ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
15 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
services/project-delivery/k8s/workflows/go-oci/ag-catalog/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: ag-catalog-
resources:
- ../base

4
services/project-delivery/k8s/workflows/go-oci/base/kustomization.yaml Normal file
View file

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- workflowtemplate.yaml

352
services/project-delivery/k8s/workflows/go-oci/base/workflowtemplate.yaml Normal file
View file

@ -0,0 +1,352 @@
apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
name: build
namespace: project-delivery
labels:
app.kubernetes.io/name: project-delivery
app.kubernetes.io/instance: go-oci
spec:
entrypoint: workflow
serviceAccountName: project-delivery-executor
automountServiceAccountToken: false
executor:
serviceAccountName: project-delivery-executor
parallelism: 3
podGC:
strategy: OnWorkflowCompletion
podMetadata:
labels:
app.kubernetes.io/name: project-delivery
delivery.quorate.dev/project: go-oci
podSpecPatch: |
dnsConfig:
options:
- name: ndots
value: "1"
containers:
- name: wait
volumeMounts:
- name: exec-sa-token
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
readOnly: true
volumes:
- name: exec-sa-token
secret: null
projected:
defaultMode: 0440
sources:
- serviceAccountToken:
expirationSeconds: 1800
path: token
- configMap:
name: kube-root-ca.crt
items:
- key: ca.crt
path: ca.crt
- downwardAPI:
items:
- path: namespace
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
fsGroup: 65532
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
arguments:
parameters:
- name: source-repository
- name: source-ref
- name: source-revision
- name: targets
templates:
- name: workflow
steps:
- - name: initialize
template: initialize
- - name: delivery
template: delivery
arguments:
parameters:
- name: working-pvc
value: "{{steps.initialize.outputs.parameters.working-pvc}}"
outputs:
parameters:
- name: delivery-result
valueFrom:
parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"
- name: initialize
metadata:
labels:
delivery.quorate.dev/stage: go-oci-init
container:
image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
args: [/orchestration/initialize.fsx]
env:
- name: POD_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.name
resources:
requests: {cpu: 100m, memory: 64Mi}
limits: {cpu: 500m, memory: 256Mi}
securityContext: &restricted
allowPrivilegeEscalation: false
capabilities: {drop: [ALL]}
readOnlyRootFilesystem: true
volumeMounts:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: workflow-workspace, mountPath: /workspace}
- {name: temporary, mountPath: /tmp}
volumes:
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
- {name: temporary, emptyDir: {}}
- name: workflow-workspace
ephemeral:
volumeClaimTemplate:
spec:
accessModes: [ReadWriteOnce]
storageClassName: openebs-hostpath-ssd
resources:
requests:
storage: 5Gi
outputs:
parameters:
- name: working-pvc
valueFrom: {path: /workspace/.claim-name}
- name: delivery
inputs:
parameters:
- name: working-pvc
dag:
tasks:
- name: source-pull
template: source-pull
arguments:
parameters:
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
- name: cache-pull
dependencies: [source-pull]
template: cache-pull
arguments:
parameters:
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
- name: toolchain-pull
dependencies: [source-pull]
template: toolchain-pull
arguments:
parameters:
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
- name: build
dependencies: [cache-pull, toolchain-pull]
template: build
arguments:
parameters:
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
- name: image-publish
dependencies: [build]
template: image-publish
arguments:
parameters:
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
- name: cache-export
dependencies: [build]
template: cache-export
continueOn:
failed: true
error: true
arguments:
parameters:
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
outputs:
parameters:
- name: delivery-result
valueFrom:
parameter: "{{tasks.image-publish.outputs.parameters.delivery-result}}"
- name: source-pull
inputs: &working-pvc-input
parameters:
- name: working-pvc
metadata:
labels:
delivery.quorate.dev/stage: go-oci-source
container:
image: *runner
command: *fsi
args: [/orchestration/source.fsx]
env:
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
resources:
requests: {cpu: 100m, memory: 128Mi}
limits: {cpu: "1", memory: 512Mi}
securityContext: *restricted
volumeMounts:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: source-auth, mountPath: /source-auth, readOnly: true}
- {name: workflow-workspace, mountPath: /source, subPath: source}
- {name: workflow-workspace, mountPath: /tmp, subPath: source/tmp}
volumes:
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
- {name: source-auth, secret: {secretName: quorate-pull, defaultMode: 0440}}
- &workflow-workspace
name: workflow-workspace
persistentVolumeClaim:
claimName: "{{inputs.parameters.working-pvc}}"
- name: cache-pull
inputs: *working-pvc-input
metadata:
labels:
delivery.quorate.dev/stage: go-oci-cache-pull
container:
image: *runner
command: *fsi
args: [/orchestration/cache.fsx]
env:
- {name: CACHE_ACTION, value: pull}
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
resources:
requests: {cpu: 500m, memory: 256Mi}
limits: {cpu: "2", memory: 1Gi}
securityContext: *restricted
volumeMounts:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
- {name: workflow-workspace, mountPath: /state, subPath: state}
- {name: workflow-workspace, mountPath: /tmp, subPath: state/cache-tmp}
volumes:
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
- {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
- *workflow-workspace
- name: toolchain-pull
inputs: *working-pvc-input
podSpecPatch: |
runtimeClassName: gvisor
metadata:
labels:
delivery.quorate.dev/stage: go-oci-toolchain
container:
image: *runner
command: *fsi
args: [/orchestration/toolchain.fsx]
env:
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
resources:
requests: {cpu: "1", memory: 512Mi}
limits: {cpu: "4", memory: 2Gi}
securityContext: *restricted
volumeMounts:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
- {name: workflow-workspace, mountPath: /state, subPath: state, readOnly: true}
- {name: workflow-workspace, mountPath: /tmp, subPath: state/toolchain-tmp}
volumes:
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
- *workflow-workspace
- name: build
inputs: *working-pvc-input
podSpecPatch: |
runtimeClassName: gvisor
metadata:
labels:
delivery.quorate.dev/stage: go-oci-build
container:
image: *runner
command: *fsi
args: [/orchestration/build.fsx]
env:
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
resources:
requests: {cpu: "2", memory: 1Gi}
limits: {cpu: "6", memory: 4Gi}
securityContext: *restricted
volumeMounts:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
- {name: workflow-workspace, mountPath: /output, subPath: output}
- {name: workflow-workspace, mountPath: /tmp, subPath: output/tmp}
volumes:
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
- *workflow-workspace
- name: image-publish
inputs: *working-pvc-input
metadata:
labels:
delivery.quorate.dev/stage: publish-internal
container:
image: *runner
command: *fsi
args: [/orchestration/publish.fsx]
env:
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
resources:
requests: {cpu: 250m, memory: 256Mi}
limits: {cpu: "2", memory: 1Gi}
securityContext: *restricted
volumeMounts:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: registry-auth, mountPath: /auth, readOnly: true}
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
- {name: workflow-workspace, mountPath: /handoff, subPath: output, readOnly: true}
- {name: workflow-workspace, mountPath: /result, subPath: output/result}
- {name: workflow-workspace, mountPath: /tmp, subPath: output/publish-tmp}
volumes:
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
- {name: registry-auth, secret: {secretName: quay-writer, defaultMode: 0440}}
- {name: registry-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
- *workflow-workspace
outputs:
parameters:
- name: delivery-result
valueFrom: {path: /result/delivery-result}
- name: cache-export
inputs: *working-pvc-input
metadata:
labels:
delivery.quorate.dev/stage: go-oci-cache-export
container:
image: *runner
command: *fsi
args: [/orchestration/cache.fsx]
env:
- {name: CACHE_ACTION, value: export}
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
resources:
requests: {cpu: "1", memory: 512Mi}
limits: {cpu: "3", memory: 2Gi}
securityContext: *restricted
volumeMounts:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
- {name: workflow-workspace, mountPath: /tmp, subPath: output/cache-tmp}
volumes:
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
- {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
- *workflow-workspace

14
services/project-delivery/k8s/workflows/go-oci/codex-bridge/kustomization.yaml Normal file
View file

@ -0,0 +1,14 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: codex-bridge-
resources:
- ../base
- network-policy.yaml
patches:
- target:
kind: WorkflowTemplate
name: build
patch: |-
- op: replace
path: /spec/podMetadata/labels/delivery.quorate.dev~1project
value: codex-bridge

37
services/project-delivery/k8s/workflows/go-oci/codex-bridge/network-policy.yaml Normal file
View file

@ -0,0 +1,37 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: codex-toolchain
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/stage: go-oci-toolchain
delivery.quorate.dev/project: codex-bridge
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- {port: "53", protocol: UDP}
- {port: "53", protocol: TCP}
rules:
dns:
- matchName: github.com
- matchName: release-assets.githubusercontent.com
- matchName: packages.wolfi.dev
- matchName: proxy.golang.org
- matchName: storage.googleapis.com
- matchName: sum.golang.org
- toFQDNs:
- {matchName: github.com}
- {matchName: release-assets.githubusercontent.com}
- {matchName: packages.wolfi.dev}
- {matchName: proxy.golang.org}
- {matchName: storage.googleapis.com}
- {matchName: sum.golang.org}
toPorts:
- ports:
- {port: "443", protocol: TCP}

12
services/project-delivery/k8s/workflows/go-oci/kustomization.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- short
- network-policy.yaml
- ag-catalog
- opnsense-cert
- relay-agent
- relay-wan
- vertex-batch
- codex-bridge
- mesh-init

5
services/project-delivery/k8s/workflows/go-oci/mesh-init/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: mesh-init-
resources:
- ../base

129
services/project-delivery/k8s/workflows/go-oci/network-policy.yaml Normal file
View file

@ -0,0 +1,129 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: go-oci-source
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/stage: go-oci-source
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- {port: "53", protocol: UDP}
- {port: "53", protocol: TCP}
rules:
dns:
- matchName: forgejo-http.forgejo.svc.cluster.local
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: forgejo
app.kubernetes.io/name: forgejo
app.kubernetes.io/instance: forgejo
toPorts:
- ports:
- {port: "3000", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: go-oci-toolchain
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/stage: go-oci-toolchain
delivery.quorate.dev/project: go-oci
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- {port: "53", protocol: UDP}
- {port: "53", protocol: TCP}
rules:
dns:
- matchName: packages.wolfi.dev
- matchName: proxy.golang.org
- matchName: storage.googleapis.com
- matchName: sum.golang.org
- toFQDNs:
- {matchName: packages.wolfi.dev}
- {matchName: proxy.golang.org}
- {matchName: storage.googleapis.com}
- {matchName: sum.golang.org}
toPorts:
- ports:
- {port: "443", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: go-oci-cache
namespace: project-delivery
spec:
endpointSelector:
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values: [go-oci-cache-pull, go-oci-cache-export]
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- {port: "53", protocol: UDP}
- {port: "53", protocol: TCP}
rules:
dns:
- matchName: s3.quorate.internal
- toCIDR: [10.66.127.81/32]
toPorts:
- ports:
- {port: "443", protocol: TCP}
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- {port: "7070", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: go-oci-publish
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/stage: publish-internal
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- {port: "53", protocol: UDP}
- {port: "53", protocol: TCP}
- toCIDR: [10.108.252.250/32, 10.66.127.81/32]
toPorts:
- ports:
- {port: "443", protocol: TCP}
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: quay
app: quay
toPorts:
- ports:
- {port: "8443", protocol: TCP}

29
services/project-delivery/k8s/workflows/go-oci/opnsense-cert/kustomization.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: opnsense-cert-
resources:
- ../base
patches:
- target:
kind: WorkflowTemplate
name: build
patch: |-
- op: replace
path: /metadata/labels/app.kubernetes.io~1instance
value: ostension
- op: replace
path: /spec/podMetadata/labels/delivery.quorate.dev~1project
value: ostension
- op: replace
path: /spec/templates/3/metadata/labels/delivery.quorate.dev~1stage
value: ostension-source
- op: remove
path: /spec/templates/3/container/volumeMounts/1
- op: remove
path: /spec/templates/3/volumes/1
- op: replace
path: /spec/templates/5/metadata/labels/delivery.quorate.dev~1stage
value: ostension-tools
- op: replace
path: /spec/templates/3/volumes/0/configMap/name
value: ostension-orch

9
services/project-delivery/k8s/workflows/go-oci/parallel/kustomization.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- target:
kind: WorkflowTemplate
name: build
path: workflow-patch.yaml

35
services/project-delivery/k8s/workflows/go-oci/parallel/workflow-patch.yaml Normal file
View file

@ -0,0 +1,35 @@
- op: remove
path: /spec/templates/2/dag/tasks/1/dependencies
- op: remove
path: /spec/templates/2/dag/tasks/2/dependencies
- op: replace
path: /spec/templates/2/dag/tasks/3/dependencies
value: [source-pull, cache-pull, toolchain-pull]
- op: add
path: /spec/templates/4/container/env/-
value: {name: CACHE_MODE, value: parallel}
- op: replace
path: /spec/templates/4/container/volumeMounts
value:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
- {name: workflow-workspace, mountPath: /cache, subPath: cache}
- {name: workflow-workspace, mountPath: /tmp, subPath: state/cache-tmp}
- op: replace
path: /spec/templates/5/container/volumeMounts
value:
- {name: orchestration, mountPath: /orchestration, readOnly: true}
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
- {name: workflow-workspace, mountPath: /tmp, subPath: state/toolchain-tmp}
- op: add
path: /spec/templates/6/container/volumeMounts/-
value: {name: workflow-workspace, mountPath: /cache, subPath: cache}
- op: replace
path: /spec/templates/8/container/volumeMounts/3
value: {name: workflow-workspace, mountPath: /cache, subPath: cache, readOnly: true}
- op: remove
path: /spec/templates/8/container/volumeMounts/4
- op: add
path: /spec/templates/8/container/env/-
value: {name: CACHE_MODE, value: parallel}

5
services/project-delivery/k8s/workflows/go-oci/relay-agent/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: relay-agent-
resources:
- ../base

5
services/project-delivery/k8s/workflows/go-oci/relay-wan/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: relay-wan-
resources:
- ../base

5
services/project-delivery/k8s/workflows/go-oci/short/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: short-
resources:
- ../base

5
services/project-delivery/k8s/workflows/go-oci/vertex-batch/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namePrefix: vertex-batch-
resources:
- ../base