53eb82c193
- Replace fragile `git fetch --depth=1 origin "$SHA"` (fails with short SHAs) with `git clone --no-checkout --filter=blob:none` + `git checkout "$SHA"` across all 3 Argo templates (5 clone blocks total) - Upgrade CI compile pool from POP2-32C-128G to POP2-HC-32C-64G (higher clock EPYC cores, 28% cheaper at €0.851/hr vs €1.18/hr) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
121 lines
3.9 KiB
YAML
121 lines
3.9 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: WorkflowTemplate
|
|
metadata:
|
|
name: build-ci-image
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/name: build-ci-image
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
activeDeadlineSeconds: 3600
|
|
serviceAccountName: argo-workflow
|
|
entrypoint: build
|
|
podMetadata:
|
|
labels:
|
|
app.kubernetes.io/component: ci-pipeline
|
|
app.kubernetes.io/part-of: foxhunt
|
|
ttlStrategy:
|
|
secondsAfterCompletion: 3600
|
|
arguments:
|
|
parameters:
|
|
- name: commit-sha
|
|
value: HEAD
|
|
- name: dockerfile
|
|
value: Dockerfile.ci-builder
|
|
- name: image-name
|
|
value: ci-builder
|
|
|
|
templates:
|
|
# Single-pod build: init container clones repo, kaniko builds image.
|
|
# Uses emptyDir — no PVC needed, works when called via templateRef.
|
|
- name: build
|
|
inputs:
|
|
parameters:
|
|
- name: commit-sha
|
|
value: "{{workflow.parameters.commit-sha}}"
|
|
- name: dockerfile
|
|
value: "{{workflow.parameters.dockerfile}}"
|
|
- name: image-name
|
|
value: "{{workflow.parameters.image-name}}"
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: ci-compile-cpu
|
|
tolerations:
|
|
- key: node.cilium.io/agent-not-ready
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
volumes:
|
|
- name: workspace
|
|
emptyDir: {}
|
|
- name: git-ssh-key
|
|
secret:
|
|
secretName: argo-git-ssh-key
|
|
defaultMode: 256
|
|
- name: registry-auth
|
|
secret:
|
|
secretName: gitlab-registry
|
|
items:
|
|
- key: .dockerconfigjson
|
|
path: config.json
|
|
initContainers:
|
|
- name: git-clone
|
|
image: alpine/git:latest
|
|
command: ["/bin/sh", "-c"]
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- name: git-ssh-key
|
|
mountPath: /etc/git-ssh
|
|
readOnly: true
|
|
- name: workspace
|
|
mountPath: /workspace
|
|
args:
|
|
- |
|
|
set -ex
|
|
mkdir -p /root/.ssh
|
|
cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config
|
|
chmod 600 /root/.ssh/config
|
|
|
|
SHA="{{inputs.parameters.commit-sha}}"
|
|
REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git"
|
|
git clone --no-checkout --filter=blob:none "$REPO" /workspace/src
|
|
cd /workspace/src
|
|
git checkout "$SHA"
|
|
echo "Checked out $(git rev-parse --short HEAD)"
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:debug
|
|
command: ["/busybox/sh", "-c"]
|
|
env:
|
|
- name: DOCKER_CONFIG
|
|
value: /kaniko/.docker
|
|
resources:
|
|
requests:
|
|
cpu: "4"
|
|
memory: 8Gi
|
|
limits:
|
|
cpu: "8"
|
|
memory: 16Gi
|
|
volumeMounts:
|
|
- name: registry-auth
|
|
mountPath: /kaniko/.docker
|
|
readOnly: true
|
|
- name: workspace
|
|
mountPath: /workspace
|
|
args:
|
|
- |
|
|
/kaniko/executor \
|
|
--context=/workspace/src \
|
|
--dockerfile=/workspace/src/infra/docker/{{inputs.parameters.dockerfile}} \
|
|
--destination=gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/{{inputs.parameters.image-name}}:latest \
|
|
--insecure-registry=gitlab-registry.foxhunt.svc.cluster.local:5000 \
|
|
--skip-tls-verify-registry=gitlab-registry.foxhunt.svc.cluster.local:5000 \
|
|
--cache=true \
|
|
--cache-repo=gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/cache \
|
|
--snapshot-mode=redo
|