apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: nuthatch-delivery
  namespace: project-delivery
  labels:
    app.kubernetes.io/name: project-delivery
    app.kubernetes.io/instance: nuthatch
spec:
  entrypoint: workflow
  serviceAccountName: project-delivery-executor
  automountServiceAccountToken: false
  executor:
    serviceAccountName: project-delivery-executor
  parallelism: 4
  podGC:
    strategy: OnWorkflowCompletion
  podMetadata:
    labels:
      app.kubernetes.io/name: project-delivery
      delivery.quorate.dev/project: nuthatch
  podSpecPatch: |
    dnsConfig:
      options:
        - name: ndots
          value: "1"
    containers:
      - name: wait
        volumeMounts:
          - name: exec-sa-token
            mountPath: /var/run/secrets/kubernetes.io/serviceaccount
            readOnly: true
    volumes:
      - name: exec-sa-token
        secret: null
        projected:
          defaultMode: 0440
          sources:
            - serviceAccountToken:
                expirationSeconds: 3600
                path: token
            - configMap:
                name: kube-root-ca.crt
                items:
                  - key: ca.crt
                    path: ca.crt
            - downwardAPI:
                items:
                  - path: namespace
                    fieldRef:
                      apiVersion: v1
                      fieldPath: metadata.namespace
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile:
      type: RuntimeDefault
  arguments:
    parameters:
      - name: source-repository
      - name: source-ref
      - name: source-revision
      - name: targets
      - name: build-kind
        value: release
  templates:
    - name: workflow
      steps:
        - - name: initialize-workspace
            template: initialize-workspace
        - - name: delivery
            template: delivery
            arguments:
              parameters:
                - name: working-pvc
                  value: "{{steps.initialize-workspace.outputs.parameters.working-pvc}}"
      outputs:
        parameters:
          - name: delivery-result
            valueFrom:
              parameter: "{{steps.delivery.outputs.parameters.delivery-result}}"

    - name: initialize-workspace
      metadata:
        labels:
          delivery.quorate.dev/stage: nuthatch-workspace-init
      container:
        image: &runner registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
        command: &fsi [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
        args: [/orchestration/initialize.fsx]
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
        resources:
          requests: {cpu: 250m, memory: 128Mi}
          limits: {cpu: "1", memory: 512Mi}
        securityContext: &restricted
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
          readOnlyRootFilesystem: true
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace}
          - {name: temporary, mountPath: /tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - {name: temporary, emptyDir: {}}
        - name: workflow-workspace
          ephemeral:
            volumeClaimTemplate:
              spec:
                accessModes: [ReadWriteOnce]
                storageClassName: openebs-hostpath-ssd
                resources:
                  requests:
                    storage: 100Gi
      outputs:
        parameters:
          - name: working-pvc
            valueFrom: {path: /workspace/.claim-name}

    - name: delivery
      inputs:
        parameters:
          - name: working-pvc
      dag:
        tasks:
          - name: tools
            template: tools
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: source
            dependencies: [tools]
            template: source
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: toolchain
            template: toolchain
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: cache-pull
            template: cache-pull
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: build
            dependencies: [source, toolchain, cache-pull]
            template: build
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: publish
            dependencies: [build]
            template: publish
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
          - name: cache-export
            dependencies: [build]
            template: cache-export
            continueOn:
              failed: true
              error: true
            arguments:
              parameters:
                - {name: working-pvc, value: "{{inputs.parameters.working-pvc}}"}
      outputs:
        parameters:
          - name: delivery-result
            valueFrom:
              parameter: "{{tasks.publish.outputs.parameters.delivery-result}}"

    - name: source
      inputs: &working-pvc-input
        parameters:
          - name: working-pvc
      metadata:
        labels:
          delivery.quorate.dev/stage: nuthatch-source
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/source.fsx]
        env:
          - {name: SOURCE_REPOSITORY, value: "{{workflow.parameters.source-repository}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: 50m, memory: 64Mi}
          limits: {cpu: 500m, memory: 256Mi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workflow-workspace, mountPath: /tools, subPath: tools, readOnly: true}
          - {name: workflow-workspace, mountPath: /source, subPath: source}
          - {name: workflow-workspace, mountPath: /tmp, subPath: source-tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - &workflow-workspace
          name: workflow-workspace
          persistentVolumeClaim:
            claimName: "{{inputs.parameters.working-pvc}}"

    - name: tools
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: nuthatch-toolchain
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/tools.fsx]
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits: {cpu: "1", memory: 1Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace, subPath: tools}
          - {name: temporary, mountPath: /tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - *workflow-workspace
        - {name: temporary, emptyDir: {}}

    - name: toolchain
      inputs: *working-pvc-input
      podSpecPatch: |
        runtimeClassName: gvisor
      metadata:
        labels:
          delivery.quorate.dev/stage: nuthatch-toolchain
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/dependencies.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
        resources:
          requests: {cpu: 500m, memory: 1Gi}
          limits: {cpu: "3", memory: 8Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: runtime-lock, mountPath: /runtime-lock, readOnly: true}
          - {name: workflow-workspace, mountPath: /source, subPath: source, readOnly: true}
          - {name: workflow-workspace, mountPath: /plan, subPath: state, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace, subPath: toolchain}
          - {name: workflow-workspace, mountPath: /tmp, subPath: toolchain/tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - *workflow-workspace
        - {name: runtime-lock, configMap: {name: nuthatch-runtime-lock, defaultMode: 0444}}

    - name: cache-pull
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: nuthatch-cache-pull
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/cache.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
          - {name: CACHE_ACTION, value: pull}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
        resources:
          requests: {cpu: "2", memory: 1Gi}
          limits: {cpu: "6", memory: 4Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: runtime-lock, mountPath: /runtime-lock, readOnly: true}
          - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
          - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
          - {name: workflow-workspace, mountPath: /source, subPath: source}
          - {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain}
          - {name: workflow-workspace, mountPath: /state, subPath: state}
          - {name: workflow-workspace, mountPath: /plan, subPath: state}
          - {name: workflow-workspace, mountPath: /state/restored-build-state/dist-newstyle, subPath: output/dist-newstyle}
          - {name: workflow-workspace, mountPath: /tmp, subPath: state/cache-tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - {name: cache-auth, secret: {secretName: project-delivery-cache-reader, defaultMode: 0440}}
        - {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
        - *workflow-workspace
        - {name: runtime-lock, configMap: {name: nuthatch-runtime-lock, defaultMode: 0444}}

    - name: build
      inputs: *working-pvc-input
      podSpecPatch: |
        runtimeClassName: gvisor
      metadata:
        labels:
          delivery.quorate.dev/stage: nuthatch-build
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/build.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
          - {name: XDG_CACHE_HOME, value: /state}
        resources:
          requests: {cpu: "6", memory: 8Gi}
          limits: {cpu: "12", memory: 24Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: apk-signing, mountPath: /apk-signing, readOnly: true}
          - {name: runtime-config, mountPath: /configuration, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace, subPath: output}
          - {name: workflow-workspace, mountPath: /workspace/source, subPath: source/source, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace/dependencies, subPath: toolchain, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace/toolchain, subPath: toolchain/toolchain, readOnly: true}
          - {name: workflow-workspace, mountPath: /workspace/cabal-home, subPath: toolchain/cabal-home}
          - {name: workflow-workspace, mountPath: /workspace/state-input, subPath: state}
          - {name: workflow-workspace, mountPath: /plan, subPath: state, readOnly: true}
          - {name: workflow-workspace, mountPath: /state, subPath: output/state}
          - {name: workflow-workspace, mountPath: /tmp, subPath: output/tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - {name: apk-signing, secret: {secretName: apk-signing, defaultMode: 0440}}
        - *workflow-workspace
        - name: runtime-config
          configMap: {name: nuthatch-runtime, defaultMode: 0444}

    - name: publish
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: publish-internal
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/push.fsx]
        env:
          - {name: BUILD_KIND, value: "{{workflow.parameters.build-kind}}"}
          - {name: SOURCE_REVISION, value: "{{workflow.parameters.source-revision}}"}
          - {name: TARGETS, value: "{{workflow.parameters.targets}}"}
        resources:
          requests: {cpu: 250m, memory: 512Mi}
          limits: {cpu: "2", memory: 2Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: registry-auth, mountPath: /auth, readOnly: true}
          - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
          - {name: workflow-workspace, mountPath: /handoff, subPath: output, readOnly: true}
          - {name: workflow-workspace, mountPath: /result, subPath: output/result}
          - {name: workflow-workspace, mountPath: /tmp, subPath: output/publish-tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - {name: registry-auth, secret: {secretName: quay-writer, defaultMode: 0440}}
        - {name: registry-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
        - *workflow-workspace
      outputs:
        parameters:
          - name: delivery-result
            valueFrom: {path: /result/delivery-result}

    - name: cache-export
      inputs: *working-pvc-input
      metadata:
        labels:
          delivery.quorate.dev/stage: nuthatch-cache-export
      container:
        image: *runner
        command: *fsi
        args: [/orchestration/cache.fsx]
        env:
          - {name: CACHE_ACTION, value: export}
        resources:
          requests: {cpu: "6", memory: 2Gi}
          limits: {cpu: "12", memory: 8Gi}
        securityContext: *restricted
        volumeMounts:
          - {name: orchestration, mountPath: /orchestration, readOnly: true}
          - {name: cache-auth, mountPath: /cache-auth, readOnly: true}
          - {name: cache-ca, mountPath: /cache-ca, readOnly: true}
          - {name: workflow-workspace, mountPath: /plan, subPath: state, readOnly: true}
          - {name: workflow-workspace, mountPath: /toolchain, subPath: toolchain, readOnly: true}
          - {name: workflow-workspace, mountPath: /build-output, subPath: output, readOnly: true}
          - {name: workflow-workspace, mountPath: /tmp, subPath: output/cache-tmp}
      volumes:
        - {name: orchestration, configMap: {name: nuthatch-delivery-orch, defaultMode: 0444}}
        - {name: cache-auth, secret: {secretName: project-delivery-cache-writer, defaultMode: 0440}}
        - {name: cache-ca, secret: {secretName: quay-internal-ca, defaultMode: 0440}}
        - *workflow-workspace