Skip to content

Commit 2b7d99c

Browse files
gururajshgururajsh
authored
Bump stack from cflinuxfs3 to cflinuxfs4 [v7] (#3157)
Use CAPI release version var Remove min CAPI jobs Move ops-files from cli-ci to this repo
1 parent e91fa56 commit 2b7d99c

26 files changed

+242
-232
lines changed

‎.github/ops-files/add-oidc-provider.yml

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
---
2+
- type: replace
3+
path: /instance_groups/name=uaa/jobs/name=uaa/properties/login/oauth?/providers?
4+
value:
5+
cli-oidc-provider:
6+
type: oidc1.0
7+
discoveryUrl: https://uaa-oidc.service.cf.internal:8443/.well-known/openid-configuration
8+
scopes:
9+
- openid
10+
linkText: My other uaa Oauth Provider
11+
showLinkText: true
12+
addShadowUserOnLogin: true
13+
relyingPartyId: rp_oidc_admin
14+
relyingPartySecret: adminsecret
15+
skipSslValidation: true
16+
storeCustomAttributes: true
17+
passwordGrantEnabled: true
18+
attributeMappings:
19+
given_name: given_name
20+
family_name: family_name
21+
user_name: user_name
22+
23+
- type: replace
24+
path: /instance_groups/name=uaa:after
25+
value:
26+
name: uaa-oidc
27+
instances: 1
28+
azs: [z1, z2, z3]
29+
vm_type: default
30+
stemcell: default
31+
persistent_disk: 500
32+
networks:
33+
- name: default
34+
jobs:
35+
- name: uaa
36+
release: uaa
37+
properties:
38+
encryption:
39+
active_key_label: 'key-1'
40+
encryption_keys:
41+
- label: 'key-1'
42+
passphrase: 'MY-PASSPHRASE'
43+
uaadb:
44+
address: sql-db.service.cf.internal
45+
databases:
46+
- name: uaa_oidc
47+
tag: uaa
48+
db_scheme: mysql
49+
port: 3306
50+
roles:
51+
- name: uaa-oidc
52+
password: "((uaa_oidc_database_password))"
53+
tag: admin
54+
uaa:
55+
url: https://uaa-oidc.service.cf.internal:8443
56+
jwt:
57+
policy:
58+
active_key_id: key-1
59+
keys:
60+
key-1:
61+
signingKey: ((uaa-oidc-key1.private_key))
62+
sslCertificate: ((uaa-oidc_tls.certificate))
63+
sslPrivateKey: ((uaa-oidc_tls.private_key))
64+
ca_certs:
65+
- ((mysql_server_certificate.ca))
66+
clients:
67+
rp_oidc_admin:
68+
authorized-grant-types: authorization_code,client_credentials,refresh_token,user_token,password,urn:ietf:params:oauth:grant-type:saml2-bearer,implicit
69+
redirect-uri: https://uaa.service.cf.internal:8443/login/callback/cli-oidc-provider
70+
scope: openid,uaa.admin,clients.read,clients.write,clients.secret,scim.read,scim.write,clients.admin,uaa.user,doppler.firehose
71+
authorities: uaa.admin,clients.admin
72+
secret: adminsecret
73+
scim:
74+
user:
75+
override: true
76+
users:
77+
- name: admin-oidc
78+
password: "((uaa_oidc_admin_password))"
79+
groups:
80+
- uaa.admin
81+
login:
82+
protocol: https
83+
saml:
84+
activeKeyId: key1
85+
keys:
86+
key1:
87+
key: ((saml_oidc-key1.private_key))
88+
passphrase: ''
89+
certificate: ((saml_oidc-key1.certificate))
90+
91+
- type: replace
92+
path: /addons/name=bosh-dns-aliases/jobs/name=bosh-dns-aliases/properties/aliases/-
93+
value:
94+
domain: uaa-oidc.service.cf.internal
95+
targets:
96+
- query: '*'
97+
instance_group: uaa-oidc
98+
deployment: cf
99+
network: default
100+
domain: bosh
101+
102+
- type: replace
103+
path: /instance_groups/name=database/jobs/name=pxc-mysql/properties/seeded_databases?/-
104+
value:
105+
name: uaa_oidc
106+
username: uaa-oidc
107+
password: "((uaa_oidc_database_password))"
108+
109+
- type: replace
110+
path: /variables?/-
111+
value:
112+
name: uaa_oidc_admin_password
113+
type: password
114+
115+
- type: replace
116+
path: /variables?/-
117+
value:
118+
name: uaa_oidc_database_password
119+
type: password
120+
121+
- type: replace
122+
path: /variables?/-
123+
value:
124+
name: uaa-oidc-key1
125+
type: rsa
126+
127+
- type: replace
128+
path: /variables?/-
129+
value:
130+
name: uaa-oidc_ca
131+
type: certificate
132+
options:
133+
is_ca: true
134+
common_name: uaa-oidc
135+
alternative_names: ["*.uaa-oidc.service.cf.internal"]
136+
extended_key_usage:
137+
- server_auth
138+
139+
- type: replace
140+
path: /variables?/-
141+
value:
142+
name: saml_oidc-key1
143+
type: certificate
144+
options:
145+
ca: uaa-oidc_ca
146+
common_name: saml_oidc
147+
148+
- type: replace
149+
path: /variables?/-
150+
value:
151+
name: uaa-oidc_tls
152+
type: certificate
153+
options:
154+
ca: uaa-oidc_ca
155+
common_name: uaa-oidc.service.cf.internal

‎.github/ops-files/add-uaa-client-credentials.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
- type: replace
3+
path: /instance_groups/name=uaa/jobs/name=uaa/properties/uaa/clients/potato-face?
4+
value:
5+
access-token-validity: 600
6+
authorized-grant-types: client_credentials
7+
override: true
8+
secret: ((client-secret))
9+
scope: openid,routing.router_groups.write,scim.read,cloud_controller.admin,uaa.user,routing.router_groups.read,cloud_controller.read,password.write,cloud_controller.write,network.admin,doppler.firehose,scim.write,uaa.admin
10+
authorities: openid,routing.router_groups.write,scim.read,cloud_controller.admin,uaa.user,routing.router_groups.read,cloud_controller.read,password.write,cloud_controller.write,network.admin,doppler.firehose,scim.write,uaa.admin
11+

‎.github/ops-files/diego-cell-instances.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
- type: replace
3+
path: /instance_groups/name=diego-cell/instances
4+
value: 3

‎.github/ops-files/use-cflinuxfs3.yml

Lines changed: 0 additions & 105 deletions
This file was deleted.

‎.github/ops-files/use-latest-capi.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
- type: replace
3+
path: /releases/name=capi/version
4+
value: latest
5+
6+
- type: remove
7+
path: /releases/name=capi/url?
8+
9+
- type: remove
10+
path: /releases/name=capi/sha1?

‎.github/workflows/tests-integration-reusable.yml

Lines changed: 14 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@ name: "pvt: run integration tests"
1010
on:
1111
workflow_call:
1212
inputs:
13-
capi-version:
14-
required: true
15-
type: string
1613
run-with-client-creds:
1714
required: true
1815
type: boolean
@@ -69,7 +66,6 @@ jobs:
6966

7067
- name: Checkout cf-deployment
7168
uses: actions/checkout@v4
72-
if: ${{ inputs.capi-version == 'edge' }}
7369
with:
7470
repository: cloudfoundry/cf-deployment
7571
path: cf-deployment
@@ -89,7 +85,7 @@ jobs:
8985
run: |
9086
shepherd login service-account ${account_token}
9187
92-
echo "shepherd create lease --duration 8h --pool ${pool_name} --pool-namespace ${pool_namespace} --namespace tas-devex"
88+
echo "shepherd create lease --duration 8h --pool ${pool_name} --pool-namespace ${pool_namespace} --namespace tas-devex --description 'CLI GHA'"
9389
lease_id=$(shepherd create lease --duration 8h --pool ${pool_name} --pool-namespace ${pool_namespace} --namespace tas-devex --json | jq -r .id)
9490
# Give sometime for the lease to complete. Shepherd may take upto an 3 hours to create an env
9591
# if the pool is empty.
@@ -145,9 +141,14 @@ jobs:
145141
apt-get install -y build-essential
146142
147143
- name: Upload latest CAPI release
148-
if: ${{ inputs.capi-version == 'edge' }}
144+
env:
145+
capi_release_version: ${{ vars.CAPI_RELEASE_VERSION }}
149146
run: |
150-
capi_release_version=$(curl -s https://api.github.com/repos/cloudfoundry/capi-release/releases/latest | jq -r .tag_name)
147+
if [ -z "$capi_release_version" ]
148+
then
149+
capi_release_version=$(curl -s https://api.github.com/repos/cloudfoundry/capi-release/releases/latest | jq -r .tag_name)
150+
fi
151+
151152
echo "Latest CAPI release is $capi_release_version"
152153
153154
eval "$(bbl print-env --metadata-file metadata.json)"
@@ -156,7 +157,6 @@ jobs:
156157
bosh upload-release "https://bosh.io/d/github.com/cloudfoundry/capi-release?v=$capi_release_version"
157158
158159
- name: Deploy Isolation Segment and OIDC Provider
159-
if: ${{ inputs.capi-version == 'edge' }}
160160
run: |
161161
env_name=$(jq -r .name metadata.json)
162162
jq -r .bosh.jumpbox_private_key metadata.json > /tmp/${env_name}.priv
@@ -165,35 +165,13 @@ jobs:
165165
# deploy
166166
bosh -d cf manifest > /tmp/manifest.yml
167167
bosh interpolate /tmp/manifest.yml \
168-
-o .github/ops-files/use-cflinuxfs3.yml \
169-
-o .github/ops-files/replace-redis.yml \
168+
-o cf-deployment/operations/use-internal-lookup-for-route-services.yml \
170169
-o cf-deployment/operations/add-persistent-isolation-segment-diego-cell.yml \
171-
-o cli-ci/ci/infrastructure/operations/use-latest-capi.yml \
172-
-o cli-ci/ci/infrastructure/operations/add-oidc-provider.yml \
173-
-o cli-ci/ci/infrastructure/operations/add-uaa-client-credentials.yml \
174-
-o cli-ci/ci/infrastructure/operations/diego-cell-instances.yml \
175-
-v client-secret="${{ secrets.CLIENT_SECRET }}" \
176-
> ./director.yml
177-
178-
bosh -d cf deploy director.yml -n
179-
echo "Deployed CAPI version:"
180-
bosh -d cf releases | grep capi
181-
182-
- name: Deploy MIN CAPI with Isolation Segment and OIDC Provider
183-
if: ${{ inputs.capi-version != 'edge' }}
184-
run: |
185-
env_name=$(jq -r .name metadata.json)
186-
jq -r .bosh.jumpbox_private_key metadata.json > /tmp/${env_name}.priv
187-
eval "$(bbl print-env --metadata-file metadata.json)"
188-
189-
# deploy
190-
bosh -d cf manifest > /tmp/manifest.yml
191-
bosh interpolate /tmp/manifest.yml \
192-
-o cf-deployment/operations/test/add-persistent-isolation-segment-diego-cell.yml \
193-
-o cli-ci/ci/infrastructure/operations/add-oidc-provider.yml \
194-
-o cli-ci/ci/infrastructure/operations/add-uaa-client-credentials.yml \
195-
-o cli-ci/ci/infrastructure/operations/diego-cell-instances.yml \
196-
-o cli-ci/ci/infrastructure/operations/use-latest-ruby-buildpack.yml \
170+
-o .github/ops-files/replace-redis.yml \
171+
-o .github/ops-files/use-latest-capi.yml \
172+
-o .github/ops-files/add-oidc-provider.yml \
173+
-o .github/ops-files/add-uaa-client-credentials.yml \
174+
-o .github/ops-files/diego-cell-instances.yml \
197175
-v client-secret="${{ secrets.CLIENT_SECRET }}" \
198176
> ./director.yml
199177

0 commit comments

Comments
 (0)