Merge pull request #2970 from zendesk/grosser/job-env

allow setting deploy env vars on kubernetes deploys

app/models/job_execution.rb

@@ -219,8 +219,7 @@ def commands(dir)
       PROJECT_REPOSITORY: @job.project.repository_url
     )
 
-    env.merge!(Hash[*Samson::Hooks.fire(:job_additional_vars, @job).compact])
-
+    Samson::Hooks.fire(:deploy_env, @job.deploy).compact.inject(env, :merge!) if @job.deploy
     base_commands(dir, env) + @job.commands
   end
 

lib/samson/hooks.rb

@@ -50,7 +50,7 @@ class UserError < StandardError
       :ensure_build_is_successful,
       :error,
       :ignore_error,
-      :job_additional_vars,
+      :deploy_env,
       :link_parts_for_resource,
       :project_docker_build_method_options,
       :project_permitted_params,
@@ -161,9 +161,9 @@ def decorator(class_name, file)
       end
 
       # temporarily add a hook for testing
-      def with_callback(name, hook_block)
+      def with_callback(name, *hook_blocks)
         original_hooks = @hooks[name].dup
-        @hooks[name] = [hook_block]
+        @hooks[name] = hook_blocks
         yield
       ensure
         @hooks[name] = original_hooks

plugins/deploy_env_vars/lib/samson_deploy_env_vars/samson_plugin.rb

@@ -13,11 +13,8 @@ class Engine < Rails::Engine
   AcceptsEnvironmentVariables::ASSIGNABLE_ATTRIBUTES
 end
 
-# Injects specific environment variables for the deploy if any
-Samson::Hooks.callback :job_additional_vars do |job|
-  if job.deploy
-    job.deploy.environment_variables.each_with_object({}) do |var, collection|
-      collection[var.name] = var.value
-    end
-  end
+# Injects specific environment variables for the deploy when they were set in the form
+# NOTE: does not resolve secrets or dollar variables on purpose
+Samson::Hooks.callback :deploy_env do |deploy|
+  deploy.environment_variables.each_with_object({}) { |var, h| h[var.name] = var.value }
 end

plugins/deploy_env_vars/test/samson_deploy_env_vars/samson_plugin_test.rb

@@ -17,37 +17,16 @@
     end
   end
 
-  describe :job_additional_vars do
-    context "if the job does not have a deploy" do
-      let(:user) { users(:admin) }
-      let(:project) { projects(:test) }
-      let(:job) { project.jobs.create!(command: 'cat foo', user: user, project: project) }
-
-      it "returns nil" do
-        Samson::Hooks.fire(:job_additional_vars, job).must_equal([nil])
-      end
+  describe :deploy_env do
+    it "returns an empty hash" do
+      Samson::Hooks.fire(:deploy_env, deploy).must_equal([{}])
     end
 
-    context "if the job does have a deploy" do
-      let(:job) { jobs(:succeeded_test) }
-
-      context "if the deploy does not have any env variables" do
-        it "returns an empty hash" do
-          Samson::Hooks.fire(:job_additional_vars, job).must_equal([{}])
-        end
-      end
-
-      context "if the deploy has environment variables" do
-        before do
-          job.deploy.environment_variables.create!(name: "TWO", value: "2")
-        end
-
-        it "returns a hash with the deploy environment variables" do
-          Samson::Hooks.fire(:job_additional_vars, job).must_equal([{
-            "TWO" => "2"
-          }])
-        end
-      end
+    it "returns a hash with the deploy environment variables" do
+      deploy.environment_variables.create!(name: "TWO", value: "2")
+      Samson::Hooks.fire(:deploy_env, deploy).must_equal([{
+        "TWO" => "2"
+      }])
     end
   end
 end

plugins/kubernetes/app/controllers/kubernetes/deploy_group_roles_controller.rb

@@ -180,6 +180,6 @@ def deploy_group_role_params(scope: params.require(:kubernetes_deploy_group_role
       :replicas, :project_id, :deploy_group_id, :delete_resource
     ]
     allowed << :no_cpu_limit if Kubernetes::DeployGroupRole::NO_CPU_LIMIT_ALLOWED
-    p scope.permit(*allowed)
+    scope.permit(*allowed)
   end
 end

plugins/kubernetes/app/models/kubernetes/deploy_executor.rb

@@ -308,7 +308,7 @@ def puts_action(action, release_doc)
     def create_release
       release = Kubernetes::Release.create_release(
         builds: @builds,
-        deploy_id: @job.deploy.id,
+        deploy: @job.deploy,
         grouped_deploy_group_roles: grouped_deploy_group_roles,
         git_sha: @job.commit,
         git_ref: @reference,
@@ -444,7 +444,12 @@ def verify_kubernetes_templates!
 
     def temp_release_docs
       @temp_release_docs ||= begin
-        release = Kubernetes::Release.new(project: @job.project, git_sha: @job.commit, git_ref: 'master')
+        release = Kubernetes::Release.new(
+          project: @job.project,
+          git_sha: @job.commit,
+          git_ref: 'master',
+          deploy: @job.deploy
+        )
         grouped_deploy_group_roles.flatten.map do |deploy_group_role|
           Kubernetes::ReleaseDoc.new(
             kubernetes_release: release,

plugins/kubernetes/app/models/kubernetes/template_filler.rb

@@ -394,7 +394,8 @@ def static_env
 
       # env from plugins
       plugin_envs = Samson::Hooks.fire(:deploy_group_env, project, @doc.deploy_group, resolve_secrets: false)
-      env.merge!(plugin_envs.inject({}, :merge!))
+      plugin_envs += Samson::Hooks.fire(:deploy_env, @doc.kubernetes_release.deploy) if @doc.kubernetes_release.deploy
+      plugin_envs.compact.inject(env, :merge!)
     end
 
     def set_secrets

plugins/kubernetes/test/models/kubernetes/template_filler_test.rb

@@ -502,6 +502,12 @@ def add_init_contnainer_new_syntax(container)
         end
       end
 
+      it "adds env from deploy_env hook" do
+        Samson::Hooks.with_callback(:deploy_env, ->(d) { {FromEnv: "$FOO secret://noooo #{d.user.name}"} }) do
+          container.fetch(:env).must_include(name: 'FromEnv', value: '$FOO secret://noooo Super Admin')
+        end
+      end
+
       it "overrides container env with deploy_group_env so samson can modify env variables" do
         raw_template[:spec][:template][:spec][:containers].first[:env] = [{name: 'FromEnv', value: 'THIS-IS-BAD'}]
         # plugins can return string or symbol keys, we should be prepared for both
@@ -825,6 +831,12 @@ def secret_annotations(hash)
         EnvironmentVariable.create!(parent: projects(:test), name: 'FOO', value: 'BAR')
         template.send(:verify_env)
       end
+
+      it "works without a deploy when doing template verification" do
+        EnvironmentVariable.create!(parent: projects(:test), name: 'FOO', value: 'BAR')
+        doc.kubernetes_release.deploy = nil
+        template.send(:verify_env)
+      end
     end
   end
 

test/models/job_execution_test.rb

@@ -136,13 +136,18 @@ def last_line_of_output
     assert_equal '[04:05:06] zebra', last_line_of_output
   end
 
-  it "tests additional exports hook" do
+  it "can add deploy env vars" do
     freeze_time
     job.update(command: 'env | sort')
-    Samson::Hooks.with_callback(:job_additional_vars, ->(_job) { {ADDITIONAL_EXPORT: "yes"} }) do
+    Samson::Hooks.with_callback(
+      :deploy_env,
+      ->(_job) { {ADDITIONAL_EXPORT1: "yes"} },
+      ->(_job) { {ADDITIONAL_EXPORT2: "yes"} }
+    ) do
       execute_job
       lines = job.output.split "\n"
-      lines.must_include "[04:05:06] ADDITIONAL_EXPORT=yes"
+      lines.must_include "[04:05:06] ADDITIONAL_EXPORT1=yes"
+      lines.must_include "[04:05:06] ADDITIONAL_EXPORT2=yes"
     end
   end