ce7cb702218693d08ea6d83464d2457c9250027c

services/project-delivery/k8s/workflows/layshaft/workflowtemplate.yaml

@@ -0,0 +1,401 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: layshaft-build
+  namespace: project-delivery
+  labels:
+    app.kubernetes.io/name: project-delivery
+    app.kubernetes.io/instance: layshaft
+spec:
+  entrypoint: workflow
+  serviceAccountName: project-delivery-executor
+  automountServiceAccountToken: false
+  executor:
+    serviceAccountName: project-delivery-executor
+  parallelism: 8
+  podGC:
+    strategy: OnWorkflowCompletion
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: project-delivery
+      delivery.quorate.dev/project: layshaft
+  podSpecPatch: |
+    dnsConfig:
+      options:
+        - name: ndots
+          value: "1"
+    containers:
+      - name: wait
+        volumeMounts:
+          - name: exec-sa-token
+            mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+            readOnly: true
+    volumes:
+      - name: exec-sa-token
+        secret: null
+        projected:
+          defaultMode: 0440
+          sources:
+            - serviceAccountToken:
+                expirationSeconds: 1800
+                path: token
+            - configMap:
+                name: kube-root-ca.crt
+                items:
+                  - {key: ca.crt, path: ca.crt}
+            - downwardAPI:
+                items:
+                  - path: namespace
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: metadata.namespace
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    fsGroup: 65532
+    fsGroupChangePolicy: OnRootMismatch
+    seccompProfile:
+      type: RuntimeDefault
+  arguments:
+    parameters:
+      - name: source-repository
+      - name: source-ref
+      - name: source-revision
+      - name: targets
+  templates:
+    - name: workflow
+      steps:
+        - - name: initialize
+            template: initialize
+        - - name: delivery
+            template: delivery
+            arguments:
+              parameters:
+                - {name: working-pvc, value: "{{steps.initialize.outputs.parameters.working-pvc}}"}
+      outputs:
+        parameters:
+          - name: delivery-result
+            valueFrom:
+              parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"
+    - name: initialize
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: layshaft-init
+      container:
+        image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:f33600d25acd0c56f6fac66282b08e52eec2942b906649abb47600ed7ac203cf
+        command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
+        workingDir: /tmp
+        args: [/actions/initialize.fsx]
+        env:
+          - {name: HOME, value: /tmp}
+          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
+          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
+          - {name: TARGETS, value: "{{workflow.parameters.targets}}"}
+          - name: POD_NAME
+            valueFrom:
+              fieldRef: {fieldPath: metadata.name}
+        resources: &small
+          requests: {cpu: 100m, memory: 128Mi}
+          limits: {memory: 1Gi}
+        securityContext: &restricted
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities: {drop: [ALL]}
+        volumeMounts:
+          - &actions-mount {name: actions, mountPath: /actions, readOnly: true}
+          - {name: work, mountPath: /workspace}
+          - {name: work, mountPath: /tmp}
+      volumes:
+        - &actions {name: actions, configMap: {name: layshaft-orch, defaultMode: 0444}}
+        - name: work
+          ephemeral:
+            volumeClaimTemplate:
+              spec:
+                accessModes: [ReadWriteOnce]
+                storageClassName: openebs-hostpath-ssd
+                resources:
+                  requests: {storage: 8Gi}
+      outputs:
+        parameters:
+          - name: working-pvc
+            valueFrom: {path: /workspace/.claim-name}
+    - name: delivery
+      inputs:
+        parameters:
+          - name: working-pvc
+      dag:
+        tasks:
+          - name: source-pull
+            template: source-pull
+            arguments: &work-arg
+              parameters:
+                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
+          - name: client-tools
+            template: tools
+            arguments: &client-arg
+              parameters:
+                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
+                - {name: lane, value: client}
+          - name: server-tools
+            template: tools
+            arguments: &server-arg
+              parameters:
+                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
+                - {name: lane, value: server}
+          - name: client-cache-pull
+            template: cache-pull
+            arguments: *client-arg
+          - name: server-cache-pull
+            template: cache-pull
+            arguments: *server-arg
+          - name: client-build
+            template: build
+            dependencies: [source-pull, client-tools, client-cache-pull]
+            arguments: *client-arg
+          - name: server-build
+            template: build
+            dependencies: [source-pull, server-tools, server-cache-pull]
+            arguments: *server-arg
+          - name: client-export
+            template: cache-export
+            dependencies: [client-build]
+            arguments: *client-arg
+          - name: server-export
+            template: cache-export
+            dependencies: [server-build]
+            arguments: *server-arg
+          - name: client-publish
+            template: client-publish
+            dependencies: [client-build]
+            arguments: *work-arg
+          - name: server-publish
+            template: server-publish
+            dependencies: [server-build]
+            arguments: *work-arg
+          - name: result
+            template: result
+            dependencies: [client-publish, server-publish]
+            arguments:
+              parameters:
+                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
+                - {name: client, value: "{{tasks.client-publish.outputs.parameters.delivery-result}}"}
+                - {name: server, value: "{{tasks.server-publish.outputs.parameters.delivery-result}}"}
+      outputs:
+        parameters:
+          - name: delivery-result
+            valueFrom: {parameter: "{{tasks.result.outputs.parameters.delivery-result}}"}
+    - name: source-pull
+      inputs: &work-input
+        parameters:
+          - name: working-pvc
+      metadata:
+        labels: {delivery.quorate.dev/stage: layshaft-source}
+      container:
+        image: *runner
+        command: *fsi
+        workingDir: /tmp
+        args: [/actions/source.fsx]
+        env: &source-env
+          - {name: HOME, value: /tmp}
+          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
+          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
+          - {name: TARGETS, value: "{{workflow.parameters.targets}}"}
+        resources: *small
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /source, subPath: source}
+          - {name: work, mountPath: /tmp, subPath: source-tmp}
+          - {name: source-auth, mountPath: /source-auth, readOnly: true}
+      volumes:
+        - *actions
+        - &work {name: work, persistentVolumeClaim: {claimName: "{{inputs.parameters.working-pvc}}"}}
+        - {name: source-auth, secret: {secretName: project-delivery-source, defaultMode: 0440}}
+    - name: tools
+      inputs: &lane-input
+        parameters:
+          - name: working-pvc
+          - name: lane
+      podSpecPatch: 'runtimeClassName: gvisor'
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: layshaft-tools
+          delivery.quorate.dev/lane: "{{inputs.parameters.lane}}"
+      container:
+        image: *runner
+        command: *fsi
+        workingDir: /tmp
+        args: [/actions/tools.fsx]
+        env:
+          - {name: HOME, value: /tmp}
+          - {name: LANE, value: "{{inputs.parameters.lane}}"}
+        resources:
+          requests: {cpu: 500m, memory: 512Mi}
+          limits: {memory: 2Gi}
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /tools, subPath: "{{inputs.parameters.lane}}/tools"}
+          - {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/tools-tmp"}
+      volumes: [*actions, *work]
+    - name: cache-pull
+      inputs: *lane-input
+      metadata:
+        labels: {delivery.quorate.dev/stage: layshaft-pull}
+      container:
+        image: *runner
+        command: *fsi
+        workingDir: /tmp
+        args: [/actions/cache.fsx]
+        env:
+          - {name: HOME, value: /tmp}
+          - {name: LANE, value: "{{inputs.parameters.lane}}"}
+          - {name: CACHE_ACTION, value: pull}
+        resources: &cache-size
+          requests: {cpu: 500m, memory: 256Mi}
+          limits: {memory: 2Gi}
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /cache, subPath: "{{inputs.parameters.lane}}/cache"}
+          - {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/cache-pull"}
+          - &cache-auth {name: cache-auth, mountPath: /cache-auth, readOnly: true}
+          - &cache-ca-mount {name: cache-ca, mountPath: /cache-ca, readOnly: true}
+      volumes:
+        - *actions
+        - *work
+        - {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
+        - &cache-ca {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
+    - name: cache-export
+      inputs: *lane-input
+      metadata:
+        labels: {delivery.quorate.dev/stage: layshaft-export}
+      container:
+        image: *runner
+        command: *fsi
+        workingDir: /tmp
+        args: [/actions/cache.fsx]
+        env:
+          - {name: HOME, value: /tmp}
+          - {name: LANE, value: "{{inputs.parameters.lane}}"}
+          - {name: CACHE_ACTION, value: export}
+        resources: *cache-size
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /cache, subPath: "{{inputs.parameters.lane}}/cache", readOnly: true}
+          - {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/cache-export"}
+          - *cache-auth
+          - *cache-ca-mount
+      volumes:
+        - *actions
+        - *work
+        - {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
+        - *cache-ca
+    - name: build
+      inputs: *lane-input
+      podSpecPatch: 'runtimeClassName: gvisor'
+      metadata:
+        labels: {delivery.quorate.dev/stage: layshaft-build}
+      container:
+        image: mcr.microsoft.com/dotnet/sdk@sha256:c45158dabdcffc8409ef46c9431c16b36d9419405b51fd29261fa8a6af3f516f
+        command: [/usr/share/dotnet/dotnet, fsi, --exec]
+        workingDir: /tmp
+        args: [/actions/build.fsx]
+        env:
+          - {name: HOME, value: /tmp}
+          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
+          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
+          - {name: TARGETS, value: "{{workflow.parameters.targets}}"}
+          - {name: LANE, value: "{{inputs.parameters.lane}}"}
+          - {name: DOTNET_GENERATE_ASPNET_CERTIFICATE, value: 'false'}
+        resources:
+          requests: {cpu: '2', memory: 2Gi}
+          limits: {memory: 6Gi}
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /source, subPath: source, readOnly: true}
+          - {name: work, mountPath: /tools, subPath: "{{inputs.parameters.lane}}/tools", readOnly: true}
+          - {name: work, mountPath: /cache, subPath: "{{inputs.parameters.lane}}/cache"}
+          - {name: work, mountPath: /output, subPath: "{{inputs.parameters.lane}}/output"}
+          - {name: work, mountPath: /tmp, subPath: "{{inputs.parameters.lane}}/build-tmp"}
+      volumes: [*actions, *work]
+    - name: client-publish
+      inputs: *work-input
+      metadata:
+        labels: {delivery.quorate.dev/stage: layshaft-client-pub}
+      container:
+        image: *runner
+        command: *fsi
+        workingDir: /tmp
+        args: [/actions/client.fsx]
+        env: *source-env
+        resources: *small
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /handoff, subPath: client/output, readOnly: true}
+          - {name: work, mountPath: /result, subPath: client/result}
+          - {name: work, mountPath: /tmp, subPath: client/publish-tmp}
+          - {name: publisher-auth, mountPath: /publisher-auth, readOnly: true}
+      volumes:
+        - *actions
+        - *work
+        - {name: publisher-auth, secret: {secretName: layshaft-publisher, defaultMode: 0440}}
+      outputs: &result-output
+        parameters:
+          - name: delivery-result
+            valueFrom: {path: /result/delivery-result}
+    - name: server-publish
+      inputs: *work-input
+      metadata:
+        labels: {delivery.quorate.dev/stage: layshaft-server-pub}
+      container:
+        image: *runner
+        command: *fsi
+        workingDir: /tmp
+        args: [/actions/server.fsx]
+        env: *source-env
+        resources: *small
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /handoff, subPath: server/output, readOnly: true}
+          - {name: work, mountPath: /result, subPath: server/result}
+          - {name: work, mountPath: /tmp, subPath: server/publish-tmp}
+          - {name: auth, mountPath: /auth, readOnly: true}
+          - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
+      volumes:
+        - *actions
+        - *work
+        - {name: auth, secret: {secretName: quay-writer, defaultMode: 0440}}
+        - {name: registry-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
+      outputs: *result-output
+    - name: result
+      inputs:
+        parameters:
+          - name: working-pvc
+          - name: client
+          - name: server
+      container:
+        image: *runner
+        command: *fsi
+        workingDir: /tmp
+        args: [/actions/result.fsx]
+        env:
+          - {name: HOME, value: /tmp}
+          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
+          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
+          - {name: TARGETS, value: "{{workflow.parameters.targets}}"}
+          - {name: CLIENT_RESULT, value: "{{inputs.parameters.client}}"}
+          - {name: SERVER_RESULT, value: "{{inputs.parameters.server}}"}
+        resources: *small
+        securityContext: *restricted
+        volumeMounts:
+          - *actions-mount
+          - {name: work, mountPath: /result, subPath: result}
+          - {name: work, mountPath: /tmp, subPath: result-tmp}
+      volumes: [*actions, *work]
+      outputs: *result-output