.gitlab-ci.yml

image: registry.ddbuild.io/images/mirror/golang:1.19-bullseye
variables:
  PROJECTNAME: "datadog-operator"
  PROJECTNAME_CHECK: "datadog-operator-check"
  GOPATH: "$CI_PROJECT_DIR/.cache"
  BUILD_DOCKER_REGISTRY: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci"
  JOB_DOCKER_IMAGE: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci-containers-project:v2.0.0"
  DOCKER_REGISTRY_LOGIN_SSM_KEY: docker_hub_login
  DOCKER_REGISTRY_PWD_SSM_KEY: docker_hub_pwd
  DOCKER_REGISTRY_URL: docker.io
  RH_PARTNER_REGISTRY: "quay.io/redhat-isv-containers"
  RH_PARTNER_PROJECT_ID: "5e7c8ebc1c86a3163d1a69be"
  RH_PARTNER_REGISTRY_USER: "redhat-isv-containers+5e7c8ebc1c86a3163d1a69be-robot"
  RH_PARTNER_REGISTRY_KEY_SSM_KEY: redhat_registry_key
  RH_PARTNER_API_KEY_SSM_KEY: redhat_api_key
  PUSH_IMAGES_TO_STAGING:
    description: "Set PUSH_IMAGE_TO_STAGING to 'true' if you want to push the operator to internal staging registry."

cache: &global_cache
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - .cache
  policy: pull-push

stages:
  - build
  - test
  - image
  - test-image
  - release
  - post-release

build:
  stage: build
  tags: ["runner:main", "size:large"]
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    - make build

unit_tests:
  stage: test
  tags: ["runner:main", "size:large"]
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    - make test

generate_code:
  stage: test
  tags: ["runner:main", "size:large"]
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    - make generate manifests
    - git diff --exit-code

build_operator_image_amd64:
  stage: image
  tags:
    - "arch:amd64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: amd64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG=$TARGET_IMAGE make docker-build-push-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi

build_operator_image_arm64:
  stage: image
  tags:
    - "arch:arm64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: arm64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-arm64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG=$TARGET_IMAGE make docker-build-push-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi

build_operator_check_image_amd64:
  stage: image
  tags:
    - "arch:amd64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: amd64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:$CI_COMMIT_TAG-amd64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG_CHECK=$TARGET_IMAGE make docker-build-push-check-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi

build_operator_check_image_arm64:
  stage: image
  tags:
    - "arch:arm64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: arm64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-arm64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:$CI_COMMIT_TAG-arm64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG_CHECK=$TARGET_IMAGE make docker-build-push-check-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi

build_bundle_image:
  stage: image
  tags:
    - "arch:amd64"
  image: $JOB_DOCKER_IMAGE
  variables:
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-bundle
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-bundle
  script:
    - BUNDLE_IMG=$TARGET_IMAGE make bundle-build-push
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi


preflight_redhat_image_amd64:
  stage: test-image
  rules:
    - if: $CI_COMMIT_TAG
      when: on_success
    - when: never
  tags:
    - "arch:amd64"
  image: $JOB_DOCKER_IMAGE
  variables:
    IMG: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64
  script:
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - make preflight-redhat-container


publish_public_main:
  stage: release
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: on_success
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-arm64
    IMG_DESTINATIONS: operator:main
    IMG_SIGNING: "false"

publish_public_tag:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
    IMG_DESTINATIONS: operator:$CI_COMMIT_TAG
    IMG_DESTINATIONS_REGEX: ':v'
    IMG_DESTINATIONS_REGEX_REPL: ':'
    IMG_SIGNING: "false"

# RedHat does not support multi-arch images. Use docker commands in lieu of DataDog/public-images until they do.
publish_redhat_public_tag:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  needs:
    - "preflight_redhat_image_amd64"
  tags: ["runner:docker", "size:large"]
  image: $JOB_DOCKER_IMAGE
  script:
    - apt-get update && apt-get -y install --no-install-recommends build-essential git awscli && apt-get -y clean && rm -rf /var/lib/apt/lists/*
    # Docker login to pull build image
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - docker pull --platform linux/amd64 $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64
    - docker tag $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64 $RH_PARTNER_REGISTRY/$RH_PARTNER_PROJECT_ID:${CI_COMMIT_TAG:1}
    # Docker login to push image to Redhat
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$RH_PARTNER_REGISTRY_KEY_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login -u "$RH_PARTNER_REGISTRY_USER" quay.io --password-stdin
    - docker push $RH_PARTNER_REGISTRY/$RH_PARTNER_PROJECT_ID:${CI_COMMIT_TAG:1}

  # Save for future use with public-images.
  # trigger:
  #   project: DataDog/public-images
  #   branch: main
  #   strategy: depend
  # variables:
  #   IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64
  #   IMG_DESTINATIONS: operator:$CI_COMMIT_TAG
  #   IMG_DESTINATIONS_REGEX: ':v'
  #   IMG_DESTINATIONS_REGEX_REPL: ':'
  #   IMG_REGISTRIES: redhat-operator

publish_public_latest:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
    IMG_DESTINATIONS: operator:latest
    IMG_SIGNING: "false"

# RedHat does not support multi-arch images. Use docker commands in lieu of DataDog/public-images until they do.
publish_redhat_public_latest:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  needs:
    - "preflight_redhat_image_amd64"
  tags: ["runner:docker", "size:large"]
  image: $JOB_DOCKER_IMAGE
  script:
    - apt-get update && apt-get -y install --no-install-recommends build-essential git awscli && apt-get -y clean && rm -rf /var/lib/apt/lists/*
    # Docker login to pull build image
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - docker pull --platform linux/amd64 $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64
    - docker tag $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64 $RH_PARTNER_REGISTRY/$RH_PARTNER_PROJECT_ID:latest
    # Docker login to push image to Redhat
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$RH_PARTNER_REGISTRY_KEY_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login -u "$RH_PARTNER_REGISTRY_USER" quay.io --password-stdin
    - docker push $RH_PARTNER_REGISTRY/$RH_PARTNER_PROJECT_ID:latest

trigger_internal_operator_image:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "true"

trigger_internal_operator_check_image:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME_CHECK
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "true"

trigger_internal_operator_nightly_image:
  stage: release
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: on_success
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    # Trigger a nightly images build that sets the RELEASE_TAG and BUILD_TAG
    BUILD_NIGHTLY: "true"
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"

trigger_internal_operator_check_nightly_image:
  stage: release
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: on_success
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME_CHECK
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    # Trigger a nightly images build that sets the RELEASE_TAG and BUILD_TAG
    BUILD_NIGHTLY: "true"
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"

trigger_custom_operator_image_staging:
  stage: release
  rules:
    - if: $PUSH_IMAGES_TO_STAGING == 'true'
      when: manual
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"

trigger_custom_operator_check_image_staging:
  stage: release
  rules:
    - if: $PUSH_IMAGES_TO_STAGING == 'true'
      when: manual
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME_CHECK
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"


submit_preflight_redhat_public_tag:
  stage: post-release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  needs:
    - "publish_redhat_public_tag"
  tags: ["runner:docker", "size:large"]
  image: $JOB_DOCKER_IMAGE
  script:
    - apt-get update && apt-get -y install --no-install-recommends build-essential git awscli && apt-get -y clean && rm -rf /var/lib/apt/lists/*
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$RH_PARTNER_REGISTRY_KEY_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$RH_PARTNER_REGISTRY_USER" --password-stdin "$RH_PARTNER_REGISTRY"
    - export RH_PARTNER_API_TOKEN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$RH_PARTNER_API_KEY_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - export IMG=$RH_PARTNER_REGISTRY/$RH_PARTNER_PROJECT_ID:${CI_COMMIT_TAG:1}
    - make preflight-redhat-container-submit


publish_community_operators:
  stage: post-release
  rules:
      - if: $CI_COMMIT_TAG
        when: manual
      - when: never
  needs:
    - "submit_preflight_redhat_public_tag"
  tags: [ "runner:docker", "size:large" ]
  image: $JOB_DOCKER_IMAGE
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    # Set version
    - export VERSION=${CI_COMMIT_TAG:1} # vX.Y.Z => X.Y.Z
    # Install github-cli and skopeo deps
    - curl -fsSL "https://cli.github.com/packages/githubcli-archive-keyring.gpg" -o /usr/share/keyrings/githubcli-archive-keyring.gpg
    - echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list
    - apt-get update -y
    - apt-get install -y gh libgpgme-dev libassuan-dev libbtrfs-dev libdevmapper-dev pkg-config
    - rm -rf /var/lib/apt/lists/*
    # Build skopeo and install (needed for make bundle-redhat)
    # Note: skopeo apt package is only available in for ubuntu 20.10+
    # https://github.com/containers/skopeo/blob/main/install.md#ubuntu
    # TODO: use apt-get when gitlab runner image base is updated to use ubuntu 20.10+
    - git clone https://github.com/containers/skopeo $GOPATH/src/github.com/containers/skopeo
    - cd $GOPATH/src/github.com/containers/skopeo && DISABLE_DOCS=1 make bin/skopeo
    - DISABLE_DOCS=1 make install
    # Set up redhat registry access to generate bundle-redhat
    - mkdir ~/.redhat
    - aws ssm get-parameter --region us-east-1 --name
      ci.datadog-operator.redhat-registry-token --with-decryption --query "Parameter.Value" --out text > ~/.redhat/auths.json
    - cd $CI_PROJECT_DIR
    - make bundle-redhat
    # configure git and github-cli
    - git config --global user.email $GITLAB_USER_EMAIL
    - git config --global user.name $GITLAB_USER_NAME
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.github-robot-token --with-decryption --query "Parameter.Value" --out text > git-token.txt
    - gh auth login --with-token < git-token.txt
    - gh auth setup-git
    # create pull request for each marketplace repo
    - make publish-community-bundles