ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
2 changed files with 145336 additions and 0 deletions
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- workflowtemplate.yaml
|
||||
|
|
@ -0,0 +1,352 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: build
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: go-oci
|
||||
spec:
|
||||
entrypoint: workflow
|
||||
serviceAccountName: project-delivery-executor
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: project-delivery-executor
|
||||
parallelism: 3
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
delivery.quorate.dev/project: go-oci
|
||||
podSpecPatch: |
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 1800
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: source-repository
|
||||
- name: source-ref
|
||||
- name: source-revision
|
||||
- name: targets
|
||||
templates:
|
||||
- name: workflow
|
||||
steps:
|
||||
- - name: initialize
|
||||
template: initialize
|
||||
- - name: delivery
|
||||
template: delivery
|
||||
arguments:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
value: "{{steps.initialize.outputs.parameters.working-pvc}}"
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom:
|
||||
parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"
|
||||
|
||||
- name: initialize
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: go-oci-init
|
||||
container:
|
||||
image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||||
command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/initialize.fsx]
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 64Mi}
|
||||
limits: {cpu: 500m, memory: 256Mi}
|
||||
securityContext: &restricted
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
- name: workflow-workspace
|
||||
ephemeral:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
storageClassName: openebs-hostpath-ssd
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
outputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
valueFrom: {path: /workspace/.claim-name}
|
||||
|
||||
- name: delivery
|
||||
inputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
dag:
|
||||
tasks:
|
||||
- name: source-pull
|
||||
template: source-pull
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: cache-pull
|
||||
dependencies: [source-pull]
|
||||
template: cache-pull
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: toolchain-pull
|
||||
dependencies: [source-pull]
|
||||
template: toolchain-pull
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: build
|
||||
dependencies: [cache-pull, toolchain-pull]
|
||||
template: build
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: image-publish
|
||||
dependencies: [build]
|
||||
template: image-publish
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: cache-export
|
||||
dependencies: [build]
|
||||
template: cache-export
|
||||
continueOn:
|
||||
failed: true
|
||||
error: true
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom:
|
||||
parameter: "{{tasks.image-publish.outputs.parameters.delivery-result}}"
|
||||
|
||||
- name: source-pull
|
||||
inputs: &working-pvc-input
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: go-oci-source
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/source.fsx]
|
||||
env:
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {cpu: "1", memory: 512Mi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: source-auth, mountPath: /source-auth, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: source/tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
|
||||
- {name: source-auth, secret: {secretName: quorate-pull, defaultMode: 0440}}
|
||||
- &workflow-workspace
|
||||
name: workflow-workspace
|
||||
persistentVolumeClaim:
|
||||
claimName: "{{inputs.parameters.working-pvc}}"
|
||||
|
||||
- name: cache-pull
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: go-oci-cache-pull
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/cache.fsx]
|
||||
env:
|
||||
- {name: CACHE_ACTION, value: pull}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources:
|
||||
requests: {cpu: 500m, memory: 256Mi}
|
||||
limits: {cpu: "2", memory: 1Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||||
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
|
||||
- {name: workflow-workspace, mountPath: /state, subPath: state}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: state/cache-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
|
||||
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- *workflow-workspace
|
||||
|
||||
- name: toolchain-pull
|
||||
inputs: *working-pvc-input
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: go-oci-toolchain
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/toolchain.fsx]
|
||||
env:
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources:
|
||||
requests: {cpu: "1", memory: 512Mi}
|
||||
limits: {cpu: "4", memory: 2Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
|
||||
- {name: workflow-workspace, mountPath: /state, subPath: state, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: state/toolchain-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
|
||||
- *workflow-workspace
|
||||
|
||||
- name: build
|
||||
inputs: *working-pvc-input
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: go-oci-build
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/build.fsx]
|
||||
env:
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources:
|
||||
requests: {cpu: "2", memory: 1Gi}
|
||||
limits: {cpu: "6", memory: 4Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /output, subPath: output}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: output/tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
|
||||
- *workflow-workspace
|
||||
|
||||
- name: image-publish
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: publish-internal
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/publish.fsx]
|
||||
env:
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources:
|
||||
requests: {cpu: 250m, memory: 256Mi}
|
||||
limits: {cpu: "2", memory: 1Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: registry-auth, mountPath: /auth, readOnly: true}
|
||||
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /handoff, subPath: output, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /result, subPath: output/result}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: output/publish-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
|
||||
- {name: registry-auth, secret: {secretName: quay-writer, defaultMode: 0440}}
|
||||
- {name: registry-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- *workflow-workspace
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom: {path: /result/delivery-result}
|
||||
|
||||
- name: cache-export
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: go-oci-cache-export
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/cache.fsx]
|
||||
env:
|
||||
- {name: CACHE_ACTION, value: export}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources:
|
||||
requests: {cpu: "1", memory: 512Mi}
|
||||
limits: {cpu: "3", memory: 2Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||||
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: output/cache-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: go-oci-orch, defaultMode: 0444}}
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
|
||||
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- *workflow-workspace
|
||||
Loading…
Reference in a new issue