workflow-openshift-4-demo.yaml

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: openshift-4-demo-
spec:
  entrypoint: start
  onExit: destroy
  arguments:
    parameters:
      - name: name
      - name: openshift-version
        value: ""
      - name: image-registry
      - name: main-image-tag
      - name: scanner-image-tag
      - name: scanner-db-image-tag
      - name: collector-slim-image-tag
      - name: central-db-image-tag
      - name: central-services-helm-chart-version
      - name: secured-cluster-services-helm-chart-version
      - name: trusted-certs-enabled
      - name: credentials-mode
      - name: region
      - name: ssd-storage-class
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: [ "ReadWriteOnce" ]
        resources:
          requests:
            storage: 10Mi
  volumes:
    - name: credentials
      secret:
        secretName: openshift-4-gcp-service-account
    - name: demo-secrets
      secret:
        secretName: demo-secrets

  templates:
    - name: start
      steps:
        - - name: create
            template: create

        - - name: pre-install
            template: pre-install

        - - name: roxctl-central
            template: roxctl-central

        - - name: roxctl-secured-cluster-services
            template: roxctl-secured-cluster-services

        - - name: run-ansible-demo
            template: run-ansible-demo
            continueOn:
              failed: true
            arguments:
              parameters:
              - name: admin-password
                value: '{{ "{{" }}steps.pre-install.outputs.parameters.admin-password{{ "}}" }}'
              - name: kubeconfig-base64
                value: '{{ "{{" }}steps.pre-install.outputs.parameters.kubeconfig-base64{{ "}}" }}'
              artifacts:
                - name: roxctl-central
                  from: '{{ "{{" }}steps.roxctl-central.outputs.artifacts.roxctl-central{{ "}}" }}'
                - name: roxctl-secured-cluster-services
                  from: '{{ "{{" }}steps.roxctl-secured-cluster-services.outputs.artifacts.roxctl-secured-cluster-services{{ "}}" }}'

        - - name: gather
            template: gather

        - - name: wait
            template: wait

    - name: create
      container:
        image: quay.io/stackrox-io/ci:automation-flavors-openshift-4-{{ .Chart.Annotations.automationFlavorsVersion }}
        imagePullPolicy: Always
        volumeMounts:
          - name: data
            mountPath: /data
        command:
          - entrypoint.sh
        args:
          - create
          - '{{ "{{" }}workflow.parameters.name{{ "}}" }}'
          - ocp.infra.rox.systems
        env:
          - name: GOOGLE_CREDENTIALS
            valueFrom:
              secretKeyRef:
                name: openshift-4-gcp-service-account
                key: google-credentials.json
          - name: GCP_PROJECT
            value : "acs-team-temp-dev"
          - name: PULL_SECRET
            valueFrom:
              secretKeyRef:
                name: redhat-pull-secret
                key: REDHAT_PULL_SECRET
          - name: OPENSHIFT_VERSION
            value: '{{ "{{" }}workflow.parameters.openshift-version{{ "}}" }}'
          - name: MASTER_NODE_COUNT
            value: "3"
          - name: WORKER_NODE_COUNT
            value: "3"
          - name: MASTER_NODE_TYPE
            value: "n1-standard-4"
          - name: WORKER_NODE_TYPE
            value: "e2-standard-16"
          - name: REGION
            value: '{{ "{{" }}workflow.parameters.region{{ "}}" }}'
          - name: TRUSTED_CERTS_ENABLED
            value: '{{ "{{" }}workflow.parameters.trusted-certs-enabled{{ "}}" }}'
          - name: CREDENTIALS_MODE
            value: '{{ "{{" }}workflow.parameters.credentials-mode{{ "}}" }}'
          - name: SSD_STORAGE_CLASS
            value: '{{ "{{" }}workflow.parameters.ssd-storage-class{{ "}}" }}'

    - name: pre-install
      script:
        image: rnix/openssl-gost
        volumeMounts:
          - name: data
            mountPath: /data
        command: [sh]
        source: |
          openssl rand -base64 32 | tr "+/" "_#"  | cut -c 1-20 > /data/admin_password
          base64 /data/auth/kubeconfig | tr -d "\n" > /data/auth/kubeconfig_base64
          subdomain=apps.{{ "{{" }}workflow.parameters.name{{ "}}" }}.ocp.infra.rox.systems
          echo "https://console-openshift-console.${subdomain}" > /data/url-openshift
          echo "https://central-stackrox.${subdomain}" > /data/url-stackrox
      outputs:
        parameters:
          - name: admin-password
            valueFrom:
              path: /data/admin_password
          - name: kubeconfig-base64
            valueFrom:
              path: /data/auth/kubeconfig_base64

    - name: run-ansible-demo
      inputs:
        parameters:
          - name: admin-password
          - name: kubeconfig-base64
        artifacts:
          - name: roxctl-central
            path: /usr/bin/roxctl-central
          - name: roxctl-secured-cluster-services
            path: /usr/bin/roxctl-secured-cluster-services
      container:
        image: quay.io/stackrox-io/ci:automation-flavors-openshift-4-demo-{{ .Chart.Annotations.automationFlavorsVersion }}
        imagePullPolicy: Always
        command:
          - ansible-playbook
        args: ["-i", "inventory.yml", "main.yml"]
        env:
          - name: IMAGE_PULL_USER
            valueFrom:
              secretKeyRef:
                name: demo-secrets
                key: QUAY_RHACS_ENG_RO_USERNAME
          - name: IMAGE_PULL_PASSWORD
            valueFrom:
              secretKeyRef:
                name: demo-secrets
                key: QUAY_RHACS_ENG_RO_PASSWORD
          - name: GOOGLE_CREDENTIALS
            valueFrom:
              secretKeyRef:
                name: openshift-4-gcp-service-account
                key: google-credentials.json
          - name: CENTRAL_PORT
            value: "443"
          - name: ORCHESTRATOR
            value: openshift
          - name: ADMIN_PASSWORD
            value: '{{ "{{" }}inputs.parameters.admin-password{{ "}}" }}'
          - name: KUBECONFIG_BASE64
            value: '{{ "{{" }}inputs.parameters.kubeconfig-base64{{ "}}" }}'
          - name: IMAGE_REGISTRY
            value: '{{ "{{" }}workflow.parameters.image-registry{{ "}}" }}'
          - name: MAIN_IMAGE_TAG
            value: '{{ "{{" }}workflow.parameters.main-image-tag{{ "}}" }}'
          - name: SCANNER_IMAGE_TAG
            value: '{{ "{{" }}workflow.parameters.scanner-image-tag{{ "}}" }}'
          - name: SCANNER_DB_IMAGE_TAG
            value: '{{ "{{" }}workflow.parameters.scanner-db-image-tag{{ "}}" }}'
          - name: COLLECTOR_SLIM_IMAGE_TAG
            value: '{{ "{{" }}workflow.parameters.collector-slim-image-tag{{ "}}" }}'
          - name: CENTRAL_DB_IMAGE_TAG
            value: '{{ "{{" }}workflow.parameters.central-db-image-tag{{ "}}" }}'
          - name: ANSIBLE_STDOUT_CALLBACK
            value: debug
        volumeMounts:
          - name: data
            mountPath: /data

    - name: gather
      script:
        image: busybox
        command: [sh]
        source: |
          cd /data
          . ./dotenv
          echo "${OPENSHIFT_CONSOLE_URL}" > cluster-console-url
          echo "${OPENSHIFT_CONSOLE_USERNAME}" > cluster-console-username
          echo "${OPENSHIFT_CONSOLE_PASSWORD}" > cluster-console-password
        volumeMounts:
          - name: data
            mountPath: /data
      outputs:
        artifacts:
          - name: admin-password
            path: /data/admin_password
            archive:
              none: {}
          - name: kubeconfig
            path: /data/auth/kubeconfig
            archive:
              none: {}
          - name: SSH_ACCESS
            path: /data/ssh/SSH_ACCESS.md
            archive:
              none: {}
          - name: url-openshift
            path: /data/url-openshift
            archive:
              none: {}
          - name: url-stackrox
            path: /data/url-stackrox
            archive:
              none: {}
          - name: dotenv
            path: /data/dotenv
            archive:
              none: {}
          - name: data
            path: /data
            archive:
              tar: {}
          - name: cluster-console-url
            path: /data/cluster-console-url
            archive:
              none: {}
          - name: cluster-console-username
            path: /data/cluster-console-username
            archive:
              none: {}
          - name: cluster-console-password
            path: /data/cluster-console-password
            archive:
              none: {}

    - name: wait
      suspend: {}

    - name: destroy
      container:
        image: quay.io/stackrox-io/ci:automation-flavors-openshift-4-{{ .Chart.Annotations.automationFlavorsVersion }}
        imagePullPolicy: Always
        command:
          - entrypoint.sh
        args:
          - destroy
          - '{{ "{{" }}workflow.parameters.name{{ "}}" }}'
        env:
          - name: GOOGLE_CREDENTIALS
            valueFrom:
              secretKeyRef:
                name: openshift-4-gcp-service-account
                key: google-credentials.json
          - name: GCP_PROJECT
            value : "acs-team-temp-dev"
        volumeMounts:
          - name: data
            mountPath: /data

    - name: roxctl-central
      activeDeadlineSeconds: 600
      outputs:
        artifacts:
          - name: roxctl-central
            path: /tmp/roxctl-central
      container:
        image: 'quay.io/stackrox-io/main:{{ "{{" }}workflow.parameters.central-services-helm-chart-version{{ "}}" }}'
        imagePullPolicy: Always
        command:
          - cp
        args:
          - --dereference
          - -v
          - /stackrox/roxctl
          - /tmp/roxctl-central

    - name: roxctl-secured-cluster-services
      activeDeadlineSeconds: 600
      outputs:
        artifacts:
          - name: roxctl-secured-cluster-services
            path: /tmp/roxctl-secured-cluster-services
      container:
        image: 'quay.io/stackrox-io/main:{{ "{{" }}workflow.parameters.secured-cluster-services-helm-chart-version{{ "}}" }}'
        imagePullPolicy: Always
        command:
          - cp
        args:
          - --dereference
          - -v
          - /stackrox/roxctl
          - /tmp/roxctl-secured-cluster-services