From 5da48184f9df66f4597a4652fd1ed747dd4274e1 Mon Sep 17 00:00:00 2001
From: Lai Jiang <jianglai@msn.com>
Date: Fri, 19 Jul 2019 16:54:56 -0400
Subject: [PATCH] Merge beam and GAE configs deployment to one GCB job (#182)

* Merge beam and GAE configs deployment to one GCB job

Deployment of GAE configs requires that the credential used by gcloud to
have GAE admin role of the project to be managed. We do not want to
grant the GCB service account that role, because it would all *any* GCB
job to deploy anything to GAE. Instead we use a dedicated credential
originally created to deploy beam pipelines. This credential is
encrypted by KMS and stored on GCS. Since the beam pipeline deployment
GCB job already does the decryption, it make sense to add the config
deployment step there as well. The beam deployment steps are tweaked to
use the nomulus tool docker image instead of the jar file.

Also moved the content of deploy_configs_to_env.sh to the GCB yaml file
itself because the shell script is not uploaded to GC Bat the same time
as the yaml file when the job is triggered by Spinnaker.

Lastly, due to b/137891685, using GCB to deploy cron jobs does not work
as we cannot use service account credential to deploy to projects under
google.com.
---
 release/cloudbuild-beam.yaml           | 51 ------------------
 release/cloudbuild-deploy-configs.yaml | 22 --------
 release/cloudbuild-deploy.yaml         | 75 ++++++++++++++++++++++++++
 release/cloudbuild-nomulus.yaml        | 18 ++++---
 release/cloudbuild-proxy.yaml          | 14 +++--
 release/cloudbuild-release.yaml        | 17 +++---
 release/cloudbuild-sync.yaml           | 12 ++---
 release/deploy_configs_to_env.sh       | 45 ----------------
 8 files changed, 112 insertions(+), 142 deletions(-)
 delete mode 100644 release/cloudbuild-beam.yaml
 delete mode 100644 release/cloudbuild-deploy-configs.yaml
 create mode 100644 release/cloudbuild-deploy.yaml
 delete mode 100755 release/deploy_configs_to_env.sh

diff --git a/release/cloudbuild-beam.yaml b/release/cloudbuild-beam.yaml
deleted file mode 100644
index 1daae15bf48..00000000000
--- a/release/cloudbuild-beam.yaml
+++ /dev/null
@@ -1,51 +0,0 @@
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-deploy-beam.yaml --dryrun=false \
-# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
-#
-# This will deploy Beam pipelines to GCS for the PROJECT_ID defined in gcloud
-# tool.
-#
-# To manually trigger a build on GCB, run:
-# gcloud builds submit --config=cloudbuild-deploy-beam.yaml \
-# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
-#
-# To trigger a build automatically, follow the instructions below and add a trigger:
-# https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
-steps:
-# Pull the latest nomulus.jar to local
-- name: 'gcr.io/${PROJECT_ID}/builder:latest'
-  args:
-  - gsutil
-  - cp
-  - gs://${PROJECT_ID}-deploy/${TAG_NAME}/nomulus.jar
-  - .
-# Pull the credential for nomulus tool
-- name: 'gcr.io/${PROJECT_ID}/builder:latest'
-  args:
-  - gsutil
-  - cp
-  - gs://${PROJECT_ID}-deploy/secrets/tool-credential.json.enc
-  - .
-# Decrypt the credential
-- name: 'gcr.io/${PROJECT_ID}/builder:latest'
-  entrypoint: /bin/bash
-  args:
-  - -c
-  - |
-    cat tool-credential.json.enc | base64 -d | gcloud kms decrypt \
-      --ciphertext-file=- --plaintext-file=tool-credential.json \
-      --location=global --keyring=nomulus-tool-keyring --key=nomulus-tool-key
-# Deploy spec11 and invoicing pipeline to GCS
-- name: 'gcr.io/${PROJECT_ID}/builder:latest'
-  entrypoint: /bin/bash
-  args:
-  - -c
-  - |
-    java -jar nomulus.jar -e ${_ENV} --credential tool-credential.json \
-    deploy_spec11_pipeline
-    java -jar nomulus.jar -e ${_ENV} --credential tool-credential.json \
-    deploy_invoicing_pipeline
-timeout: 3600s
-options:
-  machineType: 'N1_HIGHCPU_8'
diff --git a/release/cloudbuild-deploy-configs.yaml b/release/cloudbuild-deploy-configs.yaml
deleted file mode 100644
index 2438e1cc4d9..00000000000
--- a/release/cloudbuild-deploy-configs.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# To run the build locally, install cloud-build-local first.
-# See: https://cloud.google.com/cloud-build/docs/build-debug-locally
-# You will need access to a private registry, so be sure to install the docker
-# credential helper.
-# Then, in the release folder, run:
-# cloud-build-local --config=cloudbuild-deploy-configs.yaml --dryrun=false \
-#   --substitutions TAG_NAME=[TAG],_ENV=[ENV] ..
-# This will build the contents of the current directory and generate the
-# nomulus war-files locally.
-# The PROJECT_ID is the current project name that gcloud uses.
-# You can add "--push true" to have the image pushed to GCR.
-#
-# To manually trigger a build on GCB, run:
-# gcloud builds submit --config cloudbuild-deploy-configs.yaml \
-#   --substitutions TAG_NAME=[TAG],_ENV=[ENV] ..
-#
-# To trigger a build automatically, follow the instructions below and add a trigger:
-# https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
-steps:
-# Download and unzip the tarball that contains the relevant config files
-- name: 'gcr.io/${PROJECT_ID}/builder:latest'
-  args: ['release/deploy_configs_to_env.sh', '${_ENV}', '${TAG_NAME}']
diff --git a/release/cloudbuild-deploy.yaml b/release/cloudbuild-deploy.yaml
new file mode 100644
index 00000000000..1faa019809c
--- /dev/null
+++ b/release/cloudbuild-deploy.yaml
@@ -0,0 +1,75 @@
+# To run the build locally, install cloud-build-local first.
+# Then run:
+# cloud-build-local --config=cloudbuild-deploy-beam.yaml --dryrun=false \
+# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
+#
+# This will deploy Beam pipelines to GCS for the PROJECT_ID defined in gcloud
+# tool.
+#
+# To manually trigger a build on GCB, run:
+# gcloud builds submit --config=cloudbuild-deploy-beam.yaml \
+# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
+#
+# To trigger a build automatically, follow the instructions below and add a trigger:
+# https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
+steps:
+# Pull the credential for nomulus tool.
+- name: 'gcr.io/${PROJECT_ID}/builder:latest'
+  args:
+  - gsutil
+  - cp
+  - gs://${PROJECT_ID}-deploy/secrets/tool-credential.json.enc
+  - .
+# Decrypt the credential.
+- name: 'gcr.io/${PROJECT_ID}/builder:latest'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    cat tool-credential.json.enc | base64 -d | gcloud kms decrypt \
+      --ciphertext-file=- --plaintext-file=tool-credential.json \
+      --location=global --keyring=nomulus-tool-keyring --key=nomulus-tool-key
+# Deploy the Spec11 pipeline to GCS.
+- name: 'gcr.io/${PROJECT_ID}/nomulus-tool:latest'
+  args:
+  - -e
+  - ${_ENV}
+  - --credential
+  - tool-credential.json
+  - deploy_spec11_pipeline
+# Deploy the invoicing pipeline to GCS.
+- name: 'gcr.io/${PROJECT_ID}/nomulus-tool:latest'
+  args:
+  - -e
+  - ${_ENV}
+  - --credential
+  - tool-credential.json
+  - deploy_invoicing_pipeline
+# Deploy the GAE config files.
+# First authorize the gcloud tool to use the credential json file, then
+# download and unzip the tarball that contains the relevant config files
+- name: 'gcr.io/${PROJECT_ID}/builder:latest'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    gcloud auth activate-service-account --key-file=tool-credential.json
+    if [ ${_ENV} == production ]; then
+      project_id="domain-registry"
+    else
+      project_id="domain-registry-${_ENV}"
+    fi
+    gsutil cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/${_ENV}.tar .
+    tar -xvf ${_ENV}.tar
+    # Note that this currently does not work for google.com projects that
+    # we use due to b/137891685. External projects are likely to work.
+    for filename in cron dispatch dos index queue; do
+      gcloud -q --project ${project_id} app deploy \
+        default/WEB-INF/appengine-generated/${filename}.yaml
+    done
+
+timeout: 3600s
+options:
+  machineType: 'N1_HIGHCPU_8'
diff --git a/release/cloudbuild-nomulus.yaml b/release/cloudbuild-nomulus.yaml
index 04bfdd0d3b2..df152d9b954 100644
--- a/release/cloudbuild-nomulus.yaml
+++ b/release/cloudbuild-nomulus.yaml
@@ -29,20 +29,25 @@ steps:
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
   entrypoint: /bin/bash
   args:
-    - -c
-    - |
-      docker tag nomulus-tool gcr.io/${PROJECT_ID}/nomulus-tool:${TAG_NAME}
-      docker push gcr.io/${PROJECT_ID}/nomulus-tool:${TAG_NAME}
-# Get the tool image digest and substitute in the digest in the tagging yaml file.
+  - -c
+  - |
+    set -e
+    docker tag nomulus-tool gcr.io/${PROJECT_ID}/nomulus-tool:${TAG_NAME}
+    docker tag nomulus-tool gcr.io/${PROJECT_ID}/nomulus-tool:latest
+    docker push gcr.io/${PROJECT_ID}/nomulus-tool:${TAG_NAME}
+    docker push gcr.io/${PROJECT_ID}/nomulus-tool:latest
+# Get the tool image digest and substitute in the digest in other GCB files.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
   entrypoint: /bin/bash
   args:
   - -c
   - |
+    set -e
     digest=$(gcloud container images list-tags gcr.io/${PROJECT_ID}/nomulus-tool \
       --format="get(digest)" --filter="tags = ${TAG_NAME}")
     sed -i s/'$${_IMAGE}'/nomulus-tool/g release/cloudbuild-tag.yaml
     sed -i s/':$${TAG_NAME}'/@$digest/g release/cloudbuild-tag.yaml
+    sed -i s/'nomulus-tool:latest'/nomulus-tool@$digest/g release/cloudbuild-deploy-*.yaml
 # Build and package the deployment files for alpha.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
   args: ['release/build_nomulus_for_env.sh', 'alpha', 'output']
@@ -64,8 +69,7 @@ artifacts:
     - 'output/nomulus.jar'
     - 'release/cloudbuild-tag.yaml'
     - 'release/cloudbuild-sync.yaml'
-    - 'release/cloudbuild-beam-*.yaml'
-    - 'release/cloudbuild-deploy-configs-*.yaml'
+    - 'release/cloudbuild-deploy-*.yaml'
 
 timeout: 3600s
 options:
diff --git a/release/cloudbuild-proxy.yaml b/release/cloudbuild-proxy.yaml
index b2a568ff7b6..b15837066bc 100644
--- a/release/cloudbuild-proxy.yaml
+++ b/release/cloudbuild-proxy.yaml
@@ -16,11 +16,11 @@ steps:
 # Build the proxy docker image.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
   args:
-  - './gradlew'
-  - ':proxy:test'
-  - ':proxy:buildProxyImage'
-  - '-PmavenUrl=https://storage.googleapis.com/domain-registry-maven-repository/maven'
-  - '-PpluginsUrl=https://storage.googleapis.com/domain-registry-maven-repository/plugins'
+  - ./gradlew
+  - :proxy:test
+  - :proxy:buildProxyImage
+  - -PmavenUrl=https://storage.googleapis.com/domain-registry-maven-repository/maven
+  - -PpluginsUrl=https://storage.googleapis.com/domain-registry-maven-repository/plugins
 # Tag and push the image. We can't let Cloud Build's default processing do that for us
 # because we need to push the image before we can sign it in the following step.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
@@ -28,8 +28,11 @@ steps:
   args:
   - -c
   - |
+    set -e
     docker tag proxy gcr.io/${PROJECT_ID}/proxy:${TAG_NAME}
+    docker tag proxy gcr.io/${PROJECT_ID}/proxy:latest
     docker push gcr.io/${PROJECT_ID}/proxy:${TAG_NAME}
+    docker push gcr.io/${PROJECT_ID}/proxy:latest
   dir: 'proxy'
 # Get the image digest, sign it and substitute in the digest in the tagging yaml file.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
@@ -37,6 +40,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     digest=$(gcloud container images list-tags gcr.io/${PROJECT_ID}/proxy \
       --format="get(digest)" --filter="tags = ${TAG_NAME}")
     gcloud --project=${PROJECT_ID} alpha container binauthz attestations \
diff --git a/release/cloudbuild-release.yaml b/release/cloudbuild-release.yaml
index 9d0e1cd9847..315430ad982 100644
--- a/release/cloudbuild-release.yaml
+++ b/release/cloudbuild-release.yaml
@@ -24,6 +24,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     git clone https://gerrit.googlesource.com/gcompute-tools
     ./gcompute-tools/git-cookie-authdaemon
     git clone ${_INTERNAL_REPO_URL} nomulus-internal
@@ -33,6 +34,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     git tag ${TAG_NAME}
     git push origin ${TAG_NAME}
   dir: 'nomulus-internal'
@@ -42,6 +44,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     shopt -s dotglob
     rm -rf .git && rm -rf nomulus-internal/.git
     cp -rf nomulus-internal/* .
@@ -52,6 +55,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     docker build -t gcr.io/${PROJECT_ID}/builder:${TAG_NAME} .
     docker tag gcr.io/${PROJECT_ID}/builder:${TAG_NAME} gcr.io/${PROJECT_ID}/builder:latest
     docker pull gcr.io/distroless/java
@@ -73,6 +77,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     builder_digest=$(gcloud container images list-tags gcr.io/${PROJECT_ID}/builder \
       --format='get(digest)' --filter='tags = ${TAG_NAME}')
     base_digest=$(gcloud container images list-tags gcr.io/${PROJECT_ID}/base \
@@ -83,17 +88,15 @@ steps:
     sed -i s%distroless/java:debug%${PROJECT_ID}/base-debug@$debug_digest% core/Dockerfile
     sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-proxy.yaml
     sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-nomulus.yaml
-    sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-beam.yaml
-    sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-deploy-configs.yaml
+    sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-deploy.yaml
     sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-sync.yaml
     sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-tag.yaml
     sed -i s/GCP_PROJECT/${PROJECT_ID}/ proxy/kubernetes/proxy-*.yaml
     sed -i s/'$${TAG_NAME}'/${TAG_NAME}/g release/cloudbuild-sync.yaml
-    sed -i s/'$${TAG_NAME}'/${TAG_NAME}/g release/cloudbuild-beam.yaml
-    sed -i s/'$${TAG_NAME}'/${TAG_NAME}/g release/cloudbuild-deploy-configs.yaml
+    sed -i s/'$${TAG_NAME}'/${TAG_NAME}/g release/cloudbuild-deploy.yaml
     for environment in alpha crash sandbox production; do
-      sed s/'$${_ENV}'/${environment}/g release/cloudbuild-beam.yaml > release/cloudbuild-beam-${environment}.yaml
-      sed s/'$${_ENV}'/${environment}/g release/cloudbuild-deploy-configs.yaml > release/cloudbuild-deploy-configs-${environment}.yaml
+      sed s/'$${_ENV}'/${environment}/g release/cloudbuild-deploy.yaml \
+        > release/cloudbuild-deploy-${environment}.yaml
     done
 # Upload the gradle binary to GCS if it does not exist and point URL in gradle wrapper to it.
 - name: 'gcr.io/cloud-builders/gsutil'
@@ -101,6 +104,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     gradle_url=$(grep distributionUrl gradle/wrapper/gradle-wrapper.properties \
       | awk -F = '{print $2}' | sed 's/\\//g')
     gradle_bin=$(basename $gradle_url)
@@ -130,6 +134,7 @@ steps:
   args:
   - -c
   - |
+    set -e
     cp -rf nomulus-release/.git .
     rm -rf nomulus-release
     git config --global user.name "Cloud Build"
diff --git a/release/cloudbuild-sync.yaml b/release/cloudbuild-sync.yaml
index bb79b53aacb..a736629f8a7 100644
--- a/release/cloudbuild-sync.yaml
+++ b/release/cloudbuild-sync.yaml
@@ -13,12 +13,12 @@ steps:
 # Rsync the folder.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
   args:
-  - 'gsutil'
-  - '-m'
-  - 'rsync'
-  - '-d'
-  - 'gs://${PROJECT_ID}-deploy/${TAG_NAME}'
-  - 'gs://${PROJECT_ID}-deploy/live'
+  - gsutil
+  - -m
+  - rsync
+  - -d
+  - gs://${PROJECT_ID}-deploy/${TAG_NAME}
+  - gs://${PROJECT_ID}-deploy/live
 timeout: 3600s
 options:
   machineType: 'N1_HIGHCPU_8'
diff --git a/release/deploy_configs_to_env.sh b/release/deploy_configs_to_env.sh
deleted file mode 100755
index d67e2077d67..00000000000
--- a/release/deploy_configs_to_env.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/bash
-# Copyright 2019 The Nomulus Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# This script downloads the tagged tarball from GCS and uploads the AppEngine config files therein
-# to the provided environment. The standard AppEngine deployment process doesn't automatically
-# update these configs, so we must do it manually.
-
-set -e
-
-if [ $# -ne 2 ];
-then
-  echo "Usage: $0 alpha|crash|sandbox|production <tag_name>"
-  exit 1
-fi
-
-environment="$1"
-tag_name="$2"
-
-if [ "${environment}" == alpha ]; then
-  project_id="domain-registry-alpha"
-elif [ "${environment}" == crash ]; then
-  project_id="domain-registry-crash"
-elif [ "${environment}" == sandbox ]; then
-  project_id="domain-registry-sandbox"
-elif [ "${environment}" == production ]; then
-  project_id="domain-registry"
-fi
-
-gsutil cp gs://domain-registry-dev-deploy/${tag_name}/${environment}.tar .
-tar -xvf ${environment}.tar
-for filename in cron dispatch dos index queue; do
-  gcloud -q --project ${project_id} app deploy default/WEB-INF/appengine-generated/${filename}.yaml
-done