deploy

#!/usr/bin/python3

'''
    Convenient wrapper around `oc process/create/replace`. Can be run multiple
    times; subsequent runs will replace existing resources.

    Example usage:
        ./deploy --update \
            --pipeline https://github.com/jlebon/fedora-coreos-pipeline \
            --pipecfg https://github.com/jlebon/fedora-coreos-pipecfg@wip

'''

import os
import sys
import json
import yaml
import argparse
import subprocess


def main():
    args = parse_args()
    resources = process_template(args)
    update_resources(args, resources)


def parse_args():
    parser = argparse.ArgumentParser()
    parser.add_argument("--dry-run", action='store_true',
                        help="Only print what would happen")
    parser.add_argument("--pipeline", metavar='<URL>[@REF]',
                        help="Repo and ref to use for pipeline code")
    parser.add_argument("--pipecfg", metavar='<URL>[@REF]',
                        help="Repo and ref to use for pipeline config")
    parser.add_argument("--oc-cmd", default='oc',
                        help="The path to the oc binary")

    args = parser.parse_args()

    return args


def get_username():
    import pwd
    return pwd.getpwuid(os.getuid()).pw_name


def process_template(args):
    templates = ['pipeline.yaml', 'jenkins-s2i.yaml']

    params = {}
    if args.pipeline:
        params.update(params_from_git_refspec(args.pipeline, 'JENKINS_S2I'))
        params.update(params_from_git_refspec(args.pipeline, 'JENKINS_JOBS'))
    if args.pipecfg:
        params.update(params_from_git_refspec(args.pipecfg, 'PIPECFG'))
    if has_additional_root_ca(args):
        templates += ['jenkins-with-cert.yaml']
        params['JENKINS_S2I_SRC_IMAGESTREAM_NAME'] = "jenkins:latest"
        params['JENKINS_S2I_SRC_IMAGESTREAM_NAMESPACE'] = get_current_namespace(args)

    print("Parameters:")
    for k, v in params.items():
        print(f"  {k}={v}")
    print()

    def gen_param_args(selected):
        selected_params = {(k, v) for k, v in params.items() if k in selected}
        return [q for k, v in selected_params for q in ['--param', f'{k}={v}']]

    resources = []
    for template in templates:
        # we only want to pass the params which each template actually
        # supports, so filter it down for this specific template
        with open(f'manifests/{template}') as f:
            t = yaml.safe_load(f)
            tparams = [p['name'] for p in t.get('parameters', [])]
        # and generate the --param FOO=bar ... args for this template
        param_args = gen_param_args(tparams)
        j = json.loads(subprocess.check_output(
            [args.oc_cmd, 'process', '--filename', f'manifests/{template}'] +
            param_args))
        resources += j['items']
    return resources


def has_additional_root_ca(args):
    secrets = subprocess.check_output([args.oc_cmd, 'get', 'secrets', '-o=name'],
                                      encoding='utf-8').splitlines()
    return 'secret/additional-root-ca-cert' in secrets


def get_current_namespace(args):
    return subprocess.check_output([args.oc_cmd, 'project', '--short=true'],
                                   encoding='utf-8').strip()


def update_resources(args, resources):
    print("Updating:")
    for resource in resources:
        action = resource_action(args, resource)
        if action == 'skip':
            continue
        if args.dry_run:
            kind = resource['kind'].lower()
            print(f"Would {action} {kind} {resource['metadata']['name']}")
            continue
        out = subprocess.run([args.oc_cmd, action, '--filename', '-'],
                             input=json.dumps(resource), encoding='utf-8',
                             check=True, stdout=subprocess.PIPE)
        print(f"  {out.stdout.strip()}")
    print()


def resource_action(args, resource):
    if resource_exists(args, resource):
        # Some resources don't support being updated post-creation; let's just
        # skip those for now if they already exist.
        kind = resource['kind'].lower()
        if kind in ['persistentvolumeclaim']:
            print(f"  {kind} \"{resource['metadata']['name']}\" skipped")
            return 'skip'
        return 'replace'
    return 'create'


def resource_exists(args, resource):
    return subprocess.call([args.oc_cmd, 'get', resource['kind'],
                            resource['metadata']['name']],
                           stdout=subprocess.DEVNULL,
                           stderr=subprocess.DEVNULL) == 0


def params_from_git_refspec(refspec, param_prefix):
    url, ref = parse_git_refspec(refspec)
    return {f'{param_prefix}_URL': url,
            f'{param_prefix}_REF': ref}


def parse_git_refspec(refspec):
    if '@' not in refspec:
        return (refspec, get_default_branch(refspec))
    return tuple(refspec.split('@'))


def get_default_branch(repo):
    output = subprocess.check_output(['git', 'ls-remote', '--symref',
                                      repo, 'HEAD'],
                                     encoding='utf-8')
    for line in output.splitlines():
        if line.startswith('ref: '):
            ref, symref = line[len('ref: '):].split()
            if symref != "HEAD":
                continue
            assert ref.startswith("refs/heads/")
            return ref[len("refs/heads/"):]


def eprint(*args):
    print(*args, file=sys.stderr)


if __name__ == "__main__":
    sys.exit(main())