CLOUDP-295785 - release tasks integration with atomic_pipeline.py

Author: MaciejKaras

.evergreen-functions.yml

@@ -46,6 +46,9 @@ variables:
       - workdir
       # temporary secret to pull community private preview image from quay.io
       - community_private_preview_pullsecret_dockerconfigjson
+      - RELEASE_INITIAL_VERSION
+      - RELEASE_INITIAL_COMMIT_SHA
+      - RELEASE_OPERATOR_VERSION
 
 functions:
 
@@ -564,42 +567,17 @@ functions:
         working_dir: src/github.com/mongodb/mongodb-kubernetes
         binary: scripts/dev/run_python.sh scripts/release/pipeline_main.py --parallel ${image_name} ${all_agents} ${build_scenario}
 
-  # TODO: CLOUDP-335471 ; once all image builds are made with the new atomic pipeline, remove the following function
-  legacy_pipeline:
+  release_operator_pipeline:
     - *switch_context
-    - command: shell.exec
-      type: setup
-      params:
-        shell: bash
-        script: |
-          # Docker Hub workaround
-          # docker buildx needs the moby/buildkit image when setting up a builder so we pull it from our mirror
-          docker buildx create --driver=docker-container --driver-opt=image=268558157000.dkr.ecr.eu-west-1.amazonaws.com/docker-hub-mirrors/moby/buildkit:buildx-stable-1 --use
-          docker buildx inspect --bootstrap
-    - command: ec2.assume_role
-      display_name: Assume IAM role with permissions to pull Kondukto API token
-      params:
-        role_arn: ${kondukto_role_arn}
-    - command: shell.exec
-      display_name: Pull Kondukto API token from AWS Secrets Manager and write it to file
-      params:
-        silent: true
-        shell: bash
-        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
-        script: |
-          set -e
-          # use AWS CLI to get the Kondukto API token from AWS Secrets Manager
-          kondukto_token=$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)
-          # write the KONDUKTO_TOKEN environment variable to Silkbomb environment file
-          echo "KONDUKTO_TOKEN=$kondukto_token" > ${workdir}/silkbomb.env
     - command: subprocess.exec
       retry_on_failure: true
       type: setup
       params:
         shell: bash
         <<: *e2e_include_expansions_in_env
         working_dir: src/github.com/mongodb/mongodb-kubernetes
-        binary: scripts/dev/run_python.sh pipeline.py --include ${image_name} --parallel --sign
+        # By default, use the git tag that triggered the task which can be overridden with RELEASE_OPERATOR_VERSION
+        binary: scripts/dev/run_python.sh scripts/release/pipeline_main.py ${image_name} --build-scenario release --version ${RELEASE_OPERATOR_VERSION|*triggered_by_git_tag}
 
   teardown_cloud_qa_all:
     - *switch_context
@@ -855,3 +833,65 @@ functions:
           - task_name
         script: |
           ./scripts/code_snippets/${task_name}_test.sh
+
+  #
+  # kubectl mongodb plugin release functions
+  #
+  install_goreleaser:
+    - command: shell.exec
+      type: setup
+      include_expansions_in_env:
+        - goreleaser_pro_tar_gz
+      params:
+        script: |
+          set -Eeu pipefail
+          curl -fL "${goreleaser_pro_tar_gz}" --output goreleaser_Linux_x86_64.tar.gz
+          tar -xf goreleaser_Linux_x86_64.tar.gz
+          chmod 755 ./goreleaser
+
+  install_macos_notarization_service:
+    - command: shell.exec
+      type: setup
+      params:
+        include_expansions_in_env:
+          - notary_service_url
+        script: |
+          set -Eeu pipefail
+
+          curl "${notary_service_url}" --output macos-notary.zip
+          unzip -u macos-notary.zip
+          chmod 755 ./linux_amd64/macnotary
+
+  release_kubectl_mongodb_plugin:
+    - command: github.generate_token
+      params:
+        expansion_name: generated_token
+    - command: shell.exec
+      type: setup
+      params:
+        working_dir: src/github.com/mongodb/mongodb-kubernetes
+        include_expansions_in_env:
+          - GRS_USERNAME
+          - GRS_PASSWORD
+          - PKCS11_URI
+          - ARTIFACTORY_URL
+          - ARTIFACTORY_PASSWORD
+          - SIGNING_IMAGE_URI
+          - macos_notary_keyid
+          - macos_notary_secret
+          - workdir
+          - triggered_by_git_tag
+          - RELEASE_OPERATOR_VERSION
+        env:
+          XDG_CONFIG_HOME: ${go_base_path}${workdir}
+          GO111MODULE: "on"
+          GOROOT: "/opt/golang/go1.24"
+          MACOS_NOTARY_KEY: ${macos_notary_keyid}
+          MACOS_NOTARY_SECRET: ${macos_notary_secret}
+        # shell.exec EVG Task doesn't have add_to_path, so we need to explicitly add the path export below.
+        script: |
+          set -Eeu pipefail
+          export GORELEASER_CURRENT_TAG=${RELEASE_OPERATOR_VERSION|*triggered_by_git_tag}
+          export PATH=$GOROOT/bin:$PATH
+          export GITHUB_TOKEN=${generated_token}
+          ${workdir}/goreleaser release --clean