devops-camp-jenkinsfile

pipeline {
    agent {
        label 'jenkins-agent'
    }
    environment {
        PIPELINE_HASH = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()
        HARBOR_REGISTRY = 'registry.dev.afsmtddso.com'
        HARBOR_PROJECT = 'mhoffmann-harbor-project'
        APP_IMAGE_NAME = 'app'
        CREDENTIALS_ID = 'mhoffmann-harbor-auth'
        EKS_NAMESPACE = 'mhoffmann'
        DOCKER_CONFIG_LOCATION = ''
        IMAGE_DIGEST = ''
    }
    stages {
        stage('Application repository') {
            steps {
                echo "Cloning application repository"
                sh 'git clone https://github.com/McGoffmann/afs-labs-student.git'
                dir('afs-labs-student') {
                    script {
                        env.COMMIT_HASH = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()
                    }
                }
            }
        }

        stage('Application docker build') {
            steps {
                build_image('application', APP_IMAGE_NAME, './app/Dockerfile')
            }
            post {
                always {
                    clean_image(APP_IMAGE_NAME)
                }
            }
        }
        stage('Security scanning') {
            steps {
                  withCredentials([usernamePassword(credentialsId: CREDENTIALS_ID, usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD')]) {
                      echo "Scanning $APP_IMAGE_NAME image"
                      sh 'python harbor_scanner.py -i $APP_IMAGE_NAME -r $HARBOR_REGISTRY -p $HARBOR_PROJECT -c ${USERNAME}:${PASSWORD}'
                  }
            }
        }
        stage('Sign Image') {
            steps {
                echo "Signing Container Image"
                withCredentials([usernameColonPassword(credentialsId: CREDENTIALS_ID, variable: 'HARBOR-AUTH')]) {
                    script {
                        docker.withRegistry('https://$HARBOR_REGISTRY', CREDENTIALS_ID) {
                            DOCKER_CONFIG_LOCATION = sh (
                                script: 'docker login https://$HARBOR_REGISTRY/ 2>&1',
                                returnStdout: true
                            ).trim()
                            DOCKER_CONFIG_LOCATION = (DOCKER_CONFIG_LOCATION =~ /stored unencrypted in (.+)/)[ 0 ][ 1 ]
                            DOCKER_CONFIG_LOCATION = DOCKER_CONFIG_LOCATION.substring(0, DOCKER_CONFIG_LOCATION.length() - 1)
                            script {
                                sh 'docker build -t cosign-$COMMIT_HASH -f ./cosign/Dockerfile .'
                                sh "yes | docker run -i -v /var/run/docker.sock:/var/run/docker.sock -v $DOCKER_CONFIG_LOCATION:/root/.docker/config.json --rm cosign-$COMMIT_HASH sign --key cosign.key $HARBOR_REGISTRY/$HARBOR_PROJECT/$APP_IMAGE_NAME@$IMAGE_DIGEST"
                            }
                        }
                    }
                }
            }
            post {
                always {
                    echo "Clean local cosign image"
                    script {
                        try {
                            sh "docker rmi cosign-$COMMIT_HASH:latest"
                        } catch (err) {
                            echo err.getMessage()
                        }
                    }
                }
            }
        }
        stage('Deploy') {
            steps {
                echo "Deployment stage"
                sh 'kubectl -n $EKS_NAMESPACE apply -f ./afs-labs-student/kubernetes/config-map.yaml'
                sh 'kubectl -n $EKS_NAMESPACE set image deployment/app-deployment app-deployment=$HARBOR_REGISTRY/$HARBOR_PROJECT/$APP_IMAGE_NAME:$COMMIT_HASH-$PIPELINE_HASH'
            }
        }
    }
    post {
        cleanup {
            echo "Clean workspace"
            sh 'rm -rf .git ./*'
        }
    }
}

def build_image(type, IMAGE_NAME, dockerfile_location) {
    echo "Building $type image"
    withCredentials([usernameColonPassword(credentialsId: CREDENTIALS_ID, variable: 'HARBOR-AUTH')]) {
        script {
            sh "docker build -t $IMAGE_NAME-$COMMIT_HASH -f $dockerfile_location ./afs-labs-student"
            docker.withRegistry('https://$HARBOR_REGISTRY', CREDENTIALS_ID) {
                sh "docker tag $IMAGE_NAME-$COMMIT_HASH $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$COMMIT_HASH-$PIPELINE_HASH"
                IMAGE_DIGEST = sh (
                    script: "docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$COMMIT_HASH-$PIPELINE_HASH",
                    returnStdout: true
                ).trim()
                IMAGE_DIGEST = (IMAGE_DIGEST =~ /$COMMIT_HASH-$PIPELINE_HASH: digest: (sha256:.+) size/)[ 0 ][ 1 ]
                echo "IMAGE_DIGEST = $IMAGE_DIGEST"
            }
        }
    }
}

def clean_image(IMAGE_NAME) {
    echo "Clean local $IMAGE_NAME image"
    script {
        try {
            sh "docker rmi $IMAGE_NAME-$COMMIT_HASH:latest"
            sh "docker rmi $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$COMMIT_HASH-$PIPELINE_HASH"
        } catch (err) {
            echo err.getMessage()
        }
    }
}