ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
13 changed files with 145336 additions and 0 deletions
|
|
@ -0,0 +1,44 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- network-policy.yaml
|
||||
- workflowtemplate.yaml
|
||||
configMapGenerator:
|
||||
- name: remora-test-runner
|
||||
namespace: project-delivery
|
||||
files:
|
||||
- remora-test-runner.apko.yaml=remora-test-runner.apko.yaml
|
||||
options:
|
||||
labels:
|
||||
app.kubernetes.io/instance: remora
|
||||
- name: remora-test-shell
|
||||
namespace: project-delivery
|
||||
files:
|
||||
- remora-test-shell-x86_64.sha256=remora-test-shell-x86_64.sha256
|
||||
options:
|
||||
labels:
|
||||
app.kubernetes.io/instance: remora
|
||||
- name: remora-runtime
|
||||
namespace: project-delivery
|
||||
files:
|
||||
- remora-api.apko.yaml=remora-api.apko.yaml
|
||||
- remora-web.apko.yaml=remora-web.apko.yaml
|
||||
- remora-worker.apko.yaml=remora-worker.apko.yaml
|
||||
options:
|
||||
labels:
|
||||
app.kubernetes.io/instance: remora
|
||||
- name: remora-runtime-lock
|
||||
namespace: project-delivery
|
||||
files:
|
||||
- remora-runtime-aarch64.sha256=remora-runtime-aarch64.sha256
|
||||
- remora-runtime-x86_64.sha256=remora-runtime-x86_64.sha256
|
||||
- remora-runtime-aarch64.index.sha256=remora-runtime-aarch64.index.sha256
|
||||
- remora-runtime-x86_64.index.sha256=remora-runtime-x86_64.index.sha256
|
||||
- remora-test-x86_64.index.sha256=remora-test-x86_64.index.sha256
|
||||
options:
|
||||
labels:
|
||||
app.kubernetes.io/instance: remora
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: remora-source
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: remora-source
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: forge-git-http.forgejo-public.svc.cluster.local
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: forgejo-public
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forge-git
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: remora-toolchain
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: remora-toolchain
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: cdn.playwright.dev
|
||||
- matchName: github.com
|
||||
- matchName: index.crates.io
|
||||
- matchName: packages.wolfi.dev
|
||||
- matchName: playwright.download.prss.microsoft.com
|
||||
- matchName: registry.npmjs.org
|
||||
- matchName: release-assets.githubusercontent.com
|
||||
- matchName: static.crates.io
|
||||
- matchName: static.rust-lang.org
|
||||
- matchName: storage.googleapis.com
|
||||
- toFQDNs:
|
||||
- {matchName: cdn.playwright.dev}
|
||||
- {matchName: github.com}
|
||||
- {matchName: index.crates.io}
|
||||
- {matchName: packages.wolfi.dev}
|
||||
- {matchName: playwright.download.prss.microsoft.com}
|
||||
- {matchName: registry.npmjs.org}
|
||||
- {matchName: release-assets.githubusercontent.com}
|
||||
- {matchName: static.crates.io}
|
||||
- {matchName: static.rust-lang.org}
|
||||
- {matchName: storage.googleapis.com}
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: remora-cache
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [remora-cache-pull, remora-cache-export]
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: s3.quorate.internal
|
||||
- toCIDR: [10.66.127.81/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: versitygw
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "7070", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: remora-publication
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: publish-internal
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
- toCIDR: [10.108.252.250/32, 10.66.127.81/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: quay
|
||||
app: quay
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "8443", protocol: TCP}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
contents:
|
||||
repositories:
|
||||
- /workspace/repository
|
||||
packages:
|
||||
- busybox=1.37.0-r61
|
||||
- ca-certificates-bundle
|
||||
- glibc
|
||||
- libgcc
|
||||
- quorate-remora-api
|
||||
accounts:
|
||||
groups:
|
||||
- groupname: application
|
||||
gid: 65532
|
||||
users:
|
||||
- username: application
|
||||
uid: 65532
|
||||
gid: 65532
|
||||
run-as: 65532
|
||||
entrypoint:
|
||||
command: /usr/local/bin/remora-api
|
||||
environment:
|
||||
PATH: /usr/local/bin:/usr/bin:/bin
|
||||
|
|
@ -0,0 +1 @@
|
|||
44f8219ff7fb9e81cead1cbf8b59ba96c36fd26b08fbd6df9add9057ebe3e20d
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
6d774fc941dc7765b74ee340b8016e14f997f4c6fd1a66893ee8ad644c568f0c busybox-1.37.0-r61.apk
|
||||
b57bb873c64323630c8ab782a1f7fad0bb1310f2a8614e74d520374ee35d0070 c-ares-1.34.8-r0.apk
|
||||
a894593aa51c51425d7f40153d6207a6cfec8c1e9c4535592658a70d0efb39df ca-certificates-bundle-20260413-r0.apk
|
||||
2022b1a783c29cad27f82bfb1392172937d4551c5333b6e9edf3dcf46e9089e6 glibc-2.43-r11.apk
|
||||
34dd1e954b7ed68ac033b4977e865025accfd79b258133796715beb7957dd091 glibc-locale-posix-2.43-r11.apk
|
||||
333bba6e9f0978f8d4c4202a1417ecef83d514acd207212b85b7a3aa4b1056a0 icu78-data-full-78.3-r1.apk
|
||||
917bdc440d3f071f15f15ba075e7a7f8bd313621327efea8a981586664279472 ld-linux-2.43-r11.apk
|
||||
c48aeeb5135ff5c097dcaf1e374750a273a199a6566db44432617073ecaaa04c libbrotlicommon1-1.2.0-r3.apk
|
||||
4e280cdc166e0310218be9ec8bc3beef51e3d47427a73101b392490108765aa5 libbrotlidec1-1.2.0-r3.apk
|
||||
c28d6a1af259a490dd10fa36a1de484ab074dc70b91753460c310c2f6a952046 libbrotlienc1-1.2.0-r3.apk
|
||||
b7b51d79d24ce68617b21c9e47d2d909f984f8e5dfc09f8c5549c0008f95a937 libcrypto3-3.6.3-r3.apk
|
||||
a28a4e3cbd8d32aeebaed8fa27c851e639885a50d8fc3e2a6fc8ea6818a1c177 libcrypt1-2.43-r11.apk
|
||||
01d0f29263146d993b4b2e0ce56dced3b7e9700615dcf12a837e2df517b8661d libgcc-16.1.0-r4.apk
|
||||
0e317642bf4bea4915f86c5e40b24964d1dcbf1261a65ceb7666e73bf43b6452 libicu78-78.3-r1.apk
|
||||
72262931a03951c66bd1d3e503c40e12ac3ffaca2446eddf654b798064592c1b libnghttp2-14-1.70.0-r2.apk
|
||||
4a2b6c2255a27d8d6238d60bbd46101b2449a97d524aecc0b89f81f307bf55d3 libssl3-3.6.3-r3.apk
|
||||
c68b93b66292bd60d9a4d4960fa6f534b7cab8c566bba078bde136dfa9e77e95 libstdc++-16.1.0-r4.apk
|
||||
b4942b6f38d366247abd5920dc5f1cffd11d8c45f219338d1168dd5f79905e6f libxcrypt-4.5.2-r3.apk
|
||||
6a0e9a552165267e40ad4f104cae4032066f6b9b526b9a2563ef4a1b26db519a libuv-1.52.1-r1.apk
|
||||
9fbb11b4a81eb0d75de45d8c57aae993469be457dab5ad67fff4cb7a58367611 nodejs-24-24.18.1-r1.apk
|
||||
51e0e79dc5b570862fcaf818d338bc8a1c0e070de1c8d785356ab64230d8987a wolfi-baselayout-20230201-r29.apk
|
||||
1a91ed1d9c9f06629e5a5672c054ef539aaf6da2365c333509f980ef1c7f02ce zlib-1.3.2-r3.apk
|
||||
|
|
@ -0,0 +1 @@
|
|||
5306ee136b4e2c31152a7e4a2f253796b591bd1427cae75d866bcc2a31479535
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
2ca7f5ffc611dcd8130462443713abc907e64fe3e5006bd3c53960673566f5f8 busybox-1.37.0-r61.apk
|
||||
579d994e3849078b9d0b9e38a5da7d8b1d5a2a569b626f12a9e74710784095c4 c-ares-1.34.8-r0.apk
|
||||
353081c30814492d7f5f47834cb56b5662b8cff320f8836c5a4e2da7c03dd7b7 ca-certificates-bundle-20260413-r0.apk
|
||||
87983fb2cb5127bc789e316d23f021c8b6d1f5abc9c92dc0f712fc6ac63cec5b glibc-2.43-r11.apk
|
||||
90d8aa2aa456e5ccde7b113d38269bdafb500464aae42af495f4d2cda7605945 glibc-locale-posix-2.43-r11.apk
|
||||
b02a6cb15cc21dd5c9af2b7563d7a4063acf3a0b9fd3b79fa112c75104914a48 icu78-data-full-78.3-r1.apk
|
||||
0a48234fd70e0c6143e9c943033efd1bc1d7fcd9f55ad3a5d2fbb52c45127776 ld-linux-2.43-r11.apk
|
||||
49dbcc31d5126eece677200ef3c777be224c493ea4cd7a03cf3d36e27e9715f8 libbrotlicommon1-1.2.0-r3.apk
|
||||
1031104cad23db551bd510baf7fa0f9b419dfef9f7947eba2d6ec3f23528cddc libbrotlidec1-1.2.0-r3.apk
|
||||
d28217d62ea9d22c1c315a53e2e6e62bde75fd24dd859a43600c502ebca7d6d1 libbrotlienc1-1.2.0-r3.apk
|
||||
0a6db82a1064ff780f1609b5dc94a64d397924df8e6a339c0de7e210d6ae5474 libcrypto3-3.6.3-r3.apk
|
||||
866a42ac51824909346b1a3c84545f4e689efa4c6f53f19b071eae66c1e5f894 libcrypt1-2.43-r11.apk
|
||||
ad923214add20d7a410ee391718df91116ed29c12902c1170cf23a7c91adc602 libgcc-16.1.0-r4.apk
|
||||
c6d47a025599fd9154e2b337eeba9dd9cc3db2e7393a8e58ccc2b2886599272a libicu78-78.3-r1.apk
|
||||
6218d0c490d7310694c161d78b4f9ab2d4a2d743408a8e6b26cad9cc02ff21bd libnghttp2-14-1.70.0-r2.apk
|
||||
698c9f853a6afddff19a7e3005f3b68c78d254be6c256ed1b1a2c53826e023d4 libssl3-3.6.3-r3.apk
|
||||
9ac930b743608314f1a4bb0ed87518e0c5d26fbbe098f17f13dacd6bce6ab025 libstdc++-16.1.0-r4.apk
|
||||
e2a7657bde0d6e38c27e3d17de64474e9805cd92b3c8da2baa5dfba32a281ffb libxcrypt-4.5.2-r3.apk
|
||||
020c6d18c47547ff2875b57109f445066e717cd68c440dff57fb71cfee813fb2 libuv-1.52.1-r1.apk
|
||||
5af31d2691ad5ace3e081ed0dc756bb01804afb75bea458d56b5d8a2c7bf32c6 nodejs-24-24.18.1-r1.apk
|
||||
c7aef94f6c8e3060cac5a6b1dfa6257ad0d2d4d0a6ff93d02bba26e0ea518457 wolfi-baselayout-20230201-r29.apk
|
||||
26ec98f85dd79a99158ac2097fdfb31f029948c4b57046312592aa11a0639343 zlib-1.3.2-r3.apk
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
contents:
|
||||
repositories:
|
||||
- /workspace/repository
|
||||
packages:
|
||||
- bash=5.3-r12
|
||||
- busybox=1.37.0-r61
|
||||
- ca-certificates-bundle=20260413-r0
|
||||
- glibc
|
||||
- libgcc
|
||||
- quorate-remora-test-runner
|
||||
accounts:
|
||||
groups:
|
||||
- groupname: test
|
||||
gid: 65532
|
||||
users:
|
||||
- username: test
|
||||
uid: 65532
|
||||
gid: 65532
|
||||
run-as: 65532
|
||||
entrypoint:
|
||||
command: /bin/bash
|
||||
environment:
|
||||
HOME: /workspace
|
||||
PATH: /usr/local/bin:/usr/bin:/bin
|
||||
work-dir: /workspace
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
04db98c81192d3a52ece091fac002d5abd1bae97b43ef042c80196b7a9f8cc36 bash-5.3-r12.apk
|
||||
202529e6b97d8c535edc4bf2af80a3c992da11632d5d5086246e7c9c5039d344 ncurses-6.6.20260801-r0.apk
|
||||
0c3b9122d234e0bae7bacd3be6137d9bb888bc5e5dfc96a84cfdb64e6b207928 ncurses-terminfo-base-6.6.20260801-r0.apk
|
||||
|
|
@ -0,0 +1 @@
|
|||
9fcef4dcd5aa062390d7ec5812144a6c890494a6be787952bd5f6237f75bc502
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
contents:
|
||||
repositories:
|
||||
- /workspace/repository
|
||||
packages:
|
||||
- ca-certificates-bundle
|
||||
- nodejs-24=24.18.1-r1
|
||||
- quorate-remora-web
|
||||
accounts:
|
||||
groups:
|
||||
- groupname: application
|
||||
gid: 65532
|
||||
users:
|
||||
- username: application
|
||||
uid: 65532
|
||||
gid: 65532
|
||||
run-as: 65532
|
||||
entrypoint:
|
||||
command: /usr/bin/node /app/server.mjs
|
||||
environment:
|
||||
HOME: /app
|
||||
PATH: /usr/bin:/bin
|
||||
work-dir: /app
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
contents:
|
||||
repositories:
|
||||
- /workspace/repository
|
||||
packages:
|
||||
- busybox=1.37.0-r61
|
||||
- ca-certificates-bundle
|
||||
- glibc
|
||||
- libgcc
|
||||
- quorate-remora-worker
|
||||
accounts:
|
||||
groups:
|
||||
- groupname: application
|
||||
gid: 65532
|
||||
users:
|
||||
- username: application
|
||||
uid: 65532
|
||||
gid: 65532
|
||||
run-as: 65532
|
||||
entrypoint:
|
||||
command: /usr/local/bin/remora-worker
|
||||
environment:
|
||||
PATH: /usr/local/bin:/usr/bin:/bin
|
||||
|
|
@ -0,0 +1,466 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: remora-delivery
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: remora
|
||||
spec:
|
||||
entrypoint: workflow
|
||||
serviceAccountName: project-delivery-executor
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: project-delivery-executor
|
||||
parallelism: 4
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
delivery.quorate.dev/project: remora
|
||||
podSpecPatch: |
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: source-repository
|
||||
- name: source-ref
|
||||
- name: source-revision
|
||||
- name: targets
|
||||
- name: build-kind
|
||||
value: release
|
||||
templates:
|
||||
- name: workflow
|
||||
steps:
|
||||
- - name: initialize-workspace
|
||||
template: initialize-workspace
|
||||
- - name: delivery
|
||||
template: delivery
|
||||
arguments:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
value: "{{steps.initialize-workspace.outputs.parameters.working-pvc}}"
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom:
|
||||
parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"
|
||||
|
||||
- name: initialize-workspace
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: remora-workspace-init
|
||||
container:
|
||||
image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/initialize.fsx]
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
resources:
|
||||
requests: {cpu: 250m, memory: 128Mi}
|
||||
limits: {cpu: "1", memory: 512Mi}
|
||||
securityContext: &restricted
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
- name: workflow-workspace
|
||||
ephemeral:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
storageClassName: openebs-hostpath-ssd
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi
|
||||
outputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
valueFrom: {path: /workspace/.claim-name}
|
||||
|
||||
- name: delivery
|
||||
inputs:
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
dag:
|
||||
tasks:
|
||||
- name: tools
|
||||
template: tools
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: source
|
||||
dependencies: [tools]
|
||||
template: source
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: toolchain
|
||||
template: toolchain
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: cache-pull
|
||||
template: cache-pull
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: build
|
||||
dependencies: [source, toolchain, cache-pull]
|
||||
template: build
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: publish
|
||||
dependencies: [build]
|
||||
template: publish
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
- name: cache-export
|
||||
dependencies: [build]
|
||||
template: cache-export
|
||||
continueOn:
|
||||
failed: true
|
||||
error: true
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom:
|
||||
parameter: "{{tasks.publish.outputs.parameters.delivery-result}}"
|
||||
|
||||
- name: source
|
||||
inputs: &working-pvc-input
|
||||
parameters:
|
||||
- name: working-pvc
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: remora-source
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/source.fsx]
|
||||
env:
|
||||
- {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 64Mi}
|
||||
limits: {cpu: 500m, memory: 256Mi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /tools, subPath: tools, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: source-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- &workflow-workspace
|
||||
name: workflow-workspace
|
||||
persistentVolumeClaim:
|
||||
claimName: "{{inputs.parameters.working-pvc}}"
|
||||
|
||||
- name: tools
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: remora-toolchain
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/tools.fsx]
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {cpu: "1", memory: 1Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace, subPath: tools}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- *workflow-workspace
|
||||
- {name: temporary, emptyDir: {}}
|
||||
|
||||
- name: toolchain
|
||||
inputs: *working-pvc-input
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: remora-toolchain
|
||||
initContainers:
|
||||
- name: install
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/dependencies.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: TOOLCHAIN_ACTION, value: install}
|
||||
resources:
|
||||
requests: {cpu: 500m, memory: 1Gi}
|
||||
limits: {cpu: "3", memory: 6Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: runtime-lock, mountPath: /runtime-lock, readOnly: true}
|
||||
- {name: test-lock, mountPath: /test-lock, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace, subPath: toolchain}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: toolchain/tmp}
|
||||
- name: host-libs
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/host-libs.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: TOOLCHAIN_BASE, value: /workspace}
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {cpu: "1", memory: 512Mi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace, subPath: toolchain}
|
||||
- {name: workflow-workspace, mountPath: /host-lib, subPath: toolchain/host-lib}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: toolchain/tmp}
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/dependencies.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: TOOLCHAIN_ACTION, value: fetch}
|
||||
resources:
|
||||
requests: {cpu: 500m, memory: 1Gi}
|
||||
limits: {cpu: "3", memory: 6Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: runtime-lock, mountPath: /runtime-lock, readOnly: true}
|
||||
- {name: test-lock, mountPath: /test-lock, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace, subPath: toolchain}
|
||||
- {name: workflow-workspace, mountPath: /usr/lib, subPath: toolchain/host-lib, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: toolchain/tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- *workflow-workspace
|
||||
- {name: runtime-lock, configMap: {name: remora-runtime-lock, defaultMode: 0444}}
|
||||
- {name: test-lock, configMap: {name: remora-test-shell, defaultMode: 0444}}
|
||||
|
||||
- name: cache-pull
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: remora-cache-pull
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/cache.fsx]
|
||||
env:
|
||||
- {name: CACHE_ACTION, value: pull}
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
resources:
|
||||
requests: {cpu: "2", memory: 1Gi}
|
||||
limits: {cpu: "6", memory: 4Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||||
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||||
- {name: runtime-lock, mountPath: /runtime-lock, readOnly: true}
|
||||
- {name: test-lock, mountPath: /test-lock, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /source, subPath: source}
|
||||
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
|
||||
- {name: workflow-workspace, mountPath: /state, subPath: state}
|
||||
- {name: workflow-workspace, mountPath: /plan, subPath: state}
|
||||
- {name: workflow-workspace, mountPath: /state/restored-build-state/target, subPath: output/rust-target}
|
||||
- {name: workflow-workspace, mountPath: /state/restored-build-state/zig-wrappers, subPath: output/zig-wrappers}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: state/cache-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
|
||||
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- *workflow-workspace
|
||||
- {name: runtime-lock, configMap: {name: remora-runtime-lock, defaultMode: 0444}}
|
||||
- {name: test-lock, configMap: {name: remora-test-shell, defaultMode: 0444}}
|
||||
|
||||
- name: build
|
||||
inputs: *working-pvc-input
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: remora-build
|
||||
initContainers:
|
||||
- name: host-libs
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/host-libs.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: TOOLCHAIN_BASE, value: /workspace/dependencies}
|
||||
resources:
|
||||
requests: {cpu: 100m, memory: 128Mi}
|
||||
limits: {cpu: "1", memory: 512Mi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace/dependencies, subPath: toolchain}
|
||||
- {name: workflow-workspace, mountPath: /host-lib, subPath: toolchain/host-lib}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: output/tmp}
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/build.fsx]
|
||||
env:
|
||||
- {name: BUILD_ACTION, value: build}
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: XDG_CACHE_HOME, value: /state}
|
||||
resources:
|
||||
requests: {cpu: "6", memory: 8Gi}
|
||||
limits: {cpu: "12", memory: 24Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: apk-signing, mountPath: /apk-signing, readOnly: true}
|
||||
- {name: runtime-config, mountPath: /configuration, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace, subPath: output}
|
||||
- {name: workflow-workspace, mountPath: /workspace/rust/source, subPath: source/rust}
|
||||
- {name: workflow-workspace, mountPath: /workspace/rust/source/target, subPath: output/rust-target}
|
||||
- {name: workflow-workspace, mountPath: /workspace/rust/zig-cache/cargo-zigbuild/0.23.0/wrappers, subPath: output/zig-wrappers}
|
||||
- {name: workflow-workspace, mountPath: /workspace/web/source, subPath: source/web}
|
||||
- {name: workflow-workspace, mountPath: /workspace/dependencies, subPath: toolchain, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /usr/lib, subPath: toolchain/host-lib, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /workspace/state-input, subPath: state}
|
||||
- {name: workflow-workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /usr/bin, subPath: toolchain/build-usr-bin, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /state, subPath: output/state}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: output/tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- {name: apk-signing, secret: {secretName: apk-signing, defaultMode: 0440}}
|
||||
- *workflow-workspace
|
||||
- name: runtime-config
|
||||
projected:
|
||||
sources:
|
||||
- configMap: {name: remora-runtime}
|
||||
- configMap: {name: remora-test-runner}
|
||||
|
||||
- name: publish
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: publish-internal
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/push.fsx]
|
||||
env:
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
- {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
|
||||
- {name: TARGETS, value: "{{workflow.parameters.targets}}"}
|
||||
resources:
|
||||
requests: {cpu: 250m, memory: 512Mi}
|
||||
limits: {cpu: "2", memory: 2Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: registry-auth, mountPath: /auth, readOnly: true}
|
||||
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /handoff, subPath: output, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /result, subPath: output/result}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: output/publish-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- {name: registry-auth, secret: {secretName: quay-writer, defaultMode: 0440}}
|
||||
- {name: registry-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- *workflow-workspace
|
||||
outputs:
|
||||
parameters:
|
||||
- name: delivery-result
|
||||
valueFrom: {path: /result/delivery-result}
|
||||
|
||||
- name: cache-export
|
||||
inputs: *working-pvc-input
|
||||
metadata:
|
||||
labels:
|
||||
delivery.quorate.dev/stage: remora-cache-export
|
||||
container:
|
||||
image: *runner
|
||||
command: *fsi
|
||||
args: [/orchestration/cache.fsx]
|
||||
env:
|
||||
- {name: CACHE_ACTION, value: export}
|
||||
- {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
|
||||
resources:
|
||||
requests: {cpu: "6", memory: 2Gi}
|
||||
limits: {cpu: "12", memory: 8Gi}
|
||||
securityContext: *restricted
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: cache-auth, mountPath: /cache-auth, readOnly: true}
|
||||
- {name: cache-ca, mountPath: /cache-ca, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /plan, subPath: state, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /build-output, subPath: output, readOnly: true}
|
||||
- {name: workflow-workspace, mountPath: /tmp, subPath: exports/cache-tmp}
|
||||
volumes:
|
||||
- {name: orchestration, configMap: {name: remora-delivery-orch, defaultMode: 0444}}
|
||||
- {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
|
||||
- {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
|
||||
- *workflow-workspace
|
||||
Loading…
Reference in a new issue