werf.yaml

---
project: deckhouse
configVersion: 1
gitWorktree:
  forceShallowClone: true
cleanup:
  disableGitHistoryBasedPolicy: {{ env "WERF_DISABLE_META_TAGS" "false" }}
---
{{- $_ := set . "DistroPackagesProxy" (env "DISTRO_PACKAGES_PROXY" "") }}
{{- $_ := set . "CargoProxy" (env "CARGO_PROXY" "") }}
# Templates for distro proxy for packages (deb,rpm,apk)
  {{- define "alt packages proxy" }}
# Replace altlinux repos with our proxy
  {{- if $.DistroPackagesProxy }}
- sed -i "s|ftp.altlinux.org/pub/distributions/ALTLinux|{{ $.DistroPackagesProxy }}/repository/ALT-Linux-APT-Repository|g" /etc/apt/sources.list.d/alt.list
  {{- end }}
- export DEBIAN_FRONTEND=noninteractive
- apt-get update
{{- end }}

{{- define "debian packages proxy" }}
# Replace debian repos with our proxy
  {{- if $.DistroPackagesProxy }}
- sed -i "s|http://deb.debian.org|http://{{ $.DistroPackagesProxy }}/repository|g" /etc/apt/sources.list
  {{- end }}
- export DEBIAN_FRONTEND=noninteractive
- apt-get update
{{- end }}

{{- define "ubuntu packages proxy" }}
  # Replace ubuntu repos with our proxy
  {{- if $.DistroPackagesProxy }}
- sed -i 's|http://archive.ubuntu.com|http://{{ $.DistroPackagesProxy }}/repository/archive-ubuntu|g' /etc/apt/sources.list
- sed -i 's|http://security.ubuntu.com|http://{{ $.DistroPackagesProxy }}/repository/security-ubuntu|g' /etc/apt/sources.list
  {{- end }}
- export DEBIAN_FRONTEND=noninteractive
- apt-get update
{{- end }}

{{- define "alpine packages proxy" }}
# Replace alpine repos with our proxy
  {{- if $.DistroPackagesProxy }}
- sed -i 's|https://dl-cdn.alpinelinux.org|http://{{ $.DistroPackagesProxy }}/repository|g' /etc/apk/repositories
  {{- end }}
- apk update
{{- end }}

{{- define "node packages proxy" }}
  {{- if $.DistroPackagesProxy }}
- npm config set registry http://{{ $.DistroPackagesProxy }}/repository/npmjs/
  {{- end }}
{{- end }}

{{- define "pypi proxy" }}
  {{- if $.DistroPackagesProxy }}
- |
  cat <<"EOD" > /etc/pip.conf
  [global]
  index = http://{{ $.DistroPackagesProxy }}/repository/pypi-proxy/pypi
  index-url = http://{{ $.DistroPackagesProxy }}/repository/pypi-proxy/simple
  trusted-host = {{ $.DistroPackagesProxy }}
  EOD
  {{- end }}
{{- end }}
---
# revisions settings
{{- $editionsSettings := (.Files.Get "editions.yaml" | fromYaml) }}
{{- $_ := set . "Editions" $editionsSettings.editions }}

# checks redactions list
{{- if not $.Editions }}
  {{ fail "Editions list is empty" }}
{{- end }}

{{- $editionsDict := dict }}
{{- range $_, $edition := $.Editions }}
  {{- if not $edition.name }}
     {{ fail printf "Editions name is empty" }}
  {{- end }}
  {{- $_ := set $editionsDict $edition.name "" }}
{{- end }}

{{- if not (hasKey $editionsDict .Env) }}
  {{ fail (printf "Editions name not found %v" .Env) }}
{{- end }}

---
# Base Images
{{- $_ := set . "Images" (.Files.Get "candi/image_versions.yml" | fromYaml) }}
  {{- range $k, $v := .Images }}
    {{ $baseImagePath := (printf "%s%s" $.Images.REGISTRY_PATH (trimSuffix "/" $v)) }}
    {{- if ne $k "REGISTRY_PATH" }}
      {{- $_ := set $.Images $k $baseImagePath }}
    {{- end }}
  {{- end }}
---
# Version Map
{{- $versionMap := dict }}
{{- range $_, $edition := $.Editions }}
 {{- if $edition.versionMapFile }}
   {{- $versionMap = (merge $versionMap ($.Files.Get $edition.versionMapFile | fromYaml) )}}
 {{- end }}
 {{- if eq $.Env $edition.name }}
   {{- break -}}
 {{- end }}
{{- end }}

{{- $_ := set . "CandiVersionMap" $versionMap }}
---
# Terraform Versions
{{- $_ := set . "TF" (.Files.Get "candi/terraform_versions.yml" | fromYaml) }}

# Source repo  settings
{{- $_ := set . "SOURCE_REPO" (env "SOURCE_REPO" | default "https://github.com") }}

# source repo with protected cloud providers
# use example.com as default because we can fail build without env
{{- $_ := set . "CLOUD_PROVIDERS_SOURCE_REPO" (env "CLOUD_PROVIDERS_SOURCE_REPO" | default "https://example.com") }}

# Source repo with observability private code
{{- $_ := set . "OBSERVABILITY_SOURCE_REPO" (env "OBSERVABILITY_SOURCE_REPO" | default "https://example.com") }}

# Stronghold repo access for building d8 cli
{{- $_ := set . "STRONGHOLD_PULL_TOKEN" (env "STRONGHOLD_PULL_TOKEN") }}
{{- $_ := set . "DECKHOUSE_PRIVATE_REPO" (env "DECKHOUSE_PRIVATE_REPO") }}

# goproxy  settings
{{- $_ := set . "GOPROXY" (env "GOPROXY") }}
---
{{ range $path, $content := .Files.Glob ".werf/werf-**.yaml" }}
{{ tpl $content $ }}
{{ end }}
---
{{- define "base components imports" }}
- artifact: tini-artifact
  add: /tini/tini-static
  to: /usr/bin/tini
  before: setup
- artifact: semver-artifact
  add: /usr/local/bin/semver
  to: /usr/local/bin/semver
  before: setup
  {{- range $k8sVersion := tuple "1.27" "1.30"}}
    {{- $image_version := printf "%s.%d" $k8sVersion (index $.CandiVersionMap "k8s" $k8sVersion "patch") | replace "." "-" }}
- artifact: common/kubernetes-artifact-{{ $image_version }}
  add: /src/_output/bin/kubectl
  to: /usr/local/bin/kubectl-{{ $k8sVersion }}
  before: setup
  {{- end }}
{{- end }}

{{- define "base components" }}
- |
  # Install kubectl wrapper
  cat <<"EOD" > /usr/local/bin/kubectl
  {{- .Files.Get "deckhouse-controller/files/kubectl_wrapper.sh" | nindent 2 }}
  EOD
  chmod +x /usr/local/bin/kubectl
  # Shell comfort: inputrc
  cat <<"EOD" > /etc/inputrc
  {{- .Files.Get "deckhouse-controller/files/inputrc" | nindent 2 }}
  EOD
  # Shell comfort: bashrc
  cat <<"EOD" > /etc/bashrc
  {{- .Files.Get "deckhouse-controller/files/bashrc" | nindent 2 }}
  EOD
  # Shell comfort: add bashrc for root
  rm -f /root/.bashrc
  ln -s /etc/bashrc /root/.bashrc
  # Shell comfort: add bashrc for nobody
  rm -f /.bashrc
  ln -s /etc/bashrc /.bashrc
  # Shell comfort: create /etc/vim
  mkdir -p /etc/vim/
  # Shell comfort: vimrc.local
  cat <<"EOD" > /etc/vim/vimrc.local
  {{- .Files.Get "deckhouse-controller/files/vimrc.local" | nindent 2 }}
  EOD
{{- end }}

image: common-base
from: {{ .Images.BASE_ALT }}
import:
- artifact: dev-alt-artifact
  add: /
  to: /
  before: setup
  includePaths:
  - lib64/libz.so*
  - lib64/libexpat.so*
  - lib64/libssl.so.*
  - lib64/libcrypto.so.*
  - etc/pki
  - usr/share/ca-certificates/ca-bundle.crt
  - usr/bin/python3
  - usr/bin/python3.9
  - usr/lib/python3
  - usr/lib64/python3
  - usr/lib64/python3.9
  - usr/lib64/libffi.so*
  - usr/share/vim
  - etc/vim
  - etc/bash_completion.d
  - etc/bashrc.d/bash_completion.sh
  - usr/share/bash-completion
  - usr/bin/vim-console

  {{- include "base components imports" . }}

- image: common/distroless
  add: /etc/ssl
  to: /etc/ssl
  before: setup

- artifact: registrypackages/d8-curl-artifact-8-2-1
  add: /d8-curl
  to: /usr/bin/curl
  before: setup

shell:
  beforeInstall:
  {{- include "base components" . | nindent 2 }}

---
image: base-for-go
from: {{ .Images.BASE_ALT_DEV }}
import:
  {{- include "base components imports" . }}
shell:
  beforeInstall:
{{/*  TODO: Move it to the dev image */}}
  - rm -rf /usr/local/go
  - curl -sSfL https://go.dev/dl/go1.23.1.linux-amd64.tar.gz -o - | tar -C /usr/local -zxvf -
  {{- include "base components" . | nindent 2 }}

---
{{- define "exclude_modules_dir_from_images" }}
- docs
- modules/*/docs
- modules/*/README.md
- modules/*/images
- modules/*/hooks/**/*.go
- modules/*/template_tests
- modules/*/.namespace
- modules/*/values_matrix_test.yaml
- modules/*/apis/**/*.go
- modules/*/requirements/**/*.go
- modules/*/settings-conversion/**/*.go
- modules/*/hack/**/*.go
- global-hooks/**/*.go
- candi/cloud-providers/*/layouts
- candi/cloud-providers/*/terraform-modules
- '**/testdata'
{{- end}}

---
artifact: dev-alt-artifact
from: {{ .Images.BASE_ALT_DEV }}
shell:
  install:
  - /binary_replace.sh -i "/usr/bin/envsubst" -o /relocate

---
artifact: golangci-lint-artifact
from: {{ $.Images.BASE_GOLANG_23_ALPINE }}
shell:
  beforeInstall:
  - apk add --no-cache git openssh-client
  - mkdir -p ~/.ssh && echo "StrictHostKeyChecking accept-new" > ~/.ssh/config
  install:
  # Use v1.60.1 for go1.23 - https://github.com/golangci/golangci-lint/issues/4837
  - export GOPROXY={{ .GOPROXY }}
  - git clone --depth 1 {{ .SOURCE_REPO }}/golangci/golangci-lint --branch v1.60.1
  - cd golangci-lint/
  - CGO_ENABLED=0 GOOS=linux go build -ldflags '-s -w -extldflags "-static"' -o /usr/local/bin/golangci-lint cmd/golangci-lint/main.go

---
artifact: deckhouse-controller
fromImage: base-for-go
git:
- add: /
  to: /deckhouse
  includePaths:
    - dhctl
    - deckhouse-controller
    - global-hooks/**/*.go
    - modules/**/*.go
    - ee/se-plus/modules/021-cni-cilium/images/egress-gateway-agent/**/*.go
    - ee/se-plus/modules/021-cni-cilium/images/egress-gateway-agent/go.mod
    - ee/se-plus/modules/021-cni-cilium/images/egress-gateway-agent/go.sum
    - go_lib/**/*.go
    - go_lib/**/go.mod
    - go_lib/**/go.sum
    - pkg/**/*.go
    - pkg/**/go.mod
    - pkg/**/go.sum
    - go.mod
    - go.sum
    - tools
    - editions.yaml
  excludePaths:
    {{ .Files.Get (printf "tools/build_includes/modules-excluded-%s.yaml" .Env) | nindent 4}}
    - global-hooks/**/*_test.go
    - modules/**/*_test.go
    - modules/*/images
    - dhctl/development
    - deckhouse-controller/development
    - deckhouse-controller/cmd/deckhouse-controller/register-go-hooks.go
  stageDependencies:
    setup:
      - dhctl/go.mod
      - dhctl/go.sum
      - go.mod
      - go.sum
      - dhctl/**/*.go
      - deckhouse-controller/**/*.go
      - deckhouse-controller/go-build.sh
      - global-hooks/**/*.go
      - go_lib/**/*.go
      - go_lib/**/go.mod
      - go_lib/**/go.sum
      - pkg/**/*.go
      - pkg/**/go.mod
      - pkg/**/go.sum
      - modules/**/*.go
      - editions.yaml
{{ .Files.Get (printf "tools/build_includes/modules-with-dependencies-%s.yaml" .Env) }}
{{ .Files.Get (printf "tools/build_includes/candi-%s.yaml" .Env) }}
mount:
- fromPath: ~/go-pkg-cache
  to: /go/pkg
shell:
  beforeInstall:
  - mkdir /deckhouse /out

  setup:
  # Migrate internal packages imports
{{- range $_, $edition := $.Editions }}
  {{- if not $edition.skipFixingImports }}
  - find /deckhouse/modules/* -type f -name '*.go' -exec sed -E -i 's|github.com/deckhouse/deckhouse/{{ $edition.modulesDir }}|github.com/deckhouse/deckhouse/modules|g' {} +
  {{- end }}
{{- end }}
  - |
    if [ -z "$CI_COMMIT_TAG" ]; then
        latest_tag=$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags https://github.com/deckhouse/deckhouse.git 'v*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3)
        IFS='.' read -r -a version_parts <<< "$latest_tag"

        major=${version_parts[0]}
        minor=${version_parts[1]}
        new_minor=$((minor + 1))
        new_patch=0
        prerelease={{- env "CI_COMMIT_REF_SLUG" "main" }}

        new_version="${major}.${new_minor}.${new_patch}-${prerelease}+${WERF_COMMIT_HASH::7}"
        export CI_COMMIT_TAG=${new_version}
    fi
  - cd /deckhouse
  # Generate hooks imports for particular edition
  - go generate ./tools/register.go
  # Go modules depend on `register-go-hooks.go` file, hence we cannot split downloading dependencies and building
  # into separate phases.
  - go mod download
  - cd /deckhouse/deckhouse-controller
  - D8_VERSION=${CI_COMMIT_TAG} ./go-build.sh
  - mv deckhouse-controller /out
---
artifact: dhctl
fromImage: base-for-go
git:
- add: /dhctl
  to: /dhctl
  stageDependencies:
    install:
    - go.mod
    - go.sum
    setup:
    - "**/*.go"
    - Makefile
- add: /go_lib/registry-packages-proxy
  to: /go_lib/registry-packages-proxy
  stageDependencies:
    install:
      - go.mod
      - go.sum
    setup:
      - "**/*.go"
- add: /go_lib/dependency/k8s/drain
  to: /go_lib/dependency/k8s/drain
  stageDependencies:
    install:
      - go.mod
      - go.sum
    setup:
      - "**/*.go"
- add: /pkg/log
  to: /pkg/log
  stageDependencies:
    install:
      - go.mod
      - go.sum
    setup:
      - "**/*.go"
mount:
- fromPath: ~/go-pkg-cache
  to: /go/pkg
shell:
  install:
    - cd /dhctl && go mod download
  setup:
    - cd /dhctl && D8_VERSION={{- env "CI_COMMIT_TAG" | default "dev" }} make build

---
artifact: ssh-static
from: {{ .Images.BASE_ALPINE_DEV }}
shell:
  beforeInstall:
  - apk add --no-cache git openssh-client
  - mkdir -p ~/.ssh && echo "StrictHostKeyChecking accept-new" > ~/.ssh/config
  install:
  - mkdir /src
  - cd /src
  - git clone -b V_9_7_P1 --single-branch --depth=1 {{ $.SOURCE_REPO }}/openssh/openssh-portable .
  - autoreconf
  - ./configure LDFLAGS="-static $(LDFLAGS)" --prefix /ssh
  - make install

---
image: release-channel-version-prebuild
from: {{ .Images.BASE_ALPINE_DEV }}
dependencies:
- image: dev
  before: setup
  imports:
  - type: ImageDigest
    targetEnv: deckhouseImageDigest
import:
- artifact: yq4-artifact
  add: /usr/local/bin/yq
  to: /usr/local/bin/yq
  before: install
shell:
  install:
  - |
    export version="{{ env "CI_COMMIT_REF_NAME" }}"
    yq eval '.version = env(version)' /deckhouse/release.yaml | yq eval -j > version.json
    # changelog exists only for tags, we have to skip it for branches
    {{- $changelog := index (.Files.Glob "CHANGELOG/CHANGELOG-*") (printf "CHANGELOG/CHANGELOG-%s.yml" (env "CI_COMMIT_REF_NAME")) }}
    {{ if $changelog }}
    cat <<"EOF" > /changelog.yaml
    {{ $changelog | nindent 6 }}
    EOF
    {{ end }}
git:
- add: /
  to: /deckhouse
  includePaths:
  - release.yaml

---
image: release-channel-version
from: {{ .Images.BASE_SCRATCH }}
import:
- image: release-channel-version-prebuild
  add: /
  to: /
  after: install
  includePaths:
  - version.json
  - changelog.yaml
---
artifact: version-map-artifact
from: {{ .Images.BASE_ALPINE }}
import:
- artifact: yq4-artifact
  add: /usr/local/bin/yq
  to: /usr/local/bin/yq
  before: install
git:
- add: /
  to: /
  stageDependencies:
    setup:
    {{- range $_, $edition := $.Editions }}
      {{- if $edition.versionMapFile }}
      - {{ $edition.versionMapFile }}
      {{- end }}
    {{- end }}
  includePaths:
{{- range $_, $edition := $.Editions }}
  {{- if $edition.versionMapFile }}
  - {{ $edition.versionMapFile }}
  {{- end }}
{{- end }}
shell:
  setup:
{{- $previousEditionFile := "" }}
{{- range $_, $edition := $.Editions }}
  {{- $curEditionFile := printf "/version_map_%s.yml" $edition.name }}
  {{- if $edition.versionMapFile }}
    {{- $tmpEditionFile := printf "%s.tmp" $curEditionFile }}

     {{- if $previousEditionFile }}
  - cp {{ $edition.versionMapFile }} {{ $tmpEditionFile }}
  - yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' {{ $previousEditionFile }} {{ $tmpEditionFile }} > {{ $curEditionFile }}

      {{- else }}

  - cp {{ $edition.versionMapFile }} {{ $curEditionFile }}

      {{- end }}

  {{- else }}

  - cp {{ $previousEditionFile }} {{ $curEditionFile }}

  {{- end }}

  {{- $previousEditionFile = $curEditionFile }}
{{- end }}