From a19009d5184666f3d4895baa8dc432623be24e95 Mon Sep 17 00:00:00 2001 From: Mark Nuttall Date: Tue, 12 May 2020 14:22:56 +0100 Subject: [PATCH 1/6] Document automerge --- README.md | 17 +-- automerge/Dockerfile | 24 ++++ automerge/README.md | 135 ++++++++++++++++++ automerge/gitconfig | 3 + .../resources/automerge-pipeline.yaml | 30 ++++ .../standalone/templates/automerge-task.yaml | 57 ++++++++ .../standalone/templates/git-resource.yaml | 11 ++ .../standalone/templates/github-secret.yaml | 10 ++ .../standalone/templates/pull-request.yaml | 13 ++ .../resources/automerge-pipeline.yaml | 38 +++++ .../webhooks/resources/automerge-tb.yaml | 32 +++++ .../webhooks/templates/automerge-task.yaml | 86 +++++++++++ .../webhooks/templates/automerge-tt.yaml | 65 +++++++++ 13 files changed, 505 insertions(+), 16 deletions(-) create mode 100644 automerge/Dockerfile create mode 100644 automerge/README.md create mode 100644 automerge/gitconfig create mode 100644 automerge/standalone/resources/automerge-pipeline.yaml create mode 100644 automerge/standalone/templates/automerge-task.yaml create mode 100644 automerge/standalone/templates/git-resource.yaml create mode 100644 automerge/standalone/templates/github-secret.yaml create mode 100644 automerge/standalone/templates/pull-request.yaml create mode 100644 automerge/webhooks/resources/automerge-pipeline.yaml create mode 100644 automerge/webhooks/resources/automerge-tb.yaml create mode 100644 automerge/webhooks/templates/automerge-task.yaml create mode 100644 automerge/webhooks/templates/automerge-tt.yaml diff --git a/README.md b/README.md index 7bc96d1..b5568cf 100644 --- a/README.md +++ b/README.md @@ -48,18 +48,6 @@ go test ./pkg/git -run TestCopyServiceWithFailureCopying ## Getting started -This section is temporary. To create a sample promotion Pull Request, until https://github.com/rhd-gitops-example/services/issues/8 is done: - -- Fork the repository https://github.com/rhd-gitops-example/gitops-example-dev -- Fork the repository https://github.com/rhd-gitops-example/gitops-example-staging -- Inside the services folder build the code: `go build ./cmd/services` -- export GITHUB_TOKEN=[your token] -- Substitute your repository URLs for those in square brackets: - -```shell -./services promote --from [url.to.dev] --to [url.to.staging] --service service-a` -``` - At a high level the services command currently: - git clones the source and target repositories into ~/.promotion/cache @@ -69,10 +57,7 @@ At a high level the services command currently: - pushes the cloned target - creates a PR from the new branch in the target to master in the target -## Important notes: - -- We need to remove the local cache between requests. See https://github.com/rhd-gitops-example/services/issues/20. Until then, add `rm -rf ~/.promotion/cache; ` before subsequent requests. -- See https://github.com/rhd-gitops-example/services/issues/19 for an issue related to problems 'promoting' config from a source repo into a gitops repo. +See the [tekton-example](./tekton-example/README.md) directory for more on using the `promote` task with Tekton. See [automerge](./automerge/README.md) for some suggestions as to how promotion PullRequests may be merged automatically where appropriate. ## Release process diff --git a/automerge/Dockerfile b/automerge/Dockerfile new file mode 100644 index 0000000..8d412aa --- /dev/null +++ b/automerge/Dockerfile @@ -0,0 +1,24 @@ +FROM ubuntu +RUN apt-get update + +# Install curl +RUN apt-get update +RUN apt-get install -y curl + +# Install kubectl +RUN apt-get install -y apt-transport-https gnupg2 +RUN curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - +RUN echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | tee -a /etc/apt/sources.list.d/kubernetes.list +RUN apt-get update && apt-get install -y kubectl + + +# Easy way to install yq, but wastes a lot of image size. Only required for 'standalone' case. +RUN apt-get install -y software-properties-common +RUN add-apt-repository -y ppa:rmescandon/yq +RUN apt install -y yq + +# Install hub command, and add 'git' alias. 'hub' is a strict superset of 'git'. +RUN apt install -y hub +RUN ln -s /usr/local/bin/hub /usr/local/bin/git + +RUN rm -rf /var/lib/apt/lists/* \ No newline at end of file diff --git a/automerge/README.md b/automerge/README.md new file mode 100644 index 0000000..cf4ff1c --- /dev/null +++ b/automerge/README.md @@ -0,0 +1,135 @@ +# Automerge + +The `promote` task initiates change by creating Pull Requests. Sometimes a team will want to merge these manually, and sometimes automation can assist. A development team may want changes to an early, shared 'dev' environment to be merged automatically, whereas changes into 'prod' will more likely require manual approval. This directory contains sample Tekton tasks that demonstrate ways to automatically merge Pull Requests. + +We have two subdirectories: 'standalone' and 'webhooks'. In the former case, a Tekton PipelineRun must be created manually. In the latter, the [Tekton Dashboard Webhooks Extension](https://github.com/tektoncd/experimental/tree/master/webhooks-extension) is used to start an automerge PipelineRun in response to a PullRequest arriving at a GitOps repository. + +# Setup - both cases + +Our samples currently work with GitHub. They use the `hub` CLI to create a merge commit that when pushed, will merge the associated Pull Request. See [here](https://hub.github.com/hub-merge.1.html) for more details. + +## gitconfig + +Since we are creating git commits within the Tekton tasks, we need to know the username and email address to associate with them, as in our ['tekton-example'](../tekton-example/README.md). So, edit `gitconfig` and + +```sh +kubectl create configmap promoteconfigmap --from-file=gitconfig +``` + +## Dockerfile + +The 'hub' CLI runs in a Docker container within a Tekton Pipeline. We've provided a sample Dockerfile. If you are taking the 'webhooks' path you can comment out the section that installs `yq`. Then, + +```sh +docker login +docker build -t YOUR_DOCKER_HUB_ID/hub-test . +docker push YOUR_DOCKER_HUB_ID/hub-test +``` + +## Create a Pull Request + +1. Fork our example gitops repository, https://github.com/rhd-gitops-example/gitops-example-dev. +1. Create a 'promotion' Pull Request either manually or using our ['tekton-example'](../tekton-example/README.md). For example you can use code of the form, + +```sh +services promote --from promote-demo --to https://github.com/YOUR_GITHUB_ID/gitops-example-dev.git --service promote-demo +``` + +## Generate a GitHub token + +You will need a GitHub token with repository access in order to merge Pull Requests. + +## Standalone case + +Edit the four files in the 'templates' directory. + +- In `automerge-task.yaml` replace `YOUR_DOCKER_HUB_ID` with your DockerHub id. +- In `git-resource.yaml` replace `YOUR_GITHUB_ID` with your GitHub id. +- In `github-secret.yaml` replace `[your-github-token-with-repo-access]` with your base64-encoded token. Run this command to get the right string: + +```sh +echo -n [your-token] | base64 +``` + +- In pull-request.yaml replace YOUR_PULL_REQUEST_URL with your pull request URL, e.g. `https://github.com/mnuttall/gitops-example-dev/pull/22` + +Apply all the Tekton resources: + +```sh +kubectl apply -f standalone/resources +kubectl apply -f standalone/templates +``` + +Finally start the Tekton pipeline: + +```sh +tkn pipeline start automerge-pipeline -r source-repo=gitops-repo -r pr=pull-request -p github-config=promoteconfigmap -p github-secret=github-secret --showlog +``` + +The pipeline will do a dry run to test that the yaml in the Pull Request is good, then merge the Pull Request and delete the branch associated with it. + +## Tekton Dashboard Webhooks Extension + +See the [Getting Started](https://github.com/tektoncd/experimental/blob/master/webhooks-extension/docs/GettingStarted.md) guide for setup guidelines. Our example uses GitHub Enterprise (GHE) and expects webhooks to be delivered to a cluster that is routeable to from GHE. + +### Secrets and Service Accounts + +Set up your Service Account and Secret as per the guide above. In this case you should have, + +- A ServiceAccount configured for use by Tekton. +- A Tekton-compatible Secret patched onto that that ServiceAccount containing your GitHub token. + +This secret is used in two related ways. We check the source repository out using a Tekton Git PipelineResource. This sets up `~/.gitconfig` with the credentials needed for `git push` to work. It gets these credentials from the `accessToken` field of the relevant secret patched onto the ServiceAccount running the Tekton Task. We then extract the same field and export it into the `GITHUB_TOKEN` environment variable to make `hub merge` work. Instructions for creating this secret are in the Getting Started document linked above. You should have resources of the form, + +```yaml +--- +apiVersion: v1 +data: + password: [base64-encoded token] + username: [base64-encoded email address] +kind: Secret +metadata: + annotations: + tekton.dev/git-0: https://github.ibm.com # For example + labels: + serviceAccount: test-sa # As configured in the Webhooks Extension + name: github-repo-access-secret + +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: test-sa +secrets: +- name: github-repo-access-secret +``` + +### Edit templates + +Next edit the `webhooks/templates/*` files. + +- In automerge-task.yaml, + - replace `YOUR_DOCKER_HUB_ID` with your DockerHub id. + - replace `YOUR_GHE` with your GitHub Enterprise domain. +- In automerge-tt.yaml, replace YOUR_TEKTON_SERVICE_ACCOUNT with the name of your ServiceAccount used by Tekton. + +### Apply configuration + +Apply your Tekton config as usual: + +```sh +kubectl apply -f webhooks/resources +kubectl apply -f webhooks/templates +``` + +### Set up webhook, and test + +Using the Tekton Dashboard webhooks extension, associate the `automerge-pipeline` with your GitOps repository. Now when a PR is raised against that repo you should see three PipelineRuns created for `automerge-pipeline`. + +- The first is triggered when the branch for the PullRequest is created. This runs the `echo "do nothing"` section in `automerge-task`. +- The second run executes the bulk of `automerge-task`: a merge commit is created and pushed, and its associated branch deleted. + +TODO: +A discrepancy occurs between running this task against GitHub and GitHub Enterprise. On GHE, while the commit is merged the PR remains open whereas on GitHub, it is shown as merged. A commented out section in `automerge-task` notes this, which will be investigated further in a separate issue. + +- Finally the third run executes `echo "kubectl apply -k env"`. Were you to remove the `echo` then this would result in the updated configuration being deployed. \ No newline at end of file diff --git a/automerge/gitconfig b/automerge/gitconfig new file mode 100644 index 0000000..2d135f2 --- /dev/null +++ b/automerge/gitconfig @@ -0,0 +1,3 @@ +[user] + name = REPLACE_ME.GITHUB_USERNAME + email = REPLACE_ME.GITHUB_EMAIL \ No newline at end of file diff --git a/automerge/standalone/resources/automerge-pipeline.yaml b/automerge/standalone/resources/automerge-pipeline.yaml new file mode 100644 index 0000000..efeb88b --- /dev/null +++ b/automerge/standalone/resources/automerge-pipeline.yaml @@ -0,0 +1,30 @@ +apiVersion: tekton.dev/v1alpha1 +kind: Pipeline +metadata: + name: automerge-pipeline +spec: + params: + - name: github-secret + type: string + - name: github-config + type: string + resources: + - name: source-repo + type: git + - name: pr + type: pullRequest + tasks: + - name: do-this-first + taskRef: + name: automerge-task + resources: + inputs: + - name: git-source + resource: source-repo + - name: pull-request + resource: pr + params: + - name: github-secret + value: $(params.github-secret) + - name: github-config + value: $(params.github-config) \ No newline at end of file diff --git a/automerge/standalone/templates/automerge-task.yaml b/automerge/standalone/templates/automerge-task.yaml new file mode 100644 index 0000000..8259f7d --- /dev/null +++ b/automerge/standalone/templates/automerge-task.yaml @@ -0,0 +1,57 @@ +apiVersion: tekton.dev/v1alpha1 +kind: Task +metadata: + name: automerge-task +spec: + params: + - name: github-config + type: string + description: configmap name of the gitconfig file that has user name, user e-mail. The key name is gitconfig. It can be created by "kubectl create configmap --from-file=gitconfig" + - name: github-secret + type: string + description: Name of the secret containing an access token for Github. Expects Tekton format, 'username' and 'password' keys. + volumes: + - name: gitconfig + configMap: + name: $(params.github-config) + items: + - key: gitconfig + path: gitconfig + inputs: + resources: + - name: git-source + type: git + - name: pull-request + type: pullRequest + steps: + - name: check-yaml + image: YOUR_DOCKER_HUB_ID/hub-test + script: | + #!/bin/bash + kubectl apply -k git-source/env --dry-run=client + - name: merge-pr + image: YOUR_DOCKER_HUB_ID/hub-test + volumeMounts: + - name: gitconfig + mountPath: /root + script: | + #!/bin/bash -x + + cat /root/gitconfig >> $HOME/.gitconfig + fullPRLink=$(yq r pull-request/pr.json 'Link') + prURL=${fullPRLink%.diff} + + cd git-source + hub merge $prURL + git push -u origin master + + # Pushing the change will merge the PR. Delete its branch to tidy up. + prBranch=$(yq r /workspace/pull-request/pr.json 'Head.Ref') + git push origin --delete $prBranch + + env: + - name: GITHUB_TOKEN + valueFrom: + secretKeyRef: + name: $(params.github-secret) + key: password \ No newline at end of file diff --git a/automerge/standalone/templates/git-resource.yaml b/automerge/standalone/templates/git-resource.yaml new file mode 100644 index 0000000..44bc2d6 --- /dev/null +++ b/automerge/standalone/templates/git-resource.yaml @@ -0,0 +1,11 @@ +apiVersion: tekton.dev/v1alpha1 +kind: PipelineResource +metadata: + name: gitops-repo +spec: + params: + - name: revision + value: master + - name: url + value: https://github.com/YOUR_GITHUB_ID/gitops-example-dev + type: git \ No newline at end of file diff --git a/automerge/standalone/templates/github-secret.yaml b/automerge/standalone/templates/github-secret.yaml new file mode 100644 index 0000000..e516e52 --- /dev/null +++ b/automerge/standalone/templates/github-secret.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Secret +metadata: + name: github-secret + annotations: + tekton.dev/git-0: https://github.com +type: kubernetes.io/basic-auth +data: + username: dG9rZW4= + password: [your-github-token-with-repo-access] \ No newline at end of file diff --git a/automerge/standalone/templates/pull-request.yaml b/automerge/standalone/templates/pull-request.yaml new file mode 100644 index 0000000..51b1e7f --- /dev/null +++ b/automerge/standalone/templates/pull-request.yaml @@ -0,0 +1,13 @@ +apiVersion: tekton.dev/v1alpha1 +kind: PipelineResource +metadata: + name: pull-request +spec: + type: pullRequest + params: + - name: url + value: YOUR_PULL_REQUEST_URL + secrets: + - fieldName: authToken + secretName: github-secrets + secretKey: token \ No newline at end of file diff --git a/automerge/webhooks/resources/automerge-pipeline.yaml b/automerge/webhooks/resources/automerge-pipeline.yaml new file mode 100644 index 0000000..c9d791f --- /dev/null +++ b/automerge/webhooks/resources/automerge-pipeline.yaml @@ -0,0 +1,38 @@ +apiVersion: tekton.dev/v1alpha1 +kind: Pipeline +metadata: + name: automerge-pipeline +spec: + params: + - name: github-secret + type: string + - name: github-config + type: string + - name: event-type + type: string + - name: branch-name + type: string + - name: pull-request-url + type: string + resources: + - name: source-repo + type: git + tasks: + - name: test-and-automerge + taskRef: + name: automerge-task + resources: + inputs: + - name: git-source + resource: source-repo + params: + - name: github-secret + value: $(params.github-secret) + - name: github-config + value: $(params.github-config) + - name: event-type + value: $(params.event-type) + - name: branch-name + value: $(params.branch-name) + - name: pull-request-url + value: $(params.pull-request-url) \ No newline at end of file diff --git a/automerge/webhooks/resources/automerge-tb.yaml b/automerge/webhooks/resources/automerge-tb.yaml new file mode 100644 index 0000000..460d008 --- /dev/null +++ b/automerge/webhooks/resources/automerge-tb.yaml @@ -0,0 +1,32 @@ +--- +apiVersion: triggers.tekton.dev/v1alpha1 +kind: TriggerBinding +metadata: + name: automerge-pipeline-pullrequest-binding + namespace: tekton-pipelines +spec: + params: + - name: pullrequesturl + value: $(body.pull_request.html_url) + - name: gitrepositoryurl + value: $(body.repository.clone_url) + - name: event-type + value: $(header.X-GitHub-Event) + - name: branch-name + value: $(body.pull_request.head.ref) +--- + +apiVersion: triggers.tekton.dev/v1alpha1 +kind: TriggerBinding +metadata: + name: automerge-pipeline-push-binding + namespace: tekton-pipelines +spec: + params: + - name: gitrepositoryurl + value: $(body.repository.clone_url) + - name: event-type + value: $(header.X-GitHub-Event) + - name: branch-name + value: $(body.ref) + diff --git a/automerge/webhooks/templates/automerge-task.yaml b/automerge/webhooks/templates/automerge-task.yaml new file mode 100644 index 0000000..34d40bb --- /dev/null +++ b/automerge/webhooks/templates/automerge-task.yaml @@ -0,0 +1,86 @@ +apiVersion: tekton.dev/v1alpha1 +kind: Task +metadata: + name: automerge-task +spec: + params: + - name: github-config + type: string + description: configmap name of the gitconfig file that has user name, user e-mail. The key name is gitconfig. It can be created by "kubectl create configmap --from-file=gitconfig" + - name: github-secret + type: string + description: Name of the secret containing an access token for Github. Expects Tekton format, 'username' and 'password' keys. + - name: event-type + type: string + description: webhook event type. 'push', 'pull_request' are the types we're interested in. + - name: branch-name + type: string + description: Git branch name, from the push or pull_request + - name: pull-request-url + type: string + description: The URL of the pull request, where applicable + volumes: + - name: gitconfig + configMap: + name: $(params.github-config) + items: + - key: gitconfig + path: gitconfig + inputs: + resources: + - name: git-source + type: git + steps: + - name: check-yaml + image: YOUR_DOCKER_HUB_ID/hub-test + script: | + #!/bin/bash + kubectl apply -k git-source/env --dry-run=client + - name: merge-pr + image: YOUR_DOCKER_HUB_ID/hub-test + volumeMounts: + - name: gitconfig + mountPath: /root + script: | + #!/bin/bash -x + + if [ $(params.event-type) = "push" ]; then + echo "git push on branch $(params.branch-name)" + if [ $(params.branch-name) = "refs/heads/master" ]; then + echo "kubectl apply -k env" + else + echo "do nothing" + fi + elif [ $(params.event-type) = "pull_request" ]; then + + cat /root/gitconfig >> $HOME/.gitconfig + # GHE requires some extra config + # Replace `YOUR_GHE` with your GitHub Enterprise domain e.g. `github.ibm.com` + git config --global --add hub.host YOUR_GHE + + cd git-source + export HUB_VERBOSE=true + hub merge $(params.pull-request-url) + git push -u origin master + + # Pushing the change will merge the PR. To close the PR we need to delete its branch. + # We can do this if we are confident that the PR comes from a branch and not a fork. + echo git push origin --delete $(params.branch-name) + + # On GitHub Enterprise - not GitHub.com - the issue will still be open. + # We don't know if this is a bug or a feature. One way to work around this is with code of the form, + # export GITHUB_HOST=github.ibm.com + # hub api -XPATCH repos/mnuttall/gitops-example-dev/pulls/4 -f state=closed + # See https://github.com/github/hub/issues/1151 + + + else + echo "Unrecognized event-type $(params.event-type)" + fi + + env: + - name: GITHUB_TOKEN + valueFrom: + secretKeyRef: + name: $(params.github-secret) + key: accessToken \ No newline at end of file diff --git a/automerge/webhooks/templates/automerge-tt.yaml b/automerge/webhooks/templates/automerge-tt.yaml new file mode 100644 index 0000000..70f26b4 --- /dev/null +++ b/automerge/webhooks/templates/automerge-tt.yaml @@ -0,0 +1,65 @@ +apiVersion: triggers.tekton.dev/v1alpha1 +kind: TriggerTemplate +metadata: + name: automerge-pipeline-template + namespace: tekton-pipelines +spec: + params: + - name: pullrequesturl + description: The pull request url + type: string + default: notApplicable + - name: github-configmap-name + description: Name of the configmap that stores the github username and password to be used in commits. + type: string + default: promote-configmap + - name: github-secretname + description: The git secret name + default: github-secret + type: string + - name: github-secret-keyname + description: The git secret key name + default: accessToken + type: string + - name: gitrepositoryurl + description: The url of the Git repository + - name: event-type + description: push, pull_request + - name: branch-name + description: The branch name associated with push events + resourcetemplates: + - apiVersion: tekton.dev/v1alpha1 + kind: PipelineResource + metadata: + name: gitops-repo-$(uid) + spec: + params: + - name: revision + value: master + - name: url + value: $(params.gitrepositoryurl) + type: git + - apiVersion: tekton.dev/v1beta1 + kind: PipelineRun + metadata: + name: automerge-pipelinerun-$(uid) + spec: + params: + - name: github-config + value: $(params.github-configmap-name) + - name: github-secret + value: $(params.github-secretname) + - name: branch-name + value: $(params.branch-name) + - name: event-type + value: $(params.event-type) + - name: pull-request-url + value: $(params.pullrequesturl) + serviceAccountName: YOUR_TEKTON_SERVICE_ACCOUNT + pipelineRef: + name: automerge-pipeline + resources: + - name: source-repo + resourceRef: + name: gitops-repo-$(uid) + \ No newline at end of file From e0f149cbea5f7249b59ba955cbc97e9e94a8b3c3 Mon Sep 17 00:00:00 2001 From: Mark Nuttall Date: Tue, 12 May 2020 14:26:34 +0100 Subject: [PATCH 2/6] Tweak secret key --- automerge/webhooks/templates/automerge-task.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automerge/webhooks/templates/automerge-task.yaml b/automerge/webhooks/templates/automerge-task.yaml index 34d40bb..4dbf029 100644 --- a/automerge/webhooks/templates/automerge-task.yaml +++ b/automerge/webhooks/templates/automerge-task.yaml @@ -83,4 +83,4 @@ spec: valueFrom: secretKeyRef: name: $(params.github-secret) - key: accessToken \ No newline at end of file + key: password \ No newline at end of file From d41d12b51d90629097e2d84cbc5cdfb62955ec80 Mon Sep 17 00:00:00 2001 From: Mark Nuttall Date: Wed, 13 May 2020 10:22:07 +0100 Subject: [PATCH 3/6] Respond to review comments --- automerge/README.md | 11 +++-------- automerge/standalone/templates/github-secret.yaml | 4 ++-- 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/automerge/README.md b/automerge/README.md index cf4ff1c..a4d2ef2 100644 --- a/automerge/README.md +++ b/automerge/README.md @@ -45,12 +45,7 @@ Edit the four files in the 'templates' directory. - In `automerge-task.yaml` replace `YOUR_DOCKER_HUB_ID` with your DockerHub id. - In `git-resource.yaml` replace `YOUR_GITHUB_ID` with your GitHub id. -- In `github-secret.yaml` replace `[your-github-token-with-repo-access]` with your base64-encoded token. Run this command to get the right string: - -```sh -echo -n [your-token] | base64 -``` - +- In `github-secret.yaml` replace `[your-github-token-with-repo-access]` with your GitHub token. - In pull-request.yaml replace YOUR_PULL_REQUEST_URL with your pull request URL, e.g. `https://github.com/mnuttall/gitops-example-dev/pull/22` Apply all the Tekton resources: @@ -70,7 +65,7 @@ The pipeline will do a dry run to test that the yaml in the Pull Request is good ## Tekton Dashboard Webhooks Extension -See the [Getting Started](https://github.com/tektoncd/experimental/blob/master/webhooks-extension/docs/GettingStarted.md) guide for setup guidelines. Our example uses GitHub Enterprise (GHE) and expects webhooks to be delivered to a cluster that is routeable to from GHE. +See the [Getting Started](https://github.com/tektoncd/experimental/blob/master/webhooks-extension/docs/GettingStarted.md) guide for setup guidelines. Our example uses GitHub Enterprise (GHE) and expects webhooks to be delivered to a cluster that is routeable from GHE. ### Secrets and Service Accounts @@ -130,6 +125,6 @@ Using the Tekton Dashboard webhooks extension, associate the `automerge-pipeline - The second run executes the bulk of `automerge-task`: a merge commit is created and pushed, and its associated branch deleted. TODO: -A discrepancy occurs between running this task against GitHub and GitHub Enterprise. On GHE, while the commit is merged the PR remains open whereas on GitHub, it is shown as merged. A commented out section in `automerge-task` notes this, which will be investigated further in a separate issue. +A discrepancy occurs between running this task against GitHub and GitHub Enterprise. On GHE, while the commit is merged the PR remains open whereas on GitHub, it is shown as merged. A commented out section in `automerge-task` notes this, which will be investigated under https://github.com/rhd-gitops-example/services/issues/76. - Finally the third run executes `echo "kubectl apply -k env"`. Were you to remove the `echo` then this would result in the updated configuration being deployed. \ No newline at end of file diff --git a/automerge/standalone/templates/github-secret.yaml b/automerge/standalone/templates/github-secret.yaml index e516e52..4e61cab 100644 --- a/automerge/standalone/templates/github-secret.yaml +++ b/automerge/standalone/templates/github-secret.yaml @@ -5,6 +5,6 @@ metadata: annotations: tekton.dev/git-0: https://github.com type: kubernetes.io/basic-auth -data: - username: dG9rZW4= +stringData: + username: token password: [your-github-token-with-repo-access] \ No newline at end of file From ab7b9f73660cb3a7945578d65866f7870550b94d Mon Sep 17 00:00:00 2001 From: Mark Nuttall Date: Wed, 13 May 2020 11:57:23 +0100 Subject: [PATCH 4/6] More review feedback --- {automerge => automerge-example}/Dockerfile | 0 {automerge => automerge-example}/README.md | 12 ++++++++++-- {automerge => automerge-example}/gitconfig | 0 .../standalone/resources/automerge-pipeline.yaml | 0 .../standalone/templates/automerge-task.yaml | 0 .../standalone/templates/git-resource.yaml | 0 .../standalone/templates/github-secret.yaml | 0 .../standalone/templates/pull-request.yaml | 0 .../webhooks/resources/automerge-pipeline.yaml | 0 .../webhooks/resources/automerge-tb.yaml | 0 .../webhooks/templates/automerge-task.yaml | 0 .../webhooks/templates/automerge-tt.yaml | 0 12 files changed, 10 insertions(+), 2 deletions(-) rename {automerge => automerge-example}/Dockerfile (100%) rename {automerge => automerge-example}/README.md (90%) rename {automerge => automerge-example}/gitconfig (100%) rename {automerge => automerge-example}/standalone/resources/automerge-pipeline.yaml (100%) rename {automerge => automerge-example}/standalone/templates/automerge-task.yaml (100%) rename {automerge => automerge-example}/standalone/templates/git-resource.yaml (100%) rename {automerge => automerge-example}/standalone/templates/github-secret.yaml (100%) rename {automerge => automerge-example}/standalone/templates/pull-request.yaml (100%) rename {automerge => automerge-example}/webhooks/resources/automerge-pipeline.yaml (100%) rename {automerge => automerge-example}/webhooks/resources/automerge-tb.yaml (100%) rename {automerge => automerge-example}/webhooks/templates/automerge-task.yaml (100%) rename {automerge => automerge-example}/webhooks/templates/automerge-tt.yaml (100%) diff --git a/automerge/Dockerfile b/automerge-example/Dockerfile similarity index 100% rename from automerge/Dockerfile rename to automerge-example/Dockerfile diff --git a/automerge/README.md b/automerge-example/README.md similarity index 90% rename from automerge/README.md rename to automerge-example/README.md index a4d2ef2..38835b4 100644 --- a/automerge/README.md +++ b/automerge-example/README.md @@ -4,7 +4,15 @@ The `promote` task initiates change by creating Pull Requests. Sometimes a team We have two subdirectories: 'standalone' and 'webhooks'. In the former case, a Tekton PipelineRun must be created manually. In the latter, the [Tekton Dashboard Webhooks Extension](https://github.com/tektoncd/experimental/tree/master/webhooks-extension) is used to start an automerge PipelineRun in response to a PullRequest arriving at a GitOps repository. -# Setup - both cases +## Prerequisites + +This example is for more advanced users. Start with the [tekton-example](../tekton-example/README.md) if you're new to the tool. You should have a good understanding of the tool, its purposes and syntax before working through the 'automerge' topic. In addition to the `services` binary you will need the following tools installed: + +- [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/) +- [`tkn`](https://github.com/tektoncd/cli) if you're not using webhooks +- [`docker`](https://docs.docker.com/get-docker/) + +## Setup - both cases Our samples currently work with GitHub. They use the `hub` CLI to create a merge commit that when pushed, will merge the associated Pull Request. See [here](https://hub.github.com/hub-merge.1.html) for more details. @@ -41,7 +49,7 @@ You will need a GitHub token with repository access in order to merge Pull Reque ## Standalone case -Edit the four files in the 'templates' directory. +Edit the files in the 'standalone/templates' directory. - In `automerge-task.yaml` replace `YOUR_DOCKER_HUB_ID` with your DockerHub id. - In `git-resource.yaml` replace `YOUR_GITHUB_ID` with your GitHub id. diff --git a/automerge/gitconfig b/automerge-example/gitconfig similarity index 100% rename from automerge/gitconfig rename to automerge-example/gitconfig diff --git a/automerge/standalone/resources/automerge-pipeline.yaml b/automerge-example/standalone/resources/automerge-pipeline.yaml similarity index 100% rename from automerge/standalone/resources/automerge-pipeline.yaml rename to automerge-example/standalone/resources/automerge-pipeline.yaml diff --git a/automerge/standalone/templates/automerge-task.yaml b/automerge-example/standalone/templates/automerge-task.yaml similarity index 100% rename from automerge/standalone/templates/automerge-task.yaml rename to automerge-example/standalone/templates/automerge-task.yaml diff --git a/automerge/standalone/templates/git-resource.yaml b/automerge-example/standalone/templates/git-resource.yaml similarity index 100% rename from automerge/standalone/templates/git-resource.yaml rename to automerge-example/standalone/templates/git-resource.yaml diff --git a/automerge/standalone/templates/github-secret.yaml b/automerge-example/standalone/templates/github-secret.yaml similarity index 100% rename from automerge/standalone/templates/github-secret.yaml rename to automerge-example/standalone/templates/github-secret.yaml diff --git a/automerge/standalone/templates/pull-request.yaml b/automerge-example/standalone/templates/pull-request.yaml similarity index 100% rename from automerge/standalone/templates/pull-request.yaml rename to automerge-example/standalone/templates/pull-request.yaml diff --git a/automerge/webhooks/resources/automerge-pipeline.yaml b/automerge-example/webhooks/resources/automerge-pipeline.yaml similarity index 100% rename from automerge/webhooks/resources/automerge-pipeline.yaml rename to automerge-example/webhooks/resources/automerge-pipeline.yaml diff --git a/automerge/webhooks/resources/automerge-tb.yaml b/automerge-example/webhooks/resources/automerge-tb.yaml similarity index 100% rename from automerge/webhooks/resources/automerge-tb.yaml rename to automerge-example/webhooks/resources/automerge-tb.yaml diff --git a/automerge/webhooks/templates/automerge-task.yaml b/automerge-example/webhooks/templates/automerge-task.yaml similarity index 100% rename from automerge/webhooks/templates/automerge-task.yaml rename to automerge-example/webhooks/templates/automerge-task.yaml diff --git a/automerge/webhooks/templates/automerge-tt.yaml b/automerge-example/webhooks/templates/automerge-tt.yaml similarity index 100% rename from automerge/webhooks/templates/automerge-tt.yaml rename to automerge-example/webhooks/templates/automerge-tt.yaml From 6964ca063beaf1e8da90af9fbd7b0de62534bb7f Mon Sep 17 00:00:00 2001 From: Mark Nuttall Date: Wed, 13 May 2020 13:29:48 +0100 Subject: [PATCH 5/6] Honestly I thought I did this earlier --- automerge-example/standalone/templates/pull-request.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/automerge-example/standalone/templates/pull-request.yaml b/automerge-example/standalone/templates/pull-request.yaml index 51b1e7f..c6293b2 100644 --- a/automerge-example/standalone/templates/pull-request.yaml +++ b/automerge-example/standalone/templates/pull-request.yaml @@ -9,5 +9,5 @@ spec: value: YOUR_PULL_REQUEST_URL secrets: - fieldName: authToken - secretName: github-secrets - secretKey: token \ No newline at end of file + secretName: github-secret + secretKey: password \ No newline at end of file From f19b286d1dc7808677b0b6200bfc59c4053aa34a Mon Sep 17 00:00:00 2001 From: Mark Nuttall Date: Wed, 13 May 2020 14:12:12 +0100 Subject: [PATCH 6/6] Note about RBAC --- automerge-example/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/automerge-example/README.md b/automerge-example/README.md index 38835b4..6271f01 100644 --- a/automerge-example/README.md +++ b/automerge-example/README.md @@ -12,6 +12,8 @@ This example is for more advanced users. Start with the [tekton-example](../tekt - [`tkn`](https://github.com/tektoncd/cli) if you're not using webhooks - [`docker`](https://docs.docker.com/get-docker/) +*Note* The 'standalone' code was developed on Docker Desktop and does not yet include the Role-Based Access Control configuration necessary for it to run on OpenShift or other locked-down environments. The 'webhook' code was developed on OpenShift but used a ServiceAccount that had a generous Role attached to it. Full RBAC support should be added to this example under https://github.com/rhd-gitops-example/services/issues/77. + ## Setup - both cases Our samples currently work with GitHub. They use the `hub` CLI to create a merge commit that when pushed, will merge the associated Pull Request. See [here](https://hub.github.com/hub-merge.1.html) for more details.