ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
297
services/mirrored-image/k8s/workflows.yaml
Normal file
297
services/mirrored-image/k8s/workflows.yaml
Normal file
|
|
@ -0,0 +1,297 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: image-prepare
|
||||
namespace: mirrored-image
|
||||
labels:
|
||||
app.kubernetes.io/name: mirrored-image
|
||||
app.kubernetes.io/instance: mirrored-image
|
||||
spec:
|
||||
entrypoint: run
|
||||
serviceAccountName: candidate-exec
|
||||
automountServiceAccountToken: false
|
||||
executor: {serviceAccountName: candidate-exec}
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: mirrored-image
|
||||
app.kubernetes.io/instance: mirrored-image
|
||||
mirror.quorate.dev/purpose: prepare
|
||||
podSpecPatch: |
|
||||
initContainers:
|
||||
- name: init
|
||||
resources:
|
||||
requests: {cpu: 10m, memory: 32Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
containers:
|
||||
- name: wait
|
||||
resources:
|
||||
requests: {cpu: 10m, memory: 32Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
volumeMounts:
|
||||
- {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken: {path: token, expirationSeconds: 1800}
|
||||
- configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
|
||||
- downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: {type: RuntimeDefault}
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: source-repository}
|
||||
- {name: target-repository}
|
||||
- {name: digest}
|
||||
- {name: tag}
|
||||
templates:
|
||||
- name: run
|
||||
container:
|
||||
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/actions/prepare.fsx]
|
||||
env:
|
||||
- {name: REGISTRY, value: registry.quorate.internal}
|
||||
- {name: QUAY_API, value: https://registry.quorate.internal}
|
||||
- {name: TLS_VERIFY, value: "true"}
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: TARGET_REPOSITORY, value: "{{workflow.parameters.target-repository}}"}
|
||||
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||||
- {name: TAG, value: "{{workflow.parameters.tag}}"}
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {cpu: 1, memory: 512Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: actions, mountPath: /actions, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
- {name: candidate-writer, mountPath: /candidate-writer, readOnly: true}
|
||||
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||||
volumes:
|
||||
- {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
- {name: candidate-writer, secret: {secretName: candidates-writer, defaultMode: 0440}}
|
||||
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: image-promote
|
||||
namespace: mirrored-image
|
||||
labels:
|
||||
app.kubernetes.io/name: mirrored-image
|
||||
app.kubernetes.io/instance: mirrored-image
|
||||
spec:
|
||||
entrypoint: run
|
||||
serviceAccountName: promote-exec
|
||||
automountServiceAccountToken: false
|
||||
executor: {serviceAccountName: promote-exec}
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: mirrored-image
|
||||
app.kubernetes.io/instance: mirrored-image
|
||||
mirror.quorate.dev/purpose: promotion
|
||||
podSpecPatch: |
|
||||
initContainers:
|
||||
- name: init
|
||||
resources:
|
||||
requests: {cpu: 10m, memory: 32Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
containers:
|
||||
- name: wait
|
||||
resources:
|
||||
requests: {cpu: 10m, memory: 32Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
volumeMounts:
|
||||
- {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken: {path: token, expirationSeconds: 1800}
|
||||
- configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
|
||||
- downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: {type: RuntimeDefault}
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: source-repository}
|
||||
- {name: target-repository}
|
||||
- {name: digest}
|
||||
- {name: tag}
|
||||
templates:
|
||||
- name: run
|
||||
container:
|
||||
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/actions/promote.fsx]
|
||||
env:
|
||||
- {name: REGISTRY, value: registry.quorate.internal}
|
||||
- {name: QUAY_API, value: https://registry.quorate.internal}
|
||||
- {name: TLS_VERIFY, value: "true"}
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: TARGET_REPOSITORY, value: "{{workflow.parameters.target-repository}}"}
|
||||
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||||
- {name: TAG, value: "{{workflow.parameters.tag}}"}
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {cpu: 1, memory: 512Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: actions, mountPath: /actions, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
- {name: candidate-reader, mountPath: /candidate-reader, readOnly: true}
|
||||
- {name: mirror-writer, mountPath: /mirror-writer, readOnly: true}
|
||||
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||||
volumes:
|
||||
- {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
- {name: candidate-reader, secret: {secretName: candidates-reader, defaultMode: 0440}}
|
||||
- {name: mirror-writer, secret: {secretName: mirror-writer, defaultMode: 0440}}
|
||||
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: image-cleanup
|
||||
namespace: mirrored-image
|
||||
labels:
|
||||
app.kubernetes.io/name: mirrored-image
|
||||
app.kubernetes.io/instance: mirrored-image
|
||||
spec:
|
||||
entrypoint: cleanup
|
||||
serviceAccountName: cleanup-exec
|
||||
automountServiceAccountToken: false
|
||||
executor: {serviceAccountName: cleanup-exec}
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: mirrored-image
|
||||
app.kubernetes.io/instance: mirrored-image
|
||||
mirror.quorate.dev/purpose: cleanup
|
||||
podSpecPatch: |
|
||||
initContainers:
|
||||
- name: init
|
||||
resources:
|
||||
requests: {cpu: 10m, memory: 32Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
containers:
|
||||
- name: wait
|
||||
resources:
|
||||
requests: {cpu: 10m, memory: 32Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
volumeMounts:
|
||||
- {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken: {path: token, expirationSeconds: 1800}
|
||||
- configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
|
||||
- downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: {type: RuntimeDefault}
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: candidate-repository}
|
||||
- {name: mirror-repository}
|
||||
- {name: digest}
|
||||
templates:
|
||||
- name: cleanup
|
||||
steps:
|
||||
- - name: candidate
|
||||
template: candidate
|
||||
- - name: mirror
|
||||
template: mirror
|
||||
- name: candidate
|
||||
container:
|
||||
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/actions/cleanup.fsx]
|
||||
env:
|
||||
- {name: REGISTRY, value: registry.quorate.internal}
|
||||
- {name: TLS_VERIFY, value: "true"}
|
||||
- {name: REPOSITORY, value: "{{workflow.parameters.candidate-repository}}"}
|
||||
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||||
- {name: AUTH_TOKEN_PATH, value: /candidate-writer/token}
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 64Mi}
|
||||
limits: {cpu: 500m, memory: 256Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: actions, mountPath: /actions, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
- {name: candidate-writer, mountPath: /candidate-writer, readOnly: true}
|
||||
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||||
volumes:
|
||||
- {name: candidate-writer, secret: {secretName: candidates-writer, defaultMode: 0440}}
|
||||
- name: mirror
|
||||
container:
|
||||
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/actions/cleanup.fsx]
|
||||
env:
|
||||
- {name: REGISTRY, value: registry.quorate.internal}
|
||||
- {name: TLS_VERIFY, value: "true"}
|
||||
- {name: REPOSITORY, value: "{{workflow.parameters.mirror-repository}}"}
|
||||
- {name: DIGEST, value: "{{workflow.parameters.digest}}"}
|
||||
- {name: AUTH_TOKEN_PATH, value: /mirror-writer/token}
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 64Mi}
|
||||
limits: {cpu: 500m, memory: 256Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: actions, mountPath: /actions, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
- {name: mirror-writer, mountPath: /mirror-writer, readOnly: true}
|
||||
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||||
volumes:
|
||||
- {name: mirror-writer, secret: {secretName: mirror-writer, defaultMode: 0440}}
|
||||
volumes:
|
||||
- {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|
||||
Loading…
Reference in a new issue