ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
9 changed files with 145336 additions and 0 deletions
--- a/services/smartctl-image/actions/build.fsx
+++ b/services/smartctl-image/actions/build.fsx
@ -0,0 +1,93 @@
+#load "projects.fsx"
+#load "image.fsx"
+
+open System
+open System.IO
+open Contract
+open Image
+open Projects
+
+let revision = Environment.GetEnvironmentVariable "SOURCE_REVISION"
+let targets = Environment.GetEnvironmentVariable "TARGETS" |> decode<Target array>
+let project = selectProject targets
+let source = "/toolchain/upstream"
+let sourceRoot = "/output/source"
+let output = "/output"
+let go = "/toolchain/usr/lib/go/bin/go"
+let work = Path.Combine(sourceRoot, "smartctl_exporter-" + upstream)
+let patches = "/source/repository/packages/smartctl"
+
+Directory.EnumerateDirectories(source, "*", SearchOption.AllDirectories)
+|> Seq.iter (fun path ->
+    directory (Path.Combine(sourceRoot, Path.GetRelativePath(source, path)))
+    |> ignore)
+
+Directory.EnumerateFiles(source, "*", SearchOption.AllDirectories)
+|> Seq.iter (fun path ->
+    let target = Path.Combine(sourceRoot, Path.GetRelativePath(source, path))
+    directory (Path.GetDirectoryName target) |> ignore
+    File.Copy(path, target))
+
+requireSuccess
+    "/toolchain/usr/bin/patch"
+    [ "--batch"
+      "--fuzz=0"
+      "--forward"
+      "--strip=1"
+      "--input=" + Path.Combine(patches, "verify.patch") ]
+    (Some work)
+    []
+|> ignore
+
+File.Copy(Path.Combine(patches, "verify_test.go"), Path.Combine(work, "verify_test.go"))
+
+let environment architecture =
+    [ "CGO_ENABLED", "0"
+      "GOCACHE", "/cache/go"
+      "GOENV", "off"
+      "GOTOOLCHAIN", "local"
+      "GOOS", "linux"
+      "GOARCH", architecture
+      "GOMODCACHE", "/toolchain/modules"
+      "GOPATH", "/toolchain/gopath"
+      "GOPROXY", "off"
+      "GOROOT", "/toolchain/usr/lib/go"
+      "GOWORK", "off"
+      "HOME", "/tmp" ]
+
+let host =
+    match Runtime.InteropServices.RuntimeInformation.ProcessArchitecture with
+    | Runtime.InteropServices.Architecture.X64 -> "amd64"
+    | Runtime.InteropServices.Architecture.Arm64 -> "arm64"
+    | value -> fail $"unsupported builder architecture {value}"
+
+let tests =
+    requireSuccess go [ "test"; "-mod=readonly"; "./..." ] (Some work) (environment host)
+
+printfn "%s" (tests.Trim())
+
+let build architecture =
+    let name = "usr/bin/smartctl_exporter"
+    let path = Path.Combine(output, "bin", architecture, name)
+    directory (Path.GetDirectoryName path) |> ignore
+
+    requireSuccess
+        go
+        [ "build"
+          "-mod=readonly"
+          "-trimpath"
+          $"-ldflags=-s -w -buildid= -X github.com/prometheus/common/version.Version={version} -X github.com/prometheus/common/version.Revision={upstream}"
+          "-o"
+          path
+          "." ]
+        (Some work)
+        (environment architecture)
+    |> ignore
+
+    File.SetUnixFileMode(path, executableMode)
+    [ name, path ]
+
+let digest =
+    assemble "/toolchain/image-base" output revision project.Entrypoint project.WorkingDir build
+
+printfn "build=image project=%s digest=%s" project.Name digest
--- a/services/smartctl-image/actions/projects.fsx
+++ b/services/smartctl-image/actions/projects.fsx
@ -0,0 +1,37 @@
+#load "contract.fsx"
+
+open Contract
+
+type Project =
+    { Name: string
+      Workflow: string
+      Repository: string
+      Entrypoint: string list
+      WorkingDir: string }
+
+let version = "0.15.0"
+let upstream = "110b8cd0a97524bcc9f5f3ac8f4ebbfeba02fdd8"
+let sourceHash = "8849f97535b805ef36c54debfc62b01e4464e4f65545cfefe727026661e630c1"
+
+let project =
+    { Name = "smartctl"
+      Workflow = "smartctl-build"
+      Repository = "quorate/smartctl-exporter"
+      Entrypoint = [ "/usr/bin/smartctl_exporter" ]
+      WorkingDir = "/" }
+
+let selectProject (targets: Target array) =
+    require
+        (targets.Length = 1
+         && targets[0].Kind = "QuayOCI"
+         && targets[0].Repository = project.Repository)
+        "invalid smartctl delivery target"
+
+    project
+
+let validateProject (_: string) (_: Project) = ()
+let inputPaths (_: string) (_: Project) : string list = []
+let toolchainProfileName = "smartctl"
+
+let toolchainCachePaths (_: Project) =
+    [ "usr/bin/patch"; "usr/lib"; "image-base"; "modules"; "upstream" ]
--- a/services/smartctl-image/actions/runtime.apko.yaml
+++ b/services/smartctl-image/actions/runtime.apko.yaml
@ -0,0 +1,21 @@
+contents:
+  keyring:
+    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+  repositories:
+    - https://packages.wolfi.dev/os
+  packages:
+    - ca-certificates-bundle=20261020-r0
+    - smartmontools=7.5-r4
+    - wolfi-baselayout=20230201-r31
+accounts:
+  groups:
+    - groupname: application
+      gid: 65532
+  users:
+    - username: application
+      uid: 65532
+      gid: 65532
+  run-as: 65532
+environment:
+  PATH: /usr/sbin:/usr/bin:/sbin:/bin
+  SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
--- a/services/smartctl-image/actions/toolchain.fsx
+++ b/services/smartctl-image/actions/toolchain.fsx
@ -0,0 +1,88 @@
+#load "projects.fsx"
+
+open System
+open System.IO
+open System.Net.Http
+open Contract
+open Projects
+
+let targets = Environment.GetEnvironmentVariable "TARGETS" |> decode<Target array>
+let project = selectProject targets
+let root = "/toolchain"
+let baseImage = Path.Combine(root, "image-base")
+let source = Path.Combine(root, "upstream")
+
+do
+    let environment =
+        [ "GOCACHE", "/tmp/go-cache"
+          "GOENV", "off"
+          "GOMODCACHE", Path.Combine(root, "modules")
+          "GOPATH", "/tmp/gopath"
+          "GOPROXY", "https://proxy.golang.org"
+          "GOROOT", Path.Combine(root, "usr/lib/go")
+          "GOSUMDB", "sum.golang.org"
+          "GOWORK", "off"
+          "HOME", "/tmp/home" ]
+
+    requireSuccess
+        "/sbin/apk"
+        [ "add"
+          "--root"
+          root
+          "--initdb"
+          "--no-scripts"
+          "--keys-dir"
+          "/etc/apk/keys"
+          "--repository"
+          "https://packages.wolfi.dev/os"
+          "ca-certificates-bundle=20261020-r0"
+          "glibc-2.43=2.43-r19"
+          "glibc-2.43-locale-posix=2.43-r19"
+          "go-1.27=1.27.3-r0"
+          "ld-linux-2.43=2.43-r19"
+          "libgcc=16.2.0-r2"
+          "libxcrypt=4.5.2-r6"
+          "patch=2.8.1-r1"
+          "wolfi-baselayout=20230201-r31" ]
+        None
+        []
+    |> ignore
+
+    let archive = "/tmp/smartctl.tar.gz"
+    use client = new HttpClient(Timeout = TimeSpan.FromMinutes 10.0)
+
+    use input =
+        client
+            .GetStreamAsync($"https://codeload.github.com/prometheus-community/smartctl_exporter/tar.gz/{upstream}")
+            .GetAwaiter()
+            .GetResult()
+
+    use output = File.Create archive
+    input.CopyTo output
+    output.Dispose()
+    require (sha256 archive = sourceHash) "smartctl source digest mismatch"
+    directory source |> ignore
+    extractGzip archive source
+    File.Delete archive
+
+    let moduleRoot = Path.Combine(source, "smartctl_exporter-" + upstream)
+    let go = Path.Combine(root, "usr/lib/go/bin/go")
+    directory (Path.Combine(root, "modules")) |> ignore
+    requireSuccess go [ "mod"; "download" ] (Some moduleRoot) environment |> ignore
+
+    directory baseImage |> ignore
+
+    requireSuccess
+        "/usr/bin/apko"
+        [ "build"
+          "--arch"
+          "x86_64,arm64"
+          "--sbom=false"
+          "/orchestration/go-oci.apko.yaml"
+          "smartctl:base"
+          baseImage ]
+        None
+        environment
+    |> ignore
+
+    printfn "toolchain=primary project=%s" project.Name
--- a/services/smartctl-image/k8s/kustomizeconfig.yaml
+++ b/services/smartctl-image/k8s/kustomizeconfig.yaml
@ -0,0 +1,3 @@
+images:
+  - path: spec/templates/container/image
+    kind: WorkflowTemplate
--- a/services/smartctl-image/k8s/network-policy.yaml
+++ b/services/smartctl-image/k8s/network-policy.yaml
@ -0,0 +1,94 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: toolchain
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: smartctl-toolchain
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - matchName: packages.wolfi.dev
+              - matchName: proxy.golang.org
+              - matchName: codeload.github.com
+              - matchName: storage.googleapis.com
+              - matchName: sum.golang.org
+    - toFQDNs:
+        - {matchName: packages.wolfi.dev}
+        - {matchName: proxy.golang.org}
+        - {matchName: codeload.github.com}
+        - {matchName: storage.googleapis.com}
+        - {matchName: sum.golang.org}
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: publish
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/project: smartctl
+      delivery.quorate.dev/stage: smartctl-publish
+      io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - matchName: registry.quorate.internal
+    - toCIDR:
+        - 10.108.252.250/32
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: quay
+            app: quay
+            quay-component: quay-app
+            quay-operator/quayregistry: quay-registry
+      toPorts:
+        - ports:
+            - {port: "8443", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: ingress
+  namespace: quay
+spec:
+  endpointSelector:
+    matchLabels:
+      app: quay
+      quay-component: quay-app
+      quay-operator/quayregistry: quay-registry
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: project-delivery
+            delivery.quorate.dev/project: smartctl
+            delivery.quorate.dev/stage: smartctl-publish
+            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+      toPorts:
+        - ports:
+            - {port: "8443", protocol: TCP}
--- a/services/smartctl-image/k8s/project.yaml
+++ b/services/smartctl-image/k8s/project.yaml
@ -0,0 +1,25 @@
+apiVersion: delivery.quorate.dev/v1alpha1
+kind: ProjectDelivery
+metadata:
+  name: image
+  namespace: project-delivery
+spec:
+  source:
+    repository: https://forge.quorate.internal/quorate/cluster
+    continuous:
+      ref: refs/heads/master
+      paths:
+        - packages/smartctl
+        - services/smartctl-image
+        - services/project-delivery/actions/go-oci/cache.fsx
+        - services/project-delivery/actions/go-oci/contract.fsx
+        - services/project-delivery/actions/go-oci/image.fsx
+        - services/project-delivery/actions/go-oci/initialize.fsx
+        - services/project-delivery/actions/go-oci/publish.fsx
+        - services/project-delivery/actions/go-oci/source.fsx
+        - services/project-delivery/k8s/workflows/go-oci/base
+  targets:
+    - kind: QuayOCI
+      repository: quorate/smartctl-exporter
+  workflowTemplateRef:
+    name: build
--- a/services/smartctl-image/k8s/workflow-patch.yaml
+++ b/services/smartctl-image/k8s/workflow-patch.yaml
@ -0,0 +1,49 @@
+- op: replace
+  path: /metadata/labels/app.kubernetes.io~1instance
+  value: smartctl
+- op: replace
+  path: /spec/podMetadata/labels/delivery.quorate.dev~1project
+  value: smartctl
+- op: replace
+  path: /spec/templates/5/metadata/labels/delivery.quorate.dev~1stage
+  value: smartctl-toolchain
+- op: replace
+  path: /spec/templates/7/metadata/labels/delivery.quorate.dev~1stage
+  value: smartctl-publish
+- op: replace
+  path: /spec/templates/1/volumes/0
+  value: &orchestration
+    name: orchestration
+    projected:
+      defaultMode: 0444
+      sources:
+        - configMap:
+            name: go-oci-orch
+            items:
+              - {key: cache.fsx, path: cache.fsx}
+              - {key: cache-gc.fsx, path: cache-gc.fsx}
+              - {key: contract.fsx, path: contract.fsx}
+              - {key: image.fsx, path: image.fsx}
+              - {key: initialize.fsx, path: initialize.fsx}
+              - {key: publish.fsx, path: publish.fsx}
+              - {key: source.fsx, path: source.fsx}
+        - configMap:
+            name: smartctl-project
+- op: replace
+  path: /spec/templates/3/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/4/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/5/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/6/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/7/volumes/0
+  value: *orchestration
+- op: replace
+  path: /spec/templates/8/volumes/0
+  value: *orchestration
--- a/services/smartctl-image/kustomization.yaml
+++ b/services/smartctl-image/kustomization.yaml
@ -0,0 +1,47 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: smartctl-
+configurations:
+  - k8s/kustomizeconfig.yaml
+images:
+  - name: registry.quorate.internal/quorate/fsharp-runner
+    digest: sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+resources:
+  - ../project-delivery/k8s/workflows/go-oci/parallel
+  - k8s/network-policy.yaml
+  - k8s/project.yaml
+configMapGenerator:
+  - name: project
+    namespace: project-delivery
+    files:
+      - build.fsx=actions/build.fsx
+      - projects.fsx=actions/projects.fsx
+      - toolchain.fsx=actions/toolchain.fsx
+      - go-oci.apko.yaml=actions/runtime.apko.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    app.kubernetes.io/name: project-delivery
+    app.kubernetes.io/instance: smartctl
+patches:
+  - path: k8s/workflow-patch.yaml
+    target:
+      group: argoproj.io
+      version: v1alpha1
+      kind: WorkflowTemplate
+      name: build
+replacements:
+  - source:
+      group: argoproj.io
+      version: v1alpha1
+      kind: WorkflowTemplate
+      name: smartctl-build
+      fieldPath: metadata.name
+    targets:
+      - select:
+          group: delivery.quorate.dev
+          version: v1alpha1
+          kind: ProjectDelivery
+          name: smartctl-image
+        fieldPaths:
+          - spec.workflowTemplateRef.name