ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
3 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

62
services/project-delivery/k8s/workflows/saltatory/client/kustomization.yaml Normal file
View file

@ -0,0 +1,62 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- secrets.yaml
- network-policy.yaml
patches:
- target:
kind: WorkflowTemplate
name: saltatory-delivery
patch: |
- op: replace
path: /metadata/name
value: saltatory-client
- op: replace
path: /spec/templates/1/metadata/labels/delivery.quorate.dev~1stage
value: sc-initialize
- op: replace
path: /spec/templates/3/metadata/labels/delivery.quorate.dev~1stage
value: sc-source
- op: replace
path: /spec/templates/4/metadata/labels/delivery.quorate.dev~1stage
value: sc-cache-pull
- op: replace
path: /spec/templates/5/metadata/labels/delivery.quorate.dev~1stage
value: sc-tools
- op: replace
path: /spec/templates/6/metadata/labels/delivery.quorate.dev~1stage
value: sc-build
- op: replace
path: /spec/templates/7/metadata/labels/delivery.quorate.dev~1stage
value: sc-publish
- op: replace
path: /spec/templates/8/metadata/labels/delivery.quorate.dev~1stage
value: sc-cache-export
- op: replace
path: /spec/templates/4/container/env/0/value
value: client
- op: replace
path: /spec/templates/5/container/env/0/value
value: client
- op: replace
path: /spec/templates/6/container/env/0/value
value: client
- op: replace
path: /spec/templates/8/container/env/0/value
value: client
- op: replace
path: /spec/templates/7/container/args/0
value: /orchestration/release.fsx
- op: add
path: /spec/templates/7/container/env/-
value:
name: SOURCE_REPOSITORY
value: '{{workflow.parameters.source-repository}}'
- op: remove
path: /spec/templates/7/container/volumeMounts/5
- op: remove
path: /spec/templates/7/volumes/3
- op: replace
path: /spec/templates/7/volumes/2/secret/secretName
value: saltatory-publisher

196
services/project-delivery/k8s/workflows/saltatory/client/network-policy.yaml Normal file
View file

@ -0,0 +1,196 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: sc-forgejo
namespace: project-delivery
spec:
endpointSelector:
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values:
- sc-source
- sc-publish
matchLabels:
delivery.quorate.dev/project: saltatory
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: '53'
protocol: UDP
- port: '53'
protocol: TCP
rules:
dns:
- matchName: forge-git-http.forgejo-public.svc.cluster.local
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: forgejo-public
app.kubernetes.io/name: forgejo
app.kubernetes.io/instance: forge-git
toPorts:
- ports:
- port: '3000'
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: sc-forgejo
namespace: forgejo-public
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: forgejo
app.kubernetes.io/instance: forge-git
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: project-delivery
io.cilium.k8s.policy.serviceaccount: project-delivery-executor
delivery.quorate.dev/project: saltatory
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values:
- sc-source
- sc-publish
toPorts:
- ports:
- port: '3000'
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: sc-tools
namespace: project-delivery
spec:
endpointSelector:
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values:
- sc-tools
matchLabels:
delivery.quorate.dev/project: saltatory
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: '53'
protocol: UDP
- port: '53'
protocol: TCP
rules:
dns:
- matchName: github.com
- matchName: release-assets.githubusercontent.com
- matchName: services.gradle.org
- matchName: plugins.gradle.org
- matchName: plugins-artifacts.gradle.org
- matchName: repo.maven.apache.org
- matchName: maven.neoforged.net
- matchName: maven.ftb.dev
- matchName: piston-meta.mojang.com
- matchName: piston-data.mojang.com
- matchName: libraries.minecraft.net
- matchName: api.modrinth.com
- matchName: cdn.modrinth.com
- toFQDNs:
- matchName: github.com
- matchName: release-assets.githubusercontent.com
- matchName: services.gradle.org
- matchName: plugins.gradle.org
- matchName: plugins-artifacts.gradle.org
- matchName: repo.maven.apache.org
- matchName: maven.neoforged.net
- matchName: maven.ftb.dev
- matchName: piston-meta.mojang.com
- matchName: piston-data.mojang.com
- matchName: libraries.minecraft.net
- matchName: api.modrinth.com
- matchName: cdn.modrinth.com
toPorts:
- ports:
- port: '443'
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: sc-cache
namespace: project-delivery
spec:
endpointSelector:
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values:
- sc-cache-pull
- sc-cache-export
matchLabels:
delivery.quorate.dev/project: saltatory
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: '53'
protocol: UDP
- port: '53'
protocol: TCP
rules:
dns:
- matchName: s3.quorate.internal
- toFQDNs:
- matchName: s3.quorate.internal
toPorts:
- ports:
- port: '443'
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- port: '7070'
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: sc-cache
namespace: versitygw
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: project-delivery
io.cilium.k8s.policy.serviceaccount: project-delivery-executor
delivery.quorate.dev/project: saltatory
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values:
- sc-cache-pull
- sc-cache-export
toPorts:
- ports:
- port: '7070'
protocol: TCP

42
services/project-delivery/k8s/workflows/saltatory/client/secrets.yaml Normal file
View file

@ -0,0 +1,42 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: saltatory-pub-vso
namespace: project-delivery
automountServiceAccountToken: false
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
name: saltatory-publisher
namespace: project-delivery
spec:
method: kubernetes
mount: kubernetes
kubernetes:
role: saltatory-publisher
serviceAccount: saltatory-pub-vso
vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: saltatory-publisher
namespace: project-delivery
spec:
type: kv-v2
mount: secret
path: forgejo-public/tokens/saltatory-publisher
refreshAfter: 5m
destination:
name: saltatory-publisher
create: true
overwrite: true
transformation:
excludeRaw: true
excludes:
- .*
templates:
token:
text: '{{ get .Secrets "token" }}'
vaultAuthRef: saltatory-publisher