deploy-service.yml

parameters:
  - name: proxy_path
  - name: product_display_name
  - name: product_description
  - name: service_name
  - name: stage_name
  - name: short_service_name
  - name: fully_qualified_service_name
  - name: apigee_environment
  - name: apigee_organization
  - name: service_base_path
  - name: pr_label
  - name: hosted_target_connection_path_suffix
  - name: hosted_target_healthcheck_suffix
  - name: aws_account
    values:
      - ptl
      - prod
  - name: jinja_templates
    type: object
  - name: enable_monitoring
    type: boolean
  - name: enable_status_monitoring
    type: boolean
  - name: ping
    type: boolean
  - name: pre_template
    type: stepList
  - name: post_template
    type: stepList
  - name: pre_deploy
    type: stepList
  - name: post_deploy
    type: stepList
  - name: spec_file
  - name: friendly_api_name
    default: ''
  - name: portal_api_requires_callback_url
  - name: make_spec_visible
    # To mark a pipeline variable as deprecated, go to the
    # apigee-deployment.yml and give it a default value of 'DEPRECATED'.
    # Then add it to this list.
  - name: _deprecated_pipeline_variables
    type: object
    default:
      - product_display_name
      - product_description
      - make_spec_visible
      - portal_api_requires_callback_url
      - spec_file

steps:
  # Warn user they are passing deprecated variables to the deployment pipeline
  - ${{ each variable_name in parameters._deprecated_pipeline_variables }}:
    - ${{ if ne(parameters[variable_name], 'DEPRECATED') }}:
      - bash: |
          echo "##[warning]Pipeline parameter ${{ variable_name }} is deprecated"
          echo "##[warning]The value that appears in Apigee is derived from your repository's manifest.yml/manifest_template.yml file."
          echo "##[warning]To remove this warning stop passing the variable into the pipeline parameters."
          echo "##vso[task.complete result=SucceededWithIssues;]DONE"
        displayName: Warn ${{ variable_name }} is a deprecated pipeline parameter
  - bash: |
      ls -R
      if [[ -f ecs-deploy-${{ parameters.apigee_environment }}.yml ]] || [[ -f ecs-proxies-deploy.yml ]] || [[ -f ecs-proxies-deploy-sandbox.yml ]]; then
        echo "##vso[task.setvariable variable=deploy_containers]true"
      else
        echo "##vso[task.setvariable variable=deploy_containers]false"
      fi
    workingDirectory: "$(SERVICE_DIR)"
    displayName: "Check for ECS proxy definitions"

  - task: s3-cache-action@1
    inputs:
      key: poetry | utils | $(UTILS_DIR)/poetry.lock
      location: "$(UTILS_DIR)/.venv"
      debug: true
      alias: 'UtilsPreReq'
    displayName: cache utils pre-requisites

  - bash: |
      n=0
      until [ "$n" -ge 3 ]
      do
        make install && break
        n=$((n+1))
      done
    workingDirectory: "$(UTILS_DIR)"
    condition: ne(variables['CacheRestored-UtilsPreReq'], 'true')
    displayName: "Install utils pre-requisites"

  - bash: |
      tfenv use 0.14.6
    displayName: setup terraform
    condition: and(succeeded(), eq(variables['deploy_containers'], 'true'))

  - ${{ if parameters.proxy_path }}:
    - bash: |
        echo "Deploying ${{ parameters.service_name }} artifact $(SERVICE_ARTIFACT_NAME) as ${{ parameters.fully_qualified_service_name }} to ${{ parameters.service_base_path }} on $(ENV_URL)"
      displayName: 'Deploy Info'

    - ${{ each pre_template_step in parameters.pre_template }}:
      - ${{ pre_template_step }}

    # pre_template steps might have been doing cross account stuff
    # make sure we bring everything back to the correct AWS role here
    - template: ../components/aws-assume-role.yml
      parameters:
        role: "auto-ops"
        profile: "apm_${{ parameters.aws_account }}"
        aws_account: "${{ parameters.aws_account }}"

    - ${{ if parameters.jinja_templates }}:
        - bash: mkdir -p group_vars/all && touch jinja_templates.yml
          workingDirectory: "$(UTILS_DIR)/ansible/"
          displayName: Prepare extra template-proxy vars

        - ${{ each jinja_template in parameters.jinja_templates }}:
          - bash: 'echo "${{ jinja_template.key }}: ${{ jinja_template.value }}" >> jinja_templates.yml'
            workingDirectory: "$(UTILS_DIR)/ansible/group_vars/all"
            displayName: "Set ${{ jinja_template.key }} to ${{ jinja_template.value }}"

    - bash: |
        set -euo pipefail

        export SERVICE_NAME="${{ parameters.service_name }}"
        export PROXIES_DIR="$(SERVICE_DIR)/proxies"
        export SERVICE_BASE_PATH="${{ parameters.service_base_path }}"
        export APIGEE_ENVIRONMENT="${{ parameters.apigee_environment }}"
        export HOSTED_TARGET_CONNECTION_PATH_SUFFIX="${{ parameters.hosted_target_connection_path_suffix }}"
        export HOSTED_TARGET_HEALTHCHECK_SUFFIX="${{ parameters.hosted_target_healthcheck_suffix }}"
        export SOURCE_COMMIT_ID=$(Build.SourceVersion)
        export RELEASE_RELEASEID=$(Build.BuildId)

        export ASSUMED_VERSION=`echo $SERVICE_ARTIFACT_NAME | ( grep -E -o "v[0-9]+\.[0-9]+\.[0-9]+-?[a-z]*" || true ) | tail -1`
        if [[ ! -z $ASSUMED_VERSION ]]; then
          export DEPLOYED_VERSION=$ASSUMED_VERSION
        else
          export DEPLOYED_VERSION="${{ parameters.fully_qualified_service_name }}"
        fi

        if [ -f  $(SERVICE_DIR)/.build_env_vars ]; then
          source $(SERVICE_DIR)/.build_env_vars
        fi

        cd $(UTILS_DIR)
        ANSIBLE_FORCE_COLOR=yes \
        make --no-print-directory -C ansible template-proxies

        if [ -f $(SERVICE_DIR)/manifest.yml ]; then
            DIST_DIR=$(SERVICE_DIR) \
            PROXY_DIR=${{ parameters.proxy_path }} \
            ANSIBLE_FORCE_COLOR=yes \
            make --no-print-directory -C ansible add-apim-guids-policy
        fi
      displayName: Template proxies

    - ${{ each post_template_step in parameters.post_template }}:
      - ${{ post_template_step }}

  - ${{ each pre_deploy_step in parameters.pre_deploy }}:
    - ${{ pre_deploy_step }}

  - bash: |
      set -e

      proxy_vars_file=""

      if [ -f  $(SERVICE_DIR)/ecs-deploy-${{ parameters.apigee_environment }}.yml ]; then
        proxy_vars_file="$(SERVICE_DIR)/ecs-deploy-${{ parameters.apigee_environment }}.yml"
      else
        if [ -f  $(SERVICE_DIR)/ecs-deploy-all.yml ]; then
          proxy_vars_file="$(SERVICE_DIR)/ecs-deploy-all.yml"
        fi
      fi
      deploy_role=""

      if [[ ! -z "${proxy_vars_file}" ]]; then
        source $(SERVICE_DIR)/.build_env_vars
        deploy_role="deploy-${{ parameters.apigee_environment }}-${service_id}"

        account=${{ parameters.aws_account }} \
        SERVICE_BASE_PATH=${{ parameters.service_base_path }} \
        APIGEE_ENVIRONMENT=${{ parameters.apigee_environment }} \
        make --no-print-directory  -C $(UTILS_DIR)/ansible create-api-deployment-pre-reqs

      fi

      echo "##vso[task.setvariable variable=PROXY_VARS_FILE]${proxy_vars_file}"
      echo "##vso[task.setvariable variable=DEPLOY_ROLE]${deploy_role}"

    displayName: Create ECS Prerequisites
    condition: and(succeeded(), eq(variables['deploy_containers'], 'true'))

  - template: ../components/aws-assume-role.yml
    parameters:
      role: "$(DEPLOY_ROLE)"
      profile: "$(DEPLOY_ROLE)"
      aws_account: "${{ parameters.aws_account }}"

  - bash: |
      set -e
      proxy_vars_file="$(PROXY_VARS_FILE)"

      source $(SERVICE_DIR)/.build_env_vars

      export ASSUMED_VERSION=`echo $SERVICE_ARTIFACT_NAME | ( grep -E -o "v[0-9]+\.[0-9]+\.[0-9]+-?[a-z]*" || true ) | tail -1`
      if [[ ! -z $ASSUMED_VERSION ]]; then
        export DEPLOYED_VERSION=$ASSUMED_VERSION
      else
        export DEPLOYED_VERSION="${{ parameters.fully_qualified_service_name }}"
      fi

      account=${{ parameters.aws_account }} \
      PROXY_VARS_FILE="${proxy_vars_file}" \
      SOURCE_COMMIT_ID="$(Build.SourceVersion)" \
      RELEASE_RELEASEID="$(Build.BuildId)" \
      SERVICE_BASE_PATH=${{ parameters.service_base_path }} \
      APIGEE_ENVIRONMENT=${{ parameters.apigee_environment }} \
      make --no-print-directory  -C $(UTILS_DIR)/ansible deploy-ecs-proxies

    displayName: Deploy ECS proxies
    condition: and(succeeded(), ne(variables['DEPLOY_ROLE'], ''))

  - ${{ if parameters.proxy_path }}:
    - bash: |
        set -euo pipefail

        export PROXY_DIR="$(SERVICE_DIR)/proxies/${{ parameters.proxy_path }}"
        export SERVICE_NAME="${{ parameters.service_name }}"
        export FULLY_QUALIFIED_SERVICE_NAME="${{ parameters.fully_qualified_service_name }}"
        export SERVICE_BASE_PATH="${{ parameters.service_base_path }}"
        export APIGEE_ACCESS_TOKEN="$(secret.AccessToken)"
        export APIGEE_ENVIRONMENT="${{ parameters.apigee_environment }}"
        export APIGEE_ORGANIZATION="nhsd-${{ parameters.apigee_organization }}"
        export PING="${{ parameters.ping }}"
        export ANSIBLE_FORCE_COLOR=yes

        make --no-print-directory -C $(UTILS_DIR)/ansible deploy-apigee-proxy
      displayName: Deploy proxy

  - bash: |
      set -euo pipefail

      export APIGEE_ACCESS_TOKEN="$(secret.AccessToken)"
      export APIGEE_ENVIRONMENT="${{ parameters.apigee_environment }}"
      export APIGEE_ORGANIZATION="nhsd-${{ parameters.apigee_organization }}"
      export ANSIBLE_FORCE_COLOR=yes
      export DIST_DIR=$(SERVICE_DIR)
      export PULL_REQUEST="${{ parameters.pr_label }}"
      make --no-print-directory -C $(UTILS_DIR)/ansible deploy-manifest
    displayName: 'Deploy Manifest'
  
  - ${{ if parameters.proxy_path }}:
    - bash: |
        set -euo pipefail

        echo "Setting stage name as snake case for monitoring"
        export MONITORING_STAGE_NAME="${{ replace(parameters.stage_name, '_', '-') }}"
        echo "MONITORING_STAGE_NAME=${MONITORING_STAGE_NAME}"
        echo "##vso[task.setvariable variable=MONITORING_STAGE_NAME]$MONITORING_STAGE_NAME"

        if [[ "${{ parameters.apigee_environment }}" == "prod" ]]; then
          export url="https://api.service.nhs.uk/monitoring-sd/service"
          export status_body='{ "${{ parameters.service_name }}": { "${{ parameters.apigee_environment }}": [ "${{ parameters.service_name }}@$(MONITORING_STAGE_NAME)=http_2xx_with_api_key https://api.service.nhs.uk/${{ parameters.service_base_path }}/_status" ] } }'
          export ping_body='{ "${{ parameters.service_name }}": { "${{ parameters.apigee_environment }}": [ "${{ parameters.service_name }}@$(MONITORING_STAGE_NAME)=http_2xx https://api.service.nhs.uk/${{ parameters.service_base_path }}/_ping" ] } }'
        else
          export url="https://internal-dev.api.service.nhs.uk/monitoring-sd/service"
          export status_body='{ "${{ parameters.service_name }}": { "${{ parameters.apigee_environment }}": [ "${{ parameters.service_name }}@$(MONITORING_STAGE_NAME)=http_2xx_with_api_key https://${{ parameters.apigee_environment }}.api.service.nhs.uk/${{ parameters.service_base_path }}/_status" ] } }'
          export ping_body='{ "${{ parameters.service_name }}": { "${{ parameters.apigee_environment }}": [ "${{ parameters.service_name }}@$(MONITORING_STAGE_NAME)=http_2xx https://${{ parameters.apigee_environment }}.api.service.nhs.uk/${{ parameters.service_base_path }}/_ping" ] } }'
        fi

        echo "##vso[task.setvariable variable=is_pull_request]false"
        echo "##vso[task.setvariable variable=check_and_enable_ping]${{ parameters.enable_monitoring }}"
        echo "##vso[task.setvariable variable=check_and_enable_status]${{ parameters.enable_status_monitoring }}"

        if [[ "${{ parameters.service_base_path }}" == *"-pr-"* ]]; then
          echo "##vso[task.setvariable variable=check_and_enable_ping]false"
          echo "##vso[task.setvariable variable=check_and_enable_status]false"
          echo "##vso[task.setvariable variable=is_pull_request]true"
        fi

        echo "##vso[task.setvariable variable=url]$url"
        echo "##vso[task.setvariable variable=status_body]$status_body"
        echo "##vso[task.setvariable variable=ping_body]$ping_body"
      displayName: 'Set monitoring variables'

    - bash: |
        set -euo pipefail

        if [[ "${{ parameters.apigee_environment }}" == "prod" ]]; then
          export ping_endpoint_response=`curl -s -o /dev/null -w '%{http_code}' -H "apikey: $(status-endpoint-api-key)" https://api.service.nhs.uk/${{ parameters.service_base_path }}/_ping`
        else
          export ping_endpoint_response=`curl -s -o /dev/null -w '%{http_code}' -H "apikey: $(status-endpoint-api-key)" https://${{ parameters.apigee_environment }}.api.service.nhs.uk/${{ parameters.service_base_path }}/_ping`
        fi

        echo _ping_response=$ping_endpoint_response
        echo "##vso[task.setvariable variable=ping_endpoint_response]$ping_endpoint_response"

        if [[ $ping_endpoint_response == "404" ]]; then
          echo "##vso[task.logissue type=error]Your proxy doesn't have a _ping endpoint therefore we can't monitor this proxy and it should not be released, use the flag 'enable_monitoring=false' if your API doesn't support _ping healthcheck."
          exit 1
        fi

        if [[ $ping_endpoint_response != "200" ]]; then
          echo "##vso[task.logissue type=error]Your proxy's _ping endpoint has encounted an error and should not be released until it is resolved."
          exit 1
        fi
      displayName: 'Check _ping'
      condition: and(succeeded(), eq(variables['check_and_enable_ping'], 'true'))

    - bash: |
        set -euo pipefail

        if [[ "${{ parameters.apigee_environment }}" == "prod" ]]; then
          export status_endpoint_response=`curl -s -o /dev/null -w '%{http_code}' -H "apikey: $(status-endpoint-api-key)" https://api.service.nhs.uk/${{ parameters.service_base_path }}/_status`
        else
          export status_endpoint_response=`curl -s -o /dev/null -w '%{http_code}' -H "apikey: $(status-endpoint-api-key)" https://${{ parameters.apigee_environment }}.api.service.nhs.uk/${{ parameters.service_base_path }}/_status`
        fi

        echo _status_response=$status_endpoint_response
        echo "##vso[task.setvariable variable=status_endpoint_response]$status_endpoint_response"

        if [[ $status_endpoint_response == "404" ]]; then
          echo "##vso[task.logissue type=error]Your proxy doesn't have a _status endpoint therefore we can't monitor this proxy and it should not be released, use the flag 'enable_status_monitoring=false' if your API doesn't support _status healthcheck."
          exit 1
        fi

        if [[ $status_endpoint_response != "200" ]]; then
          echo "##vso[task.logissue type=error]Your proxy's _status endpoint has encounted an error and should not be released until it is resolved."
          exit 1
        fi
      displayName: 'Check _status'
      condition: and(succeeded(), eq(variables['check_and_enable_status'], 'true'))

    - bash: |
        set -euo pipefail

        curl --fail -X 'POST' -H 'apikey: $(MONITORING_API_KEY)' -d '$(status_body)' $(url)
      displayName: Enable _status monitoring
      condition: and(succeeded(), eq(variables['check_and_enable_status'], 'true'))

    - bash: |
        set -euo pipefail

        curl --fail -X 'DELETE' -H 'apikey: $(MONITORING_API_KEY)' -d '$(status_body)' $(url)
        echo
        echo "_status endpoint monitoring is disabled"
      displayName: Disable _status monitoring
      condition: and(succeeded(), eq(variables['check_and_enable_status'], 'false'), eq(variables['is_pull_request'], 'false'))

    - bash: |
        set -euo pipefail

        curl --fail -X 'POST' -H 'apikey: $(MONITORING_API_KEY)' -d '$(ping_body)' $(url)
      displayName: Enable _ping monitoring
      condition: and(succeeded(), eq(variables['check_and_enable_ping'], 'true'))

    - bash: |
        set -euo pipefail

        curl --fail -X 'DELETE' -H 'apikey: $(MONITORING_API_KEY)' -d '$(ping_body)' $(url)
        echo
        echo "_ping endpoint monitoring is disabled"
      displayName: Disable _ping monitoring
      condition: and(succeeded(), eq(variables['check_and_enable_ping'], 'false'), eq(variables['is_pull_request'], 'false'))

  - ${{ each post_deploy_step in parameters.post_deploy }}:
    - ${{ post_deploy_step }}