Skip to content

Commit 9c2f567

Browse files
paul-hummel-oraclejotruon
paul-hummel-oracle
authored and
jotruon
committed
Added - Devops Deploy Helm Attestation with helm args and helm diff.
1 parent dd6ab34 commit 9c2f567

27 files changed

+1759
-74
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
- Support for Operations Insights : Customizable configuration
66
- Support for ADB-D & ADB-CC | Autonomous Data Guard v3
77
- Support for ADB-D | Oracle Home Version Control
8+
- Support for Devops Deploy Helm Attestation with helm args and helm diff
89
### Bug Fix
910
- Fix oci_core_instance to enable updating KMS Key id associated with the boot volume
1011
- Resource Discovery is not getting detected for Custom table resource in metering_computation service

‎examples/devops/deployment_service/deploy_helm_artifact/deploy_helm_artifact.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ resource "oci_devops_deploy_artifact" "test_deploy_helm_artifact" {
6161
argument_substitution_mode = "NONE"
6262
deploy_artifact_source {
6363
deploy_artifact_source_type = "HELM_CHART"
64-
chart_url = "iad.ocir.io/ax022wvgmjpq/fake"
64+
chart_url = "oci://iad.ocir.io/ax022wvgmjpq/fake"
6565
deploy_artifact_version = "0.1"
6666
}
6767
}

‎examples/devops/deployment_service/deploy_helm_artifact_with_attestation/deploy_helm_artifact_for_attestation.tf‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
/*
2+
This example demonstrates the various ways a helm chart artifact can be created and specifically,
3+
the options available for having a signed helm chart verified per
4+
https://helm.sh/docs/topics/provenance/.
5+
*/
6+
7+
variable "tenancy_ocid" {
8+
}
9+
10+
variable "user_ocid" {
11+
}
12+
13+
variable "fingerprint" {
14+
}
15+
16+
variable "private_key_path" {
17+
}
18+
19+
variable "region" {
20+
}
21+
22+
variable "vault_secret_public_key_ocid" {
23+
}
24+
25+
provider "oci" {
26+
region = var.region
27+
tenancy_ocid = var.tenancy_ocid
28+
user_ocid = var.user_ocid
29+
fingerprint = var.fingerprint
30+
private_key_path = var.private_key_path
31+
}
32+
33+
34+
# OCID of the DevOps project.
35+
variable "project_id" {
36+
}
37+
38+
39+
locals {
40+
chart_url = "oci://iad.ocir.io/namespace/repository/chart-name"
41+
chart_version = "0.0.1"
42+
vault_secret_public_key_ocid = var.vault_secret_public_key_ocid
43+
public_key = "" // Add the public key here
44+
}
45+
46+
47+
resource "oci_devops_deploy_artifact" "helm_chart_implicit_no_public_key" {
48+
#Required
49+
argument_substitution_mode = "SUBSTITUTE_PLACEHOLDERS"
50+
deploy_artifact_source {
51+
#Required
52+
deploy_artifact_source_type = "HELM_CHART"
53+
54+
#Optional
55+
chart_url = local.chart_url
56+
deploy_artifact_version = local.chart_version
57+
}
58+
deploy_artifact_type = "HELM_CHART"
59+
project_id = var.project_id
60+
61+
#Optional
62+
description = "helm chart artifact with no public key"
63+
display_name = "helmChartWithImplicitNoPublicKey"
64+
}
65+
66+
67+
resource "oci_devops_deploy_artifact" "helm_chart_no_public_key" {
68+
#Required
69+
argument_substitution_mode = "SUBSTITUTE_PLACEHOLDERS"
70+
deploy_artifact_source {
71+
#Required
72+
deploy_artifact_source_type = "HELM_CHART"
73+
74+
#Optional
75+
chart_url = local.chart_url
76+
deploy_artifact_version = local.chart_version
77+
78+
helm_verification_key_source {
79+
verification_key_source_type = "NONE"
80+
}
81+
}
82+
deploy_artifact_type = "HELM_CHART"
83+
project_id = var.project_id
84+
85+
#Optional
86+
description = "helm chart artifact with no public key"
87+
display_name = "helmChartWithNoPublicKey"
88+
89+
}
90+
91+
92+
93+
resource "oci_devops_deploy_artifact" "helm_chart_vault_public_key" {
94+
#Required
95+
argument_substitution_mode = "SUBSTITUTE_PLACEHOLDERS"
96+
deploy_artifact_source {
97+
#Required
98+
deploy_artifact_source_type = "HELM_CHART"
99+
100+
#Optional
101+
chart_url = local.chart_url
102+
deploy_artifact_version = local.chart_version
103+
104+
helm_verification_key_source {
105+
verification_key_source_type = "VAULT_SECRET"
106+
vault_secret_id = local.vault_secret_public_key_ocid
107+
}
108+
}
109+
deploy_artifact_type = "HELM_CHART"
110+
project_id = var.project_id
111+
112+
#Optional
113+
description = "helm chart artifact with vault public key"
114+
display_name = "helmChartVaultPublicKey"
115+
116+
117+
}
118+
119+
120+
resource "oci_devops_deploy_artifact" "helm_chart_inline_public_key" {
121+
#Required
122+
argument_substitution_mode = "SUBSTITUTE_PLACEHOLDERS"
123+
deploy_artifact_source {
124+
#Required
125+
deploy_artifact_source_type = "HELM_CHART"
126+
127+
#Optional
128+
chart_url = local.chart_url
129+
deploy_artifact_version = local.chart_version
130+
131+
helm_verification_key_source {
132+
verification_key_source_type = "INLINE_PUBLIC_KEY"
133+
current_public_key = local.public_key
134+
previous_public_key = local.public_key
135+
}
136+
}
137+
deploy_artifact_type = "HELM_CHART"
138+
project_id = var.project_id
139+
140+
#Optional
141+
description = "helm chart artifact with inline public keys"
142+
display_name = "helmChartInlinePublicKeys"
143+
144+
}
145+
146+
data "oci_devops_deploy_artifact" "retrieve_artifact_with_vault_public_key" {
147+
deploy_artifact_id = oci_devops_deploy_artifact.helm_chart_vault_public_key.id
148+
}
149+
150+
data "oci_devops_deploy_artifact" "retrieve_artifact_with_inline_public_key" {
151+
deploy_artifact_id = oci_devops_deploy_artifact.helm_chart_inline_public_key.id
152+
}
153+
154+
data "oci_devops_deploy_artifact" "retrieve_artifact_with_no_public_key" {
155+
deploy_artifact_id = oci_devops_deploy_artifact.helm_chart_no_public_key.id
156+
}
157+
158+
data "oci_devops_deploy_artifact" "retrieve_artifact_implicit_no_public_key" {
159+
deploy_artifact_id = oci_devops_deploy_artifact.helm_chart_implicit_no_public_key.id
160+
}
161+
162+
163+
output helm_chart_implicit_no_public_key {
164+
value = data.oci_devops_deploy_artifact.retrieve_artifact_implicit_no_public_key
165+
}
166+
167+
output helm_chart_no_public_key {
168+
value = data.oci_devops_deploy_artifact.retrieve_artifact_with_no_public_key
169+
}
170+
171+
output helm_chart_vault_public_key {
172+
value = data.oci_devops_deploy_artifact.retrieve_artifact_with_vault_public_key
173+
}
174+
175+
output helm_chart_inline_public_key {
176+
value = data.oci_devops_deploy_artifact.retrieve_artifact_with_inline_public_key
177+
}
178+

‎examples/devops/deployment_service/helm_diff/cluster.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "oci_containerengine_cluster" "test_cluster" {
2+
#Required
3+
compartment_id = var.compartment_ocid
4+
kubernetes_version = "v1.21.5"
5+
name = "cluster"
6+
vcn_id = oci_core_vcn.test_vcn.id
7+
}

‎examples/devops/deployment_service/helm_diff/oke_helm_diff_deployment.tf‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
// Copyright (c) 2017, 2021, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
variable "tenancy_ocid" {
5+
}
6+
7+
variable "user_ocid" {
8+
}
9+
10+
variable "fingerprint" {
11+
}
12+
13+
variable "private_key_path" {
14+
}
15+
16+
variable "compartment_ocid" {
17+
}
18+
19+
variable "region" {
20+
}
21+
22+
provider "oci" {
23+
region = var.region
24+
tenancy_ocid = var.tenancy_ocid
25+
user_ocid = var.user_ocid
26+
fingerprint = var.fingerprint
27+
private_key_path = var.private_key_path
28+
}
29+
30+
resource "random_string" "topicname" {
31+
length = 10
32+
special = false
33+
}
34+
35+
resource "random_string" "projectname" {
36+
length = 10
37+
special = false
38+
}
39+
40+
resource "oci_ons_notification_topic" "test_notification_topic" {
41+
#Required
42+
compartment_id = var.compartment_ocid
43+
name = random_string.topicname.result
44+
}
45+
46+
resource "oci_devops_project" "test_project" {
47+
#Required
48+
compartment_id = var.compartment_ocid
49+
name = join("", ["A", random_string.projectname.result])
50+
notification_config {
51+
#Required
52+
topic_id = oci_ons_notification_topic.test_notification_topic.id
53+
}
54+
}
55+
56+
resource "oci_devops_deploy_pipeline" "test_deploy_pipeline" {
57+
#Required
58+
project_id = oci_devops_project.test_project.id
59+
60+
description = "description"
61+
display_name = "displayName"
62+
}
63+
64+
resource "oci_devops_deploy_artifact" "test_deploy_helm_artifact" {
65+
project_id = oci_devops_project.test_project.id
66+
display_name = "Display_name"
67+
deploy_artifact_type = "HELM_CHART"
68+
argument_substitution_mode = "NONE"
69+
deploy_artifact_source {
70+
deploy_artifact_source_type = "HELM_CHART"
71+
chart_url = "iad.ocir.io/ax022wvgmjpq/fake"
72+
deploy_artifact_version = "0.1"
73+
}
74+
}
75+
76+
resource "oci_devops_deploy_environment" "test_deploy_oke_environment" {
77+
#Required
78+
deploy_environment_type = "OKE_CLUSTER"
79+
project_id = oci_devops_project.test_project.id
80+
cluster_id = oci_containerengine_cluster.test_cluster.id
81+
display_name = "okeDeployEnvironment"
82+
}
83+
84+
resource "oci_devops_deploy_stage" "test_helm_deploy_stage" {
85+
#Required
86+
deploy_pipeline_id = oci_devops_deploy_pipeline.test_deploy_pipeline.id
87+
deploy_stage_predecessor_collection {
88+
#Required
89+
items {
90+
#Required
91+
id = oci_devops_deploy_stage.test_oke_canary_traffic_shift_deploy_stage.id
92+
}
93+
}
94+
deploy_stage_type = "OKE_HELM_CHART_DEPLOYMENT"
95+
release_name = "release-name"
96+
helm_chart_deploy_artifact_id = oci_devops_deploy_artifact.test_deploy_helm_artifact.id
97+
}
98+
99+
resource "oci_devops_deployment" "test_deployment" {
100+
#Required
101+
deploy_pipeline_id = oci_devops_deploy_pipeline.test_deploy_pipeline.id
102+
deployment_type = "PIPELINE_DEPLOYMENT"
103+
104+
deploy_stage_id = oci_devops_deploy_stage.test_helm_deploy_stage.id
105+
display_name = "HelmDiffDeployment"
106+
deployment_arguments {
107+
108+
items {
109+
name = "PLAN_DRY_RUN"
110+
value = "true"
111+
}
112+
113+
}
114+
}

0 commit comments

Comments
 (0)