524 lines
14 KiB
YAML
524 lines
14 KiB
YAML
|
apiVersion: argoproj.io/v1alpha1
|
||
|
|
kind: WorkflowTemplate
|
||
|
|
metadata:
|
||
|
|
name: rcon-delivery
|
||
|
|
namespace: project-delivery
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: project-delivery
|
||
|
|
app.kubernetes.io/instance: grafana-rcon
|
||
|
|
spec:
|
||
|
|
entrypoint: workflow
|
||
|
|
serviceAccountName: project-delivery-executor
|
||
|
|
automountServiceAccountToken: false
|
||
|
|
executor:
|
||
|
|
serviceAccountName: project-delivery-executor
|
||
|
|
parallelism: 2
|
||
|
|
podGC:
|
||
|
|
strategy: OnWorkflowCompletion
|
||
|
|
podMetadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: project-delivery
|
||
|
|
delivery.quorate.dev/project: grafana-rcon
|
||
|
|
podSpecPatch: |
|
||
|
|
dnsConfig:
|
||
|
|
options:
|
||
|
|
- name: ndots
|
||
|
|
value: "1"
|
||
|
|
containers:
|
||
|
|
- name: wait
|
||
|
|
volumeMounts:
|
||
|
|
- name: exec-sa-token
|
||
|
|
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||
|
|
readOnly: true
|
||
|
|
volumes:
|
||
|
|
- name: exec-sa-token
|
||
|
|
secret: null
|
||
|
|
projected:
|
||
|
|
defaultMode: 0440
|
||
|
|
sources:
|
||
|
|
- serviceAccountToken:
|
||
|
|
expirationSeconds: 1800
|
||
|
|
path: token
|
||
|
|
- configMap:
|
||
|
|
name: kube-root-ca.crt
|
||
|
|
items:
|
||
|
|
- key: ca.crt
|
||
|
|
path: ca.crt
|
||
|
|
- downwardAPI:
|
||
|
|
items:
|
||
|
|
- path: namespace
|
||
|
|
fieldRef:
|
||
|
|
apiVersion: v1
|
||
|
|
fieldPath: metadata.namespace
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: source-repository
|
||
|
|
- name: source-ref
|
||
|
|
- name: source-revision
|
||
|
|
- name: targets
|
||
|
|
templates:
|
||
|
|
- name: workflow
|
||
|
|
steps:
|
||
|
|
- - name: initialize
|
||
|
|
template: initialize
|
||
|
|
- - name: delivery
|
||
|
|
template: delivery
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: '{{steps.initialize.outputs.parameters.working-pvc}}'
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: delivery-result
|
||
|
|
valueFrom:
|
||
|
|
parameter: '{{steps.delivery.outputs.parameters.delivery-result}}'
|
||
|
|
- name: initialize
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: rcon-init
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: &fsi
|
||
|
|
- /usr/share/dotnet/dotnet
|
||
|
|
- /opt/fsi/fsi.dll
|
||
|
|
- --exec
|
||
|
|
args:
|
||
|
|
- /orchestration/initialize.fsx
|
||
|
|
env:
|
||
|
|
- name: POD_NAME
|
||
|
|
valueFrom:
|
||
|
|
fieldRef:
|
||
|
|
apiVersion: v1
|
||
|
|
fieldPath: metadata.name
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 100m
|
||
|
|
memory: 64Mi
|
||
|
|
limits:
|
||
|
|
cpu: 500m
|
||
|
|
memory: 256Mi
|
||
|
|
securityContext: &restricted
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities:
|
||
|
|
drop:
|
||
|
|
- ALL
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- name: orchestration
|
||
|
|
mountPath: /orchestration
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /workspace
|
||
|
|
- name: temporary
|
||
|
|
mountPath: /tmp
|
||
|
|
volumes:
|
||
|
|
- name: orchestration
|
||
|
|
configMap:
|
||
|
|
name: rcon-orch
|
||
|
|
defaultMode: 0444
|
||
|
|
- name: temporary
|
||
|
|
emptyDir: {}
|
||
|
|
- name: workflow-workspace
|
||
|
|
ephemeral:
|
||
|
|
volumeClaimTemplate:
|
||
|
|
spec:
|
||
|
|
accessModes:
|
||
|
|
- ReadWriteOnce
|
||
|
|
storageClassName: openebs-hostpath-ssd
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
storage: 15Gi
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
valueFrom:
|
||
|
|
path: /workspace/.claim-name
|
||
|
|
- name: delivery
|
||
|
|
inputs:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
dag:
|
||
|
|
tasks:
|
||
|
|
- name: source-pull
|
||
|
|
template: source-pull
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: '{{inputs.parameters.working-pvc}}'
|
||
|
|
- name: cache-pull
|
||
|
|
dependencies:
|
||
|
|
- source-pull
|
||
|
|
template: cache-pull
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: '{{inputs.parameters.working-pvc}}'
|
||
|
|
- name: toolchain-pull
|
||
|
|
dependencies:
|
||
|
|
- cache-pull
|
||
|
|
template: toolchain-pull
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: '{{inputs.parameters.working-pvc}}'
|
||
|
|
- name: build
|
||
|
|
dependencies:
|
||
|
|
- toolchain-pull
|
||
|
|
template: build
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: '{{inputs.parameters.working-pvc}}'
|
||
|
|
- name: publish
|
||
|
|
dependencies:
|
||
|
|
- build
|
||
|
|
template: publish
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: '{{inputs.parameters.working-pvc}}'
|
||
|
|
- name: cache-export
|
||
|
|
dependencies:
|
||
|
|
- build
|
||
|
|
template: cache-export
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: '{{inputs.parameters.working-pvc}}'
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: delivery-result
|
||
|
|
valueFrom:
|
||
|
|
parameter: '{{tasks.publish.outputs.parameters.delivery-result}}'
|
||
|
|
- name: source-pull
|
||
|
|
inputs: &workspace
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: go-oci-source
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: *fsi
|
||
|
|
args:
|
||
|
|
- /orchestration/source.fsx
|
||
|
|
env:
|
||
|
|
- name: SOURCE_REPOSITORY
|
||
|
|
value: '{{workflow.parameters.source-repository}}'
|
||
|
|
- name: SOURCE_REVISION
|
||
|
|
value: '{{workflow.parameters.source-revision}}'
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 100m
|
||
|
|
memory: 128Mi
|
||
|
|
limits:
|
||
|
|
cpu: '1'
|
||
|
|
memory: 512Mi
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- name: orchestration
|
||
|
|
mountPath: /orchestration
|
||
|
|
readOnly: true
|
||
|
|
- name: source-auth
|
||
|
|
mountPath: /source-auth
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /source
|
||
|
|
subPath: source
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /tmp
|
||
|
|
subPath: source/tmp
|
||
|
|
volumes:
|
||
|
|
- name: orchestration
|
||
|
|
configMap:
|
||
|
|
name: rcon-orch
|
||
|
|
defaultMode: 0444
|
||
|
|
- name: source-auth
|
||
|
|
secret:
|
||
|
|
secretName: quorate-pull
|
||
|
|
defaultMode: 0440
|
||
|
|
- &claim
|
||
|
|
name: workflow-workspace
|
||
|
|
persistentVolumeClaim:
|
||
|
|
claimName: '{{inputs.parameters.working-pvc}}'
|
||
|
|
- name: cache-pull
|
||
|
|
inputs: *workspace
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: rcon-cache-pull
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: *fsi
|
||
|
|
args:
|
||
|
|
- /orchestration/cache.fsx
|
||
|
|
env:
|
||
|
|
- name: CACHE_ACTION
|
||
|
|
value: pull
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 500m
|
||
|
|
memory: 256Mi
|
||
|
|
limits:
|
||
|
|
cpu: '2'
|
||
|
|
memory: 1Gi
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- name: orchestration
|
||
|
|
mountPath: /orchestration
|
||
|
|
readOnly: true
|
||
|
|
- name: cache-auth
|
||
|
|
mountPath: /cache-auth
|
||
|
|
readOnly: true
|
||
|
|
- name: cache-ca
|
||
|
|
mountPath: /cache-ca
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /source
|
||
|
|
subPath: source
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /toolchain
|
||
|
|
subPath: toolchain
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /state
|
||
|
|
subPath: state
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /tmp
|
||
|
|
subPath: state/cache-tmp
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /output
|
||
|
|
subPath: output
|
||
|
|
volumes:
|
||
|
|
- name: orchestration
|
||
|
|
configMap:
|
||
|
|
name: rcon-orch
|
||
|
|
defaultMode: 0444
|
||
|
|
- name: cache-auth
|
||
|
|
secret:
|
||
|
|
secretName: project-delivery-cache-reader
|
||
|
|
defaultMode: 0440
|
||
|
|
- name: cache-ca
|
||
|
|
secret:
|
||
|
|
secretName: quay-internal-ca
|
||
|
|
defaultMode: 0440
|
||
|
|
- *claim
|
||
|
|
- name: toolchain-pull
|
||
|
|
inputs: *workspace
|
||
|
|
podSpecPatch: |
|
||
|
|
runtimeClassName: gvisor
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: rcon-tools
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: *fsi
|
||
|
|
args:
|
||
|
|
- /orchestration/tools.fsx
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: '1'
|
||
|
|
memory: 512Mi
|
||
|
|
limits:
|
||
|
|
cpu: '4'
|
||
|
|
memory: 2Gi
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- name: orchestration
|
||
|
|
mountPath: /orchestration
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /source
|
||
|
|
subPath: source
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /toolchain
|
||
|
|
subPath: toolchain
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /state
|
||
|
|
subPath: state
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /tmp
|
||
|
|
subPath: state/toolchain-tmp
|
||
|
|
volumes:
|
||
|
|
- name: orchestration
|
||
|
|
configMap:
|
||
|
|
name: rcon-orch
|
||
|
|
defaultMode: 0444
|
||
|
|
- *claim
|
||
|
|
- name: build
|
||
|
|
inputs: *workspace
|
||
|
|
podSpecPatch: |
|
||
|
|
runtimeClassName: gvisor
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: rcon-build
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: *fsi
|
||
|
|
args:
|
||
|
|
- /orchestration/build.fsx
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: '2'
|
||
|
|
memory: 1Gi
|
||
|
|
limits:
|
||
|
|
cpu: '6'
|
||
|
|
memory: 4Gi
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- name: orchestration
|
||
|
|
mountPath: /orchestration
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /source
|
||
|
|
subPath: source
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /toolchain
|
||
|
|
subPath: toolchain
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /output
|
||
|
|
subPath: output
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /tmp
|
||
|
|
subPath: output/tmp
|
||
|
|
volumes:
|
||
|
|
- name: orchestration
|
||
|
|
configMap:
|
||
|
|
name: rcon-orch
|
||
|
|
defaultMode: 0444
|
||
|
|
- *claim
|
||
|
|
- name: publish
|
||
|
|
inputs: *workspace
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: rcon-publish
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: *fsi
|
||
|
|
args:
|
||
|
|
- /orchestration/publish.fsx
|
||
|
|
env:
|
||
|
|
- name: SOURCE_REVISION
|
||
|
|
value: '{{workflow.parameters.source-revision}}'
|
||
|
|
- name: TARGETS
|
||
|
|
value: '{{workflow.parameters.targets}}'
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 250m
|
||
|
|
memory: 256Mi
|
||
|
|
limits:
|
||
|
|
cpu: '2'
|
||
|
|
memory: 1Gi
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- name: orchestration
|
||
|
|
mountPath: /orchestration
|
||
|
|
readOnly: true
|
||
|
|
- name: publisher-auth
|
||
|
|
mountPath: /publisher-auth
|
||
|
|
readOnly: true
|
||
|
|
- name: publisher-ca
|
||
|
|
mountPath: /publisher-ca
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /handoff
|
||
|
|
subPath: output
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /result
|
||
|
|
subPath: output/result
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /tmp
|
||
|
|
subPath: output/publish-tmp
|
||
|
|
volumes:
|
||
|
|
- name: orchestration
|
||
|
|
configMap:
|
||
|
|
name: rcon-orch
|
||
|
|
defaultMode: 0444
|
||
|
|
- name: publisher-auth
|
||
|
|
secret:
|
||
|
|
secretName: rcon-publisher
|
||
|
|
defaultMode: 0440
|
||
|
|
- name: publisher-ca
|
||
|
|
secret:
|
||
|
|
secretName: quay-internal-ca
|
||
|
|
defaultMode: 0440
|
||
|
|
- *claim
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: delivery-result
|
||
|
|
valueFrom:
|
||
|
|
path: /result/delivery-result
|
||
|
|
- name: cache-export
|
||
|
|
inputs: *workspace
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: rcon-cache-export
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: *fsi
|
||
|
|
args:
|
||
|
|
- /orchestration/cache.fsx
|
||
|
|
env:
|
||
|
|
- name: CACHE_ACTION
|
||
|
|
value: export
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: '1'
|
||
|
|
memory: 512Mi
|
||
|
|
limits:
|
||
|
|
cpu: '3'
|
||
|
|
memory: 2Gi
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- name: orchestration
|
||
|
|
mountPath: /orchestration
|
||
|
|
readOnly: true
|
||
|
|
- name: cache-auth
|
||
|
|
mountPath: /cache-auth
|
||
|
|
readOnly: true
|
||
|
|
- name: cache-ca
|
||
|
|
mountPath: /cache-ca
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /source
|
||
|
|
subPath: source
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /toolchain
|
||
|
|
subPath: toolchain
|
||
|
|
readOnly: true
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /tmp
|
||
|
|
subPath: output/cache-tmp
|
||
|
|
- name: workflow-workspace
|
||
|
|
mountPath: /output
|
||
|
|
subPath: output
|
||
|
|
readOnly: true
|
||
|
|
volumes:
|
||
|
|
- name: orchestration
|
||
|
|
configMap:
|
||
|
|
name: rcon-orch
|
||
|
|
defaultMode: 0444
|
||
|
|
- name: cache-auth
|
||
|
|
secret:
|
||
|
|
secretName: project-delivery-cache-writer
|
||
|
|
defaultMode: 0440
|
||
|
|
- name: cache-ca
|
||
|
|
secret:
|
||
|
|
secretName: quay-internal-ca
|
||
|
|
defaultMode: 0440
|
||
|
|
- *claim
|
||
|
|
imagePullSecrets:
|
||
|
|
- name: quay-reader
|