openvpn/Jenkinsfile

def SERIAL
def ENAMES = [ 'prod', 'dev' ]
def CLUSTERS = ['prod': 'iru-swarm1-open.infoclinica.lan', 'dev': 'dev-iru-swarm.infoclinica.lan']
def REGISTRIES = ['prod': 'registry.infoclinica.ru:5000', 'dev': 'dev-registry.infoclinica.ru:5000']

pipeline {
  agent {
    label "swarm"
  }
  environment {
    DOCKER_REGISTRY='dev-registry.infoclinica.ru:5000'
    DOCKER_IMAGE='ovpn-rsa'
    SERVICE_NAME='ovpn-rsa_server'
    SERVICE_IMAGE='container_run'
    SWARM_GIT_URL='ssh://git@git.sdsys.ru:8022/iru/stack-deploy.git'
    SWARM_GIT_NAME='stack-deploy'
    PKI_GIT_URL='ssh://git@git.sdsys.ru:8022/iru/openvpn-pki.git'
    PKI_GIT_NAME='openvpn-pki'
    OVPN_GIT_DIR='openvpn'
    JENKINS_MAIL='jenkins@sdsys.ru'
    CLUSTER_NAME='dev-iru-swarm.infoclinica.lan'
    DOCKER_CERT_PATH='/run/secrets/swarm'
  }
  parameters {
    string(
      name: "branch",
      defaultValue: "97009",
      description: "Which branch to use"
    )
    string(
      name: "mailto",
      defaultValue: "tomishinets.v@sdsys.ru",
      description: "Email which has to be notified."
    )
  }
  stages {
    stage ("Discover SERIAL") {
      steps {
        script {
          SERIAL = sh script: "echo -n `date +%y%m%d``printf %03d $BUILD_NUMBER`", returnStdout: true
        }
      }
    }
    stage("Pull PKI repo") {
      steps {
        withCredentials([sshUserPrivateKey(credentialsId: 'provision', keyFileVariable: 'GIT_SSH_KEY', passphraseVariable: '', usernameVariable: 'GIT_SSH_USERNAME')]) {
          sh '''GIT_SSH_COMMAND='ssh -i ${GIT_SSH_KEY} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' \
                git clone ${PKI_GIT_URL} && cd ${WORKSPACE}/${PKI_GIT_NAME} && git checkout ${branch} && cd ${WORKSPACE}
                GIT_SSH_COMMAND='ssh -i ${GIT_SSH_KEY} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' \
                git clone ${SWARM_GIT_URL}
             '''
        }
          sh '''cp ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/ca.crt \
                ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/server.crt \
                ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/server.key \
                ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/sds-test.crt \
                ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/sds-test.key \
                ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/ta.key \
                ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/stonevpn.crl \
                ${WORKSPACE}/openvpn-pki/open/easy-rsa/keys/dh2048.pem \
                ${WORKSPACE}/openvpn/keys
                ls -al ${WORKSPACE}/openvpn/keys/
             '''
      }
    }
    stage("Build") {
      steps {
        echo "Building ${DOCKER_IMAGE}:${SERIAL}."
        sh """docker build --no-cache -t ${DOCKER_IMAGE}:${SERIAL} .
              if [ \$? != 0 ]; then echo 'The container was not built'; exit 1; fi
           """
      }
    }
    stage ("Push to registry") {
      steps {
        script {
          ENAMES.each { item ->
             echo "Pushing to: ${item}, CLUSTER ${CLUSTERS.get((item))}"
             sh """docker tag ${DOCKER_IMAGE}:${SERIAL} ${REGISTRIES.get((item))}/iru/${DOCKER_IMAGE}:${SERIAL}
                   docker push ${REGISTRIES.get((item))}/iru/${DOCKER_IMAGE}:${SERIAL}
                """
          }
        }
      }
    }
    stage("Run in Prod-like") {
      steps {
        script {
          echo "Check Prod-like cluster status"
          sh "echo -n \${SERIAL} > \${SWARM_GIT_NAME}/tags/\${DOCKER_IMAGE}.version" 
          sh """cd \${SWARM_GIT_NAME}/\${DOCKER_IMAGE}
                DOCKER_HOST=tcp://${CLUSTERS.get((ENAMES[1]))}:2376 DOCKER_TLS_VERIFY=1 ./ovpn-rsa-open-staging.sh
             """
          def NODE = sh (script: "DOCKER_HOST=tcp://${CLUSTERS.get((ENAMES[1]))}:2376 DOCKER_TLS_VERIFY=1 docker service ps \${SERVICE_NAME} --format '{{.Node}}' --filter desired-state=Running" , returnStdout: true).trim()
          echo "${NODE}"
          def CONTAINER_ID_CLIENT = sh script: "docker run --name ${DOCKER_IMAGE} -e mode=client -e server=${NODE} --privileged -d --rm  ${DOCKER_IMAGE}:${SERIAL}" , returnStdout: true
          sh """docker exec -t \${CONTAINER_ID_CLIENT} ping -c 3 -q 10.10.20.1
                if [ \$? != 0 ]; then exit 1; else echo 'OVPN_RSA is working!!!'; fi
             """
             
        }
      }
    }
    stage ("Tagging") {
      steps {
        script {
          ENAMES.each { item ->
             echo "Setting latest tag for $item"
             sh """docker tag ${DOCKER_IMAGE}:${SERIAL} ${REGISTRIES.get((item))}/${DOCKER_IMAGE}:latest
                   docker push ${REGISTRIES.get((item))}/${DOCKER_IMAGE}:latest
                """
          }
        }
      echo "Updating tag info in ${SWARM_GIT_NAME} repository"
        withCredentials([sshUserPrivateKey(credentialsId: 'provision', keyFileVariable: 'GIT_SSH_KEY', passphraseVariable: '', usernameVariable: 'GIT_SSH_USERNAME')]) {
          sh """cd ${SWARM_GIT_NAME}
                echo -n ${SERIAL} > tags/${DOCKER_IMAGE}.version
                git add -A
                git config --global user.email "${JENKINS_MAIL}"
                git config --global user.name "Jenkins"
                git commit -m 'Version update'
                GIT_SSH_COMMAND='ssh -i ${GIT_SSH_KEY} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' \
                git push origin master
             """
        }
      }
    }
  }
  post {
    always {
      sh "docker stop ${DOCKER_IMAGE}"
      sh "DOCKER_HOST=tcp://${CLUSTERS.get((ENAMES[1]))}:2376 DOCKER_TLS_VERIFY=1 docker stack rm ${DOCKER_IMAGE}"
      echo "CleaningUp work directory"
      deleteDir()
    }
    failure {
      mail charset: 'UTF-8',
           subject: "Jenkins build ERROR",
           mimeType: 'text/html',
           to: "${mailto}",
           body: "<b>ATTENTION!!!</b> <b><br> Jenkins job failed.\n\n <b><br>Project Name:</b> ${env.JOB_NAME} <b><br>\nBuild Number:</b> ${env.BUILD_NUMBER} <b><br>\nURL Build:</b> ${RUN_DISPLAY_URL}"
    }
    success {
      mail charset: 'UTF-8',
           subject: "Jenkins build SUSCCESS",
           mimeType: 'text/html',
           to: "${mailto}",
           body: "<b>Congradulations!!!</b> <b><br> Jenkins job succefully finished.\n\n <b><br>Project Name:</b> ${env.JOB_NAME} <b><br>\nBuild Number:</b> ${env.BUILD_NUMBER} <b><br>\nURL Build:</b> ${RUN_DISPLAY_URL}"
    }
  }
}