azure-pipelines-dashboard.yml

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml
name: amg_dashboard_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
variables:
  - group: app-one
  - name: region
    value: 'us-east-2'
  - name: workspace
    value: 'g-2cfb445889'
  - name: profile
    value: 'PSProfile'

trigger:
  branches:
    include:
      - main
      - dev/add-dashboard
  paths:
    include:
      - /amg_dashboard/*

pool:
    vmImage: ubuntu-latest

stages:
  - stage: grafana_dashboard_deploy
    displayName: Initialize and Review
    jobs:
    - job: Initialize
      pool:
        vmImage: ubuntu-latest
      steps:
      - task: PowerShell@2
        displayName: 'Check and install AWS.Tools modules'
        inputs:
          filePath: '$(build.sourcesdirectory)/amg_dashboard/InstallAWSTools.ps1'
      - task: PowerShell@2
        displayName: 'Set AWS Credentials'
        inputs:
          targetType: 'inline'
          script: 'Set-AWSCredential -AccessKey $(access_key) `
                    -SecretKey $(secret_key) `
                    -StoreAs $(profile)'
      - task: PowerShell@2
        displayName: 'Create API key'
        inputs:
          targetType: 'inline'
          workingDirectory: $(System.DefaultWorkingDirectory)/amg_dashboard
          script: |
              $apikey= (New-MGRFWorkspaceApiKey -KeyName "automation" `
              -KeyRole ADMIN `
              -SecondsToLive 600 `
              -WorkspaceId $(workspace) `
              -Region $(region) `
              -ProfileName $(profile)).Key
              $Content = "grafana_workspace_auth = `"$apikey`" `
              `ngrafana_workspace_url = `"https://$(workspace).grafana-workspace.us-east-2.amazonaws.com`""
              $Content | Out-File terraform.tfvars
      - task: PowerShell@2
        inputs:
          targetType: 'inline'
          script: 'terraform init `
          -backend-config="bucket=terraform-remote-bucket-skundu" `
          -backend-config="key=tf/managed-grafana/dashboard/terraform.tfstate" `
          -backend-config="access_key=$(access_key)" `
          -backend-config="secret_key=$(secret_key)" `
          -backend-config="region=$(region)" -no-color'
          workingDirectory: '$(build.sourcesdirectory)/amg_dashboard'
        displayName: Terraform init
      - task: Bash@3
        inputs:
          targetType: 'inline'
          script: 'pip install checkov'
        displayName: Install checkov
      - task: Bash@3
        inputs:
          targetType: 'inline'
          workingDirectory: $(System.DefaultWorkingDirectory)/amg_dashboard
          script: 'checkov -d . -o junitxml > scan-result.xml'
        displayName: Checkov source code scan
        continueOnError: true
      - task: PublishTestResults@2
        inputs:
          testResultsFormat: 'JUnit'
          searchFolder: '$(System.DefaultWorkingDirectory)/amg_dashboard'
          testResultsFiles: '**/*scan-result.xml'
          mergeTestResults: false
          testRunTitle: Terraform source code scan
          failTaskOnFailedTests: false
          publishRunAttachments: true
        displayName: Publish Test Result
      - task: PowerShell@2
        inputs:  
          targetType: 'inline'
          script: 'terraform plan -no-color'
          workingDirectory: '$(build.sourcesdirectory)/amg_dashboard'
        displayName: Terraform plan
      - task: PowerShell@2
        displayName: 'Delete API Key'
        inputs:
          targetType: 'inline'
          script: |
            Remove-MGRFWorkspaceApiKey -KeyName "automation" `
            -WorkspaceId $(workspace) `
            -ProfileName $(profile) `
            -Region $(region) -Force
        condition: always()
        continueOnError: true
      - task: PowerShell@2
        displayName: 'Remove AWS Credentials'
        inputs:
          targetType: 'inline'
          script: 'Remove-AWSCredentialProfile -ProfileName $(profile) -Force'
        condition: always()

    - job: review
      dependsOn: Initialize
      condition: and (succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['Build.SourceBranchName'], 'main'))
      pool: server
      displayName: Review the output of terraform plan in the previous job.
      steps:
      - task: ManualValidation@0
        timeoutInMinutes: 15 # task times out in 15 mins
        inputs:
          notifyUsers: skundu.dev@gmail.com
          instructions: 'Please validate the build configuration and resume'
          onTimeout: 'reject'

    - job: apply
      dependsOn: review
      pool:
        vmImage: ubuntu-latest
      displayName: Terraform apply
      steps:
      - task: PowerShell@2
        displayName: 'Check and install AWS.Tools modules'
        inputs:
          filePath: '$(build.sourcesdirectory)/amg_dashboard/InstallAWSTools.ps1'
      - task: PowerShell@2
        displayName: 'Set AWS Credentials'
        inputs:
          targetType: 'inline'
          script: 'Set-AWSCredential -AccessKey $(access_key) `
                    -SecretKey $(secret_key) `
                    -StoreAs $(profile)'
      - task: PowerShell@2
        displayName: 'Create API key'
        inputs:
          targetType: 'inline'
          workingDirectory: $(System.DefaultWorkingDirectory)/amg_dashboard
          script: |
              $apikey= (New-MGRFWorkspaceApiKey -KeyName "automation" `
              -KeyRole ADMIN `
              -SecondsToLive 600 `
              -WorkspaceId $(workspace) `
              -Region $(region) `
              -ProfileName $(profile)).Key
              $Content = "grafana_workspace_auth = `"$apikey`" `
              `ngrafana_workspace_url = `"https://$(workspace).grafana-workspace.us-east-2.amazonaws.com`""
              $Content | Out-File terraform.tfvars
      - task: PowerShell@2
        inputs:
          targetType: 'inline'
          script: 'terraform init `
          -backend-config="bucket=terraform-remote-bucket-skundu" `
          -backend-config="key=tf/managed-grafana/dashboard/terraform.tfstate" `
          -backend-config="region=$(region)" `
          -backend-config="access_key=$(access_key)" `
          -backend-config="secret_key=$(secret_key)" -no-color'
          workingDirectory: '$(build.sourcesdirectory)/amg_dashboard'
        displayName: Terraform init
      - task: PowerShell@2
        inputs:  
          targetType: 'inline'
          script: 'terraform apply --auto-approve -no-color'
          workingDirectory: '$(build.sourcesdirectory)/amg_dashboard'
        displayName: "Terraform apply"
      - task: PowerShell@2
        displayName: 'Delete API Key'
        inputs:
          targetType: 'inline'
          script: |
            Remove-MGRFWorkspaceApiKey -KeyName "automation" `
            -WorkspaceId $(workspace) `
            -ProfileName $(profile) `
            -Region $(region) -Force
        condition: always()
        continueOnError: true
      - task: PowerShell@2
        displayName: 'Remove AWS Credentials'
        inputs:
          targetType: 'inline'
          script: 'Remove-AWSCredentialProfile -ProfileName $(profile) -Force'
        condition: always()