ci: enable release from Azp (envoyproxy#8580)

Risk Level: Med
Testing: manual azp run
Docs Changes: N/A
Release Notes: N/A

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

.azure-pipelines/linux.yml

@@ -89,6 +89,33 @@ jobs:
       artifactName: $(CI_TARGET)
     condition: always()
 
+- job: docker
+  dependsOn: ["bazel"]
+  condition: and(succeeded(), eq(variables['PostSubmit'], 'true'), ne(variables['Build.Reason'], 'PullRequest'))
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - task: DownloadBuildArtifacts@0
+    inputs:
+      buildType: current
+      artifactName: "bazel.release"
+      itemPattern: "bazel.release/envoy_binary.tar.gz"
+      downloadType: single
+      targetPath: $(Build.StagingDirectory)
+
+  - bash: |
+      set -e
+      tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz
+      ci/docker_build.sh
+      ci/docker_push.sh
+      ci/docker_tag.sh
+    workingDirectory: $(Build.SourcesDirectory)
+    env:
+      AZP_BRANCH: $(Build.SourceBranch)
+      CIRCLE_SHA1: $(Build.SourceVersion)
+      DOCKERHUB_USERNAME: $(DockerUsername)
+      DOCKERHUB_PASSWORD: $(DockerPassword)
+
 - job: fuzzit_fuzzing
   dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
   timeoutInMinutes: 360

.circleci/config.yml

@@ -31,7 +31,7 @@ jobs:
            destination: /
    docker:
      docker:
-       - image: docker
+       - image: google/cloud-sdk
      steps:
        - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
        - checkout

ci/do_ci.sh

@@ -53,6 +53,9 @@ function cp_binary_for_image_build() {
   cp -f "${ENVOY_DELIVERY_DIR}"/envoy "${ENVOY_SRCDIR}"/build_"$1"
   mkdir -p "${ENVOY_SRCDIR}"/build_"$1"_stripped
   strip "${ENVOY_DELIVERY_DIR}"/envoy -o "${ENVOY_SRCDIR}"/build_"$1"_stripped/envoy
+
+  # Copy for azp which doesn't preserve permissions, creating a tar archive
+  tar czf "${ENVOY_BUILD_DIR}"/envoy_binary.tar.gz -C "${ENVOY_SRCDIR}" build_"$1" build_"$1"_stripped
 }
 
 function bazel_binary_build() {

ci/docker_build.sh

@@ -1,7 +1,9 @@
-#!/bin/sh
+#!/bin/bash
 
 set -ex
 
-docker build -f ci/Dockerfile-envoy-image -t envoyproxy/envoy-dev:latest .
-docker build -f ci/Dockerfile-envoy-alpine -t envoyproxy/envoy-alpine-dev:latest .
-docker build -f ci/Dockerfile-envoy-alpine-debug -t envoyproxy/envoy-alpine-debug-dev:latest .
+DOCKER_IMAGE_PREFIX="${DOCKER_IMAGE_PREFIX:-envoyproxy/envoy}"
+
+docker build -f ci/Dockerfile-envoy-image -t "${DOCKER_IMAGE_PREFIX}-dev:latest" .
+docker build -f ci/Dockerfile-envoy-alpine -t "${DOCKER_IMAGE_PREFIX}-alpine-dev:latest" .
+docker build -f ci/Dockerfile-envoy-alpine-debug -t "${DOCKER_IMAGE_PREFIX}-alpine-debug-dev:latest" .

ci/docker_push.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 # Do not ever set -x here, it is a security hazard as it will place the credentials below in the
 # CircleCI logs.
@@ -10,15 +10,17 @@ then
     exit 0
 fi
 
+DOCKER_IMAGE_PREFIX="${DOCKER_IMAGE_PREFIX:-envoyproxy/envoy}"
+
 # push the envoy image on tags or merge to master
-if [ -n "$CIRCLE_TAG" ] || [ "$CIRCLE_BRANCH" = 'master' ]
+if [ -n "$CIRCLE_TAG" ] || [ "$AZP_BRANCH" = 'refs/heads/master' ]
 then
     docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_PASSWORD"
 
-    for BUILD_TYPE in "envoy" "envoy-alpine" "envoy-alpine-debug"; do
-        docker push envoyproxy/"$BUILD_TYPE"-dev:latest
-        docker tag envoyproxy/"$BUILD_TYPE"-dev:latest envoyproxy/"$BUILD_TYPE"-dev:"$CIRCLE_SHA1"
-        docker push envoyproxy/"$BUILD_TYPE"-dev:"$CIRCLE_SHA1"
+    for BUILD_TYPE in "" "-alpine" "-alpine-debug"; do
+        docker push "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}-dev:latest"
+        docker tag "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}-dev:latest" "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}-dev:${CIRCLE_SHA1}"
+        docker push "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}-dev:${CIRCLE_SHA1}"
     done
 
     # This script tests the docker examples.

ci/docker_tag.sh

@@ -1,19 +1,21 @@
-#!/bin/sh
+#!/bin/bash
 
 # Do not ever set -x here, it is a security hazard as it will place the credentials below in the
 # CircleCI logs.
 set -e
 
+DOCKER_IMAGE_PREFIX="${DOCKER_IMAGE_PREFIX:-envoyproxy/envoy}"
+
 if [ -n "$CIRCLE_TAG" ]
 then
     docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_PASSWORD"
 
-    for BUILD_TYPE in "envoy" "envoy-alpine" "envoy-alpine-debug"; do
-        docker pull envoyproxy/"$BUILD_TYPE"-dev:"$CIRCLE_SHA1"
-        docker tag envoyproxy/"$BUILD_TYPE"-dev:"$CIRCLE_SHA1" envoyproxy/"$BUILD_TYPE":"$CIRCLE_TAG"
-        docker push envoyproxy/"$BUILD_TYPE":"$CIRCLE_TAG"
-        docker tag envoyproxy/"$BUILD_TYPE"-dev:"$CIRCLE_SHA1" envoyproxy/"$BUILD_TYPE":latest
-        docker push envoyproxy/"$BUILD_TYPE":latest
+    for BUILD_TYPE in "" "-alpine" "-alpine-debug"; do
+        docker pull "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}"-dev:"$CIRCLE_SHA1"
+        docker tag "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}"-dev:"$CIRCLE_SHA1" "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}":"$CIRCLE_TAG"
+        docker push "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}":"$CIRCLE_TAG"
+        docker tag "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}"-dev:"$CIRCLE_SHA1" "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}":latest
+        docker push "${DOCKER_IMAGE_PREFIX}${BUILD_TYPE}":latest
     done
 else
     echo 'Ignoring non-tag event for docker tag.'