apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: controller-delivery
  namespace: project-delivery
  labels:
    app.kubernetes.io/name: project-delivery
    app.kubernetes.io/instance: controller
spec:
  entrypoint: workflow
  serviceAccountName: project-delivery-executor
  automountServiceAccountToken: false
  executor:
    serviceAccountName: project-delivery-executor
  parallelism: 3
  podGC:
    strategy: OnWorkflowCompletion
  podMetadata:
    labels:
      app.kubernetes.io/name: project-delivery
      delivery.quorate.dev/project: controller
  podSpecPatch: |
    dnsConfig:
      options:
        - name: ndots
          value: "1"
    containers:
      - name: wait
        volumeMounts:
          - name: exec-sa-token
            mountPath: /var/run/secrets/kubernetes.io/serviceaccount
            readOnly: true
    volumes:
      - name: exec-sa-token
        secret: null
        projected:
          defaultMode: 0440
          sources:
            - serviceAccountToken:
                expirationSeconds: 1800
                path: token
            - configMap:
                name: kube-root-ca.crt
                items:
                  - key: ca.crt
                    path: ca.crt
            - downwardAPI:
                items:
                  - path: namespace
                    fieldRef:
                      apiVersion: v1
                      fieldPath: metadata.namespace
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile:
      type: RuntimeDefault
  arguments:
    parameters:
      - name: source-repository
      - name: source-ref
      - name: source-revision
      - name: targets
  templates:
    - name: workflow
      steps:
        - - name: initialize
            template: initialize
        - - name: delivery
            template: delivery
            arguments:
              parameters:
                - name: working-pvc
                  value: "{{steps.initialize.outputs.parameters.working-pvc}}"
      outputs:
        parameters:
          - name: delivery-result
            valueFrom:
              parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"

    - name: initialize
      metadata:
        labels:
          delivery.quorate.dev/stage: ctrl-workspace-init
      container:
        image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
        command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
        args: [/orchestration/initialize.fsx]
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
        resources:
          requests: {cpu: 100m, memory: 64Mi}
          limits: {cpu: 500m, memory: 256Mi}
        securityContext: &restricted
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
          readOnlyRootFilesystem: true
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace}
          - {name: temporary, mountPath: /tmp}
      volumes:
        - {name: orchestration, configMap: {name: controller-orch, defaultMode: 0444}}
        - {name: temporary, emptyDir: {}}
        - name: workflow-workspace
          ephemeral:
            volumeClaimTemplate:
              spec:
                accessModes: [ReadWriteOnce]
                storageClassName: openebs-hostpath-ssd
                resources:
                  requests:
                    storage: 5Gi
      outputs:
        parameters:
          - name: working-pvc
            valueFrom: {path: /workspace/.claim-name}

    - name: delivery
      inputs:
        parameters:
          - name: working-pvc
      dag:
        tasks:
          - name: source-pull
            template: source-pull
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: cache-pull
            dependencies: [source-pull]
            template: cache-pull
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: toolchain-pull
            dependencies: [source-pull]
            template: toolchain-pull
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: build
            dependencies: [cache-pull, toolchain-pull]
            template: build
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: image-publish
            dependencies: [build]
            template: image-publish
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: cache-export
            dependencies: [build]
            template: cache-export
            continueOn:
              failed: true
              error: true
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
      outputs:
        parameters:
          - name: delivery-result
            valueFrom:
              parameter: "{{tasks.image-publish.outputs.parameters.delivery-result}}"

    - name: source-pull
      inputs: &working-pvc-input
        parameters:
          - name: working-pvc
      metadata:
        labels:
          delivery.quorate.dev/stage: ctrl-source
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/source.fsx]
        env:
          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits: {cpu: "1", memory: 512Mi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: source-auth, mountPath: /source-auth, readOnly: true}
          - {name: workflow-workspace, mountPath: /source, subPath: source}
          - {name: workflow-workspace, mountPath: /tmp, subPath: source/tmp}
      volumes:
        - {name: orchestration, configMap: {name: controller-orch, defaultMode: 0444}}
        - {name: source-auth, secret: {secretName: quorate-pull, defaultMode: 0440}}
        - &workflow-workspace
          name: workflow-workspace
          persistentVolumeClaim:
            claimName: "{{inputs.parameters.working-pvc}}"

    - name: cache-pull
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: ctrl-cache-pull
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/cache.fsx]
        env:
          - {name: CACHE_ACTION, value: pull}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: 500m, memory: 256Mi}
          limits: {cpu: "2", memory: 1Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
          - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
          - {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
          - {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
          - {name: workflow-workspace, mountPath: /state, subPath: state}
          - {name: workflow-workspace, mountPath: /build-cache, subPath: output/go-cache}
          - {name: workflow-workspace, mountPath: /tmp, subPath: state/cache-tmp}
      volumes:
        - {name: orchestration, configMap: {name: controller-orch, defaultMode: 0444}}
        - {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
        - {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
        - *workflow-workspace

    - name: toolchain-pull
      inputs: *working-pvc-input
      podSpecPatch: |
        runtimeClassName: gvisor
      metadata:
        labels:
          delivery.quorate.dev/stage: ctrl-toolchain
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/toolchain.fsx]
        resources:
          requests: {cpu: "1", memory: 512Mi}
          limits: {cpu: "4", memory: 2Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
          - {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
          - {name: workflow-workspace, mountPath: /state, subPath: state, readOnly: true}
          - {name: workflow-workspace, mountPath: /tmp, subPath: toolchain/tmp}
      volumes:
        - {name: orchestration, configMap: {name: controller-orch, defaultMode: 0444}}
        - *workflow-workspace

    - name: build
      inputs: *working-pvc-input
      podSpecPatch: |
        runtimeClassName: gvisor
      metadata:
        labels:
          delivery.quorate.dev/stage: ctrl-build
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/build.fsx]
        env:
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: "2", memory: 1Gi}
          limits: {cpu: "6", memory: 4Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
          - {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
          - {name: workflow-workspace, mountPath: /state, subPath: state, readOnly: true}
          - {name: workflow-workspace, mountPath: /build-cache, subPath: output/go-cache}
          - {name: workflow-workspace, mountPath: /output, subPath: output}
          - {name: workflow-workspace, mountPath: /tmp, subPath: output/tmp}
      volumes:
        - {name: orchestration, configMap: {name: controller-orch, defaultMode: 0444}}
        - *workflow-workspace

    - name: image-publish
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: publish-internal
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/publish.fsx]
        env:
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
          - {name: TARGETS, value: "{{workflow.parameters.targets}}"}
        resources:
          requests: {cpu: 250m, memory: 256Mi}
          limits: {cpu: "2", memory: 1Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: registry-auth, mountPath: /auth, readOnly: true}
          - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
          - {name: workflow-workspace, mountPath: /handoff, subPath: output, readOnly: true}
          - {name: workflow-workspace, mountPath: /result, subPath: output/result}
          - {name: workflow-workspace, mountPath: /tmp, subPath: output/publish-tmp}
      volumes:
        - {name: orchestration, configMap: {name: controller-orch, defaultMode: 0444}}
        - {name: registry-auth, secret: {secretName: quay-writer, defaultMode: 0440}}
        - {name: registry-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
        - *workflow-workspace
      outputs:
        parameters:
          - name: delivery-result
            valueFrom: {path: /result/delivery-result}

    - name: cache-export
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: ctrl-cache-export
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/cache.fsx]
        env:
          - {name: CACHE_ACTION, value: export}
        resources:
          requests: {cpu: "1", memory: 512Mi}
          limits: {cpu: "3", memory: 2Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
          - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
          - {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
          - {name: workflow-workspace, mountPath: /state, subPath: state, readOnly: true}
          - {name: workflow-workspace, mountPath: /build-cache, subPath: output/go-cache, readOnly: true}
          - {name: workflow-workspace, mountPath: /tmp, subPath: output/cache-tmp}
      volumes:
        - {name: orchestration, configMap: {name: controller-orch, defaultMode: 0444}}
        - {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
        - {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
        - *workflow-workspace