Add dev contain pipeline.

generic-pipelines/dev-contain-pipeline.yaml

@@ -33,7 +33,7 @@ spec:
       workspace: git-credentials
     params:
     - name: url
-      value: ssh://git@git.jpace121.net:2222/packaging/dev_contain.git
+      value: ssh://git@git.jpace121.net:2222/packaging/dev_contain
     - name: branch
       value: $(params.branch)
     taskRef:

generic-pipelines/simple-ros-pipeline.yaml

@@ -43,7 +43,5 @@ spec:
       value: ./docker/Dockerfile
     - name: registry-login-secret-name
       value: $(params.registry-login-secret-name)
-    - name: cosign-secret-name
-      value: container-signing-secret
     taskRef:
       name: j7s-buildah

generic-tasks/j7s-buildah.yaml

@@ -16,8 +16,6 @@ spec:
     description: Path of the Containerfile relative to source.
   - name: registry-login-secret-name
     description: Name of the secret containing the credentials to push to the registry.
-  - name: cosign-secret-name
-    description: Name of the secret container the credentials for cosign.
   workspaces:
   - name: source
   steps:
@@ -25,10 +23,9 @@ spec:
     image: harbor.internal.jpace121.net/k8s/buildah:latest
     workingDir: $(workspaces.source.path)
     script: |
-      set -e
+      set -x
       # Login
       buildah login --tls-verify=false --username=$USERNAME --password=$PASSWORD $(params.registry)
-      cosign login --username=$USERNAME --password=$PASSWORD $(params.registry)
       # Build
       buildah --storage-driver=overlay bud --tls-verify=false --no-cache \
         -f $(params.containerfile)  -t $(params.name):$(params.version) .
@@ -39,9 +36,6 @@ spec:
       skopeo copy --debug --dest-tls-verify=false \
               containers-storage:localhost/$(params.name):$(params.version) \
               docker://$(params.registry)/$(params.name):latest
-
-      export COSIGN_PASSWORD=$(cat /etc/cosign-credentials/cosign.password)
-      cosign sign --tlog-upload=false --allow-insecure-registry --key /etc/cosign-credentials/cosign.key $(params.registry)/$(params.name):$(params.version)
     env:
     - name: USERNAME
       valueFrom:
@@ -56,13 +50,8 @@ spec:
     volumeMounts:
     - name: varlibcontainers
       mountPath: /var/lib/containers
-    - name: cosign-credentials
-      mountPath: /etc/cosign-credentials
     securityContext:
       privileged: true
   volumes:
   - name: varlibcontainers
-    emptyDir: {}
-  - name: cosign-credentials
-    secret:
-      secretName: $(params.cosign-secret-name)
+    emptyDir: {}

images/Dockerfile_buildah

@@ -3,9 +3,4 @@ FROM quay.io/buildah/upstream:latest
 # Add skopeo.
 RUN dnf install -y skopeo \
     --exclude container-selinux \
-    --enablerepo=updates-testing
-
-# Add wget, use it to install cosign.
-RUN dnf install -y wget && \
-    wget https://github.com/sigstore/cosign/releases/download/v2.1.1/cosign-2.1.1.x86_64.rpm && \
-    rpm -ivh cosign*.rpm
+    --enablerepo=updates-testing

images/Dockerfile_limbo_builder

@@ -1,13 +0,0 @@
-# For building limbo nightlies, including limbo-gui.
-FROM docker.io/library/fedora:latest
-
-RUN sudo dnf update -y && \
-    sudo dnf install -y nodejs yarnpkg \
-                        openssl-devel curl \
-                        just gcc openssh-clients \
-                        git
-RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
-RUN /bin/bash -c "source $HOME/.cargo/env && rustup update"
-RUN /bin/bash -c "source $HOME/.cargo/env && rustup toolchain install nightly"
-RUN /bin/bash -c "source $HOME/.cargo/env && rustup default nightly"
-RUN /bin/bash -c "source $HOME/.cargo/env && cargo install wasm-pack"

j7s-os/j7s-os-buildah.yaml

@@ -14,13 +14,13 @@ spec:
     description: Registry to push to.
   - name: version
     description: Version for the image.
-  - name: registry-login-secret-name
+  - name: registry-secret-name
     description: Name of secret to get credentials for registry from.
   workspaces:
   - name: source
   steps:
   - name: build
-    image: harbor.internal.jpace121.net/k8s/buildah:latest
+    image: quay.io/buildah/stable:v1.23.3
     workingDir: $(workspaces.source.path)
     script: |
       set -x
@@ -31,8 +31,8 @@ spec:
         --build-arg commit=./$(params.commit) \
         -f ./hosting/Dockerfile -t $(params.image):$(params.version) .
       # Push
-      buildah --storage-driver=overlay push --tls-verify=false localhost/$(params.image):$(params.version) docker://$(params.registry)/$(params.image):$(params.version)
-      buildah --storage-driver=overlay push --tls-verify=false localhost/$(params.image):$(params.version) docker://$(params.registry)/$(params.image):latest
+      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):$(params.version)
+      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):latest
     env:
     - name: USERNAME
       valueFrom:

j7s-os/j7s-os-image-build.yaml

@@ -10,7 +10,7 @@ spec:
   results:
   - name: version-string
   steps:
-  - image: harbor.internal.jpace121.net/k8s/j7s-image-build:latest
+  - image: harbor.internal.jpace121.net/j7s-image-build:latest
     securityContext:
       privileged: true
     script: |

j7s-os/j7s-os-k8s-deploy.yaml

@@ -12,7 +12,7 @@ spec:
     - name: ssh-directory
   steps:
     - name: update-with-flux
-      image: harbor.internal.jpace121.net/k8s/gitssh:latest
+      image: harbor.internal.jpace121.net/gitssh:latest
       script: |
         #!/usr/bin/env bash
         set -x

j7s-os/j7s-os-pipeline.yaml

@@ -1,81 +0,0 @@
-# A pipeline to build j7s-os images.
-# Steps:
-#   Clone the j7s-os repo from onedev.
-#   Call make <> in the repo.
-#   Build and push a new deployment container.
-#   Deploy the deployment container as a service.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: j7s-os-pipeline
-  namespace: j7s-ci
-spec:
-  description: Build and deploy j7s-os images.
-  params:
-  - name: make-image-name
-    type: string
-    description: The name of image to make in the os repo.
-  - name: branch
-    type: string
-    default: main
-    description: branch of j7s-os image to build.
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: Tekton's ssh credentials
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/public/j7s-os.git
-    - name: branch
-      value: $(params.branch)
-    taskRef:
-      name: j7s-git-clone
-  - name: image-build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: image-name
-      value: $(params.make-image-name)
-    taskRef:
-      name: j7s-os-image-build
-  - name: build-deploy-image
-    runAfter: ["image-build"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: commit
-      value: $(params.make-image-name)
-    - name: image
-      value: j7s-os-deploy
-    - name: registry
-      value: harbor.internal.jpace121.net/library
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    - name: registry-login-secret-name
-      value: harbor-login
-    taskRef:
-      name: j7s-os-buildah
-  - name: deploy-image
-    runAfter: ["build-deploy-image"]
-    workspaces:
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: image
-      value: harbor.internal.jpace121.net/library/j7s-os-deploy
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    taskRef:
-      name: j7s-os-k8s-deploy

j7s-os/kustomization.yaml

@@ -3,5 +3,4 @@ kind: Kustomization
 resources:
 - j7s-os-buildah.yaml
 - j7s-os-image-build.yaml
-- j7s-os-k8s-deploy.yaml
-- j7s-os-pipeline.yaml
+- j7s-os-k8s-deploy.yaml

limbo/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- limbo-just-build.yaml
-- limbo-pipeline.yaml
-- limbo-pipeline-listener.yaml
-- service-account.yaml
-- limbo-branch-trigger.yaml
-- limbo-web-branch-trigger.yaml
-- limbo-micro-host-branch-trigger.yaml
-- limbo-micro-branch-trigger.yaml

limbo/limbo-branch-trigger.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: limbo-branch-trigger-deployment
-  labels:
-    app: limbo-branch-trigger
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: limbo-branch-trigger
-  template:
-    metadata:
-      labels:
-        app: limbo-branch-trigger
-    spec:
-      volumes:
-      - name: git-credentials
-        secret:
-          secretName: git-credentials
-      containers:
-      - name: branch-trigger
-        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
-        command: ["/bin/sh","-c"]
-        args:
-        - mkdir ~/.ssh;
-          chmod 700 ~/.ssh;
-          cp -r /secrets/. ~/.ssh;
-          chmod -R 400 ~/.ssh/*;
-          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
-          j7s_branch_trigger
-        env:
-        - name: J7S_REPO
-          value: "ssh://git@git.jpace121.net:2222/limbo/limbo.git"
-        - name: J7S_URL
-          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
-        - name: J7S_ORG_NAME
-          value: "limbo"
-        - name: J7S_REPO_NAME
-          value: "limbo"
-        - name: J7S_JOB_NAME
-          value: "limbo"
-        - name: J7S_PATTERN
-          value: "^refs/heads/.*?$"
-        - name: J7S_LOOPTIME
-          value: "5.0"
-        volumeMounts:
-        - name: git-credentials
-          readOnly: true
-          mountPath: "/secrets"

limbo/limbo-just-build.yaml

@@ -1,24 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: limbo-just-build
-spec:
-  workspaces:
-  - name: source
-  - name: ssh-directory
-  steps:
-  - image: harbor.internal.jpace121.net/k8s/limbo_builder:latest
-    script: |
-      #!/usr/bin/env bash
-      set -ex
-      # Set up ssh so we can pull private dependencies.
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-      ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts
-      # Use just to run the ci steps.
-      source ~/.cargo/env
-      export CARGO_NET_GIT_FETCH_WITH_CLI=true
-      cd $(workspaces.source.path)
-      just ci-build
-      just ci-test

limbo/limbo-micro-branch-trigger.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: limbo-micro-branch-trigger-deployment
-  labels:
-    app: limbo-micro-branch-trigger
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: limbo-micro-branch-trigger
-  template:
-    metadata:
-      labels:
-        app: limbo-micro-branch-trigger
-    spec:
-      volumes:
-      - name: git-credentials
-        secret:
-          secretName: git-credentials
-      containers:
-      - name: branch-trigger
-        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
-        command: ["/bin/sh","-c"]
-        args:
-        - mkdir ~/.ssh;
-          chmod 700 ~/.ssh;
-          cp -r /secrets/. ~/.ssh;
-          chmod -R 400 ~/.ssh/*;
-          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
-          j7s_branch_trigger
-        env:
-        - name: J7S_REPO
-          value: "ssh://git@git.jpace121.net:2222/limbo/limbo_micro.git"
-        - name: J7S_URL
-          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
-        - name: J7S_PATTERN
-          value: "^refs/heads/.*?$"
-        - name: J7S_ORG_NAME
-          value: "limbo"
-        - name: J7S_REPO_NAME
-          value: "limbo_micro"
-        - name: J7S_JOB_NAME
-          value: "limbo-micro"
-        - name: J7S_LOOPTIME
-          value: "3.0"
-        volumeMounts:
-        - name: git-credentials
-          readOnly: true
-          mountPath: "/secrets"

limbo/limbo-micro-host-branch-trigger.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: limbo-micro-host-branch-trigger-deployment
-  labels:
-    app: limbo-micro-host-branch-trigger
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: limbo-micro-host-branch-trigger
-  template:
-    metadata:
-      labels:
-        app: limbo-micro-host-branch-trigger
-    spec:
-      volumes:
-      - name: git-credentials
-        secret:
-          secretName: git-credentials
-      containers:
-      - name: branch-trigger
-        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
-        command: ["/bin/sh","-c"]
-        args:
-        - mkdir ~/.ssh;
-          chmod 700 ~/.ssh;
-          cp -r /secrets/. ~/.ssh;
-          chmod -R 400 ~/.ssh/*;
-          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
-          j7s_branch_trigger
-        env:
-        - name: J7S_REPO
-          value: "ssh://git@git.jpace121.net:2222/limbo/limbo_micro_host.git"
-        - name: J7S_URL
-          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
-        - name: J7S_PATTERN
-          value: "^refs/heads/.*?$"
-        - name: J7S_ORG_NAME
-          value: "limbo"
-        - name: J7S_REPO_NAME
-          value: "limbo_micro_host"
-        - name: J7S_JOB_NAME
-          value: "limbo-micro-host"
-        - name: J7S_LOOPTIME
-          value: "3.0"
-        volumeMounts:
-        - name: git-credentials
-          readOnly: true
-          mountPath: "/secrets"

limbo/limbo-pipeline-listener.yaml

@@ -1,69 +0,0 @@
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: EventListener
-metadata:
-  name: limbo-pipeline-listener
-spec:
-  serviceAccountName: limbo-serviceaccount
-  triggers:
-    - name: limbo-pipeline-trigger
-      bindings:
-        - ref: limbo-pipeline-binding
-      template:
-        ref: limbo-pipeline-template
-  resources:
-    kubernetesResource:
-      serviceType: ClusterIP
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerBinding
-metadata:
-  name: limbo-pipeline-binding
-spec:
-  params:
-    - name: sha
-      value: $(body.sha)
-    - name: repo_name
-      value: $(body.repo_name)
-    - name: org_name
-      value: $(body.org_name)
-    - name: job_name
-      value: $(body.job_name)
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerTemplate
-metadata:
-  name: limbo-pipeline-template
-spec:
-  params:
-  - name: sha
-  - name: repo_name
-  - name: org_name
-  - name: job_name
-  resourcetemplates:
-  - apiVersion: tekton.dev/v1beta1
-    kind: PipelineRun
-    metadata:
-      generateName: "$(tt.params.job_name)-pipeline-"
-    spec:
-      pipelineRef:
-        name: limbo-pipeline
-      params:
-      - name: sha
-        value: "$(tt.params.sha)"
-      - name: gitea-repo-name
-        value: "$(tt.params.repo_name)"
-      - name: gitea-org-name
-        value: "$(tt.params.org_name)"
-      workspaces:
-      - name: shared-data
-        volumeClaimTemplate:
-          spec:
-            accessModes:
-            - ReadWriteOnce
-            resources:
-              requests:
-                  storage: 1Gi
-      - name: git-credentials
-        secret:
-          secretName: git-credentials

limbo/limbo-pipeline.yaml

@@ -1,63 +0,0 @@
-# A pipeline to build limbo.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: limbo-pipeline
-spec:
-  description: "Pipeline for limbo project."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  params:
-  - name: sha
-    description: git hash to checkout
-    default: main
-  - name: gitea-repo-name
-    description: name of the repo in gitea (the part right before .git in the clone url)
-    default: limbo
-  - name: gitea-org-name
-    description: name of the org in gitea
-    default: limbo
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/limbo/$(params.gitea-repo-name).git
-    - name: hash
-      value: $(params.sha)
-    taskRef:
-      name: j7s-git-clone-hash
-  - name: call-just
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    taskRef:
-      name: limbo-just-build
-  finally:
-    - name: gitea-status
-      params:
-        - name: git-owner
-          value: $(params.gitea-org-name)
-        - name: description
-          value: $(context.pipelineRun.name)
-        - name: git-repo-name
-          value: $(params.gitea-repo-name)
-        - name: name
-          value: j7s-ci/limbo-pipeline
-        - name: sha
-          value: $(tasks.fetch-repo.results.hash)
-        - name: status
-          value: $(tasks.status)
-      taskRef:
-        name: j7s-gitea-status

limbo/limbo-web-branch-trigger.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: limbo-web-branch-trigger-deployment
-  labels:
-    app: limbo-web-branch-trigger
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: limbo-web-branch-trigger
-  template:
-    metadata:
-      labels:
-        app: limbo-web-branch-trigger
-    spec:
-      volumes:
-      - name: git-credentials
-        secret:
-          secretName: git-credentials
-      containers:
-      - name: branch-trigger
-        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
-        command: ["/bin/sh","-c"]
-        args:
-        - mkdir ~/.ssh;
-          chmod 700 ~/.ssh;
-          cp -r /secrets/. ~/.ssh;
-          chmod -R 400 ~/.ssh/*;
-          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
-          j7s_branch_trigger
-        env:
-        - name: J7S_REPO
-          value: "ssh://git@git.jpace121.net:2222/limbo/limbo_web.git"
-        - name: J7S_URL
-          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
-        - name: J7S_PATTERN
-          value: "^refs/heads/.*?$"
-        - name: J7S_ORG_NAME
-          value: "limbo"
-        - name: J7S_REPO_NAME
-          value: "limbo_web"
-        - name: J7S_JOB_NAME
-          value: "limbo-web"
-        - name: J7S_LOOPTIME
-          value: "5.0"
-        volumeMounts:
-        - name: git-credentials
-          readOnly: true
-          mountPath: "/secrets"

limbo/service-account.yaml

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: limbo-serviceaccount
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: limbo-eventlistener-binding
-subjects:
-- kind: ServiceAccount
-  name: limbo-serviceaccount
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-roles
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: limbo-eventlistener-clusterbinding
-subjects:
-- kind: ServiceAccount
-  name: limbo-serviceaccount
-  namespace: j7s-ci
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-clusterroles

runs/dev-contain-debian.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-debian-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/debian"
-  - name: deploy
-    value: "true"

runs/dev-contain-rpm.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-rpm-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/fedora"
-  - name: deploy
-    value: "true"

runs/j7s-os-test.yaml

@@ -1,25 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: j7s-os-test-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: j7s-os-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 3Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  params:
-  - name: make-image-name
-    value: cs9-qemu-minimal-ostree.x86_64.repo
-  - name: branch
-    value: main