ce7cb702218693d08ea6d83464d2457c9250027c

services/project-delivery/k8s/workflows/saltatory/base/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - workflowtemplate.yaml

services/project-delivery/k8s/workflows/saltatory/base/workflowtemplate.yaml

@@ -0,0 +1,594 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: saltatory-delivery
+  namespace: project-delivery
+  labels:
+    app.kubernetes.io/name: project-delivery
+    app.kubernetes.io/instance: saltatory
+spec:
+  entrypoint: workflow
+  serviceAccountName: project-delivery-executor
+  automountServiceAccountToken: false
+  executor:
+    serviceAccountName: project-delivery-executor
+  parallelism: 2
+  podGC:
+    strategy: OnWorkflowCompletion
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: project-delivery
+      delivery.quorate.dev/project: saltatory
+  podSpecPatch: |
+    dnsConfig:
+      options:
+      - name: ndots
+        value: '1'
+    containers:
+    - name: wait
+      volumeMounts:
+      - name: exec-sa-token
+        mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+        readOnly: true
+      image: quay.io/argoproj/argoexec:v4.1.6@sha256:28432d912a716167709429b28e2755f49416eb4754c35ca3013863fb72717a00
+    volumes:
+    - name: exec-sa-token
+      secret: null
+      projected:
+        defaultMode: 0440
+        sources:
+        - serviceAccountToken:
+            expirationSeconds: 1800
+            path: token
+        - configMap:
+            name: kube-root-ca.crt
+            items:
+            - key: ca.crt
+              path: ca.crt
+        - downwardAPI:
+            items:
+            - path: namespace
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+    initContainers:
+    - name: init
+      image: quay.io/argoproj/argoexec:v4.1.6@sha256:28432d912a716167709429b28e2755f49416eb4754c35ca3013863fb72717a00
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    fsGroup: 65532
+    fsGroupChangePolicy: OnRootMismatch
+    seccompProfile:
+      type: RuntimeDefault
+  arguments:
+    parameters:
+    - name: source-repository
+    - name: source-ref
+    - name: source-revision
+    - name: targets
+  imagePullSecrets:
+  - name: quay-reader
+  templates:
+  - name: workflow
+    steps:
+    - - name: initialize
+        template: initialize
+    - - name: delivery
+        template: delivery
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{steps.initialize.outputs.parameters.working-pvc}}'
+    outputs:
+      parameters:
+      - name: delivery-result
+        valueFrom:
+          parameter: '{{steps.delivery.outputs.parameters.delivery-result}}'
+  - name: initialize
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: mc-initialize
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command:
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/initialize.fsx
+      resources:
+        requests:
+          cpu: 250m
+          memory: 256Mi
+        limits:
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /workspace
+      - name: workflow-workspace
+        mountPath: /tmp
+      env:
+      - name: POD_NAME
+        valueFrom:
+          fieldRef:
+            apiVersion: v1
+            fieldPath: metadata.name
+    volumes:
+    - name: orchestration
+      configMap:
+        name: saltatory-orch
+        defaultMode: 0444
+    - name: workflow-workspace
+      ephemeral:
+        volumeClaimTemplate:
+          spec:
+            accessModes:
+            - ReadWriteOnce
+            storageClassName: openebs-hostpath-ssd
+            resources:
+              requests:
+                storage: 25Gi
+    outputs:
+      parameters:
+      - name: working-pvc
+        valueFrom:
+          path: /workspace/.claim-name
+  - name: delivery
+    inputs:
+      parameters:
+      - name: working-pvc
+    dag:
+      tasks:
+      - name: source
+        template: source
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+      - name: cache-pull
+        template: cache-pull
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+        dependencies:
+        - source
+      - name: tools
+        template: tools
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+        dependencies:
+        - cache-pull
+      - name: build
+        template: build
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+        dependencies:
+        - tools
+      - name: publish
+        template: publish
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+        dependencies:
+        - build
+      - name: cache-export
+        template: cache-export
+        arguments:
+          parameters:
+          - name: working-pvc
+            value: '{{inputs.parameters.working-pvc}}'
+        dependencies:
+        - build
+    outputs:
+      parameters:
+      - name: delivery-result
+        valueFrom:
+          parameter: '{{tasks.publish.outputs.parameters.delivery-result}}'
+  - name: source
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: mc-source
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command:
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/source.fsx
+      resources:
+        requests:
+          cpu: 250m
+          memory: 256Mi
+        limits:
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: source/tmp
+      env:
+      - name: SOURCE_REPOSITORY
+        value: '{{workflow.parameters.source-repository}}'
+      - name: SOURCE_REVISION
+        value: '{{workflow.parameters.source-revision}}'
+    volumes:
+    - name: orchestration
+      configMap:
+        name: saltatory-orch
+        defaultMode: 0444
+    - name: workflow-workspace
+      persistentVolumeClaim:
+        claimName: '{{inputs.parameters.working-pvc}}'
+    inputs:
+      parameters:
+      - name: working-pvc
+  - name: cache-pull
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: mc-cache-pull
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command:
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/cache.fsx
+      resources:
+        requests:
+          cpu: 250m
+          memory: 256Mi
+        limits:
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+      - name: workflow-workspace
+        mountPath: /work
+        subPath: work
+      - name: workflow-workspace
+        mountPath: /state
+        subPath: state
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: state/pull-tmp
+      - name: cache-auth
+        mountPath: /cache-auth
+        readOnly: true
+      - name: cache-ca
+        mountPath: /cache-ca
+        readOnly: true
+      env:
+      - name: BUILD_MODULE
+        value: server
+      - name: CACHE_ACTION
+        value: pull
+    volumes:
+    - name: orchestration
+      configMap:
+        name: saltatory-orch
+        defaultMode: 0444
+    - name: workflow-workspace
+      persistentVolumeClaim:
+        claimName: '{{inputs.parameters.working-pvc}}'
+    - name: cache-auth
+      secret:
+        secretName: project-delivery-cache-reader
+        defaultMode: 0440
+    - name: cache-ca
+      secret:
+        secretName: quay-internal-ca
+        defaultMode: 0440
+    inputs:
+      parameters:
+      - name: working-pvc
+  - name: tools
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: mc-tools
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command:
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/tools.fsx
+      env:
+      - name: BUILD_MODULE
+        value: server
+      resources:
+        requests:
+          cpu: '2'
+          memory: 1Gi
+        limits:
+          memory: 8Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+      - name: workflow-workspace
+        mountPath: /work
+        subPath: work
+      - name: workflow-workspace
+        mountPath: /state
+        subPath: state
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: state/tools-tmp
+    volumes:
+    - name: orchestration
+      configMap:
+        name: saltatory-orch
+        defaultMode: 0444
+    - name: workflow-workspace
+      persistentVolumeClaim:
+        claimName: '{{inputs.parameters.working-pvc}}'
+    inputs:
+      parameters:
+      - name: working-pvc
+    podSpecPatch: |
+      runtimeClassName: gvisor
+  - name: build
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: mc-build
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command:
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/build.fsx
+      env:
+      - name: BUILD_MODULE
+        value: server
+      resources:
+        requests:
+          cpu: '2'
+          memory: 1Gi
+        limits:
+          memory: 8Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+      - name: workflow-workspace
+        mountPath: /work
+        subPath: work
+      - name: workflow-workspace
+        mountPath: /output
+        subPath: output
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: state/build-tmp
+    volumes:
+    - name: orchestration
+      configMap:
+        name: saltatory-orch
+        defaultMode: 0444
+    - name: workflow-workspace
+      persistentVolumeClaim:
+        claimName: '{{inputs.parameters.working-pvc}}'
+    inputs:
+      parameters:
+      - name: working-pvc
+    podSpecPatch: |
+      runtimeClassName: gvisor
+  - name: publish
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: mc-publish
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command:
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/publish.fsx
+      resources:
+        requests:
+          cpu: 250m
+          memory: 256Mi
+        limits:
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /handoff
+        subPath: output/jars
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /result
+        subPath: output/result
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: output/publish-tmp
+      - name: publisher-auth
+        mountPath: /publisher-auth
+        readOnly: true
+      - name: publisher-ca
+        mountPath: /publisher-ca
+        readOnly: true
+      env:
+      - name: SOURCE_REVISION
+        value: '{{workflow.parameters.source-revision}}'
+      - name: TARGETS
+        value: '{{workflow.parameters.targets}}'
+    volumes:
+    - name: orchestration
+      configMap:
+        name: saltatory-orch
+        defaultMode: 0444
+    - name: workflow-workspace
+      persistentVolumeClaim:
+        claimName: '{{inputs.parameters.working-pvc}}'
+    - name: publisher-auth
+      secret:
+        secretName: mc-publisher
+        defaultMode: 0440
+    - name: publisher-ca
+      secret:
+        secretName: quay-internal-ca
+        defaultMode: 0440
+    inputs:
+      parameters:
+      - name: working-pvc
+    outputs:
+      parameters:
+      - name: delivery-result
+        valueFrom:
+          path: /result/delivery-result
+  - name: cache-export
+    metadata:
+      labels:
+        delivery.quorate.dev/stage: mc-cache-export
+    container:
+      image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+      command:
+      - /usr/share/dotnet/dotnet
+      - /opt/fsi/fsi.dll
+      - --exec
+      args:
+      - /orchestration/cache.fsx
+      resources:
+        requests:
+          cpu: 250m
+          memory: 256Mi
+        limits:
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      volumeMounts:
+      - name: orchestration
+        mountPath: /orchestration
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /source
+        subPath: source
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /toolchain
+        subPath: toolchain
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /work
+        subPath: work
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /state
+        subPath: state
+        readOnly: true
+      - name: workflow-workspace
+        mountPath: /tmp
+        subPath: output/export-tmp
+      - name: cache-auth
+        mountPath: /cache-auth
+        readOnly: true
+      - name: cache-ca
+        mountPath: /cache-ca
+        readOnly: true
+      env:
+      - name: BUILD_MODULE
+        value: server
+      - name: CACHE_ACTION
+        value: export
+    volumes:
+    - name: orchestration
+      configMap:
+        name: saltatory-orch
+        defaultMode: 0444
+    - name: workflow-workspace
+      persistentVolumeClaim:
+        claimName: '{{inputs.parameters.working-pvc}}'
+    - name: cache-auth
+      secret:
+        secretName: project-delivery-cache-writer
+        defaultMode: 0440
+    - name: cache-ca
+      secret:
+        secretName: quay-internal-ca
+        defaultMode: 0440
+    inputs:
+      parameters:
+      - name: working-pvc

services/project-delivery/k8s/workflows/saltatory/client/kustomization.yaml

@@ -0,0 +1,62 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - secrets.yaml
+  - network-policy.yaml
+patches:
+  - target:
+      kind: WorkflowTemplate
+      name: saltatory-delivery
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: saltatory-client
+      - op: replace
+        path: /spec/templates/1/metadata/labels/delivery.quorate.dev~1stage
+        value: sc-initialize
+      - op: replace
+        path: /spec/templates/3/metadata/labels/delivery.quorate.dev~1stage
+        value: sc-source
+      - op: replace
+        path: /spec/templates/4/metadata/labels/delivery.quorate.dev~1stage
+        value: sc-cache-pull
+      - op: replace
+        path: /spec/templates/5/metadata/labels/delivery.quorate.dev~1stage
+        value: sc-tools
+      - op: replace
+        path: /spec/templates/6/metadata/labels/delivery.quorate.dev~1stage
+        value: sc-build
+      - op: replace
+        path: /spec/templates/7/metadata/labels/delivery.quorate.dev~1stage
+        value: sc-publish
+      - op: replace
+        path: /spec/templates/8/metadata/labels/delivery.quorate.dev~1stage
+        value: sc-cache-export
+      - op: replace
+        path: /spec/templates/4/container/env/0/value
+        value: client
+      - op: replace
+        path: /spec/templates/5/container/env/0/value
+        value: client
+      - op: replace
+        path: /spec/templates/6/container/env/0/value
+        value: client
+      - op: replace
+        path: /spec/templates/8/container/env/0/value
+        value: client
+      - op: replace
+        path: /spec/templates/7/container/args/0
+        value: /orchestration/release.fsx
+      - op: add
+        path: /spec/templates/7/container/env/-
+        value:
+          name: SOURCE_REPOSITORY
+          value: '{{workflow.parameters.source-repository}}'
+      - op: remove
+        path: /spec/templates/7/container/volumeMounts/5
+      - op: remove
+        path: /spec/templates/7/volumes/3
+      - op: replace
+        path: /spec/templates/7/volumes/2/secret/secretName
+        value: saltatory-publisher

services/project-delivery/k8s/workflows/saltatory/client/network-policy.yaml

@@ -0,0 +1,196 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sc-forgejo
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - sc-source
+      - sc-publish
+    matchLabels:
+      delivery.quorate.dev/project: saltatory
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: forge-git-http.forgejo-public.svc.cluster.local
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: forgejo-public
+        app.kubernetes.io/name: forgejo
+        app.kubernetes.io/instance: forge-git
+    toPorts:
+    - ports:
+      - port: '3000'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sc-forgejo
+  namespace: forgejo-public
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: forgejo
+      app.kubernetes.io/instance: forge-git
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: project-delivery
+        io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+        delivery.quorate.dev/project: saltatory
+      matchExpressions:
+      - key: delivery.quorate.dev/stage
+        operator: In
+        values:
+        - sc-source
+        - sc-publish
+    toPorts:
+    - ports:
+      - port: '3000'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sc-tools
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - sc-tools
+    matchLabels:
+      delivery.quorate.dev/project: saltatory
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: github.com
+        - matchName: release-assets.githubusercontent.com
+        - matchName: services.gradle.org
+        - matchName: plugins.gradle.org
+        - matchName: plugins-artifacts.gradle.org
+        - matchName: repo.maven.apache.org
+        - matchName: maven.neoforged.net
+        - matchName: maven.ftb.dev
+        - matchName: piston-meta.mojang.com
+        - matchName: piston-data.mojang.com
+        - matchName: libraries.minecraft.net
+        - matchName: api.modrinth.com
+        - matchName: cdn.modrinth.com
+  - toFQDNs:
+    - matchName: github.com
+    - matchName: release-assets.githubusercontent.com
+    - matchName: services.gradle.org
+    - matchName: plugins.gradle.org
+    - matchName: plugins-artifacts.gradle.org
+    - matchName: repo.maven.apache.org
+    - matchName: maven.neoforged.net
+    - matchName: maven.ftb.dev
+    - matchName: piston-meta.mojang.com
+    - matchName: piston-data.mojang.com
+    - matchName: libraries.minecraft.net
+    - matchName: api.modrinth.com
+    - matchName: cdn.modrinth.com
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sc-cache
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - sc-cache-pull
+      - sc-cache-export
+    matchLabels:
+      delivery.quorate.dev/project: saltatory
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: s3.quorate.internal
+  - toFQDNs:
+    - matchName: s3.quorate.internal
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: versitygw
+        app.kubernetes.io/name: versitygw
+        app.kubernetes.io/instance: versitygw
+    toPorts:
+    - ports:
+      - port: '7070'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sc-cache
+  namespace: versitygw
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: versitygw
+      app.kubernetes.io/instance: versitygw
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: project-delivery
+        io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+        delivery.quorate.dev/project: saltatory
+      matchExpressions:
+      - key: delivery.quorate.dev/stage
+        operator: In
+        values:
+        - sc-cache-pull
+        - sc-cache-export
+    toPorts:
+    - ports:
+      - port: '7070'
+        protocol: TCP

services/project-delivery/k8s/workflows/saltatory/client/secrets.yaml

@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: saltatory-pub-vso
+  namespace: project-delivery
+automountServiceAccountToken: false
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: saltatory-publisher
+  namespace: project-delivery
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: saltatory-publisher
+    serviceAccount: saltatory-pub-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: saltatory-publisher
+  namespace: project-delivery
+spec:
+  type: kv-v2
+  mount: secret
+  path: forgejo-public/tokens/saltatory-publisher
+  refreshAfter: 5m
+  destination:
+    name: saltatory-publisher
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        token:
+          text: '{{ get .Secrets "token" }}'
+  vaultAuthRef: saltatory-publisher

services/project-delivery/k8s/workflows/saltatory/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - base
+  - client
+  - network-policy.yaml
+  - secrets.yaml

services/project-delivery/k8s/workflows/saltatory/network-policy.yaml

@@ -0,0 +1,192 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mc-source
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - mc-source
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: forge-git-http.forgejo-public.svc.cluster.local
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: forgejo-public
+        app.kubernetes.io/name: forgejo
+        app.kubernetes.io/instance: forge-git
+    toPorts:
+    - ports:
+      - port: '3000'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mc-source
+  namespace: forgejo-public
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: forgejo
+      app.kubernetes.io/instance: forge-git
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: project-delivery
+        io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+      matchExpressions:
+      - key: delivery.quorate.dev/stage
+        operator: In
+        values:
+        - mc-source
+    toPorts:
+    - ports:
+      - port: '3000'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mc-tools
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - mc-tools
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: github.com
+        - matchName: release-assets.githubusercontent.com
+        - matchName: services.gradle.org
+        - matchName: plugins.gradle.org
+        - matchName: plugins-artifacts.gradle.org
+        - matchName: repo.maven.apache.org
+        - matchName: maven.neoforged.net
+        - matchName: piston-meta.mojang.com
+        - matchName: piston-data.mojang.com
+        - matchName: libraries.minecraft.net
+        - matchName: maven.blamejared.com
+        - matchName: modmaven.dev
+        - matchName: www.cursemaven.com
+        - matchName: api.modrinth.com
+        - matchName: cdn.modrinth.com
+  - toFQDNs:
+    - matchName: github.com
+    - matchName: release-assets.githubusercontent.com
+    - matchName: services.gradle.org
+    - matchName: plugins.gradle.org
+    - matchName: plugins-artifacts.gradle.org
+    - matchName: repo.maven.apache.org
+    - matchName: maven.neoforged.net
+    - matchName: piston-meta.mojang.com
+    - matchName: piston-data.mojang.com
+    - matchName: libraries.minecraft.net
+    - matchName: maven.blamejared.com
+    - matchName: modmaven.dev
+    - matchName: www.cursemaven.com
+    - matchName: api.modrinth.com
+    - matchName: cdn.modrinth.com
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mc-s3
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - mc-publish
+      - mc-cache-pull
+      - mc-cache-export
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: s3.quorate.internal
+  - toFQDNs:
+    - matchName: s3.quorate.internal
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: versitygw
+        app.kubernetes.io/name: versitygw
+        app.kubernetes.io/instance: versitygw
+    toPorts:
+    - ports:
+      - port: '7070'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mc-delivery
+  namespace: versitygw
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: versitygw
+      app.kubernetes.io/instance: versitygw
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: project-delivery
+        io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+      matchExpressions:
+      - key: delivery.quorate.dev/stage
+        operator: In
+        values:
+        - mc-publish
+        - mc-cache-pull
+        - mc-cache-export
+    toPorts:
+    - ports:
+      - port: '7070'
+        protocol: TCP

services/project-delivery/k8s/workflows/saltatory/secrets.yaml

@@ -0,0 +1,43 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mc-publisher-vso
+  namespace: project-delivery
+automountServiceAccountToken: false
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: mc-publisher
+  namespace: project-delivery
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: mc-publisher
+    serviceAccount: mc-publisher-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: mc-publisher
+  namespace: project-delivery
+spec:
+  type: kv-v2
+  mount: secret
+  path: versitygw/users/mc-publisher
+  refreshAfter: 1h
+  destination:
+    name: mc-publisher
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        accesskey:
+          text: mc-publisher
+        secretkey:
+          text: '{{ get .Secrets "secretAccessKey" }}'
+  vaultAuthRef: mc-publisher