infra-aws-rhel.yaml

---
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: infra-aws-rhel
  labels:
    app.kubernetes.io/version: "0.7.0-dev"
  annotations:
    tekton.dev/pipelines.minVersion: "0.24.x"
    tekton.dev/categories: infrastructure
    tekton.dev/tags: infrastructure, aws, rhel
    tekton.dev/displayName: "aws manager"
    tekton.dev/platforms: "linux/amd64"
spec:
  description: |
    Task provision a RHEL dedicated on host on AWS

    The machine will offer nested virtualizataion capabilities as so it should be spin on a dedicated (baremetal) machine
  
  params: 
  # mapt params 
  - name: project-name
    description: identifier for project. 
  - name: backed-url
    description: |
      If we want to backed resources externally we can use s3 setting this param(i.e s3://existing-bucket). 

      If default will be store on storage workspace at path set by param ws-output-path.
    default: "''"
  - name: ws-output-path
    description: path on workspace where to store ephemeral assets related with the provisioning

  # RHEL params
  - name: operation 
    description: operation to execute within the infrastructure. Current values (create, destroy)
  - name: arch
    description: architecture for the target machine. Allowed x86_64 or arm64 (default "x86_64")
    default: 'x86_64'
  - name: vm-types
    description: "Specific set of vm-types. Note vm-type should match requested arch. Also if --spot flag is used set at least 3 types comma separated and without spaces."
    default: "''"  
  - name: version
    description: this task will spin a RHEL image. This param will set the version for it. Default 9.3.
    default: '9.3'
  - name: profile-snc
    description: |
      This param will setup RHEL with SNC profile. Setting up all requirements to run https://github.com/crc-org/snc
    default: 'false'
  - name: spot
    description: Check best spot option to spin the machine and will create resources on that region.
    default: 'true'
  - name: airgap
    description: |
        Set the machine on an airgap scenario. 

        If airgap is set an extra VM is created acting as bastion, information to access bastion is also
        added to the output folder.

        To access the target machine we need to go through the bastion
    default: 'false'

  # Control params
  - name: remove-lock
    description: in case a previous run fails the stack can be locked. This value allows to control if remove lock
    default: 'true'
  - name: debug
    description: |
      Warning setting this param to true expose credentials 
      
      The parameter is intended to add verbosity on the task execution and also print credentials on stdout
      to easily access to remote machice
    default: 'false'

  results:
  - name: host
    description: ip to connect to the provisioned machine
  - name: username
    description: username to connect to the provisioned machine
  - name: key
    description: filename for the private key. The key is located at workspace-resources-path
  - name: bastion-host
    description: if airgap is set we get the bastion host as result
  - name: bastion-username
    description: if airgap is set we get the bastion username to connect as result
  - name: bastion-key
    description: if airgap is set we get the bastion filename for the private key. The key is located at workspace-resources-path

  steps:
  - name: provisioner
    image: quay.io/redhat-developer/mapt:v0.7.0-dev
    imagePullPolicy: Always
    script: |
      #!/bin/sh

      # If debug add verbosity
      if [[ $(params.debug) == "true" ]]; then
        set -xuo   
      fi

      # Credentials
      export AWS_ACCESS_KEY_ID=$(cat /opt/aws-credentials/access-key)
      export AWS_SECRET_ACCESS_KEY=$(cat /opt/aws-credentials/secret-key)
      export AWS_DEFAULT_REGION=$(cat /opt/aws-credentials/region)

      # Output folder
      workspace_path=/opt/storage/$(params.ws-output-path)
      mkdir -p ${workspace_path}

      # Remove lock
      if [[ $(params.remove-lock) == "true" ]]; then
          rm -rf ${workspace_path}/.pulumi/locks/*
      fi

      # Run mapt
      cmd="mapt aws rhel $(params.operation) "
      cmd="$cmd --project-name $(params.project-name) "
      # Set the backed url
      if [[ $(params.backed-url) != "" ]]; then
        cmd="$cmd --backed-url $(params.backed-url) "
      else
        cmd="$cmd --backed-url file://${workspace_path} "
      fi
      if [[ $(params.operation) == "create" ]]; then
        cmd="$cmd --conn-details-output ${workspace_path} " 
        cmd="$cmd --version $(params.version) "
        cmd="$cmd --arch $(params.arch) "
        if [[ $(params.vm-types) != "" ]]; then
          cmd="$cmd --vm-types $(params.vm-types) "
        fi
        cmd="$cmd --rh-subscription-username $(cat /opt/rh-account-secret/user) "  
        cmd="$cmd --rh-subscription-password $(cat /opt/rh-account-secret/password) "  
        if [[ $(params.spot) == "true" ]]; then
          cmd="$cmd --spot "
        fi
        if [[ $(params.airgap) == "true" ]]; then
          cmd="$cmd --airgap "
        fi
        if [[ $(params.profile-snc) == "true" ]]; then
          cmd="$cmd --snc "
        fi
      fi
      eval "${cmd}"
      
      create_exit_code=$?
     
      # set task results
      cat "${workspace_path}/host" | tee $(results.host.path)
      cat "${workspace_path}/username" | tee $(results.username.path)   
      echo -n "id_rsa" | tee $(results.key.path)   
      if [[ $(params.airgap) == "true" ]]; then
        cat "${workspace_path}/bastion_host" | tee $(results.bastion-host.path)
        cat "${workspace_path}/bastion_username" | tee $(results.bastion-username.path)   
        echo -n "bastion_id_rsa" | tee $(results.bastion-key.path)   
      fi

      # If debug print credentials
      if [[ $(params.debug) == "true" ]]; then
        echo "Credentials to access target machine \n"
        cat "${workspace_path}/host"
        cat "${workspace_path}/username"
        cat "${workspace_path}/id_rsa"
        if [[ $(params.airgap) == "true" ]]; then
          cat "${workspace_path}/bastion_host"
          cat "${workspace_path}/bastion_username"
          cat "${workspace_path}/bastion_id_rsa"
        fi
      fi

      if [[ ${create_exit_code} -ne 0 ]]; then 
        exit 1
      fi

    resources:      
      requests:
        memory: "200Mi"
        cpu: "100m"
      limits:
        memory: "600Mi"
        cpu: "300m"

  workspaces:
  - name: storage
    description: volume to store outputs to connect within the target machine + state file for the infrastructure 
    mountPath: /opt/storage
  - name: aws-credentials
    description: |
      ocp secret holding the aws credentials. Secret should be accessible to this task.

      ---
      apiVersion: v1
      kind: Secret
      metadata:
        name: aws-${name}
        labels:
          app.kubernetes.io/component: ${name}
          app.kubernetes.io/part-of: qe-platform
      type: Opaque
      data:
        access-key: ${access_key}
        secret-key: ${secret_key}
        region: ${region}
    mountPath: /opt/aws-credentials
  - name: rh-account-secret
    optional: true
    description: |
      ocp secret holding the credentials for a valid rh user to subscribe VM. Secret should be accessible to this task.

      Sample format for valid Secret
      ---
      apiVersion: v1
      kind: Secret
      metadata:
        name: credentials-${configname}
      type: Opaque
      data:
        user: ${user}
        password: ${password}
    mountPath: /opt/rh-account-secret