', 'Schedule'))  }}:
      value: 'apply'
    ${{ else }}:
      value: ${{ parameters.action }}

name: "AKS-SDS-Deploy - $(finalAction)"

stages:
  - stage: Precheck
    jobs:
      - job: PreChecks
        pool:
          vmImage: ${{ variables.agentPool }}
          timeoutInMinutes: ${{ variables.timeoutInMinutes }}
        steps:
          - template: steps/terraform-precheck.yaml@cnp-azuredevops-libraries
            parameters:
              keyvaultName: "infra-vault-nonprod"
              keyvaultSecret: "azure-devops-sp-token"
              serviceConnection: "DCD-CFT-Sandbox"
              overrideAction: ${{ parameters.action }}
              projectName: ${{ variables.project }}
              environment: "sbox"
              runManualStart: true

  - ${{ each component in parameters.environment_components }}:
      - stage: "CheckingClusters_${{ component.env }}"
        displayName: "Checking Clusters for ${{ component.env }}"
        dependsOn:
          - ? ${{ if and(ne(component.env, 'sbox'), eq(parameters.action, 'apply')) }}
            : - Network_${{ component.dependsOn }}
              - Managed_Identity_${{ component.dependsOn }}
              - Aks_${{ component.dependsOn }}
              - BootStrapClusters_${{ component.dependsOn }}
              - PipelineTests_${{ component.dependsOn }}
          - ? ${{ if and(ne(component.env, 'sbox'), ne(parameters.action, 'apply')) }}
            : - Network_${{ component.dependsOn }}
              - Managed_Identity_${{ component.dependsOn }}
              - Aks_${{ component.dependsOn }}
          - ${{ else }}:
              - Precheck
        jobs:
          - job: CheckingClusters
            steps:
              - checkout: self
              - task: AzureCLI@2
                displayName: "Checking available clusters"
                name: check_clusters
                inputs:
                  scriptType: bash
                  azureSubscription: ${{ component.serviceConnection }}
                  scriptPath: "scripts/checking-clusters.sh"

      - stage: Genesis_${{ component.env }}
        displayName: "${{ upper(component.env) }}: Genesis"
        condition: and(ne('${{ parameters.Action }}', 'Destroy'), succeeded())
        dependsOn:
          - CheckingClusters_${{ component.env }}
        jobs:
          - job: Genesis
            steps:
              - template: steps/set-build-repo-suffix-env-var.yaml@cnp-azuredevops-libraries
              - template: steps/terraform.yaml@cnp-azuredevops-libraries
                parameters:
                  overrideAction: ${{ parameters.action }}
                  environment: ${{ component.env }}
                  component: "00-genesis"
                  serviceConnection: ${{ component.serviceConnection }}
                  terraformInitSubscription: ${{ variables.tfInitSub }}
                  product: $(product)
                  location: ${{ parameters.location }}
                  tfVarsFile: "$(System.DefaultWorkingDirectory)/$(buildRepoSuffix)/environments/00-genesis/${{ component.env }}.tfvars"
                  planCommandOptions: "-var project=$(project) -var subscription_id=$(ARM_SUBSCRIPTION_ID)"

      - stage: Network_${{ component.env }}
        displayName: "${{ upper(component.env) }}: Network"
        dependsOn:
          - Genesis_${{ component.env }}
        jobs:
          - job: NetworkRg
            steps:
              - template: pipeline-steps/deploy-service.yaml
                parameters:
                  environment: ${{ component.env }}
                  location: ${{ parameters.location }}
                  serviceConnection: ${{ component.serviceConnection }}
                  stack: "07-network-rg"
                  project: $(project)
                  tfInitSub: ${{ variables.tfInitSub }}
                  product: $(product)
                  action: ${{ parameters.action }}

          - job: DeployInfrastructure
            dependsOn: NetworkRg
            steps:
              - template: steps/set-build-repo-suffix-env-var.yaml@cnp-azuredevops-libraries
              - template: steps/keyvault-read.yaml@cnp-azuredevops-libraries
                parameters:
                  serviceConnection: ${{ component.serviceConnection }}
                  environment: ${{ component.env }}
                  subscriptionIdVariableName: "SUBSCRIPTION_ID"
                  storageAccountVariableName: "STORAGE_ACCOUNT"
                  keyVaultVariableName: "KEY_VAULT"

              - template: steps/terraform.yaml@cnp-azuredevops-libraries
                parameters:
                  overrideAction: ${{ parameters.action }}
                  environment: ${{ component.env  }}
                  component: "01-network"
                  serviceConnection: "OPS-APPROVAL-GATE-MGMT-ENVS"
                  terraformInitSubscription: ${{ variables.tfInitSub }}
                  product: $(product)
                  location: ${{ parameters.location }}
                  tfVarsFile: "$(System.DefaultWorkingDirectory)/$(buildRepoSuffix)/environments/01-network/${{ component.env }}.tfvars"
                  planCommandOptions: "-var project=$(project) -var control_vault=$(KEY_VAULT) -var subscription_id=$(SUBSCRIPTION_ID)"
                  initCommandOptions: >
                    -var subscription_id=$(SUBSCRIPTION_ID)
                    -backend-config storage_account_name=$(STORAGE_ACCOUNT)

      - stage: Managed_Identity_${{ component.env }}
        displayName: "${{ upper(component.env) }}: Managed_Identity"
        dependsOn:
          - Network_${{ component.env }}
        jobs:
          - job: Managed_Identity
            steps:
              - template: steps/terraform.yaml@cnp-azuredevops-libraries
                parameters:
                  overrideAction: ${{ parameters.action }}
                  environment: ${{ component.env }}
                  component: "05-mis"
                  serviceConnection: ${{ component.serviceConnection }}
                  terraformInitSubscription: ${{ variables.tfInitSub }}
                  product: $(product)
                  location: ${{ parameters.location }}
                  tfVarsFile: NULL
                  planCommandOptions: "-var project=$(project) -var control_vault=$(controlKeyVault) -var subscription_id=$(ARM_SUBSCRIPTION_ID) "

      - stage: Aks_${{ component.env }}
        displayName: "${{ upper(component.env) }}: AKS clusters"
        pool: hmcts-cftptl-agent-pool
        dependsOn:
          - Managed_Identity_${{ component.env }}
        condition: |
          or (
            and(
              in(variables['Build.Reason'], 'Manual', 'PullRequest'),
              in('${{ parameters.cluster }}', '00', '01'),
              eq(dependencies.CheckingClusters_${{ component.env }}.outputs['CheckingClusters.check_clusters.cluster_deploy'], '${{ parameters.cluster }}')
            ),
            and(
              in(variables['Build.Reason'], 'Manual', 'PullRequest'),
              eq('${{ parameters.cluster }}', 'All')
            ),
            and(succeeded(), in(variables['Build.Reason'], 'PullRequest', 'Manual')),
            and(succeeded(), eq(variables['isMain'], true), eq(variables['isAutoTriggered'], true))
          )
        jobs:
          - job: DeployInfrastructure
            timeoutInMinutes: 180
            steps:
              - template: pipeline-steps/deploy-service.yaml
                parameters:
                  environment: ${{ component.env }}
                  location: ${{ parameters.location }}
                  serviceConnection: ${{ component.serviceConnection }}
                  stack: "aks"
                  project: $(project)
                  tfInitSub: ${{ variables.tfInitSub }}
                  product: $(product)
                  action: ${{ parameters.action }}
                  ${{ if ne(parameters['cluster'], 'All') }}:
                    targetCommand: '-target azurerm_resource_group.kubernetes_resource_group["\"${{parameters.cluster}}\""] -target module.kubernetes["\"${{parameters.cluster}}\""] -target azurerm_role_assignment.dev_to_stg["\"${{parameters.cluster}}\""] -target data.azurerm_resource_group.mi_stg_rg[0]'

      - stage: BootStrapClusters_${{ component.env }}
        displayName: "${{ upper(component.env) }}: BootStrap Clusters"
        dependsOn:
          - Aks_${{ component.env }}
        variables:
          clusters: ${{ parameters.cluster }}
        condition: |
          or(
            and(succeeded(), eq('${{ parameters.action }}', 'apply')),
            and(succeeded(), eq(variables['isMain'], true), eq(variables['isAutoTriggered'], true))
          )
        jobs:
          - job: BootStrap
            steps:
              - template: pipeline-steps/bootstrap.yaml
                parameters:
                  environment: ${{ component.env }}
                  cluster: ${{ parameters.cluster }}
                  serviceConnection: ${{ component.serviceConnection }}

      - stage: PipelineTests_${{ component.env }}
        displayName: "${{ upper(component.env) }}: PipelineTests"
        dependsOn:
          - BootStrapClusters_${{ component.env }}
        jobs:
          - job: PipelineTests
            pool:
              vmImage: ${{ variables.agentPool }}
            timeoutInMinutes: ${{ variables.timeoutInMinutes }}
            condition: |
              or(
                and(succeeded(), eq('${{ parameters.action }}', 'apply')),
                and(succeeded(), eq(variables['isMain'], true), eq(variables['isAutoTriggered'], true))
              )
            steps:
              - template: steps/pipeline-tests-jest.yaml@cnp-azuredevops-libraries
                parameters:
                  workingDirectory: $(Pipeline.Workspace)/s/aks-sds-deploy/scripts
                  junit_output_dir: $(Pipeline.Workspace)/s/aks-sds-deploy/environments/junit
                  environment: ${{ component.env }}
                  product: ${{ variables.product }}
                  test_title: "${{ component.env }}_${{ parameters.cluster }}_${{ parameters.location }}"
                  test_pattern: pipeline.test.ts