⚙️ Modul 5: CI/CD Pipelines

📋 Kopieren# Job 1: Erstellt einen Report
generate-report:
  stage: test
  script:
    - ansible-playbook check-network.yml > network-report.txt
    - echo "Prüfung am $(date)" >> network-report.txt
  artifacts:
    paths:
      - network-report.txt     # Diese Datei wird gespeichert
    expire_in: 1 week          # Nach einer Woche löschen
    when: always               # Auch bei Fehler speichern

# Job 2: Nutzt den Report aus Job 1
analyze-report:
  stage: deploy
  script:
    - cat network-report.txt   # Datei ist verfügbar!
    - grep -c "OK" network-report.txt

📋 Kopieren# Cache für Python Dependencies
default:
  cache:
    key: python-deps              # Eindeutiger Schlüssel
    paths:
      - .cache/pip                # pip Cache-Ordner
      - venv/                     # Virtual Environment
    policy: pull-push             # Lesen und schreiben
  
install-deps:
  stage: prepare
  script:
    - python -m venv venv
    - source venv/bin/activate
    - pip install --cache-dir=.cache/pip -r requirements.txt
    # Beim nächsten Run sind die Packages schon da!

📋 Kopieren# 1. STAGES - Die Phasen Ihrer Pipeline
stages:
  - validate    # Erste Phase
  - test        # Zweite Phase
  - deploy      # Dritte Phase

# 2. GLOBAL DEFAULTS - Gilt für alle Jobs
default:
  image: python:3.11
  tags:
    - docker
  before_script:
    - pip install -q ansible

# 3. GLOBAL VARIABLES - Überall verfügbar
variables:
  ANSIBLE_HOST_KEY_CHECKING: "false"
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

# 4. JOBS - Die eigentliche Arbeit
my-first-job:
  stage: validate
  script:
    - echo "Hello World!"
    - python --version

📋 Kopierenstages:
  - prepare      # 1. Vorbereitung (Dependencies)
  - validate     # 2. Validierung (Syntax, Lint)
  - test         # 3. Tests (Unit, Integration)
  - build        # 4. Build (Docker Image, etc.)
  - deploy       # 5. Deployment
  - verify       # 6. Post-Deployment Tests
  - cleanup      # 7. Aufräumen

📋 Kopierenmein-job:
  # Welche Stage?
  stage: test
  
  # Welches Docker-Image?
  image: ansible/ansible:latest
  
  # Auf welchen Runnern? (Tags müssen matchen)
  tags:
    - docker
    - linux
  
  # VOR dem eigentlichen Script
  before_script:
    - pip install yamllint
    - echo "Vorbereitung fertig"
  
  # DAS EIGENTLICHE SCRIPT (Pflichtfeld!)
  script:
    - yamllint config.yaml
    - ansible-lint playbook.yml
  
  # NACH dem Script (auch bei Fehler)
  after_script:
    - echo "Aufräumen..."
    - rm -rf tmp/
  
  # Variablen nur für diesen Job
  variables:
    DEBUG: "true"
  
  # Dateien speichern
  artifacts:
    paths:
      - results/
    expire_in: 1 day
  
  # Wann soll der Job laufen?
  only:
    - main
    - develop
  
  # Wann NICHT?
  except:
    - tags
  
  # Manueller Trigger?
  when: manual
  
  # Darf fehlschlagen?
  allow_failure: false
  
  # Timeout
  timeout: 30 minutes
  
  # Wiederholungen bei Fehler
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure

📋 Kopierendeploy-production:
  stage: deploy
  script:
    - ansible-playbook deploy.yml
  rules:
    # Regel 1: Auf main-Branch → Manual
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
      allow_failure: false
    
    # Regel 2: Bei Tags die mit "v" starten → Automatisch
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+/
      when: on_success
    
    # Regel 3: Merge Requests → Nur wenn Änderungen in bestimmten Dateien
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - playbooks/**/*
        - inventory/**/*
      when: on_success
    
    # Regel 4: Alles andere → Nicht ausführen
    - when: never

📋 Kopierenstages:
  - build
  - test
  - deploy

# Diese beiden Jobs laufen parallel
build-frontend:
  stage: build
  script: npm run build
  artifacts:
    paths: [dist/]

build-backend:
  stage: build
  script: go build -o app

# Dieser Job WARTET auf beide
integration-test:
  stage: test
  needs:
    - build-frontend
    - build-backend
  script: ./run-tests.sh

# Dieser Job braucht NUR das Backend
deploy-api:
  stage: deploy
  needs:
    - build-backend      # Startet, sobald build-backend fertig ist!
  script: ./deploy-api.sh

📋 Kopieren# Template (beginnt mit "." → wird nicht ausgeführt)
.ansible-template:
  image: ansible/ansible:latest
  before_script:
    - pip install -q jmespath netaddr
    - ansible --version
  variables:
    ANSIBLE_FORCE_COLOR: "true"
  tags:
    - docker

# Jobs erben vom Template
lint-playbooks:
  extends: .ansible-template
  stage: validate
  script:
    - ansible-lint playbooks/

syntax-check:
  extends: .ansible-template
  stage: validate
  script:
    - ansible-playbook --syntax-check playbooks/*.yml

dry-run:
  extends: .ansible-template
  stage: test
  script:
    - ansible-playbook --check playbooks/deploy.yml

📋 Kopieren# Globale Variablen (für alle Jobs)
variables:
  NDFC_HOST: "10.1.1.100"
  ANSIBLE_HOST_KEY_CHECKING: "false"
  ENVIRONMENT: "staging"

stages:
  - test
  - deploy

# Job mit eigenen Variablen (überschreibt globale)
test-staging:
  stage: test
  variables:
    ENVIRONMENT: "staging"    # Überschreibt global
    DEBUG: "true"             # Nur für diesen Job
  script:
    - echo "Environment: $ENVIRONMENT"
    - echo "Debug: $DEBUG"
    - echo "Host: $NDFC_HOST"

deploy-production:
  stage: deploy
  variables:
    ENVIRONMENT: "production"
  script:
    - echo "Deploying to $ENVIRONMENT on $NDFC_HOST"

📋 Kopierendeploy-to-ndfc:
  stage: deploy
  variables:
    # Öffentliche Variablen OK
    NDFC_HOST: "10.1.1.100"
    NDFC_USER: "admin"
    # NDFC_PASSWORD kommt aus GitLab CI/CD Variables!
  script:
    # Die Variable ist automatisch verfügbar
    - echo "Connecting to $NDFC_HOST as $NDFC_USER"
    - ansible-playbook -e "ndfc_password=$NDFC_PASSWORD" deploy.yml
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

📋 Kopieren# Beispiel: SSH Key als File-Variable
# In GitLab: Type = "File", Key = "SSH_PRIVATE_KEY"

deploy-via-ssh:
  stage: deploy
  script:
    # $SSH_PRIVATE_KEY ist der PFAD zur temporären Datei!
    - chmod 600 "$SSH_PRIVATE_KEY"
    - ssh -i "$SSH_PRIVATE_KEY" admin@switch.local "show run"

📋 Kopieren# Variablen an nachfolgende Jobs weitergeben
generate-version:
  stage: prepare
  script:
    - VERSION="1.0.$(date +%Y%m%d)"
    - echo "VERSION=$VERSION" >> build.env
  artifacts:
    reports:
      dotenv: build.env    # Macht Variablen verfügbar

use-version:
  stage: build
  needs:
    - generate-version
  script:
    - echo "Building version $VERSION"    # $VERSION ist verfügbar!

📋 Kopierenstages:
  - deploy

deploy-staging:
  stage: deploy
  script:
    - ansible-playbook -i inventory/staging deploy.yml
  environment:
    name: staging
    url: https://staging.network.local    # Optional: Link in GitLab UI

deploy-production:
  stage: deploy
  script:
    - ansible-playbook -i inventory/production deploy.yml
  environment:
    name: production
    url: https://network.local
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual

📋 Kopieren# Review App pro Branch
deploy-review:
  stage: deploy
  script:
    - echo "Deploying $CI_COMMIT_REF_SLUG"
    - ./deploy-review.sh "$CI_COMMIT_REF_SLUG"
  environment:
    name: review/$CI_COMMIT_REF_SLUG    # z.B. review/feature-xyz
    url: https://$CI_COMMIT_REF_SLUG.review.local
    on_stop: stop-review                 # Cleanup-Job
  rules:
    - if: $CI_COMMIT_BRANCH != "main" && $CI_COMMIT_BRANCH != "develop"

stop-review:
  stage: deploy
  script:
    - ./cleanup-review.sh "$CI_COMMIT_REF_SLUG"
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  rules:
    - if: $CI_COMMIT_BRANCH != "main" && $CI_COMMIT_BRANCH != "develop"
      when: manual

📋 Kopierendeploy-production:
  stage: deploy
  script:
    - ansible-playbook deploy.yml
  environment:
    name: production
  when: manual    # Erfordert Klick in GitLab UI
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

📋 Kopierenstages:
  - validate
  - approve
  - deploy

lint-config:
  stage: validate
  script:
    - yamllint config.yaml

# GATE: Blockiert bis jemand approved
approval-gate:
  stage: approve
  script:
    - echo "Deployment approved by $GITLAB_USER_LOGIN at $(date)"
  when: manual
  allow_failure: false    # ⚠️ Pipeline wartet hier!

deploy-network:
  stage: deploy
  script:
    - ansible-playbook deploy.yml
  needs:
    - approval-gate    # Startet erst nach Approval!

📋 Kopierenstages:
  - test
  - approve
  - deploy

# Zwei unabhängige Approvals erforderlich
approval-team-lead:
  stage: approve
  script:
    - echo "Approved by Team Lead: $GITLAB_USER_LOGIN"
  when: manual
  allow_failure: false

approval-network-admin:
  stage: approve
  script:
    - echo "Approved by Network Admin: $GITLAB_USER_LOGIN"
  when: manual
  allow_failure: false

deploy-core:
  stage: deploy
  script:
    - ansible-playbook deploy-core-switches.yml
  needs:
    - approval-team-lead
    - approval-network-admin    # Beide müssen approved haben!

📋 Kopieren# ============================================
# VXLAN EVPN Fabric Deployment Pipeline
# ============================================

stages:
  - validate
  - test
  - approve
  - deploy
  - verify

# ============================================
# GLOBAL CONFIGURATION
# ============================================

variables:
  # Ansible Settings
  ANSIBLE_FORCE_COLOR: "true"
  ANSIBLE_HOST_KEY_CHECKING: "false"
  ANSIBLE_STDOUT_CALLBACK: "yaml"
  
  # NDFC Connection (Secrets aus GitLab CI/CD Variables!)
  NDFC_HOST: "10.1.1.100"
  NDFC_USER: "admin"
  # NDFC_PASSWORD → kommt aus CI/CD Variables
  
  # Pipeline Settings
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

default:
  image: python:3.11-slim
  tags:
    - docker
  before_script:
    - pip install --quiet ansible-core yamllint ansible-lint jmespath
  cache:
    key: pip-cache
    paths:
      - .cache/pip

# ============================================
# TEMPLATES
# ============================================

.ansible-base:
  before_script:
    - pip install --quiet ansible-core yamllint ansible-lint jmespath netaddr
    - ansible-galaxy collection install cisco.dcnm --force
    - ansible --version

# ============================================
# STAGE 1: VALIDATE
# ============================================

yaml-lint:
  stage: validate
  script:
    - echo "🔍 Prüfe YAML-Syntax..."
    - yamllint -c .yamllint.yml .
  rules:
    - changes:
        - "**/*.yml"
        - "**/*.yaml"

ansible-lint:
  stage: validate
  extends: .ansible-base
  script:
    - echo "🔍 Prüfe Ansible Best Practices..."
    - ansible-lint playbooks/ --exclude .cache
  rules:
    - changes:
        - playbooks/**/*
        - roles/**/*
  allow_failure: true    # Warnungen blockieren nicht

syntax-check:
  stage: validate
  extends: .ansible-base
  script:
    - echo "🔍 Prüfe Playbook-Syntax..."
    - |
      for playbook in playbooks/*.yml; do
        echo "Checking $playbook..."
        ansible-playbook --syntax-check "$playbook"
      done
  artifacts:
    when: on_failure
    paths:
      - ansible.log
    expire_in: 1 day

# ============================================
# STAGE 2: TEST
# ============================================

dry-run-fabric:
  stage: test
  extends: .ansible-base
  script:
    - echo "🧪 Dry-Run Fabric Deployment..."
    - ansible-playbook playbooks/deploy-fabric.yml --check --diff
  environment:
    name: staging
  artifacts:
    paths:
      - dry-run-report.txt
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_BRANCH =~ /^(main|develop)$/

pre-deployment-checks:
  stage: test
  extends: .ansible-base
  script:
    - echo "🔍 Pre-Deployment Checks..."
    - ansible-playbook playbooks/pre-checks.yml
    - echo "✅ Alle Switches erreichbar"
    - echo "✅ NDFC API verfügbar"
    - echo "✅ Keine Konflikte mit bestehendem Fabric"
  artifacts:
    reports:
      junit: pre-check-results.xml
    when: always

generate-diff-report:
  stage: test
  extends: .ansible-base
  script:
    - echo "📊 Generiere Änderungsbericht..."
    - ansible-playbook playbooks/generate-diff.yml
    - cat fabric-changes.md
  artifacts:
    paths:
      - fabric-changes.md
    expose_as: "Fabric Changes Report"
    expire_in: 30 days
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# ============================================
# STAGE 3: APPROVE (Manual Gate)
# ============================================

approval-gate:
  stage: approve
  script:
    - echo "✅ Deployment freigegeben von: $GITLAB_USER_LOGIN"
    - echo "📅 Zeitpunkt: $(date -Iseconds)"
    - echo "🔖 Commit: $CI_COMMIT_SHA"
  when: manual
  allow_failure: false    # Pipeline wartet!
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  environment:
    name: production
    action: prepare

# ============================================
# STAGE 4: DEPLOY
# ============================================

deploy-fabric:
  stage: deploy
  extends: .ansible-base
  script:
    - echo "🚀 Deploying Fabric to NDFC..."
    - |
      ansible-playbook playbooks/deploy-fabric.yml         -e "ndfc_host=$NDFC_HOST"         -e "ndfc_user=$NDFC_USER"         -e "ndfc_password=$NDFC_PASSWORD"
    - echo "✅ Fabric Deployment abgeschlossen"
  needs:
    - approval-gate
  environment:
    name: production
    url: https://$NDFC_HOST
  artifacts:
    paths:
      - deployment-log.txt
    when: always
    expire_in: 90 days
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy-networks:
  stage: deploy
  extends: .ansible-base
  script:
    - echo "🌐 Deploying Networks & VRFs..."
    - ansible-playbook playbooks/deploy-networks.yml
  needs:
    - deploy-fabric
  environment:
    name: production
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# ============================================
# STAGE 5: VERIFY (Post-Deployment)
# ============================================

verify-connectivity:
  stage: verify
  extends: .ansible-base
  script:
    - echo "🔍 Verifiziere Konnektivität..."
    - ansible-playbook playbooks/verify-connectivity.yml
    - echo "✅ Alle Ping-Tests erfolgreich"
  needs:
    - deploy-networks
  artifacts:
    reports:
      junit: connectivity-report.xml
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

verify-bgp:
  stage: verify
  extends: .ansible-base
  script:
    - echo "🔍 Verifiziere BGP EVPN Status..."
    - ansible-playbook playbooks/verify-bgp.yml
    - cat bgp-status.txt
  needs:
    - deploy-fabric
  artifacts:
    paths:
      - bgp-status.txt
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

compliance-check:
  stage: verify
  extends: .ansible-base
  script:
    - echo "📋 Compliance Check..."
    - ansible-playbook playbooks/compliance-check.yml
  allow_failure: true
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# ============================================
# ROLLBACK (Manuell bei Bedarf)
# ============================================

rollback:
  stage: deploy
  extends: .ansible-base
  script:
    - echo "⏪ Rolling back to previous state..."
    - ansible-playbook playbooks/rollback.yml
    - echo "✅ Rollback abgeschlossen"
  when: manual
  allow_failure: true
  environment:
    name: production
    action: stop
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

📋 Kopieren# YAMLlint Konfiguration
extends: default

rules:
  line-length:
    max: 120
    level: warning
  truthy:
    allowed-values: ['true', 'false', 'yes', 'no']
  comments:
    min-spaces-from-content: 1
  indentation:
    spaces: 2
    indent-sequences: true

📋 Kopieren# Ansible-lint Konfiguration
skip_list:
  - yaml[line-length]
  - name[missing]

warn_list:
  - experimental

exclude_paths:
  - .cache/
  - .git/

📋 Kopierendebug-job:
  stage: test
  script:
    # 1. Alle Umgebungsvariablen anzeigen
    - env | sort
    
    # 2. Verzeichnisstruktur zeigen
    - pwd
    - ls -la
    - find . -type f -name "*.yml"
    
    # 3. Befehle mit Verbose-Modus
    - set -x    # Zeigt jeden Befehl vor Ausführung
    - pip install ansible
    - set +x
    
    # 4. Fehler abfangen und trotzdem weitermachen
    - ./might-fail.sh || echo "Fehler ignoriert"
    
    # 5. Exit-Code speichern
    - |
      ./important-script.sh
      EXIT_CODE=$?
      echo "Exit Code war: $EXIT_CODE"
      if [ $EXIT_CODE -ne 0 ]; then
        echo "Fehler aufgetreten, aber wir machen weiter"
      fi
  artifacts:
    when: always    # Auch bei Fehler Artifacts speichern
    paths:
      - "*.log"

📋 Kopieren# gitlab-runner lokal installieren (macOS)
brew install gitlab-runner

# Oder mit Docker (alle Plattformen)
docker pull gitlab/gitlab-runner:latest

# Pipeline lokal ausführen
gitlab-runner exec docker my-job-name

# Mit Variablen
gitlab-runner exec docker my-job-name \
  --env "MY_VAR=value" \
  --env "SECRET=test-secret"

📋 Kopieren# ✅ GUTE Security-Praktiken

variables:
  # Nie Secrets hier!
  PUBLIC_CONFIG: "ok"
  
deploy-secure:
  stage: deploy
  script:
    # Secrets kommen aus CI/CD Variables
    - echo "$DB_PASSWORD" | some-tool --password-stdin
    
    # Niemals so:
    # - some-tool --password="$DB_PASSWORD"  # ❌ Sichtbar in Process List!
    
    # Secrets in Dateien schreiben (temporär)
    - echo "$SSH_KEY" > /tmp/key && chmod 600 /tmp/key
    - ssh -i /tmp/key server
    - rm /tmp/key
    
  # Nur auf protected Branches deployen
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
    
  # Nur bestimmte Runner nutzen (für sensible Jobs)
  tags:
    - secure-runner
    
  # Job-Token einschränken
  id_tokens:
    OIDC_TOKEN:
      aud: https://vault.company.com