This is a pipeline defined in CircleCI:

version: 2.1

parameters:
 deploy-infra:
 type: string
 default: aws
 remove-deployment:
 type: boolean
 default: false
 wait-for-external-pipeline:
 type: integer
 default: 0

jobs:
 "Create Root CA":
 # IP ranges are only supported for Docker executors, disabling for now
 #circleci\_ip\_ranges: true # https://circleci.com/docs/ip-ranges
 machine:
 image: ubuntu-2204:2022.10.2 # https://circleci.com/docs/configuration-reference#available-linux-machine-images-cloud
 resource\_class: medium # https://circleci.com/docs/configuration-reference/#linuxvm-execution-environment
 steps:
 - checkout
 - run:
 name: Generate Ansible inventory and variable files based on YAML config
 command: cd bin && ./decrypt\_secrets.sh && ./config\_build.sh
 - run:
 name: Running certificate creation script
 command: cd bin && ./install\_ca.sh
 - run:
 # This step is necessary because the docker container runs and
 # creates files in mounted volumes as root
 name: Resetting file ownership
 command: sudo chown -R circleci:circleci ansible
 - persist\_to\_workspace:
 root: ansible
 paths:
 - "myCA"
 "Deploy SD-WAN":
 # IP ranges are only supported for Docker executors, disabling for now
 #circleci\_ip\_ranges: true # https://circleci.com/docs/ip-ranges
 machine:
 image: ubuntu-2204:2022.10.2 # https://circleci.com/docs/configuration-reference#available-linux-machine-images-cloud
 resource\_class: medium # https://circleci.com/docs/configuration-reference/#linuxvm-execution-environment
 environment:
 SDWAN\_CONTROL\_INFRA: << pipeline.parameters.deploy-infra >>
 steps:
 - checkout
 - run:
 name: Sync Git submodules
 command: git submodule sync
 - run:
 name: Checkout Git submodules
 command: git submodule update --init
 - attach\_workspace:
 at: ansible
 - run:
 name: Generate Ansible inventory and variable files based on YAML config
 command: cd bin && ./decrypt\_secrets.sh && ./config\_build.sh
 - run:
 name: Connect VPN to on-prem DC
 command: sudo apt install -y openconnect && ./bin/vpn.sh
 - run:
 name: Creating networks and VMs
 command: cd bin && cat ../ansible/inventory/sdwan\_inventory.yml && ./play.sh -v /ansible/day\_0/deploy-control-plane.yml
 - run:
 name: Waiting 5 minutes
 command: sleep 300
 - run:
 name: SD-WAN control plane day 0 configuration
 command: cd bin && ./play.sh -v /ansible/day\_0/config-control-plane.yml
 # For now we can't reliably deploy Azure and VMware edges, so exclude them from host list
 - run:
 name: Onboarding SD-WAN edges
 command: cd bin && ./play.sh -v /ansible/day\_0/onboard-edges.yml --limit 'all:!cedge-azure'
 # - run:
 # name: SD-WAN control plane day 1 configuration
 # command: cd bin && ./play.sh -v /ansible/day\_1/config-sdwan.yml
 # This is a hack, will need to find an infra independent way to export this
 # We can start with an ansible fact, but ideally Vault or equivalent
 - run:
 name: Exporting vManage external IP as shell variable VMANAGE\_EXTERNAL\_IP
 command: export VMANAGE\_EXTERNAL\_IP=$(jq -r '.outputs.vmanages\_vmanageEth0EIP.value[0]' terraform-sdwan/aws/Provision\_Instances/terraform.tfstate.d/aws\_control/terraform.tfstate) && echo $VMANAGE\_EXTERNAL\_IP
 - run:
 name: Cleaning up due to failure
 command: cd bin && ./play.sh -v /ansible/day\_0/clean-edges.yml --limit 'all:!cedge-azure'; ./play.sh -v /ansible/day\_0/clean-control-plane.yml
 when: on\_fail
 - unless:
 condition:
 equal: [ 0, << pipeline.parameters.wait-for-external-pipeline >> ]
 steps:
 - run:
 name: Triggering external pipeline
 command: |
 curl -X POST https://circleci.com/api/v2/project/gh/$EXTERNAL\_PIPELINE\_REPOUSER/$EXTERNAL\_PIPELINE\_REPONAME/pipeline \
 -H "Circle-Token: $CIRCLE\_TOKEN" -H "Content-Type: application/json" \
 -d "{\"branch\":\"$EXTERNAL\_PIPELINE\_BRANCH\",\"parameters\":{\"vmanage\_host\":\"$VMANAGE\_EXTERNAL\_IP\"}}}"
 # Another hack, a proper inter-pipeline communication is needed (or a single pipeline)
 - run:
 name: Waiting for external pipeline to run
 command: sleep << pipeline.parameters.wait-for-external-pipeline >>
 - when:
 condition: << pipeline.parameters.remove-deployment >>
 steps:
 - run:
 name: Removing edge devices deployment (VMs and networks)
 command: cd bin && ./play.sh -v /ansible/day\_0/clean-edges.yml --limit 'all:!cedge-azure'
 - run:
 name: Removing control plane deployment (VMs and networks)
 command: cd bin && ./play.sh -v /ansible/day\_0/clean-control-plane.yml

workflows:
 "Deploy SD-WAN":
 jobs:
 - "Create Root CA"
 - "Deploy SD-WAN":
 requires:
 - "Create Root CA"
그의 파이프라인은 CircleCI에 정의되어 있습니다:버전: 2.1매개변수를 사용합니다: deploy-infra: 유형: 문자열 기본값: AWS remove-deployment: 유형: 부울 기본값: false wait-for-external-pipeline: 유형: 정수 기본값: 0작업: "루트 CA 생성": # IP 범위는 Docker 실행자에 대해서만 지원되며, 현재는 비활성화되어 있습니다. #CIRCLECI\_IP\_RANGES: true # https://circleci.com/docs/ip-ranges 머신: 이미지: 우분투-2204:2022.10.2 # https://circleci.com/docs/configuration-reference#available-linux-machine-images-cloud resource\_class: medium # https://circleci.com/docs/configuration-reference/#linuxvm-execution-environment steps: - checkout - run: name: YAML 구성에 따라 Ansible 인벤토리 및 가변 파일 생성 명령: cd bin && ./decrypt\_secrets.sh && ./config\_build.sh - 실행합니다: 이름: 인증서 만들기 스크립트 실행 명령: cd bin && ./install\_ca.sh - 실행: # 이 단계는 도커 컨테이너가 실행되고 # 마운트된 볼륨에 루트로 파일을 생성하기 때문에 이 단계가 필요합니다. 이름으로 생성하기 때문에 이 단계가 필요합니다: 파일 소유권 재설정 명령: sudo chown -R circleci:circleci ansible - 지속\_to\_작업공간: 루트: ansible 경로 - "myCA" "SD-WAN 배포": # IP 범위는 Docker 실행기에 대해서만 지원되며, 지금은 비활성화되어 있습니다. #circleci\_ip\_ranges: true # https://circleci.com/docs/ip-ranges machine: 이미지: 우분투-2204:2022.10.2 # https://circleci.com/docs/configuration-reference#available-linux-machine-images-cloud resource\_class: medium # https://circleci.com/docs/configuration-reference/#linuxvm-execution-environment 환경: SDWAN\_CONTROL\_INFRA: << pipeline.parameters.deploy-infra >> steps: - checkout - run: name: Git 서브모듈 동기화 명령: git 서브모듈 동기화 - run: name: 체크아웃 Git 서브모듈 명령: git 서브모듈 업데이트 --init - 첨부\_작업공간: at: ansible - run: name: YAML 구성에 따라 Ansible 인벤토리 및 가변 파일 생성 명령: cd bin && ./decrypt\_secrets.sh && ./config\_build.sh - 실행합니다: 이름: VPN을 온프레미스 DC에 연결 명령: sudo apt install -y openconnect && ./bin/vpn.sh - 실행: name: 네트워크 및 VM 생성 명령: cd bin && cat ../ansible/inventory/sdwan\_inventory.yml && ./play.sh -v /ansible/day\_0/deploy-control-plane.yml - 실행합니다: name: 5분 대기 중 command: sleep 300 - run: name: SD-WAN 컨트롤 플레인 0일차 구성 명령: cd bin && ./play.sh -v /ansible/day\_0/config-control-plane.yml # 현재로서는 Azure 및 VMware 엣지를 안정적으로 배포할 수 없으므로 호스트 목록에서 제외합니다. - 실행합니다: name: SD-WAN 엣지 온보딩 명령: cd bin && ./play.sh -v /ansible/day\_0/onboard-edges.yml --limit 'all:!cedge-azure' # - 실행: # name: SD-WAN 컨트롤 플레인 1일차 구성 # 명령: cd bin && ./play.sh -v /ansible/day\_1/config-sdwan.yml # 이것은 해킹이므로 이를 내보낼 수 있는 인프라 독립적인 방법을 찾아야 합니다. # ansible 사실로 시작할 수 있지만 이상적으로는 Vault 또는 이와 동등한 것이 좋습니다. - 실행합니다: 이름: vManage 외부 IP를 셸 변수 VMANAGE\_EXTERNAL\_IP로 내보내기 command: export VMANAGE\_EXTERNAL\_IP=$(jq -r '.outputs.vmanages\_vmanageEth0EIP.value[0]' terraform-sdwan/aws/Provision\_Instances/terraform.tfstate.d/aws\_control/terraform.tfstate) && echo $VMANAGE\_EXTERNAL\_IP - 실행합니다: name: 실패로 인한 정리 명령: cd bin && ./play.sh -v /ansible/day\_0/clean-edges.yml --limit 'all:!cedge-azure'; ./play.sh -v /ansible/day\_0/clean-control-plane.yml 때: 켜기\_실패 - unless: 조건: 같음: [ 0, << pipeline.parameters.wait-for-external-pipeline >> ] ] steps: - run: name: 외부 파이프라인 트리거 명령을 트리거합니다: | curl -X POST https://circleci.com/api/v2/project/gh/$EXTERNAL\_PIPELINE\_REPOUSER/$EXTERNAL\_PIPELINE\_REPONAME/pipeline \ -H "Circle-Token: $CIRCLE\_TOKEN" -H "Content-Type: application/json" \ -d "{\"branch\":\"$EXTERNAL\_PIPELINE\_BRANCH\",\"parameters\":{\"vmanage\_host\":\"$VMANAGE\_EXTERNAL\_IP\"}}}" # 또 다른 해킹, 적절한 파이프라인 간 통신이 필요합니다(또는 단일 파이프라인). - 실행합니다: name: 외부 파이프라인이 실행되기를 기다리는 중입니다. command: sleep << pipeline.parameters.wait-for-external-pipeline >> - 언제 조건: << pipeline.parameters.remove-deployment >> steps: - run: name: 엣지 디바이스 배포 제거(VM 및 네트워크) 명령: cd bin && ./play.sh -v /ansible/day\_0/clean-edges.yml --limit 'all:!cedge-azure' - run: name: 컨트롤 플레인 배포 제거(VM 및 네트워크) 명령: cd bin && ./play.sh -v /ansible/day\_0/clean-control-plane.yml워크플로: "SD-WAN 배포": jobs: - "루트 CA 생성" - "SD-WAN 배포": 필요: - "루트 CA 만들기"