297 lines
12 KiB
YAML
297 lines
12 KiB
YAML
|
apiVersion: argoproj.io/v1alpha1
|
||
|
|
kind: WorkflowTemplate
|
||
|
|
metadata:
|
||
|
|
name: image-prepare
|
||
|
|
namespace: mirrored-image
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
spec:
|
||
|
|
entrypoint: run
|
||
|
|
serviceAccountName: candidate-exec
|
||
|
|
automountServiceAccountToken: false
|
||
|
|
executor: {serviceAccountName: candidate-exec}
|
||
|
|
podMetadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
mirror.quorate.dev/purpose: prepare
|
||
|
|
podSpecPatch: |
|
||
|
|
initContainers:
|
||
|
|
- name: init
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 10m, memory: 32Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
containers:
|
||
|
|
- name: wait
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 10m, memory: 32Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
volumeMounts:
|
||
|
|
- {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- name: exec-sa-token
|
||
|
|
secret: null
|
||
|
|
projected:
|
||
|
|
defaultMode: 0440
|
||
|
|
sources:
|
||
|
|
- serviceAccountToken: {path: token, expirationSeconds: 1800}
|
||
|
|
- configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
|
||
|
|
- downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
seccompProfile: {type: RuntimeDefault}
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- {name: source-repository}
|
||
|
|
- {name: target-repository}
|
||
|
|
- {name: digest}
|
||
|
|
- {name: tag}
|
||
|
|
templates:
|
||
|
|
- name: run
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||
|
|
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||
|
|
args: [/actions/prepare.fsx]
|
||
|
|
env:
|
||
|
|
- {name: REGISTRY, value: registry.quorate.internal}
|
||
|
|
- {name: QUAY_API, value: https://registry.quorate.internal}
|
||
|
|
- {name: TLS_VERIFY, value: "true"}
|
||
|
|
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||
|
|
- {name: TARGET_REPOSITORY, value: "{{workflow.parameters.target-repository}}"}
|
||
|
|
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||
|
|
- {name: TAG, value: "{{workflow.parameters.tag}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 100m, memory: 128Mi}
|
||
|
|
limits: {cpu: 1, memory: 512Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- {name: actions, mountPath: /actions, readOnly: true}
|
||
|
|
- {name: temporary, mountPath: /tmp}
|
||
|
|
- {name: candidate-writer, mountPath: /candidate-writer, readOnly: true}
|
||
|
|
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
|
||
|
|
- {name: temporary, emptyDir: {}}
|
||
|
|
- {name: candidate-writer, secret: {secretName: candidates-writer, defaultMode: 0440}}
|
||
|
|
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|
||
|
|
---
|
||
|
|
apiVersion: argoproj.io/v1alpha1
|
||
|
|
kind: WorkflowTemplate
|
||
|
|
metadata:
|
||
|
|
name: image-promote
|
||
|
|
namespace: mirrored-image
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
spec:
|
||
|
|
entrypoint: run
|
||
|
|
serviceAccountName: promote-exec
|
||
|
|
automountServiceAccountToken: false
|
||
|
|
executor: {serviceAccountName: promote-exec}
|
||
|
|
podMetadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
mirror.quorate.dev/purpose: promotion
|
||
|
|
podSpecPatch: |
|
||
|
|
initContainers:
|
||
|
|
- name: init
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 10m, memory: 32Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
containers:
|
||
|
|
- name: wait
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 10m, memory: 32Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
volumeMounts:
|
||
|
|
- {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- name: exec-sa-token
|
||
|
|
secret: null
|
||
|
|
projected:
|
||
|
|
defaultMode: 0440
|
||
|
|
sources:
|
||
|
|
- serviceAccountToken: {path: token, expirationSeconds: 1800}
|
||
|
|
- configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
|
||
|
|
- downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
seccompProfile: {type: RuntimeDefault}
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- {name: source-repository}
|
||
|
|
- {name: target-repository}
|
||
|
|
- {name: digest}
|
||
|
|
- {name: tag}
|
||
|
|
templates:
|
||
|
|
- name: run
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||
|
|
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||
|
|
args: [/actions/promote.fsx]
|
||
|
|
env:
|
||
|
|
- {name: REGISTRY, value: registry.quorate.internal}
|
||
|
|
- {name: QUAY_API, value: https://registry.quorate.internal}
|
||
|
|
- {name: TLS_VERIFY, value: "true"}
|
||
|
|
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||
|
|
- {name: TARGET_REPOSITORY, value: "{{workflow.parameters.target-repository}}"}
|
||
|
|
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||
|
|
- {name: TAG, value: "{{workflow.parameters.tag}}"}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 100m, memory: 128Mi}
|
||
|
|
limits: {cpu: 1, memory: 512Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- {name: actions, mountPath: /actions, readOnly: true}
|
||
|
|
- {name: temporary, mountPath: /tmp}
|
||
|
|
- {name: candidate-reader, mountPath: /candidate-reader, readOnly: true}
|
||
|
|
- {name: mirror-writer, mountPath: /mirror-writer, readOnly: true}
|
||
|
|
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
|
||
|
|
- {name: temporary, emptyDir: {}}
|
||
|
|
- {name: candidate-reader, secret: {secretName: candidates-reader, defaultMode: 0440}}
|
||
|
|
- {name: mirror-writer, secret: {secretName: mirror-writer, defaultMode: 0440}}
|
||
|
|
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|
||
|
|
---
|
||
|
|
apiVersion: argoproj.io/v1alpha1
|
||
|
|
kind: WorkflowTemplate
|
||
|
|
metadata:
|
||
|
|
name: image-cleanup
|
||
|
|
namespace: mirrored-image
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
spec:
|
||
|
|
entrypoint: cleanup
|
||
|
|
serviceAccountName: cleanup-exec
|
||
|
|
automountServiceAccountToken: false
|
||
|
|
executor: {serviceAccountName: cleanup-exec}
|
||
|
|
podMetadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
mirror.quorate.dev/purpose: cleanup
|
||
|
|
podSpecPatch: |
|
||
|
|
initContainers:
|
||
|
|
- name: init
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 10m, memory: 32Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
containers:
|
||
|
|
- name: wait
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 10m, memory: 32Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
volumeMounts:
|
||
|
|
- {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- name: exec-sa-token
|
||
|
|
secret: null
|
||
|
|
projected:
|
||
|
|
defaultMode: 0440
|
||
|
|
sources:
|
||
|
|
- serviceAccountToken: {path: token, expirationSeconds: 1800}
|
||
|
|
- configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
|
||
|
|
- downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
seccompProfile: {type: RuntimeDefault}
|
||
|
|
arguments:
|
||
|
|
parameters:
|
||
|
|
- {name: candidate-repository}
|
||
|
|
- {name: mirror-repository}
|
||
|
|
- {name: digest}
|
||
|
|
templates:
|
||
|
|
- name: cleanup
|
||
|
|
steps:
|
||
|
|
- - name: candidate
|
||
|
|
template: candidate
|
||
|
|
- - name: mirror
|
||
|
|
template: mirror
|
||
|
|
- name: candidate
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||
|
|
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||
|
|
args: [/actions/cleanup.fsx]
|
||
|
|
env:
|
||
|
|
- {name: REGISTRY, value: registry.quorate.internal}
|
||
|
|
- {name: TLS_VERIFY, value: "true"}
|
||
|
|
- {name: REPOSITORY, value: "{{workflow.parameters.candidate-repository}}"}
|
||
|
|
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||
|
|
- {name: AUTH_TOKEN_PATH, value: /candidate-writer/token}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 50m, memory: 64Mi}
|
||
|
|
limits: {cpu: 500m, memory: 256Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- {name: actions, mountPath: /actions, readOnly: true}
|
||
|
|
- {name: temporary, mountPath: /tmp}
|
||
|
|
- {name: candidate-writer, mountPath: /candidate-writer, readOnly: true}
|
||
|
|
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- {name: candidate-writer, secret: {secretName: candidates-writer, defaultMode: 0440}}
|
||
|
|
- name: mirror
|
||
|
|
container:
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||
|
|
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||
|
|
args: [/actions/cleanup.fsx]
|
||
|
|
env:
|
||
|
|
- {name: REGISTRY, value: registry.quorate.internal}
|
||
|
|
- {name: TLS_VERIFY, value: "true"}
|
||
|
|
- {name: REPOSITORY, value: "{{workflow.parameters.mirror-repository}}"}
|
||
|
|
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||
|
|
- {name: AUTH_TOKEN_PATH, value: /mirror-writer/token}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 50m, memory: 64Mi}
|
||
|
|
limits: {cpu: 500m, memory: 256Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- {name: actions, mountPath: /actions, readOnly: true}
|
||
|
|
- {name: temporary, mountPath: /tmp}
|
||
|
|
- {name: mirror-writer, mountPath: /mirror-writer, readOnly: true}
|
||
|
|
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- {name: mirror-writer, secret: {secretName: mirror-writer, defaultMode: 0440}}
|
||
|
|
volumes:
|
||
|
|
- {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
|
||
|
|
- {name: temporary, emptyDir: {}}
|
||
|
|
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|