root-at-skic
e2adb79e2d
A Copier template for deploying Archify Sync with Argo CD: an app-of-apps, the server's Helm chart and its values, optional secrets through External Secrets and an optional static NFS volume for PostgreSQL.
59 lines
3.6 KiB
YAML
59 lines
3.6 KiB
YAML
# https://taskfile.dev
|
|
version: "3"
|
|
|
|
vars:
|
|
ENV_DIR: '{{.ENV_DIR | default "../archify-vscode-ext-sync-gitops"}}'
|
|
TMPL_URL: '{{.TMPL_URL | default "https://gitea.lego-cloud.eu/vscode-extensions/archify-vscode-ext-sync-gitops-tmpl.git"}}'
|
|
CHART_DIR: '{{.CHART_DIR | default "../archify-vscode-ext-sync/charts/archify-sync"}}'
|
|
|
|
tasks:
|
|
render:first:
|
|
desc: First render into the environment repository from the pushed template at a tag (-- REF=v0.1.0), with copier-answers.example.yml
|
|
requires:
|
|
vars: [REF]
|
|
cmds:
|
|
# From Gitea, not this folder: the answers file records where the template lives, so
|
|
# `copier update` in the environment repo finds it and its tags later.
|
|
- copier copy --trust --overwrite --defaults --vcs-ref "{{.REF}}" --data-file copier-answers.example.yml "{{.TMPL_URL}}" "{{.ENV_DIR}}"
|
|
|
|
render:
|
|
desc: Re-render the environment repository from its own cluster/copier-answers.yml (copier update)
|
|
dir: "{{.ENV_DIR}}"
|
|
cmds:
|
|
- copier update --trust --defaults --skip-answered --answers-file cluster/copier-answers.yml
|
|
|
|
render:answers:
|
|
desc: After editing the environment repository's cluster/copier-answers.yml - re-render everything from those answers (copier recopy)
|
|
dir: "{{.ENV_DIR}}"
|
|
cmds:
|
|
# copier update only carries template changes; changed answers need a recopy.
|
|
- copier recopy --trust --defaults --skip-answered --overwrite --answers-file cluster/copier-answers.yml
|
|
|
|
validate:
|
|
desc: Render the working copy (HEAD plus uncommitted changes, not the latest tag) flag off and on into tmp/, check YAML, paths and leftovers, lint the chart with the values
|
|
cmds:
|
|
- rm -rf tmp && mkdir -p tmp
|
|
- copier copy --trust --overwrite --defaults --vcs-ref HEAD . tmp/off
|
|
- test -z "$(ls tmp/off/cluster/0300-applications | grep archify-sync)"
|
|
- copier copy --trust --overwrite --defaults --vcs-ref HEAD --data-file copier-answers.example.yml . tmp/on
|
|
- test "$(find tmp -name '*.jinja' | wc -l | tr -d ' ')" = 0
|
|
- for f in $(find tmp -name '*.yml'); do yq -e 'true' "$f" >/dev/null || { echo "does not parse $f"; exit 1; }; done
|
|
- test ! -d tmp/on/cluster/0500-resources/0100-archify-sync-secrets
|
|
# With External Secrets and a private registry: ESO's own {{"{{ }}"}} must survive.
|
|
- yq '.archify_sync.external_secrets = {"store":"vault","postgres_password_key":"pg","oidc_client_secret_key":"oidc","image_pull":{"registry":"registry.example.com","username":"pull","password_key":"reg"}} | .archify_sync.image.pull_secret = "archify-sync-image-pull"' copier-answers.example.yml > tmp/eso.yml
|
|
- copier copy --trust --overwrite --defaults --vcs-ref HEAD --data-file tmp/eso.yml . tmp/eso
|
|
- test "$(find tmp/eso -name '*.jinja' | wc -l | tr -d ' ')" = 0
|
|
- grep -q '{{"{{"}} .postgresPassword }}' tmp/eso/cluster/0500-resources/0100-archify-sync-secrets/archify-sync-secrets.yml
|
|
- grep -q '"password" .password' tmp/eso/cluster/0500-resources/0100-archify-sync-secrets/archify-sync-image-pull.yml
|
|
- |
|
|
for f in $(find tmp/on/cluster/0300-applications -name '*.yml'); do
|
|
for p in $(yq '(.spec.source.path, .spec.sources[].path) | select(. != null)' "$f"); do
|
|
case "$p" in cluster/*) [ -d "tmp/on/$p" ] || { echo "$f: missing $p"; exit 1; };; esac
|
|
done
|
|
for v in $(yq '.spec.sources[].helm.valueFiles[]' "$f" 2>/dev/null); do
|
|
[ -f "tmp/on/${v#\$values/}" ] || { echo "$f: missing $v"; exit 1; }
|
|
done
|
|
done
|
|
- helm lint "{{.CHART_DIR}}" -f tmp/on/cluster/0500-resources/0200-archify-sync/archify-sync/values.yml
|
|
- echo "valid"
|