apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: image-prepare
  namespace: mirrored-image
  labels:
    app.kubernetes.io/name: mirrored-image
    app.kubernetes.io/instance: mirrored-image
spec:
  entrypoint: run
  serviceAccountName: candidate-exec
  automountServiceAccountToken: false
  executor: {serviceAccountName: candidate-exec}
  podMetadata:
    labels:
      app.kubernetes.io/name: mirrored-image
      app.kubernetes.io/instance: mirrored-image
      mirror.quorate.dev/purpose: prepare
  podSpecPatch: |
    initContainers:
      - name: init
        resources:
          requests: {cpu: 10m, memory: 32Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
    containers:
      - name: wait
        resources:
          requests: {cpu: 10m, memory: 32Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
        volumeMounts:
          - {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
    volumes:
      - name: exec-sa-token
        secret: null
        projected:
          defaultMode: 0440
          sources:
            - serviceAccountToken: {path: token, expirationSeconds: 1800}
            - configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
            - downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile: {type: RuntimeDefault}
  arguments:
    parameters:
      - {name: source-repository}
      - {name: target-repository}
      - {name: digest}
      - {name: tag}
  templates:
    - name: run
      container:
        image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
        command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
        args: [/actions/prepare.fsx]
        env:
          - {name: REGISTRY, value: registry.quorate.internal}
          - {name: QUAY_API, value: https://registry.quorate.internal}
          - {name: TLS_VERIFY, value: "true"}
          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
          - {name: TARGET_REPOSITORY, value: "{{workflow.parameters.target-repository}}"}
          - {name: DIGEST, value: "{{workflow.parameters.digest}}"}
          - {name: TAG, value: "{{workflow.parameters.tag}}"}
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits: {cpu: 1, memory: 512Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
          readOnlyRootFilesystem: true
        volumeMounts:
          - {name: actions, mountPath: /actions, readOnly: true}
          - {name: temporary, mountPath: /tmp}
          - {name: candidate-writer, mountPath: /candidate-writer, readOnly: true}
          - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
  volumes:
    - {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
    - {name: temporary, emptyDir: {}}
    - {name: candidate-writer, secret: {secretName: candidates-writer, defaultMode: 0440}}
    - {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
---
apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: image-promote
  namespace: mirrored-image
  labels:
    app.kubernetes.io/name: mirrored-image
    app.kubernetes.io/instance: mirrored-image
spec:
  entrypoint: run
  serviceAccountName: promote-exec
  automountServiceAccountToken: false
  executor: {serviceAccountName: promote-exec}
  podMetadata:
    labels:
      app.kubernetes.io/name: mirrored-image
      app.kubernetes.io/instance: mirrored-image
      mirror.quorate.dev/purpose: promotion
  podSpecPatch: |
    initContainers:
      - name: init
        resources:
          requests: {cpu: 10m, memory: 32Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
    containers:
      - name: wait
        resources:
          requests: {cpu: 10m, memory: 32Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
        volumeMounts:
          - {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
    volumes:
      - name: exec-sa-token
        secret: null
        projected:
          defaultMode: 0440
          sources:
            - serviceAccountToken: {path: token, expirationSeconds: 1800}
            - configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
            - downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile: {type: RuntimeDefault}
  arguments:
    parameters:
      - {name: source-repository}
      - {name: target-repository}
      - {name: digest}
      - {name: tag}
  templates:
    - name: run
      container:
        image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
        command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
        args: [/actions/promote.fsx]
        env:
          - {name: REGISTRY, value: registry.quorate.internal}
          - {name: QUAY_API, value: https://registry.quorate.internal}
          - {name: TLS_VERIFY, value: "true"}
          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
          - {name: TARGET_REPOSITORY, value: "{{workflow.parameters.target-repository}}"}
          - {name: DIGEST, value: "{{workflow.parameters.digest}}"}
          - {name: TAG, value: "{{workflow.parameters.tag}}"}
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits: {cpu: 1, memory: 512Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
          readOnlyRootFilesystem: true
        volumeMounts:
          - {name: actions, mountPath: /actions, readOnly: true}
          - {name: temporary, mountPath: /tmp}
          - {name: candidate-reader, mountPath: /candidate-reader, readOnly: true}
          - {name: mirror-writer, mountPath: /mirror-writer, readOnly: true}
          - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
  volumes:
    - {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
    - {name: temporary, emptyDir: {}}
    - {name: candidate-reader, secret: {secretName: candidates-reader, defaultMode: 0440}}
    - {name: mirror-writer, secret: {secretName: mirror-writer, defaultMode: 0440}}
    - {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
---
apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: image-cleanup
  namespace: mirrored-image
  labels:
    app.kubernetes.io/name: mirrored-image
    app.kubernetes.io/instance: mirrored-image
spec:
  entrypoint: cleanup
  serviceAccountName: cleanup-exec
  automountServiceAccountToken: false
  executor: {serviceAccountName: cleanup-exec}
  podMetadata:
    labels:
      app.kubernetes.io/name: mirrored-image
      app.kubernetes.io/instance: mirrored-image
      mirror.quorate.dev/purpose: cleanup
  podSpecPatch: |
    initContainers:
      - name: init
        resources:
          requests: {cpu: 10m, memory: 32Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
    containers:
      - name: wait
        resources:
          requests: {cpu: 10m, memory: 32Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
        volumeMounts:
          - {name: exec-sa-token, mountPath: /var/run/secrets/kubernetes.io/serviceaccount, readOnly: true}
    volumes:
      - name: exec-sa-token
        secret: null
        projected:
          defaultMode: 0440
          sources:
            - serviceAccountToken: {path: token, expirationSeconds: 1800}
            - configMap: {name: kube-root-ca.crt, items: [{key: ca.crt, path: ca.crt}]}
            - downwardAPI: {items: [{path: namespace, fieldRef: {apiVersion: v1, fieldPath: metadata.namespace}}]}
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile: {type: RuntimeDefault}
  arguments:
    parameters:
      - {name: candidate-repository}
      - {name: mirror-repository}
      - {name: digest}
  templates:
    - name: cleanup
      steps:
        - - name: candidate
            template: candidate
        - - name: mirror
            template: mirror
    - name: candidate
      container:
        image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
        command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
        args: [/actions/cleanup.fsx]
        env:
          - {name: REGISTRY, value: registry.quorate.internal}
          - {name: TLS_VERIFY, value: "true"}
          - {name: REPOSITORY, value: "{{workflow.parameters.candidate-repository}}"}
          - {name: DIGEST, value: "{{workflow.parameters.digest}}"}
          - {name: AUTH_TOKEN_PATH, value: /candidate-writer/token}
        resources:
          requests: {cpu: 50m, memory: 64Mi}
          limits: {cpu: 500m, memory: 256Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
          readOnlyRootFilesystem: true
        volumeMounts:
          - {name: actions, mountPath: /actions, readOnly: true}
          - {name: temporary, mountPath: /tmp}
          - {name: candidate-writer, mountPath: /candidate-writer, readOnly: true}
          - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
      volumes:
        - {name: candidate-writer, secret: {secretName: candidates-writer, defaultMode: 0440}}
    - name: mirror
      container:
        image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
        command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
        args: [/actions/cleanup.fsx]
        env:
          - {name: REGISTRY, value: registry.quorate.internal}
          - {name: TLS_VERIFY, value: "true"}
          - {name: REPOSITORY, value: "{{workflow.parameters.mirror-repository}}"}
          - {name: DIGEST, value: "{{workflow.parameters.digest}}"}
          - {name: AUTH_TOKEN_PATH, value: /mirror-writer/token}
        resources:
          requests: {cpu: 50m, memory: 64Mi}
          limits: {cpu: 500m, memory: 256Mi}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
          readOnlyRootFilesystem: true
        volumeMounts:
          - {name: actions, mountPath: /actions, readOnly: true}
          - {name: temporary, mountPath: /tmp}
          - {name: mirror-writer, mountPath: /mirror-writer, readOnly: true}
          - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
      volumes:
        - {name: mirror-writer, secret: {secretName: mirror-writer, defaultMode: 0440}}
  volumes:
    - {name: actions, configMap: {name: mirrored-image-actions, defaultMode: 0444}}
    - {name: temporary, emptyDir: {}}
    - {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}