forked from redhat-developer/mapt
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathinfra-azure-windows-desktop.yaml
242 lines (224 loc) · 8.49 KB
/
infra-azure-windows-desktop.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
---
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: infra-azure-windows-desktop
labels:
app.kubernetes.io/version: "0.8.0-dev"
annotations:
tekton.dev/pipelines.minVersion: "0.44.x"
tekton.dev/categories: infrastructure
tekton.dev/tags: infrastructure, azure
tekton.dev/displayName: "azure manager"
tekton.dev/platforms: "linux/amd64, linux/arm64"
spec:
description: |
This task will provision / decomission windows desktop machines on azure
The output will give required information to connect within the remote provisioned host
volumes:
- name: az-credentials
secret:
secretName: $(params.secret-az-credentials)
- name: host-info
emptyDir: {}
params:
- name: secret-az-credentials
description: |
ocp secret holding the azure credentials. Secret should be accessible to this task.
---
apiVersion: v1
kind: Secret
metadata:
name: ${name}
type: Opaque
data:
tenant_id: ${tenant_id}
subscription_id: ${subscription_id}
client_id: ${client_id}
client_secret: ${client_secret}
storage_account: ${storage_account}
storage_key: ${storage_key}
blob: ${blob}
- name: id
description: identifier for the provisioned environment
- name: operation
description: operation to execute within the infrastructure. Current values (create, destroy)
# Secret result
# naming
- name: host-access-secret-name
type: string
default: "''"
description: |
Once the target is provisioned the config to connect is addded to a secret
check resutls. If this param is set the secret will be created with the name set
otherwise it will be created with a random name.
# ownership
- name: ownerKind
type: string
default: PipelineRun
description: |
The type of resource that should own the generated SpaceRequest.
Deletion of this resource will trigger deletion of the SpaceRequest.
Supported values: `PipelineRun`, `TaskRun`.
- name: ownerName
type: string
description: |
The name of the resource that should own the generated SpaceRequest.
This should either be passed the value of `$(context.pipelineRun.name)`
or `$(context.taskRun.name)` depending on the value of `ownerKind`.
- name: ownerUid
type: string
description: |
The uid of the resource that should own the generated SpaceRequest.
This should either be passed the value of `$(context.pipelineRun.uid)`
or `$(context.taskRun.uid)` depending on the value of `ownerKind`.
# VM type params
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: '8'
- name: memory
description: Amount of RAM for the cloud instance in GiB (default 64)
default: '64'
- name: nested-virt
description: Use cloud instance that has nested virtualization support
default: 'false'
- name: vmsize
description: size for the machine
default: "''"
- name: spot
description: in case spot is set to true it will check for best spot price and create the VM on the target region
default: 'true'
- name: spot-eviction-tolerance
description: 'if spot is enable we can define the minimum tolerance level of eviction. Allowed value are: lowest, low, medium, high or highest'
default: 'lowest'
# Windows params
- name: windows-featurepack
description: windows feature pack (default "22h2-pro")
default: 22h2-pro
- name: windows-version
description: Major version for windows desktop 10 or 11 (default "11")
default: '11'
# Metadata params
- name: tags
description: tags for the resources created on the providers
default: "''"
# Control params
- name: debug
description: |
Warning setting this param to true expose credentials
The parameter is intended to add verbosity on the task execution and also print credentials on stdout
to easily access to remote machice
default: 'false'
results:
- name: host-access-secret
description: |
ocp secret holding the information to connect with the target machine.
---
apiVersion: v1
kind: Secret
metadata:
name: ${name}
type: Opaque
data:
host: ${host}
username: ${username}
id_rsa: ${id_rsa}
userpassword: ${userpassword}
adminusername: ${adminusername}
adminuserpassword: ${adminuserpassword}
steps:
- name: provisioner
image: quay.io/redhat-developer/mapt:v0.8.0-dev
imagePullPolicy: Always
volumeMounts:
- name: az-credentials
mountPath: /opt/az-credentials
- name: host-info
mountPath: /opt/host-info
script: |
#!/bin/sh
# If debug add verbosity
if [[ $(params.debug) == "true" ]]; then
set -xuo
fi
# Credentials
export ARM_TENANT_ID=$(cat /opt/az-credentials/tenant_id)
export ARM_SUBSCRIPTION_ID=$(cat /opt/az-credentials/subscription_id)
export ARM_CLIENT_ID=$(cat /opt/az-credentials/client_id)
export ARM_CLIENT_SECRET=$(cat /opt/az-credentials/client_secret)
export AZURE_STORAGE_ACCOUNT=$(cat /opt/az-credentials/storage_account)
export AZURE_STORAGE_KEY=$(cat /opt/az-credentials/storage_key)
BLOB=$(cat /opt/az-credentials/blob)
# Run mapt
cmd="mapt azure windows $(params.operation) "
cmd+="--project-name mapt-windows-$(params.id) "
cmd+="--backed-url azblob://${BLOB}/windows-$(params.id) "
if [[ $(params.operation) == "create" ]]; then
cmd+="--conn-details-output /opt/host-info "
cmd+="--windows-featurepack $(params.windows-featurepack) "
cmd+="--windows-version $(params.windows-version) "
cmd+="--cpus $(params.cpus) "
cmd+="--memory $(params.memory) "
if [[ $(params.nested-virt) == "true" ]]; then cmd+="--nested-virt "; fi
if [[ -z $(params.vmsize) ]]; then cmd+="--vmsize $(params.vmsize) "; fi
if [[ $(params.spot) == "true" ]]; then cmd+="--spot "; fi
# Spot tolerance only be applied if spot is enabled
cmd+="--spot-eviction-tolerance $(params.spot-eviction-tolerance) "
cmd+="--tags $(params.tags) "
fi
eval "${cmd}"
resources:
requests:
memory: "300Mi"
cpu: "150m"
limits:
memory: "900Mi"
cpu: "400m"
- name: host-info-secret
image: registry.redhat.io/openshift4/ose-cli:4.13@sha256:e70eb2be867f1236b19f5cbfeb8e0625737ce0ec1369e32a4f9f146aaaf68d49
env:
- name: NAMESPACE
value: $(context.taskRun.namespace)
- name: OWNER_KIND
value: $(params.ownerKind)
- name: OWNER_NAME
value: $(params.ownerName)
- name: OWNER_UID
value: $(params.ownerUid)
volumeMounts:
- name: host-info
mountPath: /opt/host-info
script: |
#!/bin/bash
set -eo pipefail
if [[ $(params.operation) == "create" ]]; then
export SECRETNAME="generateName: mapt-azure-windows-"
if [[ $(params.host-access-secret-name) != "" ]]; then
export SECRETNAME="name: $(params.host-access-secret-name)"
fi
cat <<EOF > host-info.yaml
apiVersion: v1
kind: Secret
metadata:
$SECRETNAME
namespace: $NAMESPACE
ownerReferences:
- apiVersion: tekton.dev/v1
kind: $OWNER_KIND
name: $OWNER_NAME
uid: $OWNER_UID
type: Opaque
data:
host: $(cat /opt/host-info/host | base64 -w0)
username: $(cat /opt/host-info/username | base64 -w0)
id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0)
userpassword: $(cat /opt/host-info/userpassword | base64 -w0)
adminusername: $(cat /opt/host-info/adminusername | base64 -w0)
adminuserpassword: $(cat /opt/host-info/adminuserpassword | base64 -w0)
EOF
if [[ $(params.debug) == "true" ]]; then
cat /opt/host-info/*
fi
NAME=$(oc create -f host-info.yaml -o=jsonpath='{.metadata.name}')
echo -n "${NAME}" | tee $(results.host-access-secret.path)
fi