ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
6 changed files with 145336 additions and 0 deletions
|
|
@ -0,0 +1,90 @@
|
|||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: qualification-executor
|
||||
annotations:
|
||||
policies.kyverno.io/category: Project Delivery
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/title: Restrict qualification executor
|
||||
spec:
|
||||
admission: true
|
||||
background: false
|
||||
validationFailureAction: Enforce
|
||||
rules:
|
||||
- name: qualification-namespaces
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds: [Namespace]
|
||||
operations: [CREATE]
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: qualification-executor
|
||||
namespace: project-delivery
|
||||
validate:
|
||||
message: Qualification namespaces must use the recorded identity and labels.
|
||||
anyPattern:
|
||||
- metadata:
|
||||
generateName: qual-remora-????????-
|
||||
labels:
|
||||
qualification.quorate.dev/project: remora
|
||||
qualification.quorate.dev/run: "?*"
|
||||
qualification.quorate.dev/lane: "?*"
|
||||
- metadata:
|
||||
name: qual-????????????????????????????????-????????
|
||||
labels:
|
||||
qualification.quorate.dev/project: nuthatch
|
||||
qualification.quorate.dev/run: "?*"
|
||||
qualification.quorate.dev/lane: "?*"
|
||||
- name: qualification-delete
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds: [Namespace]
|
||||
operations: [DELETE]
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: qualification-executor
|
||||
namespace: project-delivery
|
||||
validate:
|
||||
anyPattern:
|
||||
- metadata:
|
||||
name: qual-remora-????????-*
|
||||
labels:
|
||||
qualification.quorate.dev/project: remora
|
||||
- metadata:
|
||||
name: qual-????????????????????????????????-????????
|
||||
labels:
|
||||
qualification.quorate.dev/project: nuthatch
|
||||
- name: qualification-gc-delete
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds: [Namespace]
|
||||
operations: [DELETE]
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: qualification-gc
|
||||
namespace: project-delivery
|
||||
validate:
|
||||
pattern:
|
||||
metadata:
|
||||
name: qual-remora-????????-*
|
||||
labels:
|
||||
qualification.quorate.dev/project: remora
|
||||
- name: qualification-resources
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds: [ServiceAccount, ConfigMap, Service, Pod, Deployment, Job, NetworkPolicy, RoleBinding, Workflow]
|
||||
operations: [CREATE, UPDATE, DELETE]
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: qualification-executor
|
||||
namespace: project-delivery
|
||||
validate:
|
||||
anyPattern:
|
||||
- metadata:
|
||||
namespace: qual-remora-????????-*
|
||||
- metadata:
|
||||
namespace: qual-????????????????????????????????-????????
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- rbac.yaml
|
||||
- guard.yaml
|
||||
- network-policy.yaml
|
||||
- workflowtemplate.yaml
|
||||
|
|
@ -0,0 +1,130 @@
|
|||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-ingress-remora-qualification-replies
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values:
|
||||
- project-delivery
|
||||
- key: io.cilium.k8s.policy.serviceaccount
|
||||
operator: In
|
||||
values:
|
||||
- qualification-executor
|
||||
- key: qualification.quorate.dev/stage
|
||||
operator: Exists
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values:
|
||||
- remora
|
||||
- nuthatch
|
||||
- key: io.cilium.k8s.policy.serviceaccount
|
||||
operator: In
|
||||
values:
|
||||
- qualification-lane
|
||||
- key: qualification.quorate.dev/stage
|
||||
operator: Exists
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "32768"
|
||||
endPort: 60999
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: qual-host-egress
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values: [remora, nuthatch]
|
||||
- key: qualification.quorate.dev/component
|
||||
operator: In
|
||||
values: [postgres]
|
||||
toPorts:
|
||||
- ports: [{port: "5432", protocol: TCP}]
|
||||
- toEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values: [remora, nuthatch]
|
||||
- key: qualification.quorate.dev/component
|
||||
operator: In
|
||||
values: [redis, dragonfly]
|
||||
toPorts:
|
||||
- ports: [{port: "6379", protocol: TCP}]
|
||||
- toEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values: [remora]
|
||||
- key: qualification.quorate.dev/component
|
||||
operator: In
|
||||
values: [vault]
|
||||
toPorts:
|
||||
- ports: [{port: "8200", protocol: TCP}]
|
||||
- toEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values: [remora, nuthatch]
|
||||
- key: qualification.quorate.dev/component
|
||||
operator: In
|
||||
values: [keycloak, zitadel]
|
||||
toPorts:
|
||||
- ports: [{port: "8080", protocol: TCP}]
|
||||
- toEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values: [remora, nuthatch]
|
||||
- key: qualification.quorate.dev/component
|
||||
operator: In
|
||||
values: [garage]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3900", protocol: TCP}
|
||||
- {port: "3901", protocol: TCP}
|
||||
- {port: "3903", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values: [remora, nuthatch]
|
||||
- key: qualification.quorate.dev/component
|
||||
operator: In
|
||||
values: [versitygw]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "10000", protocol: TCP}
|
||||
- {port: "10001", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: qual-host-replies
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.cilium.k8s.namespace.labels.qualification.quorate.dev/project
|
||||
operator: In
|
||||
values: [remora, nuthatch]
|
||||
- key: qualification.quorate.dev/component
|
||||
operator: In
|
||||
values: [postgres, redis, dragonfly, vault, keycloak, zitadel, garage, versitygw]
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "32768"
|
||||
endPort: 60999
|
||||
protocol: TCP
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quay-reader
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
destination:
|
||||
annotations:
|
||||
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
|
||||
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: qual-([0-9a-f]+-[0-9a-f]{8}|[a-z0-9-]+-[0-9a-f]{8}-.*)
|
||||
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
|
||||
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: qual-([0-9a-f]+-[0-9a-f]{8}|[a-z0-9-]+-[0-9a-f]{8}-.*)
|
||||
|
|
@ -0,0 +1,142 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: qualification-executor
|
||||
namespace: project-delivery
|
||||
automountServiceAccountToken: false
|
||||
imagePullSecrets:
|
||||
- name: quay-reader
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: qualification-executor
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
- quay-reader
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
resourceNames:
|
||||
- qualification-lane
|
||||
verbs:
|
||||
- bind
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtaskresults
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: qualification-executor
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: qualification-executor
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: qualification-executor
|
||||
namespace: project-delivery
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: qualification-lane
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
verbs: [create, get, patch]
|
||||
- apiGroups: [""]
|
||||
resources: [secrets]
|
||||
verbs: [create, get]
|
||||
- apiGroups: [""]
|
||||
resources: [services]
|
||||
verbs: [create, delete, get, patch]
|
||||
- apiGroups: [""]
|
||||
resources: [pods]
|
||||
verbs: [delete, get, list, patch]
|
||||
- apiGroups: [""]
|
||||
resources: [pods/log]
|
||||
verbs: [get]
|
||||
- apiGroups: [apps]
|
||||
resources: [deployments]
|
||||
verbs: [create, delete, get, patch]
|
||||
- apiGroups: [batch]
|
||||
resources: [jobs]
|
||||
verbs: [create, delete, get]
|
||||
- apiGroups: [networking.k8s.io]
|
||||
resources: [networkpolicies]
|
||||
verbs: [create]
|
||||
- apiGroups: [argoproj.io]
|
||||
resources: [workflowtaskresults]
|
||||
verbs: [create, patch]
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: qualification-gc
|
||||
namespace: project-delivery
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: qualification-gc
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: [namespaces]
|
||||
verbs: [list, delete]
|
||||
- apiGroups: [argoproj.io]
|
||||
resources: [workflowtaskresults]
|
||||
verbs: [create, patch]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: qualification-gc
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: qualification-gc
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: qualification-gc
|
||||
namespace: project-delivery
|
||||
|
|
@ -0,0 +1,514 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: remora-qualification
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: remora-qualification
|
||||
spec:
|
||||
entrypoint: qualify
|
||||
serviceAccountName: qualification-executor
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: qualification-executor
|
||||
activeDeadlineSeconds: 7200
|
||||
parallelism: 8
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: "{{workflow.parameters.workflow-node}}"
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: remora-qualification
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
imagePullSecrets:
|
||||
- name: quay-reader
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: test-image
|
||||
- name: workflow-node
|
||||
templates:
|
||||
- name: qualify
|
||||
dag:
|
||||
tasks:
|
||||
- name: lane
|
||||
template: lane
|
||||
arguments:
|
||||
parameters:
|
||||
- {name: lane, value: "{{item.lane}}"}
|
||||
- {name: fixture-key, value: "{{item.key}}"}
|
||||
- {name: coordination, value: "{{item.coordination}}"}
|
||||
- {name: oidc, value: "{{item.oidc}}"}
|
||||
- {name: target, value: "{{item.target}}"}
|
||||
withItems:
|
||||
- {lane: redis-keycloak-garage, key: 48e7a1ad, coordination: redis, oidc: keycloak, target: garage}
|
||||
- {lane: redis-keycloak-versitygw, key: c06df825, coordination: redis, oidc: keycloak, target: versitygw}
|
||||
- {lane: redis-zitadel-garage, key: 7be6df95, coordination: redis, oidc: zitadel, target: garage}
|
||||
- {lane: redis-zitadel-versitygw, key: ad6203d4, coordination: redis, oidc: zitadel, target: versitygw}
|
||||
- {lane: dragonfly-keycloak-garage, key: 36fdeccd, coordination: dragonfly, oidc: keycloak, target: garage}
|
||||
- {lane: dragonfly-keycloak-versitygw, key: ae9bb2a9, coordination: dragonfly, oidc: keycloak, target: versitygw}
|
||||
- {lane: dragonfly-zitadel-garage, key: 79049217, coordination: dragonfly, oidc: zitadel, target: garage}
|
||||
- {lane: dragonfly-zitadel-versitygw, key: ec7a193f, coordination: dragonfly, oidc: zitadel, target: versitygw}
|
||||
|
||||
- name: lane
|
||||
inputs:
|
||||
parameters:
|
||||
- name: lane
|
||||
- name: fixture-key
|
||||
- name: coordination
|
||||
- name: oidc
|
||||
- name: target
|
||||
metadata:
|
||||
labels:
|
||||
qualification.quorate.dev/stage: bootstrap
|
||||
podSpecPatch: |
|
||||
containers:
|
||||
- name: main
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /kubernetes
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
container:
|
||||
image: &fsi registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: &fsi-command [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/postgres.fsx]
|
||||
env:
|
||||
- {name: QUALIFICATION_ACTION, value: bootstrap}
|
||||
- {name: QUALIFICATION_RUN, value: "{{workflow.uid}}"}
|
||||
- {name: QUALIFICATION_LANE, value: "{{inputs.parameters.lane}}"}
|
||||
- {name: QUALIFICATION_KEY, value: "{{inputs.parameters.fixture-key}}"}
|
||||
- {name: QUALIFICATION_COORDINATION, value: "{{inputs.parameters.coordination}}"}
|
||||
- {name: QUALIFICATION_OIDC, value: "{{inputs.parameters.oidc}}"}
|
||||
- {name: QUALIFICATION_TARGET, value: "{{inputs.parameters.target}}"}
|
||||
- {name: TEST_IMAGE, value: "{{workflow.parameters.test-image}}"}
|
||||
- {name: WORKFLOW_NODE, value: "{{workflow.parameters.workflow-node}}"}
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 128Mi}
|
||||
limits: {cpu: 500m, memory: 512Mi}
|
||||
securityContext: &restricted
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- name: orchestration
|
||||
configMap: {name: remora-qualification-orch, defaultMode: 0444}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ClusterWorkflowTemplate
|
||||
metadata:
|
||||
name: remora-qualification-lane
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: remora-qualification
|
||||
spec:
|
||||
entrypoint: qualify
|
||||
serviceAccountName: qualification-lane
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: qualification-lane
|
||||
activeDeadlineSeconds: 5400
|
||||
podGC:
|
||||
strategy: OnPodSuccess
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: "{{workflow.parameters.workflow-node}}"
|
||||
podMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: remora-qualification
|
||||
app.kubernetes.io/instance: remora
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
imagePullSecrets:
|
||||
- name: quay-reader
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
arguments:
|
||||
parameters:
|
||||
- name: lane
|
||||
- name: coordination
|
||||
- name: oidc
|
||||
- name: target
|
||||
- name: test-image
|
||||
- name: workflow-node
|
||||
volumes:
|
||||
- name: orchestration
|
||||
configMap: {name: remora-qualification-orch, defaultMode: 0444}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
templates:
|
||||
- name: qualify
|
||||
dag:
|
||||
tasks:
|
||||
- name: setup
|
||||
template: setup
|
||||
- name: test
|
||||
dependencies: [setup]
|
||||
template: test
|
||||
|
||||
- name: setup
|
||||
metadata:
|
||||
labels:
|
||||
qualification.quorate.dev/stage: setup
|
||||
podSpecPatch: |
|
||||
containers:
|
||||
- name: main
|
||||
volumeMounts: &token-mount
|
||||
- name: exec-sa-token
|
||||
mountPath: /kubernetes
|
||||
readOnly: true
|
||||
- name: vault
|
||||
volumeMounts: *token-mount
|
||||
- name: redis
|
||||
volumeMounts: *token-mount
|
||||
- name: dragonfly
|
||||
volumeMounts: *token-mount
|
||||
- name: keycloak
|
||||
volumeMounts: *token-mount
|
||||
- name: zitadel
|
||||
volumeMounts: *token-mount
|
||||
- name: garage
|
||||
volumeMounts: *token-mount
|
||||
- name: versitygw
|
||||
volumeMounts: *token-mount
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
containerSet:
|
||||
volumeMounts: &fixture-mounts
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
containers:
|
||||
- name: main
|
||||
image: &lane-fsi registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: &lane-fsi-command [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/postgres.fsx]
|
||||
env: &fixture-env
|
||||
- {name: QUALIFICATION_ACTION, value: setup}
|
||||
- {name: QUALIFICATION_NAMESPACE, value: "{{workflow.namespace}}"}
|
||||
- {name: QUALIFICATION_LANE, value: "{{workflow.parameters.lane}}"}
|
||||
- {name: QUALIFICATION_COORDINATION, value: "{{workflow.parameters.coordination}}"}
|
||||
- {name: QUALIFICATION_OIDC, value: "{{workflow.parameters.oidc}}"}
|
||||
- {name: QUALIFICATION_TARGET, value: "{{workflow.parameters.target}}"}
|
||||
- {name: WORKFLOW_NODE, value: "{{workflow.parameters.workflow-node}}"}
|
||||
- {name: FSI_IMAGE, value: *lane-fsi}
|
||||
resources: &fixture-resources
|
||||
requests: {cpu: 25m, memory: 64Mi}
|
||||
limits: {cpu: 500m, memory: 512Mi}
|
||||
securityContext: &lane-restricted
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
- name: vault
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/vault.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: redis
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/redis.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: dragonfly
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/dragonfly.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: keycloak
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/keycloak.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: zitadel
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/zitadel.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: garage
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/garage.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
- name: versitygw
|
||||
dependencies: [main]
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/versitygw.fsx]
|
||||
env: *fixture-env
|
||||
resources: *fixture-resources
|
||||
securityContext: *lane-restricted
|
||||
|
||||
- name: test
|
||||
metadata:
|
||||
labels:
|
||||
qualification.quorate.dev/stage: test
|
||||
podSpecPatch: |
|
||||
containers:
|
||||
- name: main
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /kubernetes
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
container:
|
||||
image: *lane-fsi
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: *lane-fsi-command
|
||||
args: [/orchestration/nextest.fsx]
|
||||
env:
|
||||
- {name: QUALIFICATION_NAMESPACE, value: "{{workflow.namespace}}"}
|
||||
- {name: QUALIFICATION_LANE, value: "{{workflow.parameters.lane}}"}
|
||||
- {name: QUALIFICATION_COORDINATION, value: "{{workflow.parameters.coordination}}"}
|
||||
- {name: QUALIFICATION_OIDC, value: "{{workflow.parameters.oidc}}"}
|
||||
- {name: QUALIFICATION_TARGET, value: "{{workflow.parameters.target}}"}
|
||||
- {name: TEST_IMAGE, value: "{{workflow.parameters.test-image}}"}
|
||||
- {name: WORKFLOW_NODE, value: "{{workflow.parameters.workflow-node}}"}
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 128Mi}
|
||||
limits: {cpu: 500m, memory: 512Mi}
|
||||
securityContext: *lane-restricted
|
||||
volumeMounts: *fixture-mounts
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: WorkflowTemplate
|
||||
metadata:
|
||||
name: remora-qualification-gc
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: remora-qualification
|
||||
spec:
|
||||
entrypoint: gc
|
||||
serviceAccountName: qualification-gc
|
||||
automountServiceAccountToken: false
|
||||
executor:
|
||||
serviceAccountName: qualification-gc
|
||||
podGC:
|
||||
strategy: OnWorkflowCompletion
|
||||
podSpecPatch: |
|
||||
runtimeClassName: gvisor
|
||||
imagePullSecrets:
|
||||
- name: quay-reader
|
||||
containers:
|
||||
- name: wait
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: exec-sa-token
|
||||
secret: null
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
templates:
|
||||
- name: gc
|
||||
podSpecPatch: |
|
||||
containers:
|
||||
- name: main
|
||||
volumeMounts:
|
||||
- name: exec-sa-token
|
||||
mountPath: /kubernetes
|
||||
readOnly: true
|
||||
container:
|
||||
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||||
args: [/orchestration/postgres.fsx]
|
||||
env:
|
||||
- {name: QUALIFICATION_ACTION, value: gc}
|
||||
resources:
|
||||
requests: {cpu: 25m, memory: 64Mi}
|
||||
limits: {cpu: 250m, memory: 256Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {drop: [ALL]}
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- {name: orchestration, mountPath: /orchestration, readOnly: true}
|
||||
- {name: temporary, mountPath: /tmp}
|
||||
volumes:
|
||||
- name: orchestration
|
||||
configMap: {name: remora-qualification-orch, defaultMode: 0444}
|
||||
- {name: temporary, emptyDir: {}}
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: CronWorkflow
|
||||
metadata:
|
||||
name: remora-qualification-gc
|
||||
namespace: project-delivery
|
||||
labels:
|
||||
app.kubernetes.io/name: project-delivery
|
||||
app.kubernetes.io/instance: remora-qualification
|
||||
spec:
|
||||
schedules: ["0 3 * * *"]
|
||||
concurrencyPolicy: Forbid
|
||||
workflowSpec:
|
||||
workflowTemplateRef:
|
||||
name: remora-qualification-gc
|
||||
Loading…
Reference in a new issue