ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
2 changed files with 145336 additions and 0 deletions
--- a/services/project-delivery/k8s/workflows/go-release/base/kustomization.yaml
+++ b/services/project-delivery/k8s/workflows/go-release/base/kustomization.yaml
@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - workflowtemplate.yaml
--- a/services/project-delivery/k8s/workflows/go-release/base/workflowtemplate.yaml
+++ b/services/project-delivery/k8s/workflows/go-release/base/workflowtemplate.yaml
@ -0,0 +1,518 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: build
+  namespace: project-delivery
+  labels:
+    app.kubernetes.io/name: project-delivery
+    app.kubernetes.io/instance: go-release
+spec:
+  entrypoint: workflow
+  serviceAccountName: project-delivery-executor
+  automountServiceAccountToken: false
+  executor:
+    serviceAccountName: project-delivery-executor
+  parallelism: 3
+  podGC:
+    strategy: OnWorkflowCompletion
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: project-delivery
+      delivery.quorate.dev/project: go-release
+  podSpecPatch: "dnsConfig:\n  options:\n    - name: ndots\n      value: \"1\"\ncontainers:\n\
+    \  - name: wait\n    volumeMounts:\n      - name: exec-sa-token\n        mountPath:\
+    \ /var/run/secrets/kubernetes.io/serviceaccount\n        readOnly: true\nvolumes:\n\
+    \  - name: exec-sa-token\n    secret: null\n    projected:\n      defaultMode:\
+    \ 0440\n      sources:\n        - serviceAccountToken:\n            expirationSeconds:\
+    \ 1800\n            path: token\n        - configMap:\n            name: kube-root-ca.crt\n\
+    \            items:\n              - key: ca.crt\n                path: ca.crt\n\
+    \        - downwardAPI:\n            items:\n              - path: namespace\n\
+    \                fieldRef:\n                  apiVersion: v1\n               \
+    \   fieldPath: metadata.namespace\n"
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    fsGroup: 65532
+    fsGroupChangePolicy: OnRootMismatch
+    seccompProfile:
+      type: RuntimeDefault
+  arguments:
+    parameters:
+    - name: source-repository
+    - name: source-ref
+    - name: source-revision
+    - name: targets
+  templates:
+  - name: workflow
+    steps:
+    - - name: initialize
+        template: initialize
+    - - name: delivery
+        template: delivery
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{steps.initialize.outputs.parameters.working-pvc}}'
+    outputs:
+      parameters:
+      - name: delivery-result
+        valueFrom:
+          parameter: '{{steps.delivery.outputs.parameters.delivery-result}}'
+  - name: initialize
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: go-release-init
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command: &id001
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/initialize.fsx
+      env:
+      - name: POD_NAME
+        valueFrom:
+          fieldRef:
+            apiVersion: v1
+            fieldPath: metadata.name
+      resources:
+        requests:
+          cpu: 100m
+          memory: 64Mi
+        limits:
+          cpu: 500m
+          memory: 256Mi
+      securityContext: &id002
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /workspace
+      - name: temporary
+        mountPath: /tmp
+    volumes:
+    - name: orchestration
+      configMap:
+        name: go-release-orch
+        defaultMode: 292
+    - name: temporary
+      emptyDir: {}
+    - name: workflow-workspace
+      ephemeral:
+        volumeClaimTemplate:
+          spec:
+            accessModes:
+            - ReadWriteOnce
+            storageClassName: openebs-hostpath-ssd
+            resources:
+              requests:
+                storage: 5Gi
+    outputs:
+      parameters:
+      - name: working-pvc
+        valueFrom:
+          path: /workspace/.claim-name
+  - name: delivery
+    inputs:
+      parameters:
+      - name: working-pvc
+    dag:
+      tasks:
+      - name: source-pull
+        template: source-pull
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+      - name: cache-pull
+        dependencies:
+        - source-pull
+        template: cache-pull
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+      - name: toolchain-pull
+        dependencies:
+        - cache-pull
+        template: toolchain-pull
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+      - name: build
+        dependencies:
+        - cache-pull
+        - toolchain-pull
+        template: build
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+      - name: publish
+        dependencies:
+        - build
+        template: publish
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+      - name: cache-export
+        dependencies:
+        - build
+        template: cache-export
+        continueOn:
+          failed: true
+          error: true
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+    outputs:
+      parameters:
+      - name: delivery-result
+        valueFrom:
+          parameter: '{{tasks.publish.outputs.parameters.delivery-result}}'
+  - name: source-pull
+    inputs: &id003
+      parameters:
+      - name: working-pvc
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: go-release-source
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command: *id001
+      args:
+      - /orchestration/source.fsx
+      env:
+      - name: SOURCE_REPOSITORY
+        value: '{{workflow.parameters.source-repository}}'
+      - name: SOURCE_REVISION
+        value: '{{workflow.parameters.source-revision}}'
+      - name: TARGETS
+        value: '{{workflow.parameters.targets}}'
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: '1'
+          memory: 512Mi
+      securityContext: *id002
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: source/tmp
+    volumes:
+    - name: orchestration
+      configMap:
+        name: go-release-orch
+        defaultMode: 292
+    - &id004
+      name: workflow-workspace
+      persistentVolumeClaim:
+        claimName: '{{inputs.parameters.working-pvc}}'
+  - name: cache-pull
+    inputs: *id003
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: go-release-pull
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command: *id001
+      args:
+      - /orchestration/cache.fsx
+      env:
+      - name: CACHE_ACTION
+        value: pull
+      - name: TARGETS
+        value: '{{workflow.parameters.targets}}'
+      resources:
+        requests:
+          cpu: 500m
+          memory: 256Mi
+        limits:
+          cpu: '2'
+          memory: 1Gi
+      securityContext: *id002
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: cache-auth
+        mountPath: /cache-auth
+        readOnly: true
+      - name: cache-ca
+        mountPath: /cache-ca
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+      - name: workflow-workspace
+        mountPath: /state
+        subPath: state
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: state/cache-tmp
+      - name: workflow-workspace
+        mountPath: /build
+        subPath: build
+        readOnly: false
+    volumes:
+    - name: orchestration
+      configMap:
+        name: go-release-orch
+        defaultMode: 292
+    - name: cache-auth
+      secret:
+        secretName: project-delivery-cache-reader
+        defaultMode: 288
+    - name: cache-ca
+      secret:
+        secretName: quay-internal-ca
+        defaultMode: 288
+    - *id004
+  - name: toolchain-pull
+    inputs: *id003
+    podSpecPatch: 'runtimeClassName: gvisor
+
+      '
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: go-release-tools
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command: *id001
+      args:
+      - /orchestration/toolchain.fsx
+      env:
+      - name: TARGETS
+        value: '{{workflow.parameters.targets}}'
+      resources:
+        requests:
+          cpu: '1'
+          memory: 512Mi
+        limits:
+          cpu: '4'
+          memory: 2Gi
+      securityContext: *id002
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+      - name: workflow-workspace
+        mountPath: /state
+        subPath: state
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: state/toolchain-tmp
+      - name: workflow-workspace
+        mountPath: /build
+        subPath: build
+        readOnly: false
+    volumes:
+    - name: orchestration
+      configMap:
+        name: go-release-orch
+        defaultMode: 292
+    - *id004
+  - name: build
+    inputs: *id003
+    podSpecPatch: 'runtimeClassName: gvisor
+
+      '
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: go-release-build
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command: *id001
+      args:
+      - /orchestration/build.fsx
+      env:
+      - name: SOURCE_REVISION
+        value: '{{workflow.parameters.source-revision}}'
+      - name: TARGETS
+        value: '{{workflow.parameters.targets}}'
+      resources:
+        requests:
+          cpu: '2'
+          memory: 1Gi
+        limits:
+          cpu: '6'
+          memory: 4Gi
+      securityContext: *id002
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /output
+        subPath: output
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: output/build-tmp
+      - name: workflow-workspace
+        mountPath: /build
+        subPath: build
+        readOnly: false
+    volumes:
+    - name: orchestration
+      configMap:
+        name: go-release-orch
+        defaultMode: 292
+    - *id004
+  - name: publish
+    inputs: *id003
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: go-release-publish
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command: *id001
+      args:
+      - /orchestration/publish.fsx
+      env:
+      - name: SOURCE_REVISION
+        value: '{{workflow.parameters.source-revision}}'
+      - name: TARGETS
+        value: '{{workflow.parameters.targets}}'
+      - name: SOURCE_REPOSITORY
+        value: '{{workflow.parameters.source-repository}}'
+      resources:
+        requests:
+          cpu: 250m
+          memory: 256Mi
+        limits:
+          cpu: '2'
+          memory: 1Gi
+      securityContext: *id002
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /handoff
+        subPath: output
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /result
+        subPath: output/result
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: output/publish-tmp
+      - name: publisher-auth
+        mountPath: /publisher-auth
+        readOnly: true
+    volumes:
+    - name: orchestration
+      configMap:
+        name: go-release-orch
+        defaultMode: 292
+    - *id004
+    - name: publisher-auth
+      secret:
+        secretName: publisher
+        defaultMode: 288
+    outputs:
+      parameters:
+      - name: delivery-result
+        valueFrom:
+          path: /result/delivery-result
+  - name: cache-export
+    inputs: *id003
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: go-release-export
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command: *id001
+      args:
+      - /orchestration/cache.fsx
+      env:
+      - name: CACHE_ACTION
+        value: export
+      - name: TARGETS
+        value: '{{workflow.parameters.targets}}'
+      resources:
+        requests:
+          cpu: '1'
+          memory: 512Mi
+        limits:
+          cpu: '3'
+          memory: 2Gi
+      securityContext: *id002
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: cache-auth
+        mountPath: /cache-auth
+        readOnly: true
+      - name: cache-ca
+        mountPath: /cache-ca
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: output/cache-tmp
+      - name: workflow-workspace
+        mountPath: /build
+        subPath: build
+        readOnly: true
+    volumes:
+    - name: orchestration
+      configMap:
+        name: go-release-orch
+        defaultMode: 292
+    - name: cache-auth
+      secret:
+        secretName: project-delivery-cache-writer
+        defaultMode: 288
+    - name: cache-ca
+      secret:
+        secretName: quay-internal-ca
+        defaultMode: 288
+    - *id004