apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: lazaret-delivery
  namespace: project-delivery
  labels:
    app.kubernetes.io/name: project-delivery
    app.kubernetes.io/instance: lazaret
spec:
  entrypoint: workflow
  serviceAccountName: project-delivery-executor
  automountServiceAccountToken: false
  executor:
    serviceAccountName: project-delivery-executor
  parallelism: 4
  podGC:
    strategy: OnWorkflowCompletion
  podMetadata:
    labels:
      app.kubernetes.io/name: project-delivery
      delivery.quorate.dev/project: lazaret
  podSpecPatch: |
    dnsConfig:
      options:
        - name: ndots
          value: "1"
    containers:
      - name: wait
        volumeMounts:
          - name: exec-sa-token
            mountPath: /var/run/secrets/kubernetes.io/serviceaccount
            readOnly: true
    volumes:
      - name: exec-sa-token
        secret: null
        projected:
          defaultMode: 0440
          sources:
            - serviceAccountToken:
                expirationSeconds: 3600
                path: token
            - configMap:
                name: kube-root-ca.crt
                items:
                  - key: ca.crt
                    path: ca.crt
            - downwardAPI:
                items:
                  - path: namespace
                    fieldRef:
                      apiVersion: v1
                      fieldPath: metadata.namespace
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile:
      type: RuntimeDefault
  arguments:
    parameters:
      - name: source-repository
      - name: source-ref
      - name: source-revision
      - name: targets
      - name: build-kind
        value: release
  templates:
    - name: workflow
      steps:
        - - name: initialize-workspace
            template: initialize-workspace
        - - name: delivery
            template: delivery
            arguments:
              parameters:
                - name: working-pvc
                  value: "{{steps.initialize-workspace.outputs.parameters.working-pvc}}"
      outputs:
        parameters:
          - name: delivery-result
            valueFrom:
              parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"

    - name: initialize-workspace
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-workspace-init
      container:
        image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
        command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
        args: [/orchestration/initialize.fsx]
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
        resources:
          requests: {cpu: 100m, memory: 64Mi}
          limits: {memory: 256Mi}
        securityContext: &restricted
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
          readOnlyRootFilesystem: true
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workspace, mountPath: /workspace}
          - {name: temporary, mountPath: /tmp}
      volumes:
        - &orchestration {name: orchestration, configMap: {name: lazaret-delivery-orch, defaultMode: 0444}}
        - {name: temporary, emptyDir: {}}
        - name: workspace
          ephemeral:
            volumeClaimTemplate:
              spec:
                accessModes: [ReadWriteOnce]
                storageClassName: openebs-hostpath-ssd
                resources:
                  requests:
                    storage: 30Gi
      outputs:
        parameters:
          - name: working-pvc
            valueFrom: {path: /workspace/.claim-name}

    - name: delivery
      inputs:
        parameters:
          - name: working-pvc
      dag:
        tasks:
          - name: tools
            template: tools
            arguments: &working-pvc-argument
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: source
            dependencies: [tools]
            template: source
            arguments: *working-pvc-argument
          - name: upstream
            template: upstream
            arguments: *working-pvc-argument
          - name: cache-pull
            template: cache-pull
            arguments: *working-pvc-argument
          - name: lazaret-build
            dependencies: [source, upstream, cache-pull]
            template: lazaret-build
            arguments: *working-pvc-argument
          - name: runsc-build
            dependencies: [upstream, cache-pull]
            template: runsc-build
            arguments: *working-pvc-argument
          - name: publish
            dependencies: [lazaret-build, runsc-build]
            template: publish
            arguments: *working-pvc-argument
          - name: cache-export
            dependencies: [lazaret-build, runsc-build]
            template: cache-export
            continueOn:
              failed: true
              error: true
            arguments: *working-pvc-argument
      outputs:
        parameters:
          - name: delivery-result
            valueFrom:
              parameter: "{{tasks.publish.outputs.parameters.delivery-result}}"

    - name: source
      inputs: &working-pvc-input
        parameters:
          - name: working-pvc
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-source
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/source.fsx]
        env:
          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits: {memory: 512Mi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workspace, mountPath: /tools, subPath: tools, readOnly: true}
          - {name: workspace, mountPath: /source, subPath: source}
          - {name: workspace, mountPath: /tmp, subPath: source-tmp}
      volumes:
        - *orchestration
        - &workspace
          name: workspace
          persistentVolumeClaim:
            claimName: "{{inputs.parameters.working-pvc}}"

    - name: tools
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-upstream
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/tools.fsx]
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits: {cpu: "1", memory: 1Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workspace, mountPath: /workspace, subPath: tools}
          - {name: temporary, mountPath: /tmp}
      volumes:
        - *orchestration
        - *workspace
        - {name: temporary, emptyDir: {}}

    - name: upstream
      inputs: *working-pvc-input
      podSpecPatch: |
        runtimeClassName: gvisor
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-upstream
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/dependencies.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
        resources:
          requests: {cpu: "2", memory: 2Gi}
          limits: {memory: 12Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: build-inputs, mountPath: /build-inputs, readOnly: true}
          - {name: workspace, mountPath: /source, subPath: source, readOnly: true}
          - {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
          - {name: workspace, mountPath: /workspace/toolchain, subPath: toolchain}
          - {name: workspace, mountPath: /workspace/state, subPath: state/runsc}
          - {name: workspace, mountPath: /tmp, subPath: output/upstream-tmp}
      volumes:
        - *orchestration
        - *workspace
        - {name: build-inputs, configMap: {name: lazaret-build-inputs, defaultMode: 0444}}

    - name: cache-pull
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-cache-pull
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/cache.fsx]
        env:
          - {name: CACHE_ACTION, value: pull}
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: "2", memory: 1Gi}
          limits: {memory: 4Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
          - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
          - {name: build-inputs, mountPath: /build-inputs, readOnly: true}
          - {name: workspace, mountPath: /source, subPath: source}
          - {name: workspace, mountPath: /toolchain, subPath: toolchain}
          - {name: workspace, mountPath: /state, subPath: state}
          - {name: workspace, mountPath: /plan, subPath: state}
          - {name: workspace, mountPath: /tmp, subPath: state/cache-tmp}
      volumes:
        - *orchestration
        - *workspace
        - {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
        - {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
        - {name: build-inputs, configMap: {name: lazaret-build-inputs, defaultMode: 0444}}

    - name: lazaret-build
      inputs: *working-pvc-input
      podSpecPatch: |
        runtimeClassName: gvisor
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-build
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/build-lazaret.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: "6", memory: 8Gi}
          limits: {memory: 24Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workspace, mountPath: /bin/sh, subPath: toolchain/environment/usr/bin/busybox, readOnly: true}
          - {name: workspace, mountPath: /workspace/source, subPath: source/repository, readOnly: true}
          - {name: workspace, mountPath: /workspace/source/.lazaret/vendor/fuser-0.17.0, subPath: toolchain/cargo/fuser-0.17.0, readOnly: true}
          - {name: workspace, mountPath: /workspace/environment, subPath: toolchain/environment, readOnly: true}
          - {name: workspace, mountPath: /workspace/cargo, subPath: toolchain/cargo, readOnly: true}
          - {name: workspace, mountPath: /workspace/state, subPath: state/lazaret}
          - {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
          - {name: workspace, mountPath: /workspace/output, subPath: output/lazaret}
          - {name: workspace, mountPath: /tmp, subPath: output/lazaret-tmp}
      volumes:
        - *orchestration
        - *workspace

    - name: runsc-build
      inputs: *working-pvc-input
      podSpecPatch: |
        runtimeClassName: gvisor
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-runsc-build
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/build-runsc.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: "6", memory: 8Gi}
          limits: {memory: 24Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workspace, mountPath: /bin, subPath: toolchain/environment/usr/bin, readOnly: true}
          - {name: workspace, mountPath: /usr/bin, subPath: toolchain/environment/usr/bin, readOnly: true}
          - {name: workspace, mountPath: /usr/include, subPath: toolchain/environment/usr/include, readOnly: true}
          - {name: workspace, mountPath: /usr/lib, subPath: toolchain/environment/usr/lib, readOnly: true}
          - {name: workspace, mountPath: /workspace/environment, subPath: toolchain/environment, readOnly: true}
          - {name: workspace, mountPath: /workspace/toolchain/gvisor, subPath: toolchain/gvisor}
          - {name: workspace, mountPath: /workspace/state, subPath: state/runsc}
          - {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
          - {name: workspace, mountPath: /workspace/output, subPath: output/runsc}
          - {name: workspace, mountPath: /tmp, subPath: output/runsc-tmp}
      volumes:
        - *orchestration
        - *workspace

    - name: publish
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-publication
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/push.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
          - {name: TARGETS, value: "{{workflow.parameters.targets}}"}
        resources:
          requests: {cpu: 250m, memory: 256Mi}
          limits: {memory: 1Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: publisher-auth, mountPath: /publisher-auth, readOnly: true}
          - {name: workspace, mountPath: /handoff/lazaret, subPath: output/lazaret, readOnly: true}
          - {name: workspace, mountPath: /handoff/runsc, subPath: output/runsc, readOnly: true}
          - {name: workspace, mountPath: /result, subPath: output/result}
          - {name: workspace, mountPath: /tmp, subPath: output/publish-tmp}
      volumes:
        - *orchestration
        - *workspace
        - {name: publisher-auth, secret: {secretName: lazaret-publisher, defaultMode: 0440}}
      outputs:
        parameters:
          - name: delivery-result
            valueFrom: {path: /result/delivery-result}

    - name: cache-export
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: lazaret-cache-export
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/cache.fsx]
        env:
          - {name: CACHE_ACTION, value: export}
        resources:
          requests: {cpu: "4", memory: 2Gi}
          limits: {memory: 8Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
          - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
          - {name: workspace, mountPath: /plan, subPath: state, readOnly: true}
          - {name: workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
          - {name: workspace, mountPath: /state, subPath: state, readOnly: true}
          - {name: workspace, mountPath: /tmp, subPath: exports/cache-tmp}
      volumes:
        - *orchestration
        - *workspace
        - {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
        - {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}