417 lines
16 KiB
YAML
417 lines
16 KiB
YAML
|
apiVersion: argoproj.io/v1alpha1
|
||
|
|
kind: WorkflowTemplate
|
||
|
|
metadata:
|
||
|
|
name: lazaret-delivery
|
||
|
|
namespace: project-delivery
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: project-delivery
|
||
|
|
app.kubernetes.io/instance: lazaret
|
||
|
|
spec:
|
||
|
|
entrypoint: workflow
|
||
|
|
serviceAccountName: project-delivery-executor
|
||
|
|
automountServiceAccountToken: false
|
||
|
|
executor:
|
||
|
|
serviceAccountName: project-delivery-executor
|
||
|
|
parallelism: 4
|
||
|
|
podGC:
|
||
|
|
strategy: OnWorkflowCompletion
|
||
|
|
podMetadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: project-delivery
|
||
|
|
delivery.quorate.dev/project: lazaret
|
||
|
|
podSpecPatch: |
|
||
|
|
dnsConfig:
|
||
|
|
options:
|
||
|
|
- name: ndots
|
||
|
|
value: "1"
|
||
|
|
containers:
|
||
|
|
- name: wait
|
||
|
|
volumeMounts:
|
||
|
|
- name: exec-sa-token
|
||
|
|
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||
|
|
readOnly: true
|
||
|
|
volumes:
|
||
|
|
- name: exec-sa-token
|
||
|
|
secret: null
|
||
|
|
projected:
|
||
|
|
defaultMode: 0440
|
||
|
|
sources:
|
||
|
|
- serviceAccountToken:
|
||
|
|
expirationSeconds: 3600
|
||
|
|
path: token
|
||
|
|
- configMap:
|
||
|
|
name: kube-root-ca.crt
|
||
|
|
items:
|
||
|
|
- key: ca.crt
|
||
|
|
path: ca.crt
|
||
|
|
- downwardAPI:
|
||
|
|
items:
|
||
|
|
- path: namespace
|
||
|
|
fieldRef:
|
||
|
|
apiVersion: v1
|
||
|
|
fieldPath: metadata.namespace
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: source-repository
|
||
|
|
- name: source-ref
|
||
|
|
- name: source-revision
|
||
|
|
- name: targets
|
||
|
|
- name: build-kind
|
||
|
|
value: release
|
||
|
|
templates:
|
||
|
|
- name: workflow
|
||
|
|
steps:
|
||
|
|
- - name: initialize-workspace
|
||
|
|
template: initialize-workspace
|
||
|
|
- - name: delivery
|
||
|
|
template: delivery
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
value: "{{steps.initialize-workspace.outputs.parameters.working-pvc}}"
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: delivery-result
|
||
|
|
valueFrom:
|
||
|
|
parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"
|
||
|
|
|
||
|
|
- name: initialize-workspace
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-workspace-init
|
||
|
|
container:
|
||
|
|
image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||
|
|
command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||
|
|
args: [/orchestration/initialize.fsx]
|
||
|
|
env:
|
||
|
|
- name: POD_NAME
|
||
|
|
valueFrom:
|
||
|
|
fieldRef:
|
||
|
|
apiVersion: v1
|
||
|
|
fieldPath: metadata.name
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 100m, memory: 64Mi}
|
||
|
|
limits: {memory: 256Mi}
|
||
|
|
securityContext: &restricted
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace}
|
||
|
|
- {name: temporary, mountPath: /tmp}
|
||
|
|
volumes:
|
||
|
|
- &orchestration {name: orchestration, configMap: {name: lazaret-delivery-orch, defaultMode: 0444}}
|
||
|
|
- {name: temporary, emptyDir: {}}
|
||
|
|
- name: workspace
|
||
|
|
ephemeral:
|
||
|
|
volumeClaimTemplate:
|
||
|
|
spec:
|
||
|
|
accessModes: [ReadWriteOnce]
|
||
|
|
storageClassName: openebs-hostpath-ssd
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
storage: 30Gi
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
valueFrom: {path: /workspace/.claim-name}
|
||
|
|
|
||
|
|
- name: delivery
|
||
|
|
inputs:
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
dag:
|
||
|
|
tasks:
|
||
|
|
- name: tools
|
||
|
|
template: tools
|
||
|
|
arguments: &working-pvc-argument
|
||
|
|
parameters:
|
||
|
|
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||
|
|
- name: source
|
||
|
|
dependencies: [tools]
|
||
|
|
template: source
|
||
|
|
arguments: *working-pvc-argument
|
||
|
|
- name: upstream
|
||
|
|
template: upstream
|
||
|
|
arguments: *working-pvc-argument
|
||
|
|
- name: cache-pull
|
||
|
|
template: cache-pull
|
||
|
|
arguments: *working-pvc-argument
|
||
|
|
- name: lazaret-build
|
||
|
|
dependencies: [source, upstream, cache-pull]
|
||
|
|
template: lazaret-build
|
||
|
|
arguments: *working-pvc-argument
|
||
|
|
- name: runsc-build
|
||
|
|
dependencies: [upstream, cache-pull]
|
||
|
|
template: runsc-build
|
||
|
|
arguments: *working-pvc-argument
|
||
|
|
- name: publish
|
||
|
|
dependencies: [lazaret-build, runsc-build]
|
||
|
|
template: publish
|
||
|
|
arguments: *working-pvc-argument
|
||
|
|
- name: cache-export
|
||
|
|
dependencies: [lazaret-build, runsc-build]
|
||
|
|
template: cache-export
|
||
|
|
continueOn:
|
||
|
|
failed: true
|
||
|
|
error: true
|
||
|
|
arguments: *working-pvc-argument
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: delivery-result
|
||
|
|
valueFrom:
|
||
|
|
parameter: "{{tasks.publish.outputs.parameters.delivery-result}}"
|
||
|
|
|
||
|
|
- name: source
|
||
|
|
inputs: &working-pvc-input
|
||
|
|
parameters:
|
||
|
|
- name: working-pvc
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-source
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/source.fsx]
|
||
|
|
env:
|
||
|
|
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||
|
|
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 100m, memory: 128Mi}
|
||
|
|
limits: {memory: 512Mi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /tools, subPath: tools, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /source, subPath: source}
|
||
|
|
- {name: workspace, mountPath: /tmp, subPath: source-tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- &workspace
|
||
|
|
name: workspace
|
||
|
|
persistentVolumeClaim:
|
||
|
|
claimName: "{{inputs.parameters.working-pvc}}"
|
||
|
|
|
||
|
|
- name: tools
|
||
|
|
inputs: *working-pvc-input
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-upstream
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/tools.fsx]
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 100m, memory: 128Mi}
|
||
|
|
limits: {cpu: "1", memory: 1Gi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace, subPath: tools}
|
||
|
|
- {name: temporary, mountPath: /tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- *workspace
|
||
|
|
- {name: temporary, emptyDir: {}}
|
||
|
|
|
||
|
|
- name: upstream
|
||
|
|
inputs: *working-pvc-input
|
||
|
|
podSpecPatch: |
|
||
|
|
runtimeClassName: gvisor
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-upstream
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/dependencies.fsx]
|
||
|
|
env:
|
||
|
|
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: "2", memory: 2Gi}
|
||
|
|
limits: {memory: 12Gi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: build-inputs, mountPath: /build-inputs, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /source, subPath: source, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/toolchain, subPath: toolchain}
|
||
|
|
- {name: workspace, mountPath: /workspace/state, subPath: state/runsc}
|
||
|
|
- {name: workspace, mountPath: /tmp, subPath: output/upstream-tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- *workspace
|
||
|
|
- {name: build-inputs, configMap: {name: lazaret-build-inputs, defaultMode: 0444}}
|
||
|
|
|
||
|
|
- name: cache-pull
|
||
|
|
inputs: *working-pvc-input
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-cache-pull
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/cache.fsx]
|
||
|
|
env:
|
||
|
|
- {name: CACHE_ACTION, value: pull}
|
||
|
|
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||
|
|
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: "2", memory: 1Gi}
|
||
|
|
limits: {memory: 4Gi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||
|
|
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||
|
|
- {name: build-inputs, mountPath: /build-inputs, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /source, subPath: source}
|
||
|
|
- {name: workspace, mountPath: /toolchain, subPath: toolchain}
|
||
|
|
- {name: workspace, mountPath: /state, subPath: state}
|
||
|
|
- {name: workspace, mountPath: /plan, subPath: state}
|
||
|
|
- {name: workspace, mountPath: /tmp, subPath: state/cache-tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- *workspace
|
||
|
|
- {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
|
||
|
|
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||
|
|
- {name: build-inputs, configMap: {name: lazaret-build-inputs, defaultMode: 0444}}
|
||
|
|
|
||
|
|
- name: lazaret-build
|
||
|
|
inputs: *working-pvc-input
|
||
|
|
podSpecPatch: |
|
||
|
|
runtimeClassName: gvisor
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-build
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/build-lazaret.fsx]
|
||
|
|
env:
|
||
|
|
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||
|
|
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: "6", memory: 8Gi}
|
||
|
|
limits: {memory: 24Gi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /bin/sh, subPath: toolchain/environment/usr/bin/busybox, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/source, subPath: source/repository, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/source/.lazaret/vendor/fuser-0.17.0, subPath: toolchain/cargo/fuser-0.17.0, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/environment, subPath: toolchain/environment, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/cargo, subPath: toolchain/cargo, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/state, subPath: state/lazaret}
|
||
|
|
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/output, subPath: output/lazaret}
|
||
|
|
- {name: workspace, mountPath: /tmp, subPath: output/lazaret-tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- *workspace
|
||
|
|
|
||
|
|
- name: runsc-build
|
||
|
|
inputs: *working-pvc-input
|
||
|
|
podSpecPatch: |
|
||
|
|
runtimeClassName: gvisor
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-runsc-build
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/build-runsc.fsx]
|
||
|
|
env:
|
||
|
|
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||
|
|
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: "6", memory: 8Gi}
|
||
|
|
limits: {memory: 24Gi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /bin, subPath: toolchain/environment/usr/bin, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /usr/bin, subPath: toolchain/environment/usr/bin, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /usr/include, subPath: toolchain/environment/usr/include, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /usr/lib, subPath: toolchain/environment/usr/lib, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/environment, subPath: toolchain/environment, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/toolchain/gvisor, subPath: toolchain/gvisor}
|
||
|
|
- {name: workspace, mountPath: /workspace/state, subPath: state/runsc}
|
||
|
|
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /workspace/output, subPath: output/runsc}
|
||
|
|
- {name: workspace, mountPath: /tmp, subPath: output/runsc-tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- *workspace
|
||
|
|
|
||
|
|
- name: publish
|
||
|
|
inputs: *working-pvc-input
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-publication
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/push.fsx]
|
||
|
|
env:
|
||
|
|
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||
|
|
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||
|
|
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 250m, memory: 256Mi}
|
||
|
|
limits: {memory: 1Gi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: publisher-auth, mountPath: /publisher-auth, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /handoff/lazaret, subPath: output/lazaret, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /handoff/runsc, subPath: output/runsc, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /result, subPath: output/result}
|
||
|
|
- {name: workspace, mountPath: /tmp, subPath: output/publish-tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- *workspace
|
||
|
|
- {name: publisher-auth, secret: {secretName: lazaret-publisher, defaultMode: 0440}}
|
||
|
|
outputs:
|
||
|
|
parameters:
|
||
|
|
- name: delivery-result
|
||
|
|
valueFrom: {path: /result/delivery-result}
|
||
|
|
|
||
|
|
- name: cache-export
|
||
|
|
inputs: *working-pvc-input
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
delivery.quorate.dev/stage: lazaret-cache-export
|
||
|
|
container:
|
||
|
|
image: *runner
|
||
|
|
command: *fsi
|
||
|
|
args: [/orchestration/cache.fsx]
|
||
|
|
env:
|
||
|
|
- {name: CACHE_ACTION, value: export}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: "4", memory: 2Gi}
|
||
|
|
limits: {memory: 8Gi}
|
||
|
|
securityContext: *restricted
|
||
|
|
volumeMounts:
|
||
|
|
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||
|
|
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||
|
|
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /state, subPath: state, readOnly: true}
|
||
|
|
- {name: workspace, mountPath: /tmp, subPath: exports/cache-tmp}
|
||
|
|
volumes:
|
||
|
|
- *orchestration
|
||
|
|
- *workspace
|
||
|
|
- {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
|
||
|
|
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|