From 9cd4da9acf5c9bcc8f49fcaeda2e73fb1e31cb09 Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Thu, 5 Mar 2026 22:58:42 +0100 Subject: [PATCH] fix(ci): restructure Docker build to single pod with emptyDir build-ci-image used volumeClaimTemplates (PVC) shared between a git-clone pod and a kaniko-build pod in a DAG. When called via templateRef from ci-pipeline, the VCT wasn't inherited, causing "volume 'workspace' not found" errors. Fixed by merging into a single pod: init container (git clone) + main container (kaniko build) sharing an emptyDir volume. No PVC needed, works correctly when called via templateRef. Also removed stale compile-training-template.yaml reference from kustomization (file doesn't exist, template is inline in ci-pipeline). Co-Authored-By: Claude Opus 4.6 --- infra/k8s/argo/build-ci-image-template.yaml | 143 +++++++------------- infra/k8s/argo/kustomization.yaml | 1 - 2 files changed, 51 insertions(+), 93 deletions(-) diff --git a/infra/k8s/argo/build-ci-image-template.yaml b/infra/k8s/argo/build-ci-image-template.yaml index dccf46d45..1079b39cf 100644 --- a/infra/k8s/argo/build-ci-image-template.yaml +++ b/infra/k8s/argo/build-ci-image-template.yaml @@ -24,29 +24,10 @@ spec: value: Dockerfile.ci-builder - name: image-name value: ci-builder - volumes: - - name: git-ssh-key - secret: - secretName: argo-git-ssh-key - defaultMode: 256 - - name: registry-auth - secret: - secretName: gitlab-registry - items: - - key: .dockerconfigjson - path: config.json - - volumeClaimTemplates: - - metadata: - name: workspace - spec: - accessModes: ["ReadWriteOnce"] - storageClassName: scw-bssd - resources: - requests: - storage: 5Gi templates: + # Single-pod build: init container clones repo, kaniko builds image. + # Uses emptyDir — no PVC needed, works when called via templateRef. - name: build inputs: parameters: @@ -56,84 +37,62 @@ spec: value: "{{workflow.parameters.dockerfile}}" - name: image-name value: "{{workflow.parameters.image-name}}" - dag: - tasks: - - name: git-clone - template: git-clone - arguments: - parameters: - - name: commit-sha - value: "{{inputs.parameters.commit-sha}}" - - name: kaniko-build - template: kaniko-build - dependencies: [git-clone] - arguments: - parameters: - - name: dockerfile - value: "{{inputs.parameters.dockerfile}}" - - name: image-name - value: "{{inputs.parameters.image-name}}" - - # ── git-clone: fetch source code into shared PVC ── - - name: git-clone nodeSelector: k8s.scaleway.com/pool-name: ci-compile-cpu tolerations: - key: node.cilium.io/agent-not-ready operator: Exists effect: NoSchedule - inputs: - parameters: - - name: commit-sha - container: - image: alpine/git:latest - command: ["/bin/sh", "-c"] - resources: - requests: - cpu: 200m - memory: 256Mi - limits: - cpu: "1" - memory: 512Mi - volumeMounts: - - name: git-ssh-key - mountPath: /etc/git-ssh - readOnly: true - - name: workspace - mountPath: /workspace - args: - - | - set -e - mkdir -p ~/.ssh - cp /etc/git-ssh/ssh-privatekey ~/.ssh/id_ed25519 - chmod 600 ~/.ssh/id_ed25519 - printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > ~/.ssh/config - chmod 600 ~/.ssh/config + volumes: + - name: workspace + emptyDir: {} + - name: git-ssh-key + secret: + secretName: argo-git-ssh-key + defaultMode: 256 + - name: registry-auth + secret: + secretName: gitlab-registry + items: + - key: .dockerconfigjson + path: config.json + initContainers: + - name: git-clone + image: alpine/git:latest + command: ["/bin/sh", "-c"] + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: "1" + memory: 512Mi + volumeMounts: + - name: git-ssh-key + mountPath: /etc/git-ssh + readOnly: true + - name: workspace + mountPath: /workspace + args: + - | + set -e + mkdir -p ~/.ssh + cp /etc/git-ssh/ssh-privatekey ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > ~/.ssh/config + chmod 600 ~/.ssh/config - SHA="{{inputs.parameters.commit-sha}}" - REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git" - if [ "$SHA" = "HEAD" ]; then - git clone --depth=1 "$REPO" /workspace/src - else - git clone --depth=1 "$REPO" /workspace/src - cd /workspace/src - git fetch --depth=1 origin "$SHA" - git checkout "$SHA" - fi - echo "Checked out $(cd /workspace/src && git rev-parse --short HEAD)" - - # ── kaniko-build: build and push image from cloned source ── - - name: kaniko-build - nodeSelector: - k8s.scaleway.com/pool-name: ci-compile-cpu - tolerations: - - key: node.cilium.io/agent-not-ready - operator: Exists - effect: NoSchedule - inputs: - parameters: - - name: dockerfile - - name: image-name + SHA="{{inputs.parameters.commit-sha}}" + REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git" + if [ "$SHA" = "HEAD" ]; then + git clone --depth=1 "$REPO" /workspace/src + else + git clone --depth=1 "$REPO" /workspace/src + cd /workspace/src + git fetch --depth=1 origin "$SHA" + git checkout "$SHA" + fi + echo "Checked out $(cd /workspace/src && git rev-parse --short HEAD)" container: image: gcr.io/kaniko-project/executor:debug command: ["/busybox/sh", "-c"] diff --git a/infra/k8s/argo/kustomization.yaml b/infra/k8s/argo/kustomization.yaml index 9f2d6a84e..a6c27ae83 100644 --- a/infra/k8s/argo/kustomization.yaml +++ b/infra/k8s/argo/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ci-pipeline-template.yaml - - compile-training-template.yaml - build-ci-image-template.yaml - training-workflow-template.yaml - argo-workflow-netpol.yaml