ce7cb702218693d08ea6d83464d2457c9250027c

services/quay-operator/k8s/kustomizeconfig.yaml

@@ -0,0 +1,3 @@
+images:
+  - path: spec/templates/container/image
+    kind: WorkflowTemplate

services/quay-operator/k8s/network-policy.yaml

@@ -0,0 +1,90 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: tools
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: quay-op-toolchain
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - {matchName: packages.wolfi.dev}
+              - {matchName: github.com}
+              - {matchName: codeload.github.com}
+              - {matchName: proxy.golang.org}
+              - {matchName: sum.golang.org}
+              - {matchName: storage.googleapis.com}
+    - toFQDNs:
+        - {matchName: packages.wolfi.dev}
+        - {matchName: github.com}
+        - {matchName: codeload.github.com}
+        - {matchName: proxy.golang.org}
+        - {matchName: sum.golang.org}
+        - {matchName: storage.googleapis.com}
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: publish
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: quay-op-publish
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - {matchName: zot.quorate.internal}
+    - toCIDR: [172.28.129.182/32]
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zot
+            app.kubernetes.io/name: zot
+            app.kubernetes.io/instance: zot
+      toPorts:
+        - ports:
+            - {port: "5000", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: zot-in
+  namespace: zot
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: zot
+      app.kubernetes.io/instance: zot
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: project-delivery
+            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+            delivery.quorate.dev/stage: quay-op-publish
+      toPorts:
+        - ports:
+            - {port: "5000", protocol: TCP}

services/quay-operator/k8s/project.yaml

@@ -0,0 +1,21 @@
+apiVersion: delivery.quorate.dev/v1alpha1
+kind: ProjectDelivery
+metadata:
+  name: image
+  namespace: project-delivery
+spec:
+  source:
+    repository: https://forge.quorate.internal/quorate/cluster
+    continuous:
+      ref: refs/heads/master
+      paths:
+        - packages/quay-operator
+        - packages/project-quay-catalog
+        - services/quay-operator
+  targets:
+    - kind: ZotOCI
+      repository: olm/quay-operator
+    - kind: ZotOCI
+      repository: olm/project-quay-catalog
+  workflowTemplateRef:
+    name: build

services/quay-operator/k8s/vso.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: zot-vso
+  namespace: project-delivery
+automountServiceAccountToken: false
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: zot
+  namespace: project-delivery
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: quay-op-writer
+    serviceAccount: quay-op-zot-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: writer
+  namespace: project-delivery
+spec:
+  type: kv-v2
+  mount: secret
+  path: zot/quay-op
+  refreshAfter: 1h
+  destination:
+    name: quay-op-writer
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        .dockerconfigjson:
+          text: |
+            {{- $user := get .Secrets "username" -}}
+            {{- $password := get .Secrets "password" -}}
+            {"auths":{"zot.quorate.internal":{"username":"{{ $user }}","password":"{{ $password }}","auth":"{{ printf "%s:%s" $user $password | b64enc }}"}}}
+  vaultAuthRef: quay-op-zot

services/quay-operator/k8s/workflow-patch.yaml

@@ -0,0 +1,80 @@
+- op: replace
+  path: /metadata/labels/app.kubernetes.io~1instance
+  value: quay-op
+- op: replace
+  path: /spec/podMetadata/labels/delivery.quorate.dev~1project
+  value: quay-op
+- op: replace
+  path: /spec/templates/5/metadata/labels/delivery.quorate.dev~1stage
+  value: quay-op-toolchain
+- op: replace
+  path: /spec/templates/7/metadata/labels/delivery.quorate.dev~1stage
+  value: quay-op-publish
+- op: replace
+  path: /spec/templates/1/volumes/0
+  value: &orchestration
+    name: orchestration
+    projected:
+      defaultMode: 0444
+      sources:
+        - configMap:
+            name: go-oci-orch
+            items:
+              - {key: contract.fsx, path: contract.fsx}
+              - {key: initialize.fsx, path: go-init.fsx}
+              - {key: image.fsx, path: image.fsx}
+        - configMap:
+            name: quay-op-project
+- op: replace
+  path: /spec/templates/3/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/4/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/5/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/6/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/7/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/7/volumes/1/secret/secretName
+  value: quay-op-writer
+- op: replace
+  path: /spec/templates/8/volumes/0
+  value: *orchestration
+- op: add
+  path: /spec/templates/6/container/volumeMounts/-
+  value:
+    name: workflow-workspace
+    mountPath: /workspace
+    subPath: output/workspace
+- op: replace
+  path: /spec/templates/4/container/volumeMounts
+  value:
+    - {name: orchestration, mountPath: /orchestration, readOnly: true}
+    - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
+    - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
+    - {name: workflow-workspace, mountPath: /cache, subPath: cache}
+    - {name: workflow-workspace, mountPath: /tmp, subPath: state/cache-tmp}
+- op: replace
+  path: /spec/templates/5/container/volumeMounts
+  value:
+    - {name: orchestration, mountPath: /orchestration, readOnly: true}
+    - {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
+    - {name: workflow-workspace, mountPath: /tmp, subPath: state/toolchain-tmp}
+- op: add
+  path: /spec/templates/6/container/volumeMounts/5/readOnly
+  value: true
+- op: replace
+  path: /spec/templates/8/container/volumeMounts
+  value:
+    - {name: orchestration, mountPath: /orchestration, readOnly: true}
+    - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
+    - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
+    - {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
+    - {name: workflow-workspace, mountPath: /build-cache, subPath: output/go-cache, readOnly: true}
+    - {name: workflow-workspace, mountPath: /tmp, subPath: output/cache-tmp}