infra/.drone.yml

kind: pipeline
type: kubernetes
name: default
concurrency:
  limit: 1
clone:
  disable: true
trigger:
  event:
    - push

steps:
  - name: Prepare terraform files
    image: alpine
    commands:
      - "apk update && apk add jq curl git git-crypt"
      - "for i in 1 2 3 4 5; do git clone https://github.com/ViktorBarzin/infra.git . && break || echo \"Clone attempt $i failed, retrying in 10s...\" && sleep 10; done"
      - "git checkout $DRONE_COMMIT"
      - |
        curl -k https://10.0.20.100:6443/api/v1/namespaces/drone/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
      - "git-crypt unlock /tmp/key"
  - name: Terragrunt apply
    image: alpine
    commands:
      - "apk update && apk add curl unzip git openssh-client"
      # Install Terraform
      - "wget -O /tmp/terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip"
      - "unzip -o /tmp/terraform.zip -d /usr/local/bin/ && chmod 755 /usr/local/bin/terraform"
      # Install Terragrunt
      - "wget -O /usr/local/bin/terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/v0.99.4/terragrunt_linux_amd64"
      - "chmod 755 /usr/local/bin/terragrunt"
      # Apply platform stack (core infrastructure services - equivalent to old terraform apply -target=module.kubernetes_cluster)
      - "cd stacks/platform && terragrunt apply --non-interactive -auto-approve"

  - name: Push commit
    image: alpine
    commands:
      - "apk update && apk add openssh-client git git-crypt"
      - "mkdir ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts"
      - "chmod 400 secrets/deploy_key"
      - "git add ."
      - "git remote set-url origin git@github.com:ViktorBarzin/infra.git"
      - "git commit -m 'Drone CI deploy commit [CI SKIP]' || echo 'No changes'"
      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git push origin master"
  - name: slack
    image: plugins/slack
    settings:
      webhook:
        from_secret: slack_webhook
      channel: general
    when:
      status: [success, failure]

---
kind: pipeline
type: kubernetes
name: build-cli
concurrency:
  limit: 1
clone:
  disable: true
trigger:
  event:
    include:
      - push

steps:
  - name: Clone
    image: alpine
    commands:
      - "apk update && apk add git"
      - "for i in 1 2 3 4 5; do git clone https://github.com/ViktorBarzin/infra.git . && break || echo \"Clone attempt $i failed, retrying in 10s...\" && sleep 10; done"
      - "git checkout $DRONE_COMMIT"
  - name: Build image
    image: plugins/docker
    settings:
      username: "viktorbarzin"
      password:
        from_secret: dockerhub-pat
      repo: viktorbarzin/infra
      dockerfile: cli/Dockerfile
      context: cli
      auto_tag: true

---
kind: pipeline
type: kubernetes
name: renew-tls-certificate
clone:
  disable: true
trigger:
  event:
    - cron
  cron:
    - renew-tls-certificate

steps:
  - name: Prepare terraform files
    image: alpine
    commands:
      - "apk update && apk add jq curl git git-crypt"
      - "for i in 1 2 3 4 5; do git clone https://github.com/ViktorBarzin/infra.git . && break || echo \"Clone attempt $i failed, retrying in 10s...\" && sleep 10; done"
      - "git checkout $DRONE_COMMIT"
      - |
        curl -k https://10.0.20.100:6443/api/v1/namespaces/drone/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
      - "git-crypt unlock /tmp/key"
  - name: Run renew script
    image: alpine
    environment:
      TECHNITIUM_API_KEY:
        from_secret: TECHNITIUM_API_KEY
      CLOUDFLARE_TOKEN:
        from_secret: CLOUDFLARE_TOKEN
      CLOUDFLARE_ZONE_ID:
        from_secret: CLOUDFLARE_ZONE_ID
    commands:
      - "apk update && apk add certbot curl jq"
      - "./modules/kubernetes/setup_tls_secret/renew2.sh"
  - name: Commit updated certificates
    image: alpine
    commands:
      - "apk update && apk add openssh-client git git-crypt"
      - "mkdir ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts"
      - "chmod 400 secrets/deploy_key"
      - "git add ."
      - "git remote set-url origin git@github.com:ViktorBarzin/infra.git"
      - "git commit -m 'Drone CI Update TLS Certificates Commit' || echo 'No changes'"
      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git pull --rebase origin master"
      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git push origin master"