quorate/services/project-delivery/k8s/workflows/ostension/plugin.yaml

apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: ostension-pkg-build
  namespace: project-delivery
  labels:
    app.kubernetes.io/name: project-delivery
    app.kubernetes.io/instance: ostension
spec:
  entrypoint: workflow
  serviceAccountName: project-delivery-executor
  automountServiceAccountToken: false
  executor:
    serviceAccountName: project-delivery-executor
  parallelism: 2
  podGC:
    strategy: OnWorkflowCompletion
  podMetadata:
    labels:
      app.kubernetes.io/name: project-delivery
      delivery.quorate.dev/project: ostension
  podSpecPatch: |
    dnsConfig:
      options:
      - name: ndots
        value: '1'
    containers:
    - name: wait
      volumeMounts:
      - name: exec-sa-token
        mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        readOnly: true
    volumes:
    - name: exec-sa-token
      secret: null
      projected:
        defaultMode: 288
        sources:
        - serviceAccountToken:
            expirationSeconds: 1800
            path: token
        - configMap:
            name: kube-root-ca.crt
            items:
            - key: ca.crt
              path: ca.crt
        - downwardAPI:
            items:
            - path: namespace
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile:
      type: RuntimeDefault
  arguments:
    parameters:
    - name: source-repository
    - name: source-ref
    - name: source-revision
    - name: targets
  templates:
  - name: workflow
    steps:
    - - name: initialize
        template: initialize
    - - name: delivery
        template: delivery
        arguments:
          parameters:
          - name: working-pvc
            value: '{{steps.initialize.outputs.parameters.working-pvc}}'
    outputs:
      parameters:
      - name: delivery-result
        valueFrom:
          parameter: '{{steps.delivery.outputs.parameters.delivery-result}}'
  - name: initialize
    metadata:
      labels:
        delivery.quorate.dev/stage: go-oci-init
    container:
      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
      command: &fsi
      - /usr/share/dotnet/dotnet
      - /opt/fsi/fsi.dll
      - --exec
      args:
      - /orchestration/initialize.fsx
      env:
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      resources:
        requests:
          cpu: 100m
          memory: 64Mi
        limits:
          cpu: 500m
          memory: 256Mi
      securityContext: &restricted
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
      volumeMounts:
      - name: orchestration
        mountPath: /orchestration
        readOnly: true
      - name: workflow-workspace
        mountPath: /workspace
      - name: temporary
        mountPath: /tmp
    volumes:
    - name: orchestration
      configMap:
        name: ostension-pkg-orch
        defaultMode: 292
    - name: temporary
      emptyDir: {}
    - name: workflow-workspace
      ephemeral:
        volumeClaimTemplate:
          spec:
            accessModes:
            - ReadWriteOnce
            storageClassName: openebs-hostpath-ssd
            resources:
              requests:
                storage: 5Gi
    outputs:
      parameters:
      - name: working-pvc
        valueFrom:
          path: /workspace/.claim-name
  - name: delivery
    inputs:
      parameters:
      - name: working-pvc
    dag:
      tasks:
      - name: source-pull
        template: source-pull
        arguments:
          parameters:
          - name: working-pvc
            value: '{{inputs.parameters.working-pvc}}'
      - name: cache-pull
        dependencies:
        - source-pull
        template: cache-pull
        arguments:
          parameters:
          - name: working-pvc
            value: '{{inputs.parameters.working-pvc}}'
      - name: toolchain-pull
        dependencies:
        - cache-pull
        template: toolchain-pull
        arguments:
          parameters:
          - name: working-pvc
            value: '{{inputs.parameters.working-pvc}}'
      - name: build
        dependencies:
        - cache-pull
        - toolchain-pull
        template: build
        arguments:
          parameters:
          - name: working-pvc
            value: '{{inputs.parameters.working-pvc}}'
      - name: plugin-publish
        dependencies:
        - build
        template: plugin-publish
        arguments:
          parameters:
          - name: working-pvc
            value: '{{inputs.parameters.working-pvc}}'
      - name: cache-export
        dependencies:
        - build
        template: cache-export
        continueOn:
          failed: true
          error: true
        arguments:
          parameters:
          - name: working-pvc
            value: '{{inputs.parameters.working-pvc}}'
    outputs:
      parameters:
      - name: delivery-result
        valueFrom:
          parameter: '{{tasks.plugin-publish.outputs.parameters.delivery-result}}'
  - name: source-pull
    inputs: &working-pvc-input
      parameters:
      - name: working-pvc
    metadata:
      labels:
        delivery.quorate.dev/stage: ostension-source
    container:
      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
      command: *fsi
      args:
      - /orchestration/source.fsx
      env:
      - name: SOURCE_REPOSITORY
        value: '{{workflow.parameters.source-repository}}'
      - name: SOURCE_REVISION
        value: '{{workflow.parameters.source-revision}}'
      - name: TARGETS
        value: '{{workflow.parameters.targets}}'
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: '1'
          memory: 512Mi
      securityContext: *restricted
      volumeMounts:
      - name: orchestration
        mountPath: /orchestration
        readOnly: true
      - name: workflow-workspace
        mountPath: /source
        subPath: source
      - name: workflow-workspace
        mountPath: /tmp
        subPath: source/tmp
    volumes:
    - name: orchestration
      configMap:
        name: ostension-pkg-orch
        defaultMode: 292
    - &workflow-workspace
      name: workflow-workspace
      persistentVolumeClaim:
        claimName: '{{inputs.parameters.working-pvc}}'
  - name: cache-pull
    inputs: *working-pvc-input
    metadata:
      labels:
        delivery.quorate.dev/stage: go-oci-cache-pull
    container:
      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
      command: *fsi
      args:
      - /orchestration/cache.fsx
      env:
      - name: CACHE_ACTION
        value: pull
      - name: TARGETS
        value: '{{workflow.parameters.targets}}'
      resources:
        requests:
          cpu: 500m
          memory: 256Mi
        limits:
          cpu: '2'
          memory: 1Gi
      securityContext: *restricted
      volumeMounts:
      - name: orchestration
        mountPath: /orchestration
        readOnly: true
      - name: cache-auth
        mountPath: /cache-auth
        readOnly: true
      - name: cache-ca
        mountPath: /cache-ca
        readOnly: true
      - name: workflow-workspace
        mountPath: /toolchain
        subPath: toolchain
      - name: workflow-workspace
        mountPath: /state
        subPath: state
      - name: workflow-workspace
        mountPath: /tmp
        subPath: state/cache-tmp
    volumes:
    - name: orchestration
      configMap:
        name: ostension-pkg-orch
        defaultMode: 292
    - name: cache-auth
      secret:
        secretName: project-delivery-cache-reader
        defaultMode: 288
    - name: cache-ca
      secret:
        secretName: quay-internal-ca
        defaultMode: 288
    - *workflow-workspace
  - name: toolchain-pull
    inputs: *working-pvc-input
    podSpecPatch: |
      runtimeClassName: gvisor
    metadata:
      labels:
        delivery.quorate.dev/stage: ostension-pkg-tools
    container:
      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
      command: *fsi
      args:
      - /orchestration/toolchain.fsx
      env:
      - name: TARGETS
        value: '{{workflow.parameters.targets}}'
      resources:
        requests:
          cpu: '1'
          memory: 512Mi
        limits:
          cpu: '4'
          memory: 2Gi
      securityContext: *restricted
      volumeMounts:
      - name: orchestration
        mountPath: /orchestration
        readOnly: true
      - name: workflow-workspace
        mountPath: /toolchain
        subPath: toolchain
      - name: workflow-workspace
        mountPath: /state
        subPath: state
        readOnly: true
      - name: workflow-workspace
        mountPath: /tmp
        subPath: state/toolchain-tmp
    volumes:
    - name: orchestration
      configMap:
        name: ostension-pkg-orch
        defaultMode: 292
    - *workflow-workspace
  - name: build
    inputs: *working-pvc-input
    podSpecPatch: |
      runtimeClassName: gvisor
    metadata:
      labels:
        delivery.quorate.dev/stage: ostension-pkg-build
    container:
      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
      command: *fsi
      args:
      - /orchestration/build.fsx
      env:
      - name: SOURCE_REVISION
        value: '{{workflow.parameters.source-revision}}'
      - name: TARGETS
        value: '{{workflow.parameters.targets}}'
      resources:
        requests:
          cpu: 500m
          memory: 256Mi
        limits:
          cpu: '2'
          memory: 1Gi
      securityContext: *restricted
      volumeMounts:
      - name: orchestration
        mountPath: /orchestration
        readOnly: true
      - name: workflow-workspace
        mountPath: /source
        subPath: source
        readOnly: true
      - name: workflow-workspace
        mountPath: /toolchain
        subPath: toolchain
        readOnly: true
      - name: workflow-workspace
        mountPath: /output
        subPath: output
      - name: workflow-workspace
        mountPath: /tmp
        subPath: output/tmp
    volumes:
    - name: orchestration
      configMap:
        name: ostension-pkg-orch
        defaultMode: 292
    - *workflow-workspace
  - name: plugin-publish
    inputs: *working-pvc-input
    metadata:
      labels:
        delivery.quorate.dev/stage: ostension-release
    container:
      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
      command: *fsi
      args:
      - /orchestration/release.fsx
      env:
      - name: SOURCE_REVISION
        value: '{{workflow.parameters.source-revision}}'
      - name: SOURCE_REPOSITORY
        value: '{{workflow.parameters.source-repository}}'
      - name: TARGETS
        value: '{{workflow.parameters.targets}}'
      resources:
        requests:
          cpu: 250m
          memory: 256Mi
        limits:
          cpu: '2'
          memory: 1Gi
      securityContext: *restricted
      volumeMounts:
      - name: orchestration
        mountPath: /orchestration
        readOnly: true
      - name: publisher-auth
        mountPath: /publisher-auth
        readOnly: true
      - name: workflow-workspace
        mountPath: /handoff/plugin
        subPath: output/plugin
        readOnly: true
      - name: workflow-workspace
        mountPath: /result
        subPath: output/plugin-result
      - name: workflow-workspace
        mountPath: /tmp
        subPath: output/plugin-tmp
    volumes:
    - name: orchestration
      configMap:
        name: ostension-pkg-orch
        defaultMode: 292
    - name: publisher-auth
      secret:
        secretName: ostension-publisher
        defaultMode: 288
    - *workflow-workspace
    outputs:
      parameters:
      - name: delivery-result
        valueFrom:
          path: /result/delivery-result
  - name: cache-export
    inputs: *working-pvc-input
    metadata:
      labels:
        delivery.quorate.dev/stage: go-oci-cache-export
    container:
      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
      command: *fsi
      args:
      - /orchestration/cache.fsx
      env:
      - name: CACHE_ACTION
        value: export
      - name: TARGETS
        value: '{{workflow.parameters.targets}}'
      resources:
        requests:
          cpu: '1'
          memory: 512Mi
        limits:
          cpu: '3'
          memory: 2Gi
      securityContext: *restricted
      volumeMounts:
      - name: orchestration
        mountPath: /orchestration
        readOnly: true
      - name: cache-auth
        mountPath: /cache-auth
        readOnly: true
      - name: cache-ca
        mountPath: /cache-ca
        readOnly: true
      - name: workflow-workspace
        mountPath: /toolchain
        subPath: toolchain
        readOnly: true
      - name: workflow-workspace
        mountPath: /tmp
        subPath: output/cache-tmp
    volumes:
    - name: orchestration
      configMap:
        name: ostension-pkg-orch
        defaultMode: 292
    - name: cache-auth
      secret:
        secretName: project-delivery-cache-writer
        defaultMode: 288
    - name: cache-ca
      secret:
        secretName: quay-internal-ca
        defaultMode: 288
    - *workflow-workspace