apiVersion: argoproj.io/v1alpha1 kind: WorkflowTemplate metadata: name: fsharp-runner-delivery namespace: project-delivery labels: app.kubernetes.io/name: project-delivery app.kubernetes.io/instance: fsharp-runner spec: entrypoint: workflow serviceAccountName: project-delivery-executor automountServiceAccountToken: false executor: serviceAccountName: project-delivery-executor imagePullSecrets: - name: quay-reader parallelism: 3 podGC: strategy: OnWorkflowCompletion podMetadata: labels: app.kubernetes.io/name: project-delivery delivery.quorate.dev/project: fsharp-runner podSpecPatch: | containers: - name: wait volumeMounts: - name: exec-sa-token mountPath: /var/run/secrets/kubernetes.io/serviceaccount readOnly: true volumes: - name: exec-sa-token secret: null projected: defaultMode: 0440 sources: - serviceAccountToken: expirationSeconds: 3600 path: token - configMap: name: kube-root-ca.crt items: - key: ca.crt path: ca.crt - downwardAPI: items: - path: namespace fieldRef: apiVersion: v1 fieldPath: metadata.namespace securityContext: runAsNonRoot: true runAsUser: 65532 runAsGroup: 65532 fsGroup: 65532 fsGroupChangePolicy: OnRootMismatch seccompProfile: type: RuntimeDefault arguments: parameters: - name: source-repository - name: source-ref - name: source-revision - name: targets templates: - name: workflow steps: - - name: initialize template: initialize - - arguments: parameters: - name: working-pvc value: '{{steps.initialize.outputs.parameters.working-pvc}}' name: delivery template: delivery outputs: parameters: - name: delivery-result valueFrom: parameter: '{{steps.delivery.outputs.parameters.delivery-result}}' - name: initialize metadata: labels: delivery.quorate.dev/stage: fsharp-init container: image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83 command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec] args: [/orchestration/initialize.fsx] env: - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name resources: &resources requests: {cpu: 250m, memory: 256Mi} limits: {cpu: "2", memory: 2Gi} securityContext: &restricted allowPrivilegeEscalation: false capabilities: {drop: [ALL]} readOnlyRootFilesystem: true volumeMounts: - {name: orchestration, mountPath: /orchestration, readOnly: true} - {name: workflow-workspace, mountPath: /workspace} - {name: temporary, mountPath: /tmp} volumes: - &orch {name: orchestration, configMap: {name: fsharp-runner-orch, defaultMode: 0444}} - &temporary {name: temporary, emptyDir: {}} - name: workflow-workspace ephemeral: volumeClaimTemplate: spec: accessModes: [ReadWriteOnce] storageClassName: openebs-hostpath-ssd resources: requests: storage: 5Gi outputs: parameters: - name: working-pvc valueFrom: {path: /workspace/.claim-name} - dag: tasks: - arguments: parameters: - name: working-pvc value: '{{inputs.parameters.working-pvc}}' name: source-pull template: source-pull - arguments: parameters: - name: working-pvc value: '{{inputs.parameters.working-pvc}}' name: cache-pull template: cache-pull - arguments: parameters: - name: working-pvc value: '{{inputs.parameters.working-pvc}}' name: toolchain-pull template: toolchain-pull - arguments: parameters: - name: working-pvc value: '{{inputs.parameters.working-pvc}}' dependencies: - source-pull - cache-pull - toolchain-pull name: build template: build - arguments: parameters: - name: working-pvc value: '{{inputs.parameters.working-pvc}}' dependencies: - build name: image-publish template: image-publish - arguments: parameters: - name: working-pvc value: '{{inputs.parameters.working-pvc}}' continueOn: error: true failed: true dependencies: - build name: cache-export template: cache-export inputs: parameters: - name: working-pvc name: delivery outputs: parameters: - name: delivery-result valueFrom: parameter: '{{tasks.image-publish.outputs.parameters.delivery-result}}' - container: args: - /orchestration/source.fsx command: *fsi env: - name: SOURCE_REPOSITORY value: '{{workflow.parameters.source-repository}}' - name: SOURCE_REVISION value: '{{workflow.parameters.source-revision}}' image: *runner resources: *resources securityContext: *restricted volumeMounts: - mountPath: /orchestration name: orchestration readOnly: true - mountPath: /source-auth name: source-auth readOnly: true - mountPath: /source name: workflow-workspace subPath: source - mountPath: /tmp name: workflow-workspace subPath: source/tmp inputs: parameters: - name: working-pvc metadata: labels: delivery.quorate.dev/stage: go-oci-source name: source-pull volumes: - configMap: defaultMode: 292 name: fsharp-runner-orch name: orchestration - name: source-auth secret: defaultMode: 288 secretName: quorate-pull - name: workflow-workspace persistentVolumeClaim: claimName: '{{inputs.parameters.working-pvc}}' - container: args: - /orchestration/cache.fsx command: *fsi env: - name: CACHE_ACTION value: pull - name: TARGETS value: '{{workflow.parameters.targets}}' - name: CACHE_MODE value: parallel image: *runner resources: limits: cpu: "2" memory: 1Gi requests: cpu: 500m memory: 256Mi securityContext: *restricted volumeMounts: - mountPath: /orchestration name: orchestration readOnly: true - mountPath: /cache-auth name: cache-auth readOnly: true - mountPath: /cache-ca name: cache-ca readOnly: true - mountPath: /cache name: workflow-workspace subPath: cache - mountPath: /tmp name: workflow-workspace subPath: state/cache-tmp inputs: parameters: - name: working-pvc metadata: labels: delivery.quorate.dev/stage: go-oci-cache-pull name: cache-pull volumes: - configMap: defaultMode: 292 name: fsharp-runner-orch name: orchestration - name: cache-auth secret: defaultMode: 288 secretName: project-delivery-cache-reader - name: cache-ca secret: defaultMode: 288 secretName: quay-internal-ca - name: workflow-workspace persistentVolumeClaim: claimName: '{{inputs.parameters.working-pvc}}' - container: args: - /orchestration/prepare.fsx - acquire command: *fsi image: *runner resources: *resources securityContext: *restricted volumeMounts: - mountPath: /orchestration name: orchestration readOnly: true - mountPath: /toolchain name: workflow-workspace subPath: toolchain - mountPath: /tmp name: workflow-workspace subPath: state/toolchain-tmp - name: orchestration mountPath: /configuration readOnly: true inputs: parameters: - name: working-pvc metadata: labels: delivery.quorate.dev/stage: fsharp-acquire name: toolchain-pull volumes: - configMap: defaultMode: 292 name: fsharp-runner-orch name: orchestration - name: workflow-workspace persistentVolumeClaim: claimName: '{{inputs.parameters.working-pvc}}' - name: build inputs: parameters: - name: working-pvc container: args: - /orchestration/prepare.fsx - build command: *fsi env: - name: SOURCE_REVISION value: '{{workflow.parameters.source-revision}}' - name: TARGETS value: '{{workflow.parameters.targets}}' image: *runner resources: *resources securityContext: *restricted volumeMounts: - mountPath: /orchestration name: orchestration readOnly: true - mountPath: /source name: workflow-workspace readOnly: true subPath: source - mountPath: /toolchain name: workflow-workspace readOnly: true subPath: toolchain - mountPath: /output name: workflow-workspace subPath: output - mountPath: /tmp name: workflow-workspace subPath: output/tmp - mountPath: /cache name: workflow-workspace subPath: cache metadata: labels: delivery.quorate.dev/stage: fsharp-toolchain podSpecPatch: | runtimeClassName: gvisor volumes: - configMap: defaultMode: 292 name: fsharp-runner-orch name: orchestration - name: workflow-workspace persistentVolumeClaim: claimName: '{{inputs.parameters.working-pvc}}' - container: args: - /orchestration/prepare.fsx - publish command: *fsi env: - name: SOURCE_REVISION value: '{{workflow.parameters.source-revision}}' - name: TARGETS value: '{{workflow.parameters.targets}}' image: *runner resources: *resources securityContext: *restricted volumeMounts: - mountPath: /orchestration name: orchestration readOnly: true - mountPath: /auth name: registry-auth readOnly: true - mountPath: /registry-ca name: registry-ca readOnly: true - mountPath: /handoff name: workflow-workspace readOnly: true subPath: output - mountPath: /result name: workflow-workspace subPath: output/result - mountPath: /tmp name: workflow-workspace subPath: output/publish-tmp inputs: parameters: - name: working-pvc metadata: labels: delivery.quorate.dev/stage: publish-internal name: image-publish outputs: parameters: - name: delivery-result valueFrom: path: /result/delivery-result volumes: - configMap: defaultMode: 292 name: fsharp-runner-orch name: orchestration - name: registry-auth secret: defaultMode: 288 secretName: quay-writer - name: registry-ca secret: defaultMode: 288 secretName: quay-internal-ca - name: workflow-workspace persistentVolumeClaim: claimName: '{{inputs.parameters.working-pvc}}' - container: args: - /orchestration/cache.fsx command: *fsi env: - name: CACHE_ACTION value: export - name: TARGETS value: '{{workflow.parameters.targets}}' - name: CACHE_MODE value: parallel image: *runner resources: limits: cpu: "3" memory: 2Gi requests: cpu: "1" memory: 512Mi securityContext: *restricted volumeMounts: - mountPath: /orchestration name: orchestration readOnly: true - mountPath: /cache-auth name: cache-auth readOnly: true - mountPath: /cache-ca name: cache-ca readOnly: true - mountPath: /cache name: workflow-workspace readOnly: true subPath: cache - mountPath: /tmp name: workflow-workspace subPath: output/cache-tmp inputs: parameters: - name: working-pvc metadata: labels: delivery.quorate.dev/stage: go-oci-cache-export name: cache-export volumes: - configMap: defaultMode: 292 name: fsharp-runner-orch name: orchestration - name: cache-auth secret: defaultMode: 288 secretName: project-delivery-cache-writer - name: cache-ca secret: defaultMode: 288 secretName: quay-internal-ca - name: workflow-workspace persistentVolumeClaim: claimName: '{{inputs.parameters.working-pvc}}'