fix(ci): restructure Docker build to single pod with emptyDir
build-ci-image used volumeClaimTemplates (PVC) shared between a git-clone pod and a kaniko-build pod in a DAG. When called via templateRef from ci-pipeline, the VCT wasn't inherited, causing "volume 'workspace' not found" errors. Fixed by merging into a single pod: init container (git clone) + main container (kaniko build) sharing an emptyDir volume. No PVC needed, works correctly when called via templateRef. Also removed stale compile-training-template.yaml reference from kustomization (file doesn't exist, template is inline in ci-pipeline). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
jgrusewski
@@ -24,29 +24,10 @@ spec:
|
||||
value: Dockerfile.ci-builder
|
||||
- name: image-name
|
||||
value: ci-builder
|
||||
volumes:
|
||||
- name: git-ssh-key
|
||||
secret:
|
||||
secretName: argo-git-ssh-key
|
||||
defaultMode: 256
|
||||
- name: registry-auth
|
||||
secret:
|
||||
secretName: gitlab-registry
|
||||
items:
|
||||
- key: .dockerconfigjson
|
||||
path: config.json
|
||||
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: workspace
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: scw-bssd
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
|
||||
templates:
|
||||
# Single-pod build: init container clones repo, kaniko builds image.
|
||||
# Uses emptyDir — no PVC needed, works when called via templateRef.
|
||||
- name: build
|
||||
inputs:
|
||||
parameters:
|
||||
@@ -56,84 +37,62 @@ spec:
|
||||
value: "{{workflow.parameters.dockerfile}}"
|
||||
- name: image-name
|
||||
value: "{{workflow.parameters.image-name}}"
|
||||
dag:
|
||||
tasks:
|
||||
- name: git-clone
|
||||
template: git-clone
|
||||
arguments:
|
||||
parameters:
|
||||
- name: commit-sha
|
||||
value: "{{inputs.parameters.commit-sha}}"
|
||||
- name: kaniko-build
|
||||
template: kaniko-build
|
||||
dependencies: [git-clone]
|
||||
arguments:
|
||||
parameters:
|
||||
- name: dockerfile
|
||||
value: "{{inputs.parameters.dockerfile}}"
|
||||
- name: image-name
|
||||
value: "{{inputs.parameters.image-name}}"
|
||||
|
||||
# ── git-clone: fetch source code into shared PVC ──
|
||||
- name: git-clone
|
||||
nodeSelector:
|
||||
k8s.scaleway.com/pool-name: ci-compile-cpu
|
||||
tolerations:
|
||||
- key: node.cilium.io/agent-not-ready
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
inputs:
|
||||
parameters:
|
||||
- name: commit-sha
|
||||
container:
|
||||
image: alpine/git:latest
|
||||
command: ["/bin/sh", "-c"]
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
volumeMounts:
|
||||
- name: git-ssh-key
|
||||
mountPath: /etc/git-ssh
|
||||
readOnly: true
|
||||
- name: workspace
|
||||
mountPath: /workspace
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
mkdir -p ~/.ssh
|
||||
cp /etc/git-ssh/ssh-privatekey ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > ~/.ssh/config
|
||||
chmod 600 ~/.ssh/config
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: git-ssh-key
|
||||
secret:
|
||||
secretName: argo-git-ssh-key
|
||||
defaultMode: 256
|
||||
- name: registry-auth
|
||||
secret:
|
||||
secretName: gitlab-registry
|
||||
items:
|
||||
- key: .dockerconfigjson
|
||||
path: config.json
|
||||
initContainers:
|
||||
- name: git-clone
|
||||
image: alpine/git:latest
|
||||
command: ["/bin/sh", "-c"]
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
volumeMounts:
|
||||
- name: git-ssh-key
|
||||
mountPath: /etc/git-ssh
|
||||
readOnly: true
|
||||
- name: workspace
|
||||
mountPath: /workspace
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
mkdir -p ~/.ssh
|
||||
cp /etc/git-ssh/ssh-privatekey ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > ~/.ssh/config
|
||||
chmod 600 ~/.ssh/config
|
||||
|
||||
SHA="{{inputs.parameters.commit-sha}}"
|
||||
REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git"
|
||||
if [ "$SHA" = "HEAD" ]; then
|
||||
git clone --depth=1 "$REPO" /workspace/src
|
||||
else
|
||||
git clone --depth=1 "$REPO" /workspace/src
|
||||
cd /workspace/src
|
||||
git fetch --depth=1 origin "$SHA"
|
||||
git checkout "$SHA"
|
||||
fi
|
||||
echo "Checked out $(cd /workspace/src && git rev-parse --short HEAD)"
|
||||
|
||||
# ── kaniko-build: build and push image from cloned source ──
|
||||
- name: kaniko-build
|
||||
nodeSelector:
|
||||
k8s.scaleway.com/pool-name: ci-compile-cpu
|
||||
tolerations:
|
||||
- key: node.cilium.io/agent-not-ready
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
inputs:
|
||||
parameters:
|
||||
- name: dockerfile
|
||||
- name: image-name
|
||||
SHA="{{inputs.parameters.commit-sha}}"
|
||||
REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git"
|
||||
if [ "$SHA" = "HEAD" ]; then
|
||||
git clone --depth=1 "$REPO" /workspace/src
|
||||
else
|
||||
git clone --depth=1 "$REPO" /workspace/src
|
||||
cd /workspace/src
|
||||
git fetch --depth=1 origin "$SHA"
|
||||
git checkout "$SHA"
|
||||
fi
|
||||
echo "Checked out $(cd /workspace/src && git rev-parse --short HEAD)"
|
||||
container:
|
||||
image: gcr.io/kaniko-project/executor:debug
|
||||
command: ["/busybox/sh", "-c"]
|
||||
|
||||
@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ci-pipeline-template.yaml
|
||||
- compile-training-template.yaml
|
||||
- build-ci-image-template.yaml
|
||||
- training-workflow-template.yaml
|
||||
- argo-workflow-netpol.yaml
|
||||
|
||||
Reference in New Issue
Block a user