Add example GitLab workflows for Magnum CAPI management cluster (azimuth-cloud#151)

Co-authored-by: sd109 <[email protected]>

Author: sd109

.gitlab-ci-magnum.yml.sample

@@ -0,0 +1,157 @@
+---
+
+default:
+  image: ubuntu:jammy
+
+variables:
+  # Because we are installing git-crypt as part of the job, we cannot reuse old
+  # checkouts where git-crypt is already initialised as this results in an error
+  GIT_STRATEGY: clone
+  # Use the pipeline credentials for Terraform
+  # This assumes that we are using GitLab-managed Terraform state (recommended when available)
+  TF_HTTP_USERNAME: gitlab-ci-token
+  TF_HTTP_PASSWORD: $CI_JOB_TOKEN
+
+stages:
+  # This stage owns the scheduled job that checks for upstream changes
+  - scheduled
+  # This stage owns the deploy job for the staging environment
+  - staging
+  # This stage owns the deploy job for the production environment
+  - production
+
+#####
+# This job checks to see if there is a new release that needs to be merged
+#
+# If there is, it will create a new branch containing the changes and a corresponding merge request
+#
+# It runs as a scheduled job, for which a suitable schedule must be defined, e.g. daily or weekly
+#
+# This job writes back to the repository and to the merge requests API
+# To do this, it needs more power than is granted to the CI token
+# So CI variables must be set that contain an access token and the corresponding username
+# This can be a Project Access Token (paid feature, recommended if available) or a Personal Access Token (not ideal)
+#####
+check_for_release:
+  stage: scheduled
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_BRANCH == "main"
+  variables:
+    GIT_STRATEGY: none
+  before_script:
+    - apt update -y
+    - apt install -y curl git jq
+  script:
+    # Configure git to use the available credentials
+    - git config --global credential.helper store
+    # Do our own clone to make sure we don't get unrelated history errors from detached heads
+    - git clone https://${GITLAB_PAT_USERNAME}:${GITLAB_PAT_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git ${CI_PROJECT_NAME}
+    - cd ${CI_PROJECT_NAME}
+    # Tell git who we are for commits
+    - git config user.email "${CI_PROJECT_PATH_SLUG}-ci@${CI_SERVER_HOST}"
+    - git config user.name "${CI_PROJECT_NAME} CI"
+    # Create the merge branch
+    - ./bin/create-merge-branch
+    # Create a merge request for the branch
+    - |
+        if [ -f ".mergeenv" ]; then
+          source ".mergeenv"
+          BODY="{
+            \"id\": ${CI_PROJECT_ID},
+            \"title\": \"Upgrade config to upstream version ${RELEASE_TAG}\",
+            \"source_branch\": \"${BRANCH_NAME}\",
+            \"target_branch\": \"main\",
+            \"remove_source_branch\": true,
+            \"assignee_id\": \"${GITLAB_USER_ID}\"
+          }"
+          curl -kfsSL -X POST \
+            "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/merge_requests" \
+            --header "Authorization: Bearer ${GITLAB_PAT_TOKEN}" \
+            --header "Content-Type: application/json" \
+            --data "${BODY}"
+        fi
+
+#####
+# This job deploys a staging/test version of the Magnum CAPI management cluster
+#
+# It runs automatically for every commit to main that changes one of the files
+# that affects the environment.
+# 
+# NOTE: If the target site doesn't have a separate staging cloud with it's own Magnum
+# deployment then it may still be worth including a management cluster staging env in
+# this config repo which is a stripped down (1 master, 1 worker) version of the prod
+# env. Although this will not allow for testing the interaction between Magnum and the
+# CAPI management cluster, it will at least validate the deployment config before a
+# production rollout is performed.
+#####
+deploy_staging:
+  stage: staging
+  rules:
+    # Prevent the job from running on any branch that is not main
+    - if: $CI_COMMIT_BRANCH != "main"
+      when: never
+    # Allow deployments to be manually triggered on main even when there are no changed files
+    - if: $CI_PIPELINE_SOURCE == "web"
+    # Run for commits to main that change particular files
+    - if: $CI_PIPELINE_SOURCE == "push"
+      changes:
+        # Files that affect the staging environment
+        - env
+        - env.secret
+        - requirements.yml
+        - environments/base/**/*
+        - environments/ha/**/*
+        - environments/capi-mgmt/**/*
+        # TODO: Change these to actual site environment names
+        - environments/site-base/**/*
+        - environments/site-staging/**/*
+  environment:
+    # TODO: Change this to site staging environment name
+    name: site-staging
+  variables:
+    ANSIBLE_FORCE_COLOR: "true"
+  before_script:
+    - source ./bin/ci-setup
+  script:
+    - ansible-playbook stackhpc.azimuth_ops.provision_capi_mgmt
+
+#####
+# This job deploys the Magnum CAPI management cluster to the production environment
+#
+# It runs for every commit to main that changes one of the files that affects
+# the environment, but only if the staging deployment succeeded
+#
+# It also includes a manual gate that can be used as a confirmation that the
+# relevant testing has taken place on staging
+#####
+deploy_production:
+  stage: production
+  rules:
+    # Prevent the job from running on any branch that is not main
+    - if: $CI_COMMIT_BRANCH != "main"
+      when: never
+    # Allow deployments to be manually triggered on main even when there are no changed files
+    - if: $CI_PIPELINE_SOURCE == "web"
+      when: manual
+    # Run for commits to main that change particular files
+    - if: $CI_PIPELINE_SOURCE == "push"
+      changes:
+        - env
+        - env.secret
+        - requirements.yml
+        - environments/base/**/*
+        - environments/ha/**/*
+        - environments/capi-mgmt/**/*
+        # TODO: Change these to actual site environment names
+        - environments/site-base/**/*
+        - environments/site-staging/**/*
+      when: manual
+  environment:
+    # TODO: Change this to site prod environment name
+    name: site-prod
+  variables:
+    ANSIBLE_FORCE_COLOR: "true"
+  before_script:
+    - source ./bin/ci-setup
+  script:
+    - ansible-playbook stackhpc.azimuth_ops.provision_capi_mgmt