ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
2 changed files with 145336 additions and 0 deletions
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- workflowtemplate.yaml
|
||||
|
|
@ -0,0 +1,343 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: nuthatch-qualification
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: nuthatch-qualification
|
||||
spec:
|
||||
entrypoint: qualify
|
||||
serviceAccountName: qualification-executor
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: qualification-executor
|
||||
activeDeadlineSeconds: 10800
|
||||
parallelism: 2
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: "{{workflow.parameters.workflow-node}}"
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: nuthatch-qualification
|
||||
podSpecPatch: |
|
||||
imagePullSecrets:
|
||||
- name: quay-reader
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: test-image
|
||||
- name: workflow-node
|
||||
- name: gate
|
||||
value: all
|
||||
templates:
|
||||
- name: qualify
|
||||
dag:
|
||||
tasks:
|
||||
- name: gate
|
||||
template: bootstrap
|
||||
when: "{{=workflow.parameters['gate'] == 'all' || workflow.parameters['gate'] == item.gate}}"
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: gate, value: "{{item.gate}}"}
|
||||
- {name: coordination, value: "{{item.coordination}}"}
|
||||
- {name: oidc, value: "{{item.oidc}}"}
|
||||
- {name: target, value: "{{item.target}}"}
|
||||
withItems:
|
||||
- {gate: unit, coordination: none, oidc: none, target: none}
|
||||
- {gate: dependency, coordination: all, oidc: all, target: all}
|
||||
- {gate: fixture, coordination: all, oidc: all, target: all}
|
||||
- {gate: storage, coordination: none, oidc: none, target: all}
|
||||
- {gate: auth, coordination: all, oidc: all, target: all}
|
||||
- {gate: browser, coordination: redis, oidc: keycloak, target: garage}
|
||||
- {gate: idempotency, coordination: all, oidc: all, target: all}
|
||||
- {gate: product, coordination: all, oidc: all, target: all}
|
||||
- {gate: protocol, coordination: redis, oidc: none, target: all}
|
||||
- {gate: recovery, coordination: redis, oidc: none, target: all}
|
||||
- {gate: runtime, coordination: redis, oidc: keycloak, target: garage}
|
||||
- {gate: streaming, coordination: all, oidc: all, target: all}
|
||||
|
||||
- name: bootstrap
|
||||
inputs:
|
||||
parameters:
|
||||
- name: gate
|
||||
- name: coordination
|
||||
- name: oidc
|
||||
- name: target
|
||||
metadata:
|
||||
labels:
|
||||
qualification.quorate.dev/stage: bootstrap
|
||||
podSpecPatch: |
|
||||
containers:
|
||||
- name: main
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /kubernetes
|
||||
readOnly: true
|
||||
container:
|
||||
image: &fsi registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: &fsi-command [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/qualification.fsx]
|
||||
env:
|
||||
- {name: QUALIFICATION_ACTION, value: bootstrap}
|
||||
- {name: QUALIFICATION_RUN, value: "{{workflow.uid}}"}
|
||||
- {name: QUALIFICATION_GATE, value: "{{inputs.parameters.gate}}"}
|
||||
- {name: QUALIFICATION_COORDINATION, value: "{{inputs.parameters.coordination}}"}
|
||||
- {name: QUALIFICATION_OIDC, value: "{{inputs.parameters.oidc}}"}
|
||||
- {name: QUALIFICATION_TARGET, value: "{{inputs.parameters.target}}"}
|
||||
- {name: TEST_IMAGE, value: "{{workflow.parameters.test-image}}"}
|
||||
- {name: WORKFLOW_NODE, value: "{{workflow.parameters.workflow-node}}"}
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 128Mi}
|
||||
limits: {cpu: 500m, memory: 512Mi}
|
||||
securityContext: &restricted
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- name: orchestration
|
||||
configMap: {name: nuthatch-qualification-orch, defaultMode: 0444}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ClusterWorkflowTemplate
|
||||
metadata:
|
||||
name: nuthatch-qualification-lane
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: nuthatch-qualification
|
||||
spec:
|
||||
entrypoint: qualify
|
||||
serviceAccountName: qualification-lane
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: qualification-lane
|
||||
activeDeadlineSeconds: 7200
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: "{{workflow.parameters.workflow-node}}"
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: nuthatch-qualification
|
||||
app.kubernetes.io/instance: nuthatch
|
||||
podSpecPatch: |
|
||||
imagePullSecrets:
|
||||
- name: quay-reader
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: gate
|
||||
- name: coordination
|
||||
- name: oidc
|
||||
- name: target
|
||||
- name: test-image
|
||||
- name: workflow-node
|
||||
volumes:
|
||||
- name: orchestration
|
||||
configMap: {name: nuthatch-qualification-orch, defaultMode: 0444}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
templates:
|
||||
- name: qualify
|
||||
metadata:
|
||||
labels:
|
||||
qualification.quorate.dev/stage: qualification
|
||||
podSpecPatch: |
|
||||
containers:
|
||||
- name: main
|
||||
volumeMounts: &token-mount
|
||||
- name: exec-sa-token
|
||||
mountPath: /kubernetes
|
||||
readOnly: true
|
||||
- name: redis
|
||||
volumeMounts: *token-mount
|
||||
- name: dragonfly
|
||||
volumeMounts: *token-mount
|
||||
- name: keycloak
|
||||
volumeMounts: *token-mount
|
||||
- name: zitadel
|
||||
volumeMounts: *token-mount
|
||||
- name: garage
|
||||
volumeMounts: *token-mount
|
||||
- name: versitygw
|
||||
volumeMounts: *token-mount
|
||||
- name: test
|
||||
volumeMounts: *token-mount
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
containerSet:
|
||||
volumeMounts: &fixture-mounts
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
containers:
|
||||
- name: main
|
||||
image: &lane-fsi registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: &lane-fsi-command [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/postgres.fsx]
|
||||
env: &fixture-env
|
||||
- {name: QUALIFICATION_NAMESPACE, value: "{{workflow.namespace}}"}
|
||||
- {name: QUALIFICATION_GATE, value: "{{workflow.parameters.gate}}"}
|
||||
- {name: QUALIFICATION_COORDINATION, value: "{{workflow.parameters.coordination}}"}
|
||||
- {name: QUALIFICATION_OIDC, value: "{{workflow.parameters.oidc}}"}
|
||||
- {name: QUALIFICATION_TARGET, value: "{{workflow.parameters.target}}"}
|
||||
- {name: TEST_IMAGE, value: "{{workflow.parameters.test-image}}"}
|
||||
- {name: WORKFLOW_NODE, value: "{{workflow.parameters.workflow-node}}"}
|
||||
- {name: FSI_IMAGE, value: *lane-fsi}
|
||||
resources: &fixture-resources
|
||||
requests: {cpu: 25m, memory: 64Mi}
|
||||
limits: {cpu: 500m, memory: 512Mi}
|
||||
securityContext: &lane-restricted
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
- name: redis
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/redis.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: dragonfly
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/dragonfly.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: keycloak
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/keycloak.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: zitadel
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/zitadel.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: garage
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/garage.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: versitygw
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/versitygw.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: test
|
||||
dependencies: [redis, dragonfly, keycloak, zitadel, garage, versitygw]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/test.fsx]
|
||||
env: *fixture-env
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 128Mi}
|
||||
limits: {cpu: 500m, memory: 512Mi}
|
||||
securityContext: *lane-restricted
|
||||
Loading…
Reference in a new issue