deploy

#!/usr/bin/python3

'''
    Convenient wrapper around `oc process/create/replace`. Can be run multiple
    times; subsequent runs will replace existing resources.

    Example usage:
        ./deploy --update \
            --pipeline https://github.com/jlebon/fedora-coreos-pipeline \
            --config https://github.com/jlebon/fedora-coreos-config@wip \
            --cosa-img quay.io/jlebon/coreos-assembler:main
            # OR
            --cosa https://github.com/jlebon/coreos-assembler

'''

import os
import sys
import json
import yaml
import argparse
import subprocess

# the code supports multiple prod pipelines for easing migrations
PROD_CLUSTERS = {
    "https://api.ocp.fedoraproject.org:6443": "fedora-coreos-pipeline"
}


def main():
    args = parse_args()

    if targeting_official_namespace(args) and not args.official:
        eprint("Refusing to create resources in official namespace.")
        eprint("Use --official to create resources there.")
        return 1

    resources = process_template(args)
    update_resources(args, resources)


def targeting_official_namespace(args):
    ctx_name = subprocess.check_output(
        [args.oc_cmd, 'config', 'current-context'], encoding='utf-8').strip()
    cfg = yaml.safe_load(subprocess.check_output(
        [args.oc_cmd, 'config', 'view'], encoding='utf-8'))
    ctx = [c['context'] for c in cfg['contexts'] if c['name'] == ctx_name]
    assert len(ctx) == 1, f"Found {len(ctx)} contexts named '{ctx_name}'"
    ctx = ctx[0]

    cluster_name = ctx['cluster']
    namespace = ctx['namespace']
    url = [c['cluster']['server'] for c in cfg['clusters']
           if c['name'] == cluster_name]
    assert len(url) == 1, f"Found {len(url)} clusters named '{cluster_name}'"
    url = url[0]

    if url not in PROD_CLUSTERS:
        return False
    return namespace == PROD_CLUSTERS[url]


def parse_args():
    parser = argparse.ArgumentParser()
    parser.add_argument("--official", action='store_true',
                        help="Allows updating resources in official pipeline")
    parser.add_argument("--dry-run", action='store_true',
                        help="Only print what would happen")
    parser.add_argument("--pipeline", metavar='<URL>[@REF]',
                        help="Repo and ref to use for pipeline code")
    parser.add_argument("--pipecfg", metavar='<URL>[@REF]',
                        help="Repo and ref to use for pipeline config")
    parser.add_argument("--cosa-img", metavar='FQIN',
                        help="Pullspec to use for COSA image")
    parser.add_argument("--oc-cmd", default='oc',
                        help="The path to the oc binary")

    args = parser.parse_args()

    return args


def get_username():
    import pwd
    return pwd.getpwuid(os.getuid()).pw_name


def process_template(args):
    templates = ['pipeline.yaml', 'jenkins-s2i.yaml']

    params = {}
    if args.pipeline:
        params.update(params_from_git_refspec(args.pipeline, 'JENKINS_S2I'))
        params.update(params_from_git_refspec(args.pipeline, 'JENKINS_JOBS'))
    if args.pipecfg:
        params.update(params_from_git_refspec(args.pipecfg, 'PIPECFG'))
    if args.cosa_img:
        params['COREOS_ASSEMBLER_IMAGE'] = args.cosa_img
    if has_additional_root_ca(args):
        templates += ['jenkins-agent.yaml']
        # we want :latest to be owned by our BuildConfig, so call the base
        # image :base instead of :latest
        params['JENKINS_AGENT_BASE_TAG'] = "base"

    print("Parameters:")
    for k, v in params.items():
        print(f"  {k}={v}")
    print()

    def gen_param_args(selected):
        selected_params = {(k, v) for k, v in params.items() if k in selected}
        return [q for k, v in selected_params for q in ['--param', f'{k}={v}']]

    resources = []
    for template in templates:
        # we only want to pass the params which each template actually
        # supports, so filter it down for this specific template
        with open(f'manifests/{template}') as f:
            t = yaml.safe_load(f)
            tparams = [p['name'] for p in t.get('parameters', [])]
        # and generate the --param FOO=bar ... args for this template
        param_args = gen_param_args(tparams)
        j = json.loads(subprocess.check_output(
            [args.oc_cmd, 'process', '--filename', f'manifests/{template}'] +
            param_args))
        resources += j['items']
    return resources


def has_additional_root_ca(args):
    secrets = subprocess.check_output([args.oc_cmd, 'get', 'secrets', '-o=name'],
                                      encoding='utf-8').splitlines()
    return 'secret/additional-root-ca-cert' in secrets


def update_resources(args, resources):
    print("Updating:")
    for resource in resources:
        action = resource_action(args, resource)
        if action == 'skip':
            continue
        if args.dry_run:
            kind = resource['kind'].lower()
            print(f"Would {action} {kind} {resource['metadata']['name']}")
            continue
        out = subprocess.run([args.oc_cmd, action, '--filename', '-'],
                             input=json.dumps(resource), encoding='utf-8',
                             check=True, stdout=subprocess.PIPE)
        print(f"  {out.stdout.strip()}")
    print()


def resource_action(args, resource):
    if resource_exists(args, resource):
        # Some resources don't support being updated post-creation; let's just
        # skip those for now if they already exist.
        kind = resource['kind'].lower()
        if kind in ['persistentvolumeclaim']:
            print(f"  {kind} \"{resource['metadata']['name']}\" skipped")
            return 'skip'
        return 'replace'
    return 'create'


def resource_exists(args, resource):
    return subprocess.call([args.oc_cmd, 'get', resource['kind'],
                            resource['metadata']['name']],
                           stdout=subprocess.DEVNULL,
                           stderr=subprocess.DEVNULL) == 0


def params_from_git_refspec(refspec, param_prefix):
    url, ref = parse_git_refspec(refspec)
    return {f'{param_prefix}_URL': url,
            f'{param_prefix}_REF': ref}


def parse_git_refspec(refspec):
    if '@' not in refspec:
        return (refspec, get_default_branch(refspec))
    return tuple(refspec.split('@'))


def get_default_branch(repo):
    output = subprocess.check_output(['git', 'ls-remote', '--symref',
                                      repo, 'HEAD'],
                                     encoding='utf-8')
    for line in output.splitlines():
        if line.startswith('ref: '):
            ref, symref = line[len('ref: '):].split()
            if symref != "HEAD":
                continue
            assert ref.startswith("refs/heads/")
            return ref[len("refs/heads/"):]


def eprint(*args):
    print(*args, file=sys.stderr)


if __name__ == "__main__":
    sys.exit(main())