Compare commits
No commits in common. "0a765489ac8fc82778593186b1977a0bba9709a1" and "16cf6f66f3e4ee1cceeb01f749f0188f1df079a3" have entirely different histories.
0a765489ac
...
16cf6f66f3
|
|
@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
|||
kind: Kustomization
|
||||
resources:
|
||||
- maidn-node-static-image.yaml
|
||||
- maidn-node-runtime-image.yaml
|
||||
- maidn-preview-orphan-reconciler.yaml
|
||||
|
|
|
|||
|
|
@ -1,136 +0,0 @@
|
|||
apiVersion: tekton.dev/v1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: maidn-node-runtime-image
|
||||
namespace: tekton-pipelines
|
||||
spec:
|
||||
params:
|
||||
- name: url
|
||||
type: string
|
||||
- name: revision
|
||||
type: string
|
||||
- name: image
|
||||
type: string
|
||||
volumes:
|
||||
- name: work
|
||||
emptyDir: {}
|
||||
- name: git-credentials
|
||||
secret:
|
||||
secretName: forgejo-git-credentials
|
||||
- name: registry-credentials
|
||||
secret:
|
||||
secretName: forgejo-registry-credentials
|
||||
items:
|
||||
- key: .dockerconfigjson
|
||||
path: config.json
|
||||
stepTemplate:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
steps:
|
||||
- name: clone
|
||||
image: alpine/git:2.47.2
|
||||
env:
|
||||
- name: REPOSITORY_URL
|
||||
value: $(params.url)
|
||||
- name: REVISION
|
||||
value: $(params.revision)
|
||||
- name: IMAGE
|
||||
value: $(params.image)
|
||||
volumeMounts:
|
||||
- name: work
|
||||
mountPath: /work
|
||||
- name: git-credentials
|
||||
mountPath: /credentials
|
||||
readOnly: true
|
||||
script: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
case "$REPOSITORY_URL" in https://git.pingu.pw/*) ;; *) exit 1 ;; esac
|
||||
repository_path=${REPOSITORY_URL#https://git.pingu.pw/}
|
||||
case "$repository_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*.git) ;; *) exit 1 ;; esac
|
||||
case "$repository_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
|
||||
case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
|
||||
case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
||||
case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
|
||||
image_path=${IMAGE#git.pingu.pw/}
|
||||
case "$image_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*) ;; *) exit 1 ;; esac
|
||||
case "$image_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
|
||||
cat >/work/askpass <<'EOF'
|
||||
#!/bin/sh
|
||||
case "$1" in *Username*) cat /credentials/username ;; *) cat /credentials/password ;; esac
|
||||
EOF
|
||||
chmod 0700 /work/askpass
|
||||
GIT_ASKPASS=/work/askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" /work/source
|
||||
git -C /work/source checkout "$REVISION"
|
||||
rm -f /work/askpass
|
||||
- name: build-layer
|
||||
image: node:22-alpine
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
volumeMounts:
|
||||
- name: work
|
||||
mountPath: /work
|
||||
script: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
cd /work/source
|
||||
npm install --ignore-scripts --no-audit --no-fund --package-lock=false
|
||||
npm run build
|
||||
npm prune --omit=dev --ignore-scripts --no-audit --no-fund
|
||||
test -f package.json
|
||||
test -d node_modules
|
||||
test -d dist
|
||||
mkdir -p /work/layer/app
|
||||
cp package.json /work/layer/app/
|
||||
cp -R node_modules dist /work/layer/app/
|
||||
tar -C /work/layer -cf /work/layer.tar app
|
||||
rm -rf /work/source /work/layer
|
||||
- name: append
|
||||
image: gcr.io/go-containerregistry/crane:v0.21.7
|
||||
env:
|
||||
- name: HOME
|
||||
value: /tekton/home
|
||||
- name: DOCKER_CONFIG
|
||||
value: /tekton/home/.docker
|
||||
args:
|
||||
- append
|
||||
- --base=node:22-alpine
|
||||
- --new_layer=/work/layer.tar
|
||||
- --new_tag=$(params.image):$(params.revision)
|
||||
volumeMounts:
|
||||
- name: work
|
||||
mountPath: /work
|
||||
- name: registry-credentials
|
||||
mountPath: /tekton/home/.docker
|
||||
readOnly: true
|
||||
- name: mutate
|
||||
image: gcr.io/go-containerregistry/crane:v0.21.7
|
||||
env:
|
||||
- name: HOME
|
||||
value: /tekton/home
|
||||
- name: DOCKER_CONFIG
|
||||
value: /tekton/home/.docker
|
||||
args:
|
||||
- mutate
|
||||
- $(params.image):$(params.revision)
|
||||
- --entrypoint=node
|
||||
- --cmd=dist/index.js
|
||||
- --workdir=/app
|
||||
- --user=node
|
||||
- --env=PORT=8080
|
||||
- --exposed-ports=8080/tcp
|
||||
- --tag=$(params.image):$(params.revision)
|
||||
volumeMounts:
|
||||
- name: registry-credentials
|
||||
mountPath: /tekton/home/.docker
|
||||
readOnly: true
|
||||
|
|
@ -1,46 +1,30 @@
|
|||
apiVersion: tekton.dev/v1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: maidn-node-static-image
|
||||
name: maidn-git-clone
|
||||
namespace: tekton-pipelines
|
||||
spec:
|
||||
params:
|
||||
- name: url
|
||||
type: string
|
||||
- name: revision
|
||||
type: string
|
||||
- name: image
|
||||
type: string
|
||||
- name: output-directory
|
||||
type: string
|
||||
- name: build-configuration
|
||||
type: string
|
||||
default: ci
|
||||
- name: base-image
|
||||
type: string
|
||||
default: nginx:1.27-alpine
|
||||
volumes:
|
||||
- name: work
|
||||
emptyDir: {}
|
||||
- name: git-credentials
|
||||
secret:
|
||||
secretName: forgejo-git-credentials
|
||||
- name: registry-credentials
|
||||
secret:
|
||||
secretName: forgejo-registry-credentials
|
||||
items:
|
||||
- key: .dockerconfigjson
|
||||
path: config.json
|
||||
stepTemplate:
|
||||
env:
|
||||
- name: HOME
|
||||
value: /tekton/home
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
params:
|
||||
- name: url
|
||||
type: string
|
||||
- name: revision
|
||||
type: string
|
||||
workspaces:
|
||||
- name: source
|
||||
steps:
|
||||
- name: clone
|
||||
image: alpine/git:2.47.2
|
||||
|
|
@ -49,71 +33,160 @@ spec:
|
|||
value: $(params.url)
|
||||
- name: REVISION
|
||||
value: $(params.revision)
|
||||
volumeMounts:
|
||||
- name: work
|
||||
mountPath: /work
|
||||
- name: git-credentials
|
||||
mountPath: /credentials
|
||||
readOnly: true
|
||||
- name: SOURCE_PATH
|
||||
value: $(workspaces.source.path)
|
||||
script: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
case "$REPOSITORY_URL" in https://git.pingu.pw/*.git) ;; *) exit 1 ;; esac
|
||||
case "$REPOSITORY_URL" in https://git.pingu.pw/*) ;; *) exit 1 ;; esac
|
||||
repository_path=${REPOSITORY_URL#https://git.pingu.pw/}
|
||||
case "$repository_path" in *.git) ;; *) exit 1 ;; esac
|
||||
case "$repository_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*) exit 1 ;; esac
|
||||
case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
|
||||
case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
||||
cat >/work/askpass <<'EOF'
|
||||
#!/bin/sh
|
||||
case "$1" in *Username*) cat /credentials/username ;; *) cat /credentials/password ;; esac
|
||||
EOF
|
||||
chmod 0700 /work/askpass
|
||||
GIT_ASKPASS=/work/askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" /work/source
|
||||
git -C /work/source checkout "$REVISION"
|
||||
rm -f /work/askpass
|
||||
git clone "$REPOSITORY_URL" "$SOURCE_PATH"
|
||||
git config --global --add safe.directory "$SOURCE_PATH"
|
||||
git -C "$SOURCE_PATH" checkout "$REVISION"
|
||||
---
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: maidn-node-static-build
|
||||
namespace: tekton-pipelines
|
||||
spec:
|
||||
stepTemplate:
|
||||
env:
|
||||
- name: HOME
|
||||
value: /tekton/home
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
params:
|
||||
- name: output-directory
|
||||
type: string
|
||||
- name: build-configuration
|
||||
type: string
|
||||
default: ci
|
||||
- name: target-directory
|
||||
type: string
|
||||
default: /www/target
|
||||
workspaces:
|
||||
- name: source
|
||||
steps:
|
||||
- name: build-layer
|
||||
image: node:22-alpine
|
||||
env:
|
||||
- name: OUTPUT_DIRECTORY
|
||||
value: $(params.output-directory)
|
||||
- name: SOURCE_PATH
|
||||
value: $(workspaces.source.path)
|
||||
- name: TARGET_DIRECTORY
|
||||
value: $(params.target-directory)
|
||||
- name: BUILD_CONFIGURATION
|
||||
value: $(params.build-configuration)
|
||||
- name: NODE_OPTIONS
|
||||
value: --max-old-space-size=384
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
env:
|
||||
- name: NODE_OPTIONS
|
||||
value: --max-old-space-size=384
|
||||
- name: OUTPUT_DIRECTORY
|
||||
value: $(params.output-directory)
|
||||
- name: BUILD_CONFIGURATION
|
||||
value: $(params.build-configuration)
|
||||
volumeMounts:
|
||||
- name: work
|
||||
mountPath: /work
|
||||
script: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
case "$OUTPUT_DIRECTORY" in ''|/*|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
||||
case "$TARGET_DIRECTORY" in /*) ;; *) exit 1 ;; esac
|
||||
target_path=${TARGET_DIRECTORY#/}
|
||||
case "$target_path" in ''|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
||||
case "$BUILD_CONFIGURATION" in ''|-*|*[!A-Za-z0-9._-]*) exit 1 ;; esac
|
||||
cd /work/source
|
||||
build_dir=$(mktemp -d)
|
||||
cp -R "$SOURCE_PATH"/. "$build_dir"
|
||||
cd "$build_dir"
|
||||
# ponytail: no lockfile; skip install scripts and use npm ci when package-lock.json is committed.
|
||||
npm install --ignore-scripts --no-audit --no-fund --package-lock=false
|
||||
npm run build -- --configuration "$BUILD_CONFIGURATION"
|
||||
test -d "$OUTPUT_DIRECTORY"
|
||||
mkdir -p /work/layer/www
|
||||
cp -R "$OUTPUT_DIRECTORY"/. /work/layer/www/
|
||||
tar -C /work/layer -cf /work/layer.tar www
|
||||
rm -rf /work/source /work/layer
|
||||
layer_dir=$(mktemp -d)
|
||||
trap 'rm -rf "$build_dir" "$layer_dir"' EXIT
|
||||
mkdir -p "$layer_dir/$target_path"
|
||||
cp -R "$OUTPUT_DIRECTORY"/. "$layer_dir/$target_path/"
|
||||
tar -C "$layer_dir" -cf "$SOURCE_PATH/layer.tar" "$target_path"
|
||||
for memory_peak_path in /sys/fs/cgroup/memory.peak /sys/fs/cgroup/memory/memory.max_usage_in_bytes; do
|
||||
if [ -r "$memory_peak_path" ] && memory_peak=$(cat "$memory_peak_path"); then
|
||||
case "$memory_peak" in ''|*[!0-9]*) ;; *) printf 'cgroup memory peak: %s\n' "$memory_peak"; break ;; esac
|
||||
fi
|
||||
done
|
||||
---
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: maidn-node-static-push
|
||||
namespace: tekton-pipelines
|
||||
spec:
|
||||
stepTemplate:
|
||||
env:
|
||||
- name: HOME
|
||||
value: /tekton/home
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
params:
|
||||
- name: image
|
||||
type: string
|
||||
- name: revision
|
||||
type: string
|
||||
- name: base-image
|
||||
type: string
|
||||
default: nginx:1.27-alpine
|
||||
workspaces:
|
||||
- name: source
|
||||
volumes:
|
||||
- name: registry-credentials
|
||||
secret:
|
||||
secretName: forgejo-registry-credentials
|
||||
items:
|
||||
- key: .dockerconfigjson
|
||||
path: config.json
|
||||
steps:
|
||||
- name: validate-inputs
|
||||
image: alpine:3.21.3
|
||||
env:
|
||||
- name: IMAGE
|
||||
value: $(params.image)
|
||||
- name: REVISION
|
||||
value: $(params.revision)
|
||||
- name: BASE_IMAGE
|
||||
value: $(params.base-image)
|
||||
script: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
|
||||
image_path=${IMAGE#git.pingu.pw/}
|
||||
case "$image_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*|*/) exit 1 ;; esac
|
||||
case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
|
||||
case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
||||
case "$BASE_IMAGE" in ''|-*|*[!A-Za-z0-9._/@:-]*|/*|*//*|*..*) exit 1 ;; esac
|
||||
- name: push
|
||||
image: gcr.io/go-containerregistry/crane:v0.21.7
|
||||
env:
|
||||
- name: HOME
|
||||
value: /tekton/home
|
||||
- name: DOCKER_CONFIG
|
||||
value: /tekton/home/.docker
|
||||
args:
|
||||
- append
|
||||
- --base=$(params.base-image)
|
||||
- --new_layer=/work/layer.tar
|
||||
- --new_layer=$(workspaces.source.path)/layer.tar
|
||||
- --new_tag=$(params.image):$(params.revision)
|
||||
volumeMounts:
|
||||
- name: work
|
||||
mountPath: /work
|
||||
- name: registry-credentials
|
||||
mountPath: /tekton/home/.docker
|
||||
readOnly: true
|
||||
|
|
|
|||
|
|
@ -1,51 +0,0 @@
|
|||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
task="$root/catalog/maidn-node-runtime-image.yaml"
|
||||
|
||||
contains() {
|
||||
grep -qF -- "$1" "$task"
|
||||
}
|
||||
|
||||
for value in \
|
||||
'apiVersion: tekton.dev/v1' \
|
||||
'kind: Task' \
|
||||
'name: maidn-node-runtime-image' \
|
||||
'emptyDir: {}' \
|
||||
'forgejo-git-credentials' \
|
||||
'forgejo-registry-credentials' \
|
||||
'case "$REPOSITORY_URL" in https://git.pingu.pw/*)' \
|
||||
'case "$REVISION" in [A-Za-z0-9]*)' \
|
||||
'case "$IMAGE" in git.pingu.pw/*)' \
|
||||
'GIT_ASKPASS=/work/askpass' \
|
||||
'runAsNonRoot: true' \
|
||||
'allowPrivilegeEscalation: false' \
|
||||
'drop: [ALL]' \
|
||||
'type: RuntimeDefault' \
|
||||
'npm install --ignore-scripts --no-audit --no-fund --package-lock=false' \
|
||||
'memory: 256Mi' \
|
||||
'memory: 512Mi' \
|
||||
'npm run build' \
|
||||
'npm prune --omit=dev --ignore-scripts --no-audit --no-fund' \
|
||||
'cp package.json /work/layer/app/' \
|
||||
'cp -R node_modules dist /work/layer/app/' \
|
||||
'tar -C /work/layer -cf /work/layer.tar app' \
|
||||
'--base=node:22-alpine' \
|
||||
'--new_tag=$(params.image):$(params.revision)' \
|
||||
'- mutate' \
|
||||
'--entrypoint=node' \
|
||||
'--cmd=dist/index.js' \
|
||||
'--workdir=/app' \
|
||||
'--user=node' \
|
||||
'--env=PORT=8080' \
|
||||
'--exposed-ports=8080/tcp' \
|
||||
'--tag=$(params.image):$(params.revision)'; do
|
||||
contains "$value"
|
||||
done
|
||||
|
||||
for param in url revision image; do
|
||||
contains "name: $param"
|
||||
done
|
||||
|
||||
! grep -qiE 'kaniko|privileged: true' "$task"
|
||||
|
|
@ -2,39 +2,36 @@
|
|||
set -eu
|
||||
|
||||
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
task="$root/catalog/maidn-node-static-image.yaml"
|
||||
catalog="$root/catalog/maidn-node-static-image.yaml"
|
||||
tmp=$(mktemp -d)
|
||||
trap 'rm -rf "$tmp"' EXIT
|
||||
|
||||
contains() {
|
||||
grep -qF -- "$1" "$task"
|
||||
task() {
|
||||
awk -v name="$1" '
|
||||
/^---$/ { if (found) exit }
|
||||
$0 == " name: " name { found=1 }
|
||||
found { print }
|
||||
' "$catalog"
|
||||
}
|
||||
|
||||
for value in \
|
||||
'apiVersion: tekton.dev/v1' \
|
||||
'kind: Task' \
|
||||
'name: maidn-node-static-image' \
|
||||
'emptyDir: {}' \
|
||||
'forgejo-git-credentials' \
|
||||
'forgejo-registry-credentials' \
|
||||
'case "$REPOSITORY_URL" in https://git.pingu.pw/*.git)' \
|
||||
'case "$REVISION" in [A-Za-z0-9]*)' \
|
||||
'case "$OUTPUT_DIRECTORY" in' \
|
||||
'case "$BUILD_CONFIGURATION" in' \
|
||||
'GIT_ASKPASS=/work/askpass' \
|
||||
'runAsNonRoot: true' \
|
||||
'allowPrivilegeEscalation: false' \
|
||||
'drop: [ALL]' \
|
||||
'type: RuntimeDefault' \
|
||||
'npm install --ignore-scripts --no-audit --no-fund --package-lock=false' \
|
||||
'memory: 256Mi' \
|
||||
'memory: 512Mi' \
|
||||
'tar -C /work/layer -cf /work/layer.tar www' \
|
||||
'--base=$(params.base-image)' \
|
||||
'--new_tag=$(params.image):$(params.revision)'; do
|
||||
contains "$value"
|
||||
[ "$(grep -c '^apiVersion: tekton.dev/v1$' "$catalog")" -eq 3 ]
|
||||
[ "$(grep -c '^kind: Task$' "$catalog")" -eq 3 ]
|
||||
[ "$(grep -cF 'runAsNonRoot: true' "$catalog")" -eq 3 ]
|
||||
[ "$(grep -cF 'forgejo-registry-credentials' "$catalog")" -eq 1 ]
|
||||
|
||||
for name in maidn-git-clone maidn-node-static-build maidn-node-static-push; do
|
||||
task "$name" > "$tmp/$name"
|
||||
grep -qF " name: $name" "$tmp/$name"
|
||||
grep -qF ' - name: source' "$tmp/$name"
|
||||
done
|
||||
|
||||
for param in url revision image output-directory build-configuration base-image; do
|
||||
contains "name: $param"
|
||||
done
|
||||
|
||||
! grep -qiE 'kaniko|privileged: true' "$task"
|
||||
grep -qF 'git clone "$REPOSITORY_URL" "$SOURCE_PATH"' "$tmp/maidn-git-clone"
|
||||
grep -qF 'value: --max-old-space-size=384' "$tmp/maidn-node-static-build"
|
||||
grep -qF 'memory: 256Mi' "$tmp/maidn-node-static-build"
|
||||
grep -qF 'memory: 512Mi' "$tmp/maidn-node-static-build"
|
||||
grep -qF 'tar -C "$layer_dir" -cf "$SOURCE_PATH/layer.tar" "$target_path"' "$tmp/maidn-node-static-build"
|
||||
grep -qF 'for memory_peak_path in /sys/fs/cgroup/memory.peak /sys/fs/cgroup/memory/memory.max_usage_in_bytes; do' "$tmp/maidn-node-static-build"
|
||||
grep -qF "if [ -r \"\$memory_peak_path\" ] && memory_peak=\$(cat \"\$memory_peak_path\"); then" "$tmp/maidn-node-static-build"
|
||||
grep -qF 'image: gcr.io/go-containerregistry/crane:v0.21.7' "$tmp/maidn-node-static-push"
|
||||
grep -qF ' - append' "$tmp/maidn-node-static-push"
|
||||
grep -qF 'mountPath: /tekton/home/.docker' "$tmp/maidn-node-static-push"
|
||||
|
|
|
|||
Loading…
Reference in a new issue