ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
4 changed files with 145336 additions and 0 deletions
|
|
@ -0,0 +1,208 @@
|
|||
{
|
||||
"environmentPackages": [
|
||||
"alsa-lib=1.2.16.1-r2",
|
||||
"bash=5.3-r12",
|
||||
"binutils=2.47-r0",
|
||||
"build-base=1-r9",
|
||||
"busybox=1.37.0-r61",
|
||||
"ca-certificates=20260611-r1",
|
||||
"ca-certificates-bundle=20260413-r1",
|
||||
"clang-20=20.1.8-r18",
|
||||
"cmake=4.3.4-r1",
|
||||
"coreutils=9.11-r3",
|
||||
"curl=8.21.0-r1",
|
||||
"cyrus-sasl-heimdal-libs=2.1.28-r56",
|
||||
"diffutils=3.12-r6",
|
||||
"elfutils=0.196-r0",
|
||||
"elfutils-dev=0.196-r0",
|
||||
"fontconfig-config=2.18.3-r1",
|
||||
"freetype=2.14.3-r6",
|
||||
"gawk=5.4.1-r0",
|
||||
"gcc=16.2.0-r1",
|
||||
"gdbm=1.26-r6",
|
||||
"giflib=6.1.3-r1",
|
||||
"git=2.55.0-r4",
|
||||
"glibc-2.43=2.43-r14",
|
||||
"glibc-2.43-dev=2.43-r14",
|
||||
"glibc-2.43-locale-posix=2.43-r17",
|
||||
"gmp=6.3.0-r9",
|
||||
"grep=3.12-r7",
|
||||
"heimdal-libs=7.8.0-r52",
|
||||
"isl=0.28-r3",
|
||||
"java-cacerts=20260611-r1",
|
||||
"jitterentropy-library=3.7.0-r2",
|
||||
"jitterentropy-library-dev=3.7.0-r2",
|
||||
"json-c=0.19-r1",
|
||||
"jsoncpp=1.9.8-r3",
|
||||
"keyutils-libs=1.6.3-r40",
|
||||
"krb5-conf=1.0-r9",
|
||||
"krb5-libs=1.22.2-r3",
|
||||
"lcms2=2.19.1-r2",
|
||||
"ld-linux-2.43=2.43-r14",
|
||||
"libLLVM-20=20.1.8-r18",
|
||||
"libLLVM-22=22.1.8-r2",
|
||||
"libacl1=2.4.0-r3",
|
||||
"libarchive=3.8.9-r1",
|
||||
"libatomic=16.2.0-r1",
|
||||
"libattr1=2.6.0-r3",
|
||||
"libbpf=1.7.0-r4",
|
||||
"libbpf-dev=1.7.0-r3",
|
||||
"libbrotlicommon1=1.2.0-r5",
|
||||
"libbrotlidec1=1.2.0-r5",
|
||||
"libbz2-1=1.0.8-r24",
|
||||
"libclang-cpp-20=20.1.8-r18",
|
||||
"libcom_err=1.47.4-r2",
|
||||
"libcrypt1=2.40-r22",
|
||||
"libcrypto3=3.6.4-r5",
|
||||
"libcurl-openssl4=8.21.0-r3",
|
||||
"libdebuginfod=0.196-r0",
|
||||
"libdebuginfod-dev=0.196-r0",
|
||||
"libelf=0.196-r0",
|
||||
"libexpat1=2.8.4-r0",
|
||||
"libffi=3.8.0-r1",
|
||||
"libffi-dev=3.8.0-r0",
|
||||
"libfontconfig1=2.18.3-r1",
|
||||
"libgcc=16.2.0-r1",
|
||||
"libgomp=16.2.0-r1",
|
||||
"libidn2=2.3.8-r9",
|
||||
"libjpeg-turbo=3.2.0-r4",
|
||||
"libldap=2.6.10-r5",
|
||||
"liblz4-1=1.10.0-r10",
|
||||
"libnghttp2-14=1.70.0-r3",
|
||||
"libpcre2-8-0=10.48-r0",
|
||||
"libpng=1.6.58-r3",
|
||||
"libpsl=0.23.3-r1",
|
||||
"libquadmath=16.2.0-r1",
|
||||
"librhash0=1.4.6-r6",
|
||||
"libselinux=3.11-r2",
|
||||
"libsepol=3.11-r3",
|
||||
"libssl3=3.6.4-r5",
|
||||
"libstdc++=16.2.0-r1",
|
||||
"libstdc++-dev=16.2.0-r1",
|
||||
"libtasn1=4.21.0-r6",
|
||||
"libunistring=1.4.2-r3",
|
||||
"libuuid=2.42.3-r3",
|
||||
"libuv=1.52.1-r2",
|
||||
"libverto=0.3.2-r8",
|
||||
"libx11=1.8.13-r5",
|
||||
"libxau=1.0.12-r8",
|
||||
"libxcb=1.17.0-r16",
|
||||
"libxcrypt=4.5.2-r5",
|
||||
"libxcrypt-dev=4.5.2-r5",
|
||||
"libxdmcp=1.1.5-r11",
|
||||
"libxext=1.3.7-r3",
|
||||
"libxi=1.8.3-r1",
|
||||
"libxml2=2.15.0-r0",
|
||||
"libxrender=0.9.12-r9",
|
||||
"libxtst=1.2.5-r8",
|
||||
"libzstd1=1.5.7-r10",
|
||||
"linux-headers=7.2.5-r0",
|
||||
"lld-20=20.1.8-r18",
|
||||
"llvm-20=20.1.8-r18",
|
||||
"make=4.4.1-r13",
|
||||
"mpc=1.4.1-r1",
|
||||
"mpdecimal=4.0.1-r4",
|
||||
"mpfr=4.2.2-r3",
|
||||
"ncurses=6.6.20260905-r0",
|
||||
"ncurses-terminfo-base=6.6.20260905-r0",
|
||||
"nghttp3=1.18.0-r1",
|
||||
"ngtcp2=1.25.0-r2",
|
||||
"nss-db=2.43-r13",
|
||||
"nss-hesiod=2.43-r13",
|
||||
"numactl=2.0.19-r5",
|
||||
"numactl-dev=2.0.19-r4",
|
||||
"openjdk-17=17.0.20-r0",
|
||||
"openssf-compiler-options=20250904-r9",
|
||||
"openssl-dev=3.6.3-r4",
|
||||
"openssl-provider-legacy-allowed=4.0.2-r1",
|
||||
"p11-kit=0.26.5-r1",
|
||||
"p11-kit-trust=0.26.5-r1",
|
||||
"patch=2.8-r7",
|
||||
"pkgconf=3.0.5-r0",
|
||||
"posix-cc-wrappers=2-r10",
|
||||
"py3-pip-wheel=26.2.1-r1",
|
||||
"python-3.14=3.14.7-r1",
|
||||
"python-3.14-base=3.14.7-r1",
|
||||
"readline=8.3-r3",
|
||||
"rust-1.97=1.97.1-r0",
|
||||
"sqlite-libs=3.53.4-r2",
|
||||
"ttf-dejavu=2.37-r8",
|
||||
"unzip=6.0-r7",
|
||||
"wolfi-baselayout=20230201-r30",
|
||||
"xz=5.8.4-r0",
|
||||
"xz-dev=5.8.4-r0",
|
||||
"zig=0.15.2-r2",
|
||||
"zip=3.0-r10",
|
||||
"zlib=1.3.2-r5",
|
||||
"zlib-dev=1.3.2-r5",
|
||||
"zstd-dev=1.5.7-r10"
|
||||
],
|
||||
"bazel": {
|
||||
"name": "bazel",
|
||||
"url": "https://releases.bazel.build/8.3.1/release/bazel-8.3.1-linux-x86_64",
|
||||
"sha256": "17247e8a84245f59d3bc633d0cfe0a840992a7760a11af1a30012d03da31604c"
|
||||
},
|
||||
"rustStd": {
|
||||
"name": "rust-std-x86_64-musl.tar.gz",
|
||||
"url": "https://static.rust-lang.org/dist/2026-07-16/rust-std-1.97.1-x86_64-unknown-linux-musl.tar.gz",
|
||||
"sha256": "d160dfc81d21fdc72534859fae249fecf6ab70640375f64fc4e77005a48c18d0"
|
||||
},
|
||||
"cargoZigbuild": {
|
||||
"name": "cargo-zigbuild.tar.xz",
|
||||
"url": "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-x86_64-unknown-linux-musl.tar.xz",
|
||||
"sha256": "f0aa9cc8220a84788c6e4a9b6d80422f041659227b680fdef982d5a8ddffddb4"
|
||||
},
|
||||
"crossSysrootPackages": [
|
||||
"ca-certificates-bundle=20260611-r1",
|
||||
"glibc-2.44=2.44-r6",
|
||||
"glibc-2.44-locale-posix=2.44-r6",
|
||||
"glibc-dev=2.43-r13",
|
||||
"ld-linux-2.44=2.44-r6",
|
||||
"libgcc=16.2.0-r1",
|
||||
"libxcrypt=4.5.2-r5",
|
||||
"libxcrypt-dev=4.5.2-r5",
|
||||
"linux-headers=7.1.8-r0",
|
||||
"nss-db=2.43-r13",
|
||||
"nss-hesiod=2.43-r13",
|
||||
"wolfi-baselayout=20230201-r30"
|
||||
],
|
||||
"fuser": {
|
||||
"version": "0.17.0",
|
||||
"crateSha256": "80a5eca878900c2e39e9e52fd797954b7fc39eeefc8558257114bfea6a698fcf",
|
||||
"patch": {
|
||||
"path": "patches/fuser-0.17.0-lock-flags.patch",
|
||||
"sha256": "4d25e1af35c7a04d1904ef32899207880da1461c6fb8657090301c45c064e22a"
|
||||
}
|
||||
},
|
||||
"gvisor": {
|
||||
"revision": "9f8f6c917885d9ef3d84c17280939c012dea0dfe",
|
||||
"archiveSha256": "9d96426115f1bf54ef09ba41964c73dc3c809743519c8442016b8dd3fce0889d",
|
||||
"buildId": "9e711e005f13402e728a0c3ada3fdc67a38918da31f720e5be1006edc4272a51",
|
||||
"moduleLock": {
|
||||
"path": "patches/gvisor-9f8f6c917-MODULE.bazel.lock",
|
||||
"sha256": "8402c7beb4baf2c666f4b78e400ea3f15514b56117598c2cb5411d6a35208d34"
|
||||
},
|
||||
"patches": [
|
||||
{
|
||||
"path": "patches/gvisor-9f8f6c917-directory-handles.patch",
|
||||
"sha256": "541420eece9ec7efbef156bdb726744ead6b4d991d41c5560f4fdfe83fb2357a"
|
||||
},
|
||||
{
|
||||
"path": "patches/gvisor-9f8f6c917-private-ownership.patch",
|
||||
"sha256": "79a8c98502d3bb7c254ffb0885dbd26afffac227d04a0091ff91383df0842561"
|
||||
},
|
||||
{
|
||||
"path": "patches/gvisor-9f8f6c917-per-description-file-handles.patch",
|
||||
"sha256": "2403efb81df3185145d18ebdf8d511252fbc2fb414bae4746d7fe471ec4ea9d9"
|
||||
},
|
||||
{
|
||||
"path": "patches/gvisor-9f8f6c917-hostinet-recv-flags.patch",
|
||||
"sha256": "d3f49a22fe60955d422f63557bc16907fdf65dff368dff296af5535a67b76e74"
|
||||
},
|
||||
{
|
||||
"path": "patches/gvisor-9f8f6c917-gofer-zombie-state.patch",
|
||||
"sha256": "2b7c7444dc56ff47e63af951c24d1dd30092c278c4cba7a6dcd3c3f1062c3206"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- network-policy.yaml
|
||||
- workflowtemplate.yaml
|
||||
configMapGenerator:
|
||||
- name: lazaret-build-inputs
|
||||
namespace: project-delivery
|
||||
files:
|
||||
- inputs.json=dependency-inputs/inputs.json
|
||||
options:
|
||||
labels:
|
||||
app.kubernetes.io/instance: lazaret
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
|
|
@ -0,0 +1,156 @@
|
|||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: lazaret-source
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: lazaret-source
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: forge-git-http.forgejo-public.svc.cluster.local
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: forgejo-public
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forge-git
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: lazaret-upstream
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: lazaret-upstream
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: bcr.bazel.build
|
||||
- matchName: codeload.github.com
|
||||
- matchName: download.gnome.org
|
||||
- matchName: dl.google.com
|
||||
- matchName: files.pythonhosted.org
|
||||
- matchName: github.com
|
||||
- matchName: go.dev
|
||||
- matchName: golang.google.cn
|
||||
- matchName: index.crates.io
|
||||
- matchName: mirror.bazel.build
|
||||
- matchName: packages.wolfi.dev
|
||||
- matchName: pkgconfig.freedesktop.org
|
||||
- matchName: proxy.golang.org
|
||||
- matchName: release-assets.githubusercontent.com
|
||||
- matchName: releases.bazel.build
|
||||
- matchName: static.crates.io
|
||||
- matchName: static.rust-lang.org
|
||||
- matchName: storage.googleapis.com
|
||||
- toFQDNs:
|
||||
- {matchName: bcr.bazel.build}
|
||||
- {matchName: codeload.github.com}
|
||||
- {matchName: download.gnome.org}
|
||||
- {matchName: dl.google.com}
|
||||
- {matchName: files.pythonhosted.org}
|
||||
- {matchName: github.com}
|
||||
- {matchName: go.dev}
|
||||
- {matchName: golang.google.cn}
|
||||
- {matchName: index.crates.io}
|
||||
- {matchName: mirror.bazel.build}
|
||||
- {matchName: packages.wolfi.dev}
|
||||
- {matchName: pkgconfig.freedesktop.org}
|
||||
- {matchName: proxy.golang.org}
|
||||
- {matchName: release-assets.githubusercontent.com}
|
||||
- {matchName: releases.bazel.build}
|
||||
- {matchName: static.crates.io}
|
||||
- {matchName: static.rust-lang.org}
|
||||
- {matchName: storage.googleapis.com}
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: lazaret-cache
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [lazaret-cache-pull, lazaret-cache-export]
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: s3.quorate.internal
|
||||
- toCIDR: [10.66.127.81/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: versitygw
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "7070", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: lazaret-publication
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: lazaret-publication
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: forge-git-http.forgejo-public.svc.cluster.local
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: forgejo-public
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forge-git
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
|
|
@ -0,0 +1,417 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: lazaret-delivery
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: lazaret
|
||||
spec:
|
||||
entrypoint: workflow
|
||||
serviceAccountName: project-delivery-executor
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: project-delivery-executor
|
||||
parallelism: 4
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
delivery.quorate.dev/project: lazaret
|
||||
podSpecPatch: |
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: source-repository
|
||||
- name: source-ref
|
||||
- name: source-revision
|
||||
- name: targets
|
||||
- name: build-kind
|
||||
value: release
|
||||
templates:
|
||||
- name: workflow
|
||||
steps:
|
||||
- - name: initialize-workspace
|
||||
template: initialize-workspace
|
||||
- - name: delivery
|
||||
template: delivery
|
||||
arguments:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
value: "{{steps.initialize-workspace.outputs.parameters.working-pvc}}"
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom:
|
||||
parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"
|
||||
|
||||
- name: initialize-workspace
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-workspace-init
|
||||
container:
|
||||
image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/initialize.fsx]
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 64Mi}
|
||||
limits: {memory: 256Mi}
|
||||
securityContext: &restricted
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- &orchestration {name: orchestration, configMap: {name: lazaret-delivery-orch, defaultMode: 0444}}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
- name: workspace
|
||||
ephemeral:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
storageClassName: openebs-hostpath-ssd
|
||||
resources:
|
||||
requests:
|
||||
storage: 30Gi
|
||||
outputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
valueFrom: {path: /workspace/.claim-name}
|
||||
|
||||
- name: delivery
|
||||
inputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
dag:
|
||||
tasks:
|
||||
- name: tools
|
||||
template: tools
|
||||
arguments: &working-pvc-argument
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: source
|
||||
dependencies: [tools]
|
||||
template: source
|
||||
arguments: *working-pvc-argument
|
||||
- name: upstream
|
||||
template: upstream
|
||||
arguments: *working-pvc-argument
|
||||
- name: cache-pull
|
||||
template: cache-pull
|
||||
arguments: *working-pvc-argument
|
||||
- name: lazaret-build
|
||||
dependencies: [source, upstream, cache-pull]
|
||||
template: lazaret-build
|
||||
arguments: *working-pvc-argument
|
||||
- name: runsc-build
|
||||
dependencies: [upstream, cache-pull]
|
||||
template: runsc-build
|
||||
arguments: *working-pvc-argument
|
||||
- name: publish
|
||||
dependencies: [lazaret-build, runsc-build]
|
||||
template: publish
|
||||
arguments: *working-pvc-argument
|
||||
- name: cache-export
|
||||
dependencies: [lazaret-build, runsc-build]
|
||||
template: cache-export
|
||||
continueOn:
|
||||
failed: true
|
||||
error: true
|
||||
arguments: *working-pvc-argument
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom:
|
||||
parameter: "{{tasks.publish.outputs.parameters.delivery-result}}"
|
||||
|
||||
- name: source
|
||||
inputs: &working-pvc-input
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-source
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/source.fsx]
|
||||
env:
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {memory: 512Mi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workspace, mountPath: /tools, subPath: tools, readOnly: true}
|
||||
- {name: workspace, mountPath: /source, subPath: source}
|
||||
- {name: workspace, mountPath: /tmp, subPath: source-tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- &workspace
|
||||
name: workspace
|
||||
persistentVolumeClaim:
|
||||
claimName: "{{inputs.parameters.working-pvc}}"
|
||||
|
||||
- name: tools
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-upstream
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/tools.fsx]
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {cpu: "1", memory: 1Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace, subPath: tools}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- *workspace
|
||||
- {name: temporary, emptyDir: {}}
|
||||
|
||||
- name: upstream
|
||||
inputs: *working-pvc-input
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-upstream
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/dependencies.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
resources:
|
||||
requests: {cpu: "2", memory: 2Gi}
|
||||
limits: {memory: 12Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: build-inputs, mountPath: /build-inputs, readOnly: true}
|
||||
- {name: workspace, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/toolchain, subPath: toolchain}
|
||||
- {name: workspace, mountPath: /workspace/state, subPath: state/runsc}
|
||||
- {name: workspace, mountPath: /tmp, subPath: output/upstream-tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- *workspace
|
||||
- {name: build-inputs, configMap: {name: lazaret-build-inputs, defaultMode: 0444}}
|
||||
|
||||
- name: cache-pull
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-cache-pull
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/cache.fsx]
|
||||
env:
|
||||
- {name: CACHE_ACTION, value: pull}
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
resources:
|
||||
requests: {cpu: "2", memory: 1Gi}
|
||||
limits: {memory: 4Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||||
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||||
- {name: build-inputs, mountPath: /build-inputs, readOnly: true}
|
||||
- {name: workspace, mountPath: /source, subPath: source}
|
||||
- {name: workspace, mountPath: /toolchain, subPath: toolchain}
|
||||
- {name: workspace, mountPath: /state, subPath: state}
|
||||
- {name: workspace, mountPath: /plan, subPath: state}
|
||||
- {name: workspace, mountPath: /tmp, subPath: state/cache-tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- *workspace
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
|
||||
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- {name: build-inputs, configMap: {name: lazaret-build-inputs, defaultMode: 0444}}
|
||||
|
||||
- name: lazaret-build
|
||||
inputs: *working-pvc-input
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-build
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/build-lazaret.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
resources:
|
||||
requests: {cpu: "6", memory: 8Gi}
|
||||
limits: {memory: 24Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workspace, mountPath: /bin/sh, subPath: toolchain/environment/usr/bin/busybox, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/source, subPath: source/repository, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/source/.lazaret/vendor/fuser-0.17.0, subPath: toolchain/cargo/fuser-0.17.0, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/environment, subPath: toolchain/environment, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/cargo, subPath: toolchain/cargo, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/state, subPath: state/lazaret}
|
||||
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/output, subPath: output/lazaret}
|
||||
- {name: workspace, mountPath: /tmp, subPath: output/lazaret-tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- *workspace
|
||||
|
||||
- name: runsc-build
|
||||
inputs: *working-pvc-input
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-runsc-build
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/build-runsc.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
resources:
|
||||
requests: {cpu: "6", memory: 8Gi}
|
||||
limits: {memory: 24Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workspace, mountPath: /bin, subPath: toolchain/environment/usr/bin, readOnly: true}
|
||||
- {name: workspace, mountPath: /usr/bin, subPath: toolchain/environment/usr/bin, readOnly: true}
|
||||
- {name: workspace, mountPath: /usr/include, subPath: toolchain/environment/usr/include, readOnly: true}
|
||||
- {name: workspace, mountPath: /usr/lib, subPath: toolchain/environment/usr/lib, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/environment, subPath: toolchain/environment, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/toolchain/gvisor, subPath: toolchain/gvisor}
|
||||
- {name: workspace, mountPath: /workspace/state, subPath: state/runsc}
|
||||
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workspace, mountPath: /workspace/output, subPath: output/runsc}
|
||||
- {name: workspace, mountPath: /tmp, subPath: output/runsc-tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- *workspace
|
||||
|
||||
- name: publish
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-publication
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/push.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources:
|
||||
requests: {cpu: 250m, memory: 256Mi}
|
||||
limits: {memory: 1Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: publisher-auth, mountPath: /publisher-auth, readOnly: true}
|
||||
- {name: workspace, mountPath: /handoff/lazaret, subPath: output/lazaret, readOnly: true}
|
||||
- {name: workspace, mountPath: /handoff/runsc, subPath: output/runsc, readOnly: true}
|
||||
- {name: workspace, mountPath: /result, subPath: output/result}
|
||||
- {name: workspace, mountPath: /tmp, subPath: output/publish-tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- *workspace
|
||||
- {name: publisher-auth, secret: {secretName: lazaret-publisher, defaultMode: 0440}}
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom: {path: /result/delivery-result}
|
||||
|
||||
- name: cache-export
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: lazaret-cache-export
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/cache.fsx]
|
||||
env:
|
||||
- {name: CACHE_ACTION, value: export}
|
||||
resources:
|
||||
requests: {cpu: "4", memory: 2Gi}
|
||||
limits: {memory: 8Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||||
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||||
- {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
|
||||
- {name: workspace, mountPath: /state, subPath: state, readOnly: true}
|
||||
- {name: workspace, mountPath: /tmp, subPath: exports/cache-tmp}
|
||||
volumes:
|
||||
- *orchestration
|
||||
- *workspace
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
|
||||
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
Loading…
Reference in a new issue