cd-redmine-via-helm.yml

name: $(BuildDefinitionName)_$(date:yyyyMMdd)$(rev:.r)

trigger: none
pr: none

variables:
- group: global-variables
- name: azureSubscription
  value: AzureSubscription
- name: environment
  value: production
- name: helmVersion
  value: latest
- name: kubectlVersion
  value: latest
- name: aksName
  value: BabosbirdAks
- name: resourceGroupName
  value: BabosbirdRG
- name: firewallName
  value: BabosbirdFirewall
- name: firewallPolicyName
  value: BabosbirdFirewallPolicy 
- name: routeTableName
  value: DefaultRouteTable
- name: location
  value: westeurope
- name: helmRepoName
  value: bitnami-azure
- name: helmRepoUrl
  value: https://marketplace.azurecr.io/helm/v1/repo
- name: helmChartName
  value: bitnami-azure/redmine
- name: releaseName
  value: redmine
- name: namespace
  value: sample
- name: serviceName
  value: redmine
- name: ruleCollectionGroupName
  value: DefaultDnatRuleCollectionGroup
- name: dnatRuleCollectionName
  value: DnatRules
- name: publicIpAddressResourceGroupName
  value: PublicIpsRG
- name: destinationPort
  value: 80
- name: translatedPort
  value: 80
- name: kubefile
  value: ./kubeconfig
- name: KUBECONFIG
  value: ./kubeconfig
- name: HELM_EXPERIMENTAL_OCI
  value: 1
- name: domain
  value: babosbird.com
- name: subdomain
  value: redmine
- name: dnsZoneResourceGroupName
  value: DnsResourceGroup
  
pool: Terraform

stages :
- stage: helm_deployment
  displayName: Install Workload
  jobs: 
  - deployment: production
    displayName: Helm Deployment
    environment: $(environment)
    continueOnError: false
    strategy:
      runOnce:
        deploy:
          steps:
          - checkout: none
          - task: HelmInstaller@1
            displayName: 'Install Helm'
            enabled: false
            inputs:
              helmVersionToInstall: $(helmVersion)
          - task: KubectlInstaller@0
            displayName: 'Install Kubectl'
            enabled: false
            inputs:
              kubectlVersion: $(kubectlVersion)
          - task: AzureCLI@2
            displayName: 'Deploy Helm Chart'
            inputs:
              scriptType: bash
              scriptLocation: inlineScript
              azureSubscription: $(azureSubscription)
              addSpnToEnvironment: true
              inlineScript: |
                # variables
                subscriptionName=$(az account show --query name --output tsv)

                # Allow installing Azure CLI extensions without prompt
                az config set extension.use_dynamic_install=yes_without_prompt

                # Get AKS credentials
                echo "Retrieving credentials for [$(aksName)] AKS cluster..."
                 az aks get-credentials \
                  --name $(aksName) \
                  --resource-group $(resourceGroupName) \
                  --overwrite-existing \
                  --file $(kubefile) \
                  --admin \
                  
                if  [[ $? == 0 ]]; then
                  echo "Successfully retrieved credentials for [$(aksName)] AKS cluster"
                else
                  echo "Failed to retrieve credentials for [$(aksName)] AKS cluster"
                  exit -1
                fi
                
                # Add Helm repo
                echo "Adding [$(helmRepoName)] Helm repo..."
                helm repo add $(helmRepoName) $(helmRepoUrl)
                
                if  [[ $? == 0 ]]; then
                  echo "Successfully added [$(helmRepoName) - $(helmRepoUrl)] Helm repo"
                else
                  echo "Failed to add [$(helmRepoName) - $(helmRepoUrl)] Helm repo"
                  exit -1
                fi

                # Check if a Helm release already exists
                ns=$(namespace)
                exists=$(helm list -A --output json | jq -r '.[].namespace | select(. == "'$ns'")')

                if [[ -n $exists ]]; then
                  echo "A [$(releaseName)] Helm release already exists in the [$(namespace)] namespace"
                  echo "Upgrading [$(helmChartName)] Helm chart in the [$(releaseName)] Helm release..."
                  redminePassword=$(kubectl get secret --namespace $(namespace) redmine -o jsonpath="{.data.redmine-password}" | base64 --decode)

                  # Install Helm chart
                  helm upgrade \
                    --namespace $(namespace) \
                    --create-namespace \
                    --install \
                    --wait \
                    --timeout 30m \
                    --set livenessProbe.initialDelaySeconds=300 \
                    --set readinessProbe.initialDelaySeconds=300 \
                    --set startupProbe.initialDelaySeconds=600 \
                    --set redminePassword=$redminePassword \
                    $(releaseName) $(helmChartName)
                else
                  echo "No [$(releaseName)] Helm release exists in the [$(namespace)] namespace"
                  echo "Installing [$(helmChartName)] Helm chart to [$(releaseName)] Helm release..."

                  # Install Helm chart
                  helm install \
                    --namespace $(namespace) \
                    --create-namespace \
                    --wait \
                    --timeout 30m \
                    --set livenessProbe.initialDelaySeconds=300 \
                    --set readinessProbe.initialDelaySeconds=300 \
                    --set startupProbe.initialDelaySeconds=600 \
                    $(releaseName) $(helmChartName)
                fi

                if  [[ $? == 0 ]]; then
                  echo "Successfully installed [$(helmChartName)] Helm chart to [$(releaseName)] Helm release"
                else
                  echo "Failed to install [$(helmChartName)] Helm chart to [$(releaseName)] Helm release"
                  exit -1
                fi

                # Retrieve service public IP address
                serviceExternalIpAddress=""
                while [ -z $serviceExternalIpAddress ]; do
                  echo "Waiting for end point..."
                  serviceExternalIpAddress=$(kubectl get service $(serviceName) -n $(namespace) --template="{{range .status.loadBalancer.ingress}}{{.ip}}{{end}}")
                  [ -z "$serviceExternalIpAddress" ] && sleep 10
                done
                echo "[$(serviceName)] service endpoint ready: $serviceExternalIpAddress"

                # Create resource group for public IP addresses
                echo "Checking if [$(publicIpAddressResourceGroupName)] resource group actually exists in the [$subscriptionName] subscription..."
                az group show --name $(publicIpAddressResourceGroupName) &>/dev/null

                if [[ $? != 0 ]]; then
                  echo "No [$(publicIpAddressResourceGroupName)] resource group actually exists in the [$subscriptionName] subscription"
                  echo "Creating [$(publicIpAddressResourceGroupName)] resource group in the [$subscriptionName] subscription..."

                  # Create the resource group
                  az group create \
                    --name $(publicIpAddressResourceGroupName) \
                    --location $(location) 1>/dev/null

                  if [[ $? == 0 ]]; then
                    echo "[$(publicIpAddressResourceGroupName)] resource group successfully created in the [$subscriptionName] subscription"
                  else
                    echo "Failed to create [$(publicIpAddressResourceGroupName)] resource group in the [$subscriptionName] subscription"
                    exit -1
                  fi
                else
                  echo "[$(publicIpAddressResourceGroupName)] resource group already exists in the [$subscriptionName] subscription"
                fi

                # Create prefix
                s1=$(aksName)
                s2=$(namespace)
                s3=$(serviceName)
                prefix="${s1^}_${s2^}_${s3^}"

                # Create public IP address
                firewallPublicIpName="${prefix}_PublicIp"
                echo "Checking if [$firewallPublicIpName] public IP already exists in the [$(publicIpAddressResourceGroupName)] resource group..."
                
                az network public-ip show \
                  --name $firewallPublicIpName \
                  --resource-group $(publicIpAddressResourceGroupName) &>/dev/null
                
                if [[ $? != 0 ]]; then
                  echo "No [$firewallPublicIpName] public IP exists in the [$(publicIpAddressResourceGroupName)] resource group"
                  echo "Creating [$firewallPublicIpName] public IP in the [$(publicIpAddressResourceGroupName)] resource group..."
                  
                  az network public-ip create \
                    --name $firewallPublicIpName \
                    --resource-group $(publicIpAddressResourceGroupName) \
                    --location $(location) \
                    --sku Standard \
                    --allocation-method Static \
                    --zone 1 2 3 \
                    --tags serviceName=$(serviceName) namespace=$(namespace) cluster=$(aksName) 1>/dev/null

                  if [[ $? == 0 ]]; then
                    echo "[$firewallPublicIpName] public IP successfully created in the [$(publicIpAddressResourceGroupName)] resource group"
                  else
                    echo "Failed to create [$firewallPublicIpName] public IP in the [$(publicIpAddressResourceGroupName)] resource group"
                    exit -1
                  fi
                else
                  echo "[$firewallPublicIpName] public IP already exists in the [$(publicIpAddressResourceGroupName)] resource group"
                fi

                # Get the resource id of the Public IP
                echo "Retrieving the resource id of the [$firewallPublicIpName] public IP"
                firewallPublicIpId=$(az network public-ip show \
                  --name $firewallPublicIpName \
                  --resource-group $(publicIpAddressResourceGroupName) \
                  --query id \
                  --output tsv)
                
                if [[ -n $firewallPublicIpId ]]; then
                  echo "Resource id of the [$firewallPublicIpName] public IP successfully retrieved:"
                  echo $firewallPublicIpId
                else
                  echo "Failed to retrieve the resource id of the [$firewallPublicIpName] public IP"
                  exit -1
                fi

                # Get the address of the public IP
                echo "Retrieving the address of the [$firewallPublicIpName] public IP..."

                firewallPublicIpAddress=$(az network public-ip show \
                  --name $firewallPublicIpName \
                  --resource-group $(publicIpAddressResourceGroupName) \
                  --query ipAddress \
                  --output tsv 2>/dev/null)

                if [[ -n $firewallPublicIpAddress ]]; then
                  echo "[$firewallPublicIpAddress] address of the [$firewallPublicIpName] public IP successfully retrieved"
                  echo "##vso[task.setvariable variable=firewallPublicIpAddress;]$firewallPublicIpAddress"
                else
                  echo "Failed to retrieve the address of the [$firewallPublicIpName]"
                  exit -1
                fi

                # Create firewall Ip configuration with the new public Ip address
                firewallIpConfig="${prefix}_Config"
                echo "Checking if [$firewallIpConfig] firewall IP configuration already exists in the [$(firewallName)] firewall..."
                
                az network firewall ip-config show \
                  --name $firewallIpConfig \
                  --firewall-name $(firewallName) \
                  --resource-group $(resourceGroupName) &>/dev/null
                
                if [[ $? != 0 ]]; then
                  echo "No [$firewallIpConfig] firewall IP configuration exists in the [$(firewallName)] firewall"
                  echo "Creating [$firewallIpConfig] firewall IP configuration in the [$(firewallName)] firewall..."

                  az network firewall ip-config create \
                    --name $firewallIpConfig \
                    --firewall-name $(firewallName) \
                    --public-ip-address $firewallPublicIpId \
                    --resource-group $(resourceGroupName) 1>/dev/null

                  if [[ $? == 0 ]]; then
                    echo "[$firewallIpConfig] firewall IP configuration successfully created in the [$(firewallName)] firewall"
                  else
                    echo "Failed to create [$firewallIpConfig] firewall IP configuration the [$(firewallName)] firewall"
                    exit -1
                  fi
                else
                  echo "[$firewallIpConfig] firewall IP configuration already exists in the [$(firewallName)] firewall"
                fi

                # Check if the rule collection exists
                echo "Checking if [$(dnatRuleCollectionName)] DNAT rule collection already exists in the [$(firewallPolicyName)] firewall policy..."
                col=$(dnatRuleCollectionName)
                collectionName=$(az network firewall policy rule-collection-group collection list \
                  --policy-name $(firewallPolicyName) \
                  --rule-collection-group-name $(ruleCollectionGroupName) \
                  --resource-group $(resourceGroupName) \
                  --query "[?name=='"$col"'].name" \
                  --output tsv)
                
                if [[ -z $collectionName ]]; then
                  echo "No [$(dnatRuleCollectionName)] DNAT rule collection exists in the [$(firewallPolicyName)] firewall policy"
                  echo "Creating [$(dnatRuleCollectionName)] DNAT rule collection in the [$(firewallPolicyName)] firewall policy..."

                  az network firewall policy rule-collection-group collection add-filter-collection --collection-priority \
                    --name $(dnatRuleCollectionName) \
                    --policy-name $(firewallPolicyName) \
                    --rule-collection-group-name $(ruleCollectionGroupName) \
                    --resource-group $(resourceGroupName) \
                    --action Allow \
                    --rule-type NatRule \
                    --collection-priority 100 1>/dev/null

                  if [[ $? == 0 ]]; then
                    echo "[$(dnatRuleCollectionName)] DNAT rule collection successfully created in the [$(firewallPolicyName)] firewall policy"
                  else
                    echo "Failed to create [$(dnatRuleCollectionName)] DNAT rule collection in the [$(firewallPolicyName)] firewall policy"
                    exit -1
                  fi
                else
                  echo "[$(dnatRuleCollectionName)] DNAT rule collection already exists in the [$(firewallPolicyName)] firewall policy"
                fi

                # Create DNAT rule in the Firewall Policy
                dnatRuleName="${prefix}_Rule"
                echo "Checking if [$dnatRuleName] DNAT rule already exists in the [$(firewallPolicyName)] firewall policy..."
                name=$(az network firewall policy rule-collection-group collection list \
                  --policy-name $(firewallPolicyName) \
                  --resource-group $(resourceGroupName) \
                  --rule-collection-group-name $(ruleCollectionGroupName) \
                  --query "[0].rules[?name=='$dnatRuleName']".name \
                  --output tsv)

                if [[ -z $name ]]; then
                  echo "Creating [$dnatRuleName] DNAT rule in the [$(firewallPolicyName)] firewall policy..."
                  az network firewall policy rule-collection-group collection rule add \
                    --policy-name $(firewallPolicyName) \
                    --resource-group $(resourceGroupName) \
                    --rule-collection-group-name $(ruleCollectionGroupName) \
                    --collection-name $(dnatRuleCollectionName) \
                    --name $dnatRuleName \
                    --rule-type NatRule \
                    --destination-addresses $firewallPublicIpAddress \
                    --destination-ports $(destinationPort) \
                    --ip-protocols TCP \
                    --source-addresses '*' \
                    --translated-fqdn """""" \
                    --translated-port $(translatedPort) \
                    --translated-address $serviceExternalIpAddress 1>/dev/null
                
                  if [[ $? == 0 ]]; then
                    echo "[$dnatRuleName] DNAT rule successfully created in the [$(firewallPolicyName)] firewall policy"
                  else
                    echo "Failed to create [$dnatRuleName] DNAT rule in the [$(firewallPolicyName)] firewall policy"
                    exit -1
                  fi
                else
                  echo "[$dnatRuleName] DNAT rule already exists in the [$(firewallPolicyName)] firewall policy"
                fi

                # Create user-defined route in the route table
                udrName="${prefix}_Udr"
                echo "Checking if [$udrName] user-defined route already exists in the [$(routeTableName)] route table..."

                az network route-table route show \
                  --name $udrName \
                  --route-table-name $(routeTableName) \
                  --resource-group $(resourceGroupName) 1>/dev/null
                
                if [[ $? != 0 ]]; then
                  echo "No [$udrName] user-defined route exists in the [$(routeTableName)] route table"
                  echo "Creating [$udrName] user-defined route in the [$(routeTableName)] route table..."

                  az network route-table route create \
                    --name $udrName \
                    --address-prefix "${firewallPublicIpAddress}/32" \
                    --next-hop-type Internet \
                    --route-table-name $(routeTableName) \
                    --resource-group $(resourceGroupName) 1>/dev/null

                  if [[ $? == 0 ]]; then
                    echo "[$udrName] user-defined route successfully created in the [$(routeTableName)] route table"
                  else
                    echo "Failed to create [$udrName] user-defined route in the [$(routeTableName)] route table"
                    exit -1
                  fi
                else
                  echo "[$udrName] user-defined route already exists in the [$(routeTableName)] route table"
                fi
          - task: AzureCLI@2
            displayName: 'Configure DNS'
            inputs:
              scriptType: bash
              scriptLocation: inlineScript
              azureSubscription: $(azureSubscription)
              addSpnToEnvironment: true
              inlineScript: |
                # Check if an A record for the subdomain exists in the DNS Zone
                echo "Retrieving the A record for the [$(subdomain)] subdomain from the [$(domain)] DNS zone..."
                ipv4Address=$(az network dns record-set a list \
                    --zone-name $(domain) \
                    --resource-group $(dnsZoneResourceGroupName) \
                    --query "[?name=='$(subdomain)'].arecords[].ipv4Address" \
                    --output tsv)

                if [[ -n $ipv4Address ]]; then
                    echo "An A record already exists in [$(domain)] DNS zone for the [$(subdomain)] subdomain with [$ipv4Address] IP address"

                    if [[ $ipv4Address == $(firewallPublicIpAddress) ]]; then
                        echo "The [$ipv4Address] ip address of the existing A record is equal to the ip address of the [$ingressName] ingress"
                        echo "No additional step is required"
                        exit
                    else
                        echo "The [$ipv4Address] ip address of the existing A record is different than the ip address of the [$ingressName] ingress"
                    fi

                    # Retrieving name of the record set relative to the zone
                    echo "Retrieving the name of the record set relative to the [$(domain)] zone..."

                    recordSetName=$(az network dns record-set a list \
                        --zone-name $(domain) \
                        --resource-group $(dnsZoneResourceGroupName) \
                        --query "[?name=='$(subdomain)'].name" \
                        --output name 2>/dev/null)

                    if [[ -n $recordSetName ]]; then
                        "[$recordSetName] record set name successfully retrieved"
                    else
                        "Failed to retrieve the name of the record set relative to the [$(domain)] zone"
                        exit
                    fi

                    # Remove the a record
                    echo "Removing the A record from the record set relative to the [$(domain)] zone..."

                    az network dns record-set a remove-record \
                        --ipv4-address $ipv4Address \
                        --record-set-name $recordSetName \
                        --zone-name $(domain) \
                        --resource-group $(dnsZoneResourceGroupName) \

                    if [[ $? == 0 ]]; then 
                        echo "[$ipv4Address] ip address successfully removed from the [$recordSetName] record set"
                    else
                        echo "Failed to remove the [$ipv4Address] ip address from the [$recordSetName] record set"
                        exit
                    fi
                fi

                # Create the a record    
                echo "Creating an A record in [$(domain)] DNS zone for the [$(subdomain)] subdomain with [$(firewallPublicIpAddress)] IP address..."
                az network dns record-set a add-record \
                    --zone-name $(domain) \
                    --resource-group $(dnsZoneResourceGroupName) \
                    --record-set-name $(subdomain) \
                    --ipv4-address $(firewallPublicIpAddress) 1>/dev/null

                if [[ $? == 0 ]]; then
                    echo "A record for the [$(subdomain)] subdomain with [$(firewallPublicIpAddress)] IP address successfully created in [$(domain)] DNS zone"
                else
                    echo "Failed to create an A record for the $(subdomain) subdomain with [$(firewallPublicIpAddress)] IP address in [$(domain)] DNS zone"
                fi