ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
5 changed files with 145336 additions and 0 deletions
3
services/quay-custom/k8s/kustomizeconfig.yaml
Normal file
3
services/quay-custom/k8s/kustomizeconfig.yaml
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
images:
|
||||
- path: spec/templates/container/image
|
||||
kind: WorkflowTemplate
|
||||
100
services/quay-custom/k8s/network-policy.yaml
Normal file
100
services/quay-custom/k8s/network-policy.yaml
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: tools
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: quay-toolchain
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- {matchName: packages.wolfi.dev}
|
||||
- {matchName: dl.google.com}
|
||||
- {matchName: github.com}
|
||||
- {matchPattern: "*.github.com"}
|
||||
- {matchName: proxy.golang.org}
|
||||
- {matchName: storage.googleapis.com}
|
||||
- {matchName: sum.golang.org}
|
||||
- {matchName: files.pythonhosted.org}
|
||||
- {matchName: cdn-ubi.redhat.com}
|
||||
- {matchName: quay.io}
|
||||
- {matchPattern: "*.quay.io"}
|
||||
- toFQDNs:
|
||||
- {matchName: packages.wolfi.dev}
|
||||
- {matchName: dl.google.com}
|
||||
- {matchName: github.com}
|
||||
- {matchPattern: "*.github.com"}
|
||||
- {matchName: proxy.golang.org}
|
||||
- {matchName: storage.googleapis.com}
|
||||
- {matchName: sum.golang.org}
|
||||
- {matchName: files.pythonhosted.org}
|
||||
- {matchName: cdn-ubi.redhat.com}
|
||||
- {matchName: quay.io}
|
||||
- {matchPattern: "*.quay.io"}
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: publish
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
delivery.quorate.dev/stage: quay-publish
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- {matchName: zot.quorate.internal}
|
||||
- toCIDR: [172.28.129.182/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: zot
|
||||
app.kubernetes.io/name: zot
|
||||
app.kubernetes.io/instance: zot
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "5000", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: zot-in
|
||||
namespace: zot
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: zot
|
||||
app.kubernetes.io/instance: zot
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: project-delivery
|
||||
io.cilium.k8s.policy.serviceaccount: project-delivery-executor
|
||||
delivery.quorate.dev/stage: quay-publish
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "5000", protocol: TCP}
|
||||
17
services/quay-custom/k8s/project.yaml
Normal file
17
services/quay-custom/k8s/project.yaml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: delivery.quorate.dev/v1alpha1
|
||||
kind: ProjectDelivery
|
||||
metadata:
|
||||
name: image
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
source:
|
||||
repository: https://forge.quorate.internal/quorate/cluster
|
||||
continuous:
|
||||
ref: refs/heads/master
|
||||
paths:
|
||||
- services/quay-custom
|
||||
targets:
|
||||
- kind: ZotOCI
|
||||
repository: quay/quay
|
||||
workflowTemplateRef:
|
||||
name: build
|
||||
45
services/quay-custom/k8s/vso.yaml
Normal file
45
services/quay-custom/k8s/vso.yaml
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: zot-vso
|
||||
namespace: project-delivery
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: zot
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: quay-custom-writer
|
||||
serviceAccount: quay-custom-zot-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: writer
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: zot/quay-custom
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: quay-custom-writer
|
||||
create: true
|
||||
overwrite: true
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
.dockerconfigjson:
|
||||
text: |
|
||||
{{- $user := get .Secrets "username" -}}
|
||||
{{- $password := get .Secrets "password" -}}
|
||||
{"auths":{"zot.quorate.internal":{"username":"{{ $user }}","password":"{{ $password }}","auth":"{{ printf "%s:%s" $user $password | b64enc }}"}}}
|
||||
vaultAuthRef: quay-custom-zot
|
||||
50
services/quay-custom/k8s/workflow-patch.yaml
Normal file
50
services/quay-custom/k8s/workflow-patch.yaml
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
- op: replace
|
||||
path: /metadata/labels/app.kubernetes.io~1instance
|
||||
value: quay-custom
|
||||
- op: replace
|
||||
path: /spec/podMetadata/labels/delivery.quorate.dev~1project
|
||||
value: quay-custom
|
||||
- op: replace
|
||||
path: /spec/templates/5/metadata/labels/delivery.quorate.dev~1stage
|
||||
value: quay-toolchain
|
||||
- op: replace
|
||||
path: /spec/templates/7/metadata/labels/delivery.quorate.dev~1stage
|
||||
value: quay-publish
|
||||
- op: replace
|
||||
path: /spec/templates/1/volumes/0
|
||||
value: &orchestration
|
||||
name: orchestration
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- configMap:
|
||||
name: go-oci-orch
|
||||
items:
|
||||
- {key: cache.fsx, path: cache.fsx}
|
||||
- {key: cache-gc.fsx, path: cache-gc.fsx}
|
||||
- {key: contract.fsx, path: contract.fsx}
|
||||
- {key: initialize.fsx, path: initialize.fsx}
|
||||
- {key: source.fsx, path: source.fsx}
|
||||
- configMap:
|
||||
name: quay-custom-project
|
||||
- op: replace
|
||||
path: /spec/templates/3/volumes/0
|
||||
value: *orchestration
|
||||
- op: replace
|
||||
path: /spec/templates/4/volumes/0
|
||||
value: *orchestration
|
||||
- op: replace
|
||||
path: /spec/templates/5/volumes/0
|
||||
value: *orchestration
|
||||
- op: replace
|
||||
path: /spec/templates/6/volumes/0
|
||||
value: *orchestration
|
||||
- op: replace
|
||||
path: /spec/templates/7/volumes/0
|
||||
value: *orchestration
|
||||
- op: replace
|
||||
path: /spec/templates/7/volumes/1/secret/secretName
|
||||
value: quay-custom-writer
|
||||
- op: replace
|
||||
path: /spec/templates/8/volumes/0
|
||||
value: *orchestration
|
||||
Loading…
Reference in a new issue