ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
4 changed files with 145336 additions and 0 deletions
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- workflowtemplate.yaml
|
||||
- network-policy.yaml
|
||||
- secrets.yaml
|
||||
|
|
@ -0,0 +1,228 @@
|
|||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-forgejo
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
matchExpressions:
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [layshaft-source, layshaft-client-pub]
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: forge-git-http.forgejo-public.svc.cluster.local
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: forgejo-public
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forge-git
|
||||
toPorts:
|
||||
- ports: [{port: '3000', protocol: TCP}]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-cache
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
matchExpressions:
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [layshaft-pull, layshaft-export]
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: s3.quorate.internal
|
||||
- toCIDR: [10.66.127.81/32]
|
||||
toPorts:
|
||||
- ports: [{port: '443', protocol: TCP}]
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: versitygw
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
toPorts:
|
||||
- ports: [{port: '7070', protocol: TCP}]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-sdk
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
delivery.quorate.dev/stage: layshaft-tools
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: builds.dotnet.microsoft.com
|
||||
- toFQDNs:
|
||||
- matchName: builds.dotnet.microsoft.com
|
||||
toPorts:
|
||||
- ports: [{port: '443', protocol: TCP}]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-rpm-tools
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
delivery.quorate.dev/stage: layshaft-tools
|
||||
delivery.quorate.dev/lane: client
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: github.com
|
||||
- matchName: release-assets.githubusercontent.com
|
||||
- toFQDNs:
|
||||
- matchName: github.com
|
||||
- matchName: release-assets.githubusercontent.com
|
||||
toPorts:
|
||||
- ports: [{port: '443', protocol: TCP}]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-runtime
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
delivery.quorate.dev/stage: layshaft-tools
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: packages.wolfi.dev
|
||||
- toFQDNs:
|
||||
- matchName: packages.wolfi.dev
|
||||
toPorts:
|
||||
- ports: [{port: '443', protocol: TCP}]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-linker
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
delivery.quorate.dev/stage: layshaft-tools
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: archive.ubuntu.com
|
||||
- matchName: ports.ubuntu.com
|
||||
- toFQDNs:
|
||||
- matchName: archive.ubuntu.com
|
||||
- matchName: ports.ubuntu.com
|
||||
toPorts:
|
||||
- ports: [{port: '443', protocol: TCP}]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-build
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
delivery.quorate.dev/stage: layshaft-build
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: api.nuget.org
|
||||
- matchName: www.nuget.org
|
||||
- matchName: globalcdn.nuget.org
|
||||
- toFQDNs:
|
||||
- matchName: api.nuget.org
|
||||
- matchName: www.nuget.org
|
||||
- matchName: globalcdn.nuget.org
|
||||
toPorts:
|
||||
- ports: [{port: '443', protocol: TCP}]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft-quay
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/project: layshaft
|
||||
delivery.quorate.dev/stage: layshaft-server-pub
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
|
||||
rules:
|
||||
dns:
|
||||
- matchName: registry.quorate.internal
|
||||
- toCIDR: [10.108.252.250/32]
|
||||
toPorts:
|
||||
- ports: [{port: '443', protocol: TCP}]
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: quay
|
||||
app: quay
|
||||
toPorts:
|
||||
- ports: [{port: '8443', protocol: TCP}]
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: layshaft-pub-vso
|
||||
namespace: project-delivery
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: layshaft-publisher
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: layshaft-publisher
|
||||
serviceAccount: layshaft-pub-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: layshaft-publisher
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/tokens/layshaft-publisher
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: layshaft-publisher
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
token:
|
||||
text: '{{ get .Secrets "token" }}'
|
||||
vaultAuthRef: layshaft-publisher
|
||||
|
|
@ -0,0 +1,401 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: layshaft-build
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: layshaft
|
||||
spec:
|
||||
entrypoint: workflow
|
||||
serviceAccountName: project-delivery-executor
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: project-delivery-executor
|
||||
parallelism: 8
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
delivery.quorate.dev/project: layshaft
|
||||
podSpecPatch: |
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 1800
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- {key: ca.crt, path: ca.crt}
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: source-repository
|
||||
- name: source-ref
|
||||
- name: source-revision
|
||||
- name: targets
|
||||
templates:
|
||||
- name: workflow
|
||||
steps:
|
||||
- - name: initialize
|
||||
template: initialize
|
||||
- - name: delivery
|
||||
template: delivery
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{steps.initialize.outputs.parameters.working-pvc}}"}
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom:
|
||||
parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"
|
||||
- name: initialize
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: layshaft-init
|
||||
container:
|
||||
image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:f33600d25acd0c56f6fac66282b08e52eec2942b906649abb47600ed7ac203cf
|
||||
command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
workingDir: /tmp
|
||||
args: [/actions/initialize.fsx]
|
||||
env:
|
||||
- {name: HOME, value: /tmp}
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef: {fieldPath: metadata.name}
|
||||
resources: &small
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {memory: 1Gi}
|
||||
securityContext: &restricted
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: {drop: [ALL]}
|
||||
volumeMounts:
|
||||
- &actions-mount {name: actions, mountPath: /actions, readOnly: true}
|
||||
- {name: work, mountPath: /workspace}
|
||||
- {name: work, mountPath: /tmp}
|
||||
volumes:
|
||||
- &actions {name: actions, configMap: {name: layshaft-orch, defaultMode: 0444}}
|
||||
- name: work
|
||||
ephemeral:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
storageClassName: openebs-hostpath-ssd
|
||||
resources:
|
||||
requests: {storage: 8Gi}
|
||||
outputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
valueFrom: {path: /workspace/.claim-name}
|
||||
- name: delivery
|
||||
inputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
dag:
|
||||
tasks:
|
||||
- name: source-pull
|
||||
template: source-pull
|
||||
arguments: &work-arg
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: client-tools
|
||||
template: tools
|
||||
arguments: &client-arg
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- {name: lane, value: client}
|
||||
- name: server-tools
|
||||
template: tools
|
||||
arguments: &server-arg
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- {name: lane, value: server}
|
||||
- name: client-cache-pull
|
||||
template: cache-pull
|
||||
arguments: *client-arg
|
||||
- name: server-cache-pull
|
||||
template: cache-pull
|
||||
arguments: *server-arg
|
||||
- name: client-build
|
||||
template: build
|
||||
dependencies: [source-pull, client-tools, client-cache-pull]
|
||||
arguments: *client-arg
|
||||
- name: server-build
|
||||
template: build
|
||||
dependencies: [source-pull, server-tools, server-cache-pull]
|
||||
arguments: *server-arg
|
||||
- name: client-export
|
||||
template: cache-export
|
||||
dependencies: [client-build]
|
||||
arguments: *client-arg
|
||||
- name: server-export
|
||||
template: cache-export
|
||||
dependencies: [server-build]
|
||||
arguments: *server-arg
|
||||
- name: client-publish
|
||||
template: client-publish
|
||||
dependencies: [client-build]
|
||||
arguments: *work-arg
|
||||
- name: server-publish
|
||||
template: server-publish
|
||||
dependencies: [server-build]
|
||||
arguments: *work-arg
|
||||
- name: result
|
||||
template: result
|
||||
dependencies: [client-publish, server-publish]
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- {name: client, value: "{{tasks.client-publish.outputs.parameters.delivery-result}}"}
|
||||
- {name: server, value: "{{tasks.server-publish.outputs.parameters.delivery-result}}"}
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom: {parameter: "{{tasks.result.outputs.parameters.delivery-result}}"}
|
||||
- name: source-pull
|
||||
inputs: &work-input
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
metadata:
|
||||
labels: {delivery.quorate.dev/stage: layshaft-source}
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
workingDir: /tmp
|
||||
args: [/actions/source.fsx]
|
||||
env: &source-env
|
||||
- {name: HOME, value: /tmp}
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources: *small
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /source, subPath: source}
|
||||
- {name: work, mountPath: /tmp, subPath: source-tmp}
|
||||
- {name: source-auth, mountPath: /source-auth, readOnly: true}
|
||||
volumes:
|
||||
- *actions
|
||||
- &work {name: work, persistentVolumeClaim: {claimName: "{{inputs.parameters.working-pvc}}"}}
|
||||
- {name: source-auth, secret: {secretName: project-delivery-source, defaultMode: 0440}}
|
||||
- name: tools
|
||||
inputs: &lane-input
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
- name: lane
|
||||
podSpecPatch: 'runtimeClassName: gvisor'
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: layshaft-tools
|
||||
delivery.quorate.dev/lane: "{{inputs.parameters.lane}}"
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
workingDir: /tmp
|
||||
args: [/actions/tools.fsx]
|
||||
env:
|
||||
- {name: HOME, value: /tmp}
|
||||
- {name: LANE, value: "{{inputs.parameters.lane}}"}
|
||||
resources:
|
||||
requests: {cpu: 500m, memory: 512Mi}
|
||||
limits: {memory: 2Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /tools, subPath: "{{inputs.parameters.lane}}/tools"}
|
||||
- {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/tools-tmp"}
|
||||
volumes: [*actions, *work]
|
||||
- name: cache-pull
|
||||
inputs: *lane-input
|
||||
metadata:
|
||||
labels: {delivery.quorate.dev/stage: layshaft-pull}
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
workingDir: /tmp
|
||||
args: [/actions/cache.fsx]
|
||||
env:
|
||||
- {name: HOME, value: /tmp}
|
||||
- {name: LANE, value: "{{inputs.parameters.lane}}"}
|
||||
- {name: CACHE_ACTION, value: pull}
|
||||
resources: &cache-size
|
||||
requests: {cpu: 500m, memory: 256Mi}
|
||||
limits: {memory: 2Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /cache, subPath: "{{inputs.parameters.lane}}/cache"}
|
||||
- {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/cache-pull"}
|
||||
- &cache-auth {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||||
- &cache-ca-mount {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||||
volumes:
|
||||
- *actions
|
||||
- *work
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
|
||||
- &cache-ca {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- name: cache-export
|
||||
inputs: *lane-input
|
||||
metadata:
|
||||
labels: {delivery.quorate.dev/stage: layshaft-export}
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
workingDir: /tmp
|
||||
args: [/actions/cache.fsx]
|
||||
env:
|
||||
- {name: HOME, value: /tmp}
|
||||
- {name: LANE, value: "{{inputs.parameters.lane}}"}
|
||||
- {name: CACHE_ACTION, value: export}
|
||||
resources: *cache-size
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /cache, subPath: "{{inputs.parameters.lane}}/cache", readOnly: true}
|
||||
- {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/cache-export"}
|
||||
- *cache-auth
|
||||
- *cache-ca-mount
|
||||
volumes:
|
||||
- *actions
|
||||
- *work
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
|
||||
- *cache-ca
|
||||
- name: build
|
||||
inputs: *lane-input
|
||||
podSpecPatch: 'runtimeClassName: gvisor'
|
||||
metadata:
|
||||
labels: {delivery.quorate.dev/stage: layshaft-build}
|
||||
container:
|
||||
image: mcr.microsoft.com/dotnet/sdk@sha256:c45158dabdcffc8409ef46c9431c16b36d9419405b51fd29261fa8a6af3f516f
|
||||
command: [/usr/share/dotnet/dotnet, fsi, --exec]
|
||||
workingDir: /tmp
|
||||
args: [/actions/build.fsx]
|
||||
env:
|
||||
- {name: HOME, value: /tmp}
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
- {name: LANE, value: "{{inputs.parameters.lane}}"}
|
||||
- {name: DOTNET_GENERATE_ASPNET_CERTIFICATE, value: 'false'}
|
||||
resources:
|
||||
requests: {cpu: '2', memory: 2Gi}
|
||||
limits: {memory: 6Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: work, mountPath: /tools, subPath: "{{inputs.parameters.lane}}/tools", readOnly: true}
|
||||
- {name: work, mountPath: /cache, subPath: "{{inputs.parameters.lane}}/cache"}
|
||||
- {name: work, mountPath: /output, subPath: "{{inputs.parameters.lane}}/output"}
|
||||
- {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/build-tmp"}
|
||||
volumes: [*actions, *work]
|
||||
- name: client-publish
|
||||
inputs: *work-input
|
||||
metadata:
|
||||
labels: {delivery.quorate.dev/stage: layshaft-client-pub}
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
workingDir: /tmp
|
||||
args: [/actions/client.fsx]
|
||||
env: *source-env
|
||||
resources: *small
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /handoff, subPath: client/output, readOnly: true}
|
||||
- {name: work, mountPath: /result, subPath: client/result}
|
||||
- {name: work, mountPath: /tmp, subPath: client/publish-tmp}
|
||||
- {name: publisher-auth, mountPath: /publisher-auth, readOnly: true}
|
||||
volumes:
|
||||
- *actions
|
||||
- *work
|
||||
- {name: publisher-auth, secret: {secretName: layshaft-publisher, defaultMode: 0440}}
|
||||
outputs: &result-output
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom: {path: /result/delivery-result}
|
||||
- name: server-publish
|
||||
inputs: *work-input
|
||||
metadata:
|
||||
labels: {delivery.quorate.dev/stage: layshaft-server-pub}
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
workingDir: /tmp
|
||||
args: [/actions/server.fsx]
|
||||
env: *source-env
|
||||
resources: *small
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /handoff, subPath: server/output, readOnly: true}
|
||||
- {name: work, mountPath: /result, subPath: server/result}
|
||||
- {name: work, mountPath: /tmp, subPath: server/publish-tmp}
|
||||
- {name: auth, mountPath: /auth, readOnly: true}
|
||||
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||||
volumes:
|
||||
- *actions
|
||||
- *work
|
||||
- {name: auth, secret: {secretName: quay-writer, defaultMode: 0440}}
|
||||
- {name: registry-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
outputs: *result-output
|
||||
- name: result
|
||||
inputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
- name: client
|
||||
- name: server
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
workingDir: /tmp
|
||||
args: [/actions/result.fsx]
|
||||
env:
|
||||
- {name: HOME, value: /tmp}
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
- {name: CLIENT_RESULT, value: "{{inputs.parameters.client}}"}
|
||||
- {name: SERVER_RESULT, value: "{{inputs.parameters.server}}"}
|
||||
resources: *small
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- *actions-mount
|
||||
- {name: work, mountPath: /result, subPath: result}
|
||||
- {name: work, mountPath: /tmp, subPath: result-tmp}
|
||||
volumes: [*actions, *work]
|
||||
outputs: *result-output
|
||||
Loading…
Reference in a new issue