Jenkinsfile_keygen 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214
  1. pipeline {
  2. agent {
  3. label "swarm"
  4. }
  5. environment {
  6. DOCKER_REGISTRY='dev-registry.infoclinica.ru:5000'
  7. DOCKER_IMAGE='iru/ovpn-rsa'
  8. SERVICE_NAME="ovpn-rsa_server"
  9. PKI_GIT_URL='ssh://git@git.sdsys.ru:8022/iru/openvpn-pki.git'
  10. PKI_GIT_NAME='openvpn-pki'
  11. OVPN_GIT_URL='ssh://git@git.sdsys.ru:8022/iru/openvpn.git'
  12. OVPN_GIT_DIR='openvpn'
  13. JENKINS_MAIL='jenkins.dev@sdsys.ru'
  14. SMTP_SERVER='mail.sdsys.ru'
  15. DOCKER_CERT_PATH='/run/secrets/swarm'
  16. CLUSTER_NAME='iru-swarm1-open.infoclinica.ru'
  17. COMMAND=''
  18. }
  19. parameters {
  20. string(
  21. name: "branch",
  22. defaultValue: "master",
  23. description: "Which branch to use"
  24. )
  25. choice (
  26. choices: 'keygen\nrevoke',
  27. description: 'Whats the action?',
  28. name: 'TASK_ACTION')
  29. choice (
  30. choices: 'client\nadmin',
  31. description: 'Whats the mode?',
  32. name: 'MODE')
  33. string(
  34. name: "client_mail",
  35. defaultValue: "admin@sdsys.ru",
  36. description: "Email which has to be recieved certs and key"
  37. )
  38. string(
  39. name: "key_name",
  40. defaultValue: "test",
  41. description: "The names for generation keys and certs."
  42. )
  43. string(
  44. name: "mailto",
  45. defaultValue: "admin@sdsys.ru",
  46. description: "Email which has to be notified."
  47. )
  48. }
  49. stages {
  50. stage("Pull PKI repo") {
  51. steps {
  52. withCredentials([sshUserPrivateKey(credentialsId: 'provision', keyFileVariable: 'GIT_SSH_KEY', passphraseVariable: '', usernameVariable: 'GIT_SSH_USERNAME')]) {
  53. sh '''GIT_SSH_COMMAND='ssh -i ${GIT_SSH_KEY} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' \
  54. git clone ${PKI_GIT_URL}
  55. cd ${WORKSPACE}/${PKI_GIT_NAME} && git checkout ${branch}
  56. '''
  57. }
  58. }
  59. }
  60. stage("Generate Keys and Certs or Revoke") {
  61. steps {
  62. script {
  63. def cert = "${WORKSPACE}/${PKI_GIT_NAME}/open/easy-rsa/client_keys/sds-${key_name}.zip"
  64. switch (TASK_ACTION) {
  65. case 'keygen':
  66. if (fileExists(cert)) {
  67. currentBuild.result = 'ABORTED'
  68. error ("Cert already exist!!!")
  69. return
  70. }
  71. COMMAND ="keygen.sh"
  72. break
  73. case 'revoke':
  74. if (!fileExists(cert)) {
  75. currentBuild.result = 'ABORTED'
  76. error ("Cert doesn't exist!!!")
  77. return
  78. }
  79. COMMAND ="revoke.sh"
  80. break
  81. }
  82. echo "Running ${DOCKER_REGISTRY}/${DOCKER_IMAGE}:latest."
  83. withCredentials([sshUserPrivateKey(credentialsId: 'provision', keyFileVariable: 'GIT_SSH_KEY', passphraseVariable: '', usernameVariable: 'GIT_SSH_USERNAME')]) {
  84. sh """set +x
  85. docker pull $DOCKER_REGISTRY/$DOCKER_IMAGE:latest
  86. docker run -i --rm -e TZ=Europe/Moscow -e mode=keygen -e "SSHKEY=`cat ${GIT_SSH_KEY}`" \
  87. -e git_url=${PKI_GIT_URL} -e git_dir=${PKI_GIT_NAME} \
  88. $DOCKER_REGISTRY/$DOCKER_IMAGE:latest /tmp/$COMMAND $key_name $branch
  89. """
  90. }
  91. }
  92. }
  93. }
  94. stage("Pull new version of REPOs") {
  95. steps {
  96. script {
  97. echo "Delete old repo version"
  98. sh 'rm -rf ${WORKSPACE}/${PKI_GIT_NAME} && rm -rf ${WORKSPACE}/${OVPN_GIT_DIR}'
  99. withCredentials([sshUserPrivateKey(credentialsId: 'provision', keyFileVariable: 'GIT_SSH_KEY', passphraseVariable: '', usernameVariable: 'GIT_SSH_USERNAME')]) {
  100. sh '''GIT_SSH_COMMAND='ssh -i ${GIT_SSH_KEY} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' \
  101. git clone ${OVPN_GIT_URL}
  102. cd ${WORKSPACE}/${OVPN_GIT_DIR} && git checkout ${branch} && cd ${WORKSPACE}
  103. GIT_SSH_COMMAND='ssh -i ${GIT_SSH_KEY} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' \
  104. git clone ${PKI_GIT_URL}
  105. cd ${WORKSPACE}/${PKI_GIT_NAME} && git checkout ${branch}
  106. '''
  107. }
  108. }
  109. }
  110. }
  111. stage("Generate configs") {
  112. when {
  113. expression { params.TASK_ACTION == 'keygen' }
  114. }
  115. steps {
  116. script {
  117. switch (MODE) {
  118. case 'client':
  119. file = "${WORKSPACE}/${OVPN_GIT_DIR}/ip_client.txt"
  120. break
  121. case 'admin':
  122. file = "${WORKSPACE}/${OVPN_GIT_DIR}/ip_admin.txt"
  123. break
  124. }
  125. string ip = readFile(file)
  126. split = ip.tokenize(".")
  127. if (split[3].toInteger() >= 254) {
  128. currentBuild.result == 'FAILURE'
  129. error ("The last oktet => 254!!!")
  130. return
  131. } else {
  132. split[3] = (split[3].toInteger() + 1) + ""
  133. def newIp = split.join(".")
  134. string txt = split[3].toString()
  135. writeFile file: file, text: newIp
  136. def conf = "${WORKSPACE}/${OVPN_GIT_DIR}/${OVPN_GIT_DIR}/persist/ccd/${key_name}"
  137. writeFile file: conf, text: "ifconfig-push " + newIp + " 255.255.0.0"
  138. }
  139. withCredentials([sshUserPrivateKey(credentialsId: 'provision', keyFileVariable: 'GIT_SSH_KEY', passphraseVariable: '', usernameVariable: 'GIT_SSH_USERNAME')]) {
  140. sh '''cd ${OVPN_GIT_DIR}
  141. echo "Add new config for ${key_name}" > ../commit.txt
  142. git add -A
  143. git config --global user.email "${JENKINS_MAIL}"
  144. git config --global user.name "Jenkins"
  145. git commit -F ../commit.txt
  146. GIT_SSH_COMMAND='ssh -i ${GIT_SSH_KEY} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' \
  147. git push origin ${branch}
  148. '''
  149. }
  150. }
  151. }
  152. }
  153. stage("Send key, certs and config with email") {
  154. when {
  155. expression { params.TASK_ACTION == 'keygen' }
  156. }
  157. steps {
  158. script {
  159. fileZip = "${WORKSPACE}/${PKI_GIT_NAME}/open/easy-rsa/client_keys/sds-${key_name}.zip"
  160. if ( !fileExists("${fileZip}")) {
  161. currentBuild.result == 'FAILURE'
  162. return
  163. } else {
  164. withEnv(["zip=${fileZip}"]) {
  165. withCredentials([usernamePassword(credentialsId: 'jenkins', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD')]) {
  166. sh '''echo "Ваши ключ, сертификаты и конфигурационный файл для подключения к infoclinica.ru" | email -s "Your Certs and Key" \
  167. -f ${JENKINS_MAIL} \
  168. -r ${SMTP_SERVER} \
  169. -m login \
  170. -u ${USERNAME} \
  171. -i ${PASSWORD} \
  172. -a ${zip} \
  173. ${client_mail}
  174. '''
  175. }
  176. }
  177. }
  178. }
  179. }
  180. }
  181. stage("Update ccd-files and stonevpn.crl") {
  182. steps {
  183. script {
  184. def NODE = sh (script: "DOCKER_HOST=tcp://${CLUSTER_NAME}:2376 DOCKER_TLS_VERIFY=1 docker service ps \${SERVICE_NAME} --format '{{.Node}}' --filter desired-state=Running" , returnStdout: true).trim()
  185. sh "if [ -z ${NODE} ]; then echo '${SERVICE_NAME} does not running'; exit 1; fi"
  186. def container_id = sh (script: "DOCKER_HOST=tcp://${NODE}:2376 DOCKER_TLS_VERIFY=1 docker ps -q -f label=ru.sdsys.subcontainer=\${SERVICE_NAME}" , returnStdout: true).trim()
  187. sh "DOCKER_HOST=tcp://${NODE}:2376 DOCKER_TLS_VERIFY=1 docker cp ${WORKSPACE}/${OVPN_GIT_DIR}/${OVPN_GIT_DIR}/persist/ccd/ ${container_id}:/etc/${OVPN_GIT_DIR}/persist"
  188. sh "DOCKER_HOST=tcp://${NODE}:2376 DOCKER_TLS_VERIFY=1 docker cp ${WORKSPACE}/${PKI_GIT_NAME}/open/easy-rsa/keys/stonevpn.crl ${container_id}:/etc/${OVPN_GIT_DIR}/persist/stonevpn.crl"
  189. }
  190. }
  191. }
  192. }
  193. post {
  194. always {
  195. echo "CleaningUp work directory"
  196. deleteDir()
  197. }
  198. failure {
  199. mail charset: 'UTF-8',
  200. subject: "Jenkins build ERROR",
  201. mimeType: 'text/html',
  202. to: "${mailto}",
  203. body: "<b>ATTENTION!!!</b> <b><br> Jenkins job failed.\n\n <b><br>Project Name:</b> ${env.JOB_NAME} <b><br>\nBuild Number:</b> ${env.BUILD_NUMBER} <b><br>\nURL Build:</b> ${RUN_DISPLAY_URL}"
  204. }
  205. aborted {
  206. mail charset: 'UTF-8',
  207. subject: "Jenkins build ERROR",
  208. mimeType: 'text/html',
  209. to: "${client_mail}",
  210. body: "<b>ATTENTION!!!</b> <b><br> Jenkins job aborted.\n\n <b><br> The CNAME ${key_name} is already exists!\n\n <b><br>Project Name:</b> ${env.JOB_NAME} <b><br>\nBuild Number:</b> ${env.BUILD_NUMBER} <b><br>\nURL Build:</b> ${RUN_DISPLAY_URL}"
  211. }
  212. }
  213. }