update certs

chains/chains-config.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-chains
-  name: chains-config
-  namespace: tekton-chains
-data:
-   artifacts.taskrun.format: in-toto
-   artifacts.taskrun.storage: tekton
-   artifacts.taskrun.signer: x509
-   artifacts.pipelinerun.format: in-toto
-   artifacts.pipelinerun.storage: tekton
-   artifacts.pipelinerun.signer: x509
-   artifacts.oci.storage: tekton
-   artifacts.oci.signer: ""
-   builder.id: http://tekton.internal.jpace121.net

chains/tekton-feature-flags.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-   name: feature-flags
-   namespace: tekton-pipelines
-data:
-   enable-api-fields: "alpha"
-   enable-provenance-in-status: "true"

deployments/mosquitto.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mosquitto-deployment
-  labels:
-    app: mosquitto
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mosquitto
-  template:
-    metadata:
-      labels:
-        app: mosquitto
-    spec:
-      containers:
-      - name: mosquitto
-        image: 192.168.1.149:8443/mosquitto:0.0.7
-        args: ["-v", "-c", "/opt/mqtt/mosquitto.conf"]
-        volumeMounts:
-          - mountPath: /opt/mqtt
-            name: mosquitto-conf
-        ports:
-          - containerPort: 9000
-            name: websockets-port
-          - containerPort: 9001
-            name: mqtt-port
-      volumes:
-      - name: mosquitto-conf
-        configMap:
-          name: mosquitto-conf
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mosquitto-service
-spec:
-  selector:
-    app: mosquitto
-  type: LoadBalancer
-  ports:
-    - protocol: TCP
-      port: 9000
-      name: websockets-port
-    - protocol: TCP
-      port: 9001
-      name: mqtt-port
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mosquitto-conf
-data:
-  acl.yaml: |
-    default:
-        can_read: true
-        can_write: false
-    jimmy:
-        can_read: true
-        can_write: true
-  keys.yaml: |
-    default:
-    - /opt/mqtt/jpace121-key.pem
-    - /opt/mqtt/service-key.pem
-  mosquitto.conf: |
-    per_listener_settings false
-    allow_anonymous false
-    log_type all
-
-    auth_plugin /usr/lib/libj7s-plugin.so
-    auth_opt_key_file /opt/mqtt/keys.yaml
-    auth_opt_acl_file /opt/mqtt/acl.yaml
-
-    listener 9000
-    protocol websockets
-
-    listener 9001
-    protocol mqtt
-  service-key.pem: |
-    -----BEGIN PUBLIC KEY-----
-    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9DBwMe+eHkYLfq076sFq75gepyaL4LQtX8qVlGjJCtLxV308L2d8XGC35VBxrIbx8Bs5sKT4e5s9suzO8FhGMQ==
-    -----END PUBLIC KEY-----
-  jpace121-key.pem: |
-    -----BEGIN PUBLIC KEY-----
-    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEqdtuaoyDj8jCtgB9qfUMwDe//VLAF1HTXHTQ7OS8i/S3wjOC4YOHxRy9kYQ3LdE44r7kIX6DR8VLJ3srctQ0xw==
-    -----END PUBLIC KEY-----

deployments/pvc-copy.yaml

@@ -1,44 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pvc-copy-deployment
-  labels:
-    app: pvc-copy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pvc-copy
-  template:
-    metadata:
-      labels:
-        app: pvc-copy
-    spec:
-      containers:
-      - name: pvc-copy
-        image: 192.168.1.149:8443/jwp-build:latest
-        volumeMounts:
-          - mountPath: /var/original-pvc
-            name: original-pvc
-          - mountPath: /var/new-pvc
-            name: new-pvc
-      volumes:
-      - name: original-pvc
-        persistentVolumeClaim:
-          claimName: kanboard-pvc
-      - name: new-pvc
-        persistentVolumeClaim:
-          claimName: kanboard-pvc-nfs
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: kanboard-pvc-nfs
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: nfs-client
-  resources:
-    requests:
-      storage: 2Gi

deployments/squid.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: squid-deployment
-  labels:
-    app: squid
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: squid
-  template:
-    metadata:
-      labels:
-        app: squid
-    spec:
-      containers:
-      - name: squid
-        image: 192.168.1.149:8443/squid:0.3
-        volumeMounts:
-          - mountPath: /var/spool/squid
-            name: squid-volume
-        ports:
-          - containerPort: 3128
-            name: squid-port
-      volumes:
-      - name: squid-volume
-        emptyDir: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: squid-service
-spec:
-  selector:
-    app: squid
-  ports:
-    - protocol: TCP
-      targetPort: 3128
-      port: 3128
-      name: squid-port

deployments/test-branch-pipeline.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: test-branch-pipeline-deployment
-  namespace: j7s-ci
-  labels:
-    app: test-branch-pipeline
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: test-branch-pipeline
-  template:
-    metadata:
-      labels:
-        app: test-branch-pipeline
-    spec:
-      volumes:
-         - name: ssh-volume
-           secret:
-              secretName: git-credentials
-      containers:
-      - name: branch-pipeline
-        image: 192.168.1.149:8443/j7s_branch_trigger:0.2
-        command: ["/bin/bash", "-c"]
-        volumeMounts:
-           - mountPath: /ssh-volume
-             name: ssh-volume
-        env:
-           - name: J7S_REPO
-             value: "ssh://git.jpace121.net:2222/tests/job-test"
-           - name: J7S_URL
-             value: http://el-test-pipeline-listener.j7s-ci.svc.cluster.local:8080
-        args:
-           - |
-            cp -r /ssh-volume ~/.ssh
-            chmod 700 ~/.ssh
-            chmod -R 400 ~/.ssh/*
-
-            j7s_branch_trigger

dns/dns.yaml

@@ -1,31 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: coredns
-  namespace: kube-system
-data:
-  Corefile: |
-    .:53 {
-        errors
-        health
-        hosts {
-          192.168.1.128 tekton.internal.jpace121.net
-          192.168.1.128 k3s
-          192.168.1.128 harbor.internal.jpace121.net
-          192.168.1.135 k3s-node1
-          10.100.100.1 git.jpace121.net
-          fallthrough
-        }
-        ready
-        kubernetes cluster.local in-addr.arpa ip6.arpa {
-          pods insecure
-          fallthrough in-addr.arpa ip6.arpa
-        }
-        prometheus :9153
-        forward . /etc/resolv.conf
-        cache 30
-        reload
-        loadbalance
-    }
-  NodeHosts: |
-    #192.168.1.128 k3s

docs/cluster-v2-design.md

@@ -418,7 +418,7 @@ On VM:
 sudo hostnamectl set-hostname j7s-cluster
 sudo systemctl disable firewalld --now
 sudo su
-export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.46.0.0/16 --service-cidr 10.47.0.0/16 --cluster-dns 10.47.0.10 --selinux"
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.46.0.0/16 --service-cidr 10.47.0.0/16 --cluster-dns 10.47.0.10 --selinux --resolv-conf /run/systemd/resolve/resolv.conf"
 curl -sfL https://get.k3s.io | sh -s -
 exit
 sudo cp /etc/rancher/k3s/k3s.yaml ~/j7s-cluster.yaml
@@ -676,3 +676,11 @@ tar xpvzf /home/jimmy/db-backup.tar.gz
 sudo chown -R systemd-oom:systemd-oom *
 ```
 
+# Bugs
+After installation of fedora neeeded to run:
+
+```
+sudo lvextend /dev/mapper/fedora_fedora-root -l+100%FREE
+sudo xfs_growfs /dev/mapper/fedora_fedora-root
+```
+in the VM so the root directory wasn't limited to 15Gb.

docs/rotating_k3s_certs.md

@@ -0,0 +1,37 @@
+# Rotating k8s certs
+
+Problem: k3s client certs, including the admin cert expire after 1 year.
+
+To see cert:
+```
+cat ~/.kube/config | grep client-certificate-data | cut -f2 -d : | tr -d ' ' | base64 -d | openssl x509 -text -out -
+```
+
+```
+ssh jimmy@192.168.1.103
+sudo systemctl stop k3s
+sudo k3s certificate rotate
+sudo systemctl start k3s
+
+
+```
+
+```
+sudo cp /etc/rancher/k3s/k3s.yaml ~/j7s-cluster.yaml
+sudo chown jimmy:jimmy ~/j7s-cluster.yaml
+exit
+
+```
+
+```
+rm  ~/.kube/j7s-cluster.yaml
+scp jimmy@192.168.1.103:~/j7s-cluster.yaml /home/jimmy/.kube/.
+# Use text editor to fix IP in file.
+
+```
+
+```
+export KUBECONFIG=~/.kube/j7s-cluster.yaml
+kubectl get nodes
+```
+

docs/updating-ca.md

@@ -0,0 +1,47 @@
+# Updating CA
+
+## What is it?
+
+My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.
+
+The original one was built using cfssl.
+I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to
+renew the cert, I just built a new CA from scratch.
+
+Here is how.
+
+## Make the CA
+
+```
+cd ~/Develop/jpace121-certificate-authority
+j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca
+```
+
+## Tell Nginx
+
+```
+scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem
+```
+Then restart nginx.
+
+## Tell Keycloak
+
+```
+base64 -w 0 ca/cert.pem
+```
+
+Copy to keycloak-config.yaml.
+
+Deploy.
+
+```
+export KUBECONFIG=~/.kube/infra.yaml
+kubectl apply -f keycloak-config.yaml
+kubectl apply -f deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```
+
+Watch the logs:
+```
+kubectl logs -n keycloak deployment/keycloak-deployment keycloak
+```

docs/updating-keycloak.md

@@ -0,0 +1,17 @@
+# Updating Keycloak
+
+If keycloak needs to be updated for harbor to work, you can't really pull the image
+from Harbor, so we directly import the image into the cluster.
+See the steps I followed below.
+
+```
+podman build -f images/Dockerfile -t harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 .
+podman save harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 -o keycloak.tar
+scp keycloak.tar jimmy@192.168.1.112:.
+ssh jimmy@192.168.1.112
+sudo k3s ctr images import keycloak.tar
+sudo k3s ctr images ls
+exit
+kubectl apply -f manifests/deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```

docs/upgrading-k3s-notes.md

@@ -0,0 +1,53 @@
+# Notes on updating k3s and cilium
+
+Notes:
+1. Cilium need to be uninstalled with the cilium cli version it was installed with,
+   then reinstalled using the new cilium cli and the new installation instructions.
+2. K3S can be updated by calling the install script with the same options as before.
+
+
+Update k3s.
+Update cilium.
+
+Update k3s.
+
+j7s-cluster:
+```
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.46.0.0/16 --service-cidr 10.47.0.0/16 --cluster-dns 10.47.0.10 --selinux --resolv-conf /run/systemd/resolve/resolv.conf"
+curl -sfL https://get.k3s.io | sh -s -
+```
+
+infra-cluster:
+```
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.44.0.0/16 --service-cidr 10.45.0.0/16 --cluster-dns 10.45.0.10 --selinux"
+curl -sfL https://get.k3s.io | sh -s -
+```
+
+I don't know why I needed resolve-conf in one but not the other, but I did confirm it was not set in the infra-cluster systemd file...
+
+Update cilium:
+
+
+1. Move cilium binary to cilium-original
+
+For j7s-cluster:
+2. `export KUBECONFIG=~/.kube/j7s-cluster.yaml`
+3. `cilium-original uninstall`
+4. `cilium install --version 1.15.5 --set=ipam.operator.clusterPoolIPv4PodCIDRList="10.46.0.0/16"`
+5. `ssh jimmy@192.168.1.103`
+6. `sudo su`
+7. `iptables-save |  grep -v '\-A' | iptables-restore`
+8. `exit` `exit`
+
+
+For infra cluster:
+2. `export KUBECONFIG=~/.kube/infra.yaml`
+3. `cilium-original uninstall`
+4. `cilium install --version 1.15.5 --set=ipam.operator.clusterPoolIPv4PodCIDRList="10.44.0.0/16"`
+wait......
+5. `ssh jimmy@192.168.1.112`
+6. `sudo su`
+7. `iptables-save |  grep -v '\-A' | iptables-restore`
+8. `exit` `exit`
+
+I didn't wait where I put wait..... and had to rstart k3s...

images/Dockerfile_ansible-podman

@@ -1,4 +0,0 @@
-FROM quay.io/podman/stable:v4.2.1
-
-RUN dnf update && \
-    dnf install -y ansible git

images/Dockerfile_buildah

@@ -1,6 +0,0 @@
-FROM quay.io/buildah/upstream:latest
-
-# Add skopeo.
-RUN dnf install -y skopeo \
-    --exclude container-selinux \
-    --enablerepo=updates-testing

images/Dockerfile_curl

@@ -1,6 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y \
-       curl \
-       jq

images/Dockerfile_gitssh

@@ -1,6 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y \
-       git \
-       openssh-client

images/Dockerfile_j7s-image-build

@@ -1,9 +0,0 @@
-FROM quay.io/centos/centos:stream9
-RUN dnf install -y 'dnf-command(copr)' && \
-    dnf copr enable -y @osbuild/osbuild && \
-    dnf install -y osbuild osbuild-tools osbuild-ostree make sudo git
-RUN useradd -m -G wheel -s /bin/bash -u 1000 j7s && \
-    bash -c 'echo "%wheel  ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers.d/container' && \
-    chmod 0440 /etc/sudoers.d/container
-USER j7s
-ENTRYPOINT ["bash"]

images/Dockerfile_vcs

@@ -1,10 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y curl
-RUN curl -s https://packagecloud.io/install/repositories/dirk-thomas/vcstool/script.deb.sh | bash
-RUN apt update -y && \
-    apt install -y \
-       git \
-       openssh-client \
-       python3-vcstool

infra-cluster/gitea/manifests/config-map.yaml

@@ -11,6 +11,7 @@ metadata:
 data:
   GITEA____APP_NAME: "Forge"
   GITEA__server__DOMAIN: "git.jpace121.net"
+  GITEA__server__PUBLIC_URL_DETECTION: "never"
   GITEA__server__SSH_DOMAIN: "git.jpace121.net"
   GITEA__server__HTTP_PORT: "3000"
   GITEA__server__ROOT_URL: https://git.jpace121.net/
@@ -19,9 +20,9 @@ data:
   GITEA__server__LFS_START_SERVER: "true"
   GITEA__server__LFS_OFFLINE_MODE: "true"
   GITEA__server__LANDING_PAGE: "explore"
-  GITEA__database__PATH: "/data/gitea/gitea.db"
+  GITEA__database__PATH: "/data/gitea/gitea.db?_journal_mode=WAL&"
   GITEA__database__DB_TYPE: "sqlite3"
   GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
   GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
   GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
-  GITEA__webhook__ALLOWED_HOST_LIST: "0x2A"
+  GITEA__security__ALLOWED_HOST_LIST: "0x2A"

infra-cluster/gitea/manifests/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: gitea-app
-        image: docker.io/gitea/gitea:1.19.0
+        image: docker.io/gitea/gitea:28.1
         ports:
         - containerPort: 3000
         - containerPort: 2222

infra-cluster/keycloak/images/Dockerfile

@@ -1,5 +1,4 @@
-FROM quay.io/keycloak/keycloak:20.0
+FROM quay.io/keycloak/keycloak:26.8
 WORKDIR /opt/keycloak
 RUN ./bin/kc.sh build \
-    --spi-x509cert-lookup-provider=nginx \
-    --features docker
+    --db postgres

infra-cluster/keycloak/manifests/deployment.yaml

@@ -8,6 +8,8 @@ metadata:
     app: keycloak
 spec:
   replicas: 1
+  strategy:
+     type: Recreate
   selector:
     matchLabels:
       app: keycloak
@@ -30,8 +32,12 @@ spec:
             secretKeyRef:
               name: keycloak-db-secret
               key: POSTGRES_PASSWORD
+        lifecycle:
+          preStop:
+            exec:
+              command: ["/usr/local/bin/pg_ctl stop -D /var/lib/postgresql/data -w -t 60 -m fast"]
       - name: keycloak
-        image: harbor.internal.jpace121.net/k8s/jpace-keycloak:20.0.0
+        image: harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0
         env:
         - name: KC_LOG_LEVEL
           value: DEBUG
@@ -51,21 +57,29 @@ spec:
             secretKeyRef:
               name: keycloak-secret
               key: KC_DB_PASSWORD
+        - name: KC_SPI_X509CERT_LOOKUP_PROVIDER
+          value: "nginx"
+        - name: KC_SPI_X509CERT_LOOKUP__NGINX__SSL_CLIENT_CERT
+          value: "ssl-client-cert"
+        - name: KC_TRUSTSTORE_PATHS
+          value: "/opt/keycloak-config/jpace121-ca.pem"
+        - name: KC_HTTPS_CLIENT_AUTH
+          value: "request"
+        - name: KC_HOSTNAME
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_ADMIN
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_STRICT
+          value: "true"
+        - name: KC_PROXY_HEADERS
+          value: "xforwarded"
+        - name: KC_HTTP_ENABLED
+          value: "true"
         volumeMounts:
         - name: keycloak-config
           mountPath: /opt/keycloak-config/
         args:
         - start
-        - --hostname-url=https://auth.jpace121.net
-        - --hostname-strict-backchannel=true
-        - --hostname-admin-url=https://auth.jpace121.net
-        - --https-client-auth=request
-        - --spi-truststore-file-file=/opt/keycloak-config/truststore.jks
-        - --spi-truststore-file-password=password
-        - --spi-x509cert-lookup-nginx-ssl-client-cert=ssl-client-cert
-        - --spi-x509cert-lookup-provider=nginx
-        - --features docker
-        - --proxy=edge
       volumes:
       - name: db-storage
         persistentVolumeClaim:

infra-cluster/keycloak/manifests/keycloak-config.yaml

@@ -5,4 +5,4 @@ metadata:
   namespace: keycloak
 apiVersion: v1
 binaryData:
-  truststore.jks: MIIC4gIBAzCCAowGCSqGSIb3DQEHAaCCAn0EggJ5MIICdTCCAnEGCSqGSIb3DQEHBqCCAmIwggJeAgEAMIICVwYJKoZIhvcNAQcBMGYGCSqGSIb3DQEFDTBZMDgGCSqGSIb3DQEFDDArBBR06xf6EozPqDQ/xzGXp40CBqhk+AICJxACASAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEFizOH2LYOBzcHQsXzKXTJaAggHgiX6o5k8bo8w5RiwFngx7snUOMw9eYheq8YgkhuUhLgnx2uxYcw3ajFXYXuq/M6a5vXjQ7bLpeoidY9YdBl74UZjXEbLnTnWQQjjjoMIhBImmMe4ycxbRJ56EAJ4XDPhMwjf1dsGnCL1LX4KHNqVmHSGdkNJSB+PeU4Z6NrdO6sD9LPgaSTTq5b1czv3I8vH5aY/sT+8U4JR+P7xjNzobHzK2L+zcNTS1Hu29qYllQNsfks3gBsJn2Gmdw8NZXrRXCZZXQt7G4mqdPMuLrkd1pTjndYhsMHFMKA67WhNQe14UMlWPKpAPZ2nnS8x+AIVz2H5mQldVEXdeZDvujLYzRp5LyLwEYRHTIMEahGE0d9BIkijJ6kc5hGpF1IRlimVhZDowvX9sbtjHWgJdo5Gm3UEfSTQ9FSB7E8D11MbNZcaqbJcrK8GwKJHnSokCApaJ/Q2eat7YhhWJ/AkveXF0JYd8VPn4BTeOmukr+uZKzRPRoNyvG3orQYm78gJhmMqloHzI4f1VL68h+80VHtt2m+p99p3ZswyYh9dMhpdEue94VSCaMN9ZpEDB7RTYC6O0ZkVdd4uo6Kmu8MGhF8KQEBBCHKqL8ONVXFAcTzF1g5h8h644G29OmqXiro/Dy/gVME0wMTANBglghkgBZQMEAgEFAAQgGlefxTaHIgl4GJ5h3SQvPJSGNfFH2tCI9jtTh4U8KjEEFATo1+WMtc4hIa6Jt1vjX5YGS5mmAgInEA==
+  jpace121-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJsVENDQVRxZ0F3SUJBZ0lVWUc1c2tnbTJoQUtKWXlwa01ldFhZU0FMaEl3d0NnWUlLb1pJemowRUF3SXcKSnpFWU1CWUdBMVVFQ2d3UGFuQmhZMlV4TWpFdWJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQWdGdzB5TmpFdwpNVEF4TlRVeE5EQmFHQTh5TVRJMk1Ea3hOakUxTlRFME1Gb3dKekVZTUJZR0ExVUVDZ3dQYW5CaFkyVXhNakV1CmJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJBakUKdEpVSFZqbTl3eWRuUnhXbFd6U3lKTWRNMGVIbjNSNGZ2STFYbE1uU2VYOXlQN2VxU3pXRm4ydmZvbTJJaCtJUAozK2tRNlVkeCtVaE1UK2h2ZGJ5alFqQkFNQTRHQTFVZER3RUIvd1FFQXdJQmhqQWRCZ05WSFE0RUZnUVVDalI2CkJDQ0huSk5RRXFlK3FmOGZqQjI3bEZBd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBS0JnZ3Foa2pPUFFRREFnTkoKQURCR0FpRUE0VTJmVldIeUIyODdyT2gwMFo1L3lSYlBqNVpoWDg3U3JwSTVHN2k3b0NRQ0lRRFJ3WmlxYmRsRQptaGZiSC94Rm1VemY5TExzYVArbGpzU2VjcytYU1pES2dRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

j7s-cluster/bootstrap.sh

@@ -0,0 +1,7 @@
+flux bootstrap git \
+  --author-email=flux@internal.jpace121.net \
+  --author-name=Flux \
+  --context=j7s \
+  --url=ssh://git@git.jpace121.net:2222/cd/flux-cluster.git \
+  --branch=master \
+  --path=clusters/j7s-cluster

jobs/cache-check.yaml

@@ -1,21 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: cache-check
-spec:
-  template:
-    spec:
-      containers:
-      - name: cache-check
-        image: docker.io/debian:bullseye-slim
-        env:
-        - name: http_proxy
-          value: http://squid-service:3128
-        command: ["bash"]
-        args:
-          - "-c"
-          - >-
-            apt update -y &&
-            apt upgrade -y
-      restartPolicy: Never
-  backoffLimit: 1

jobs/nfs-test.yaml

@@ -1,33 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: test-claim
-spec:
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Mi
----
-kind: Pod
-apiVersion: v1
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: test-pod
-    image: busybox:stable
-    command:
-      - "/bin/sh"
-    args:
-      - "-c"
-      - "touch /mnt/SUCCESS && exit 0 || exit 1"
-    volumeMounts:
-      - name: nfs-pvc
-        mountPath: "/mnt"
-  restartPolicy: "Never"
-  volumes:
-    - name: nfs-pvc
-      persistentVolumeClaim:
-        claimName: test-claim

jobs/test-trigger-check.yaml

@@ -1,21 +0,0 @@
-# Keeping this as an example, but the test pipeline was changed
-# at one point to show interoperability with PRs.
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: test-trigger-check
-  namespace: j7s-ci
-spec:
-  template:
-    spec:
-      containers:
-      - name: test-trigger-check
-        image: 192.168.1.149:8443/curl:latest
-        command: ["bash"]
-        args:
-          - "-c"
-          - >-
-            curl -X POST http://el-test-pipeline-listener.j7s-ci.svc.cluster.local:8080 -H 'Content-Type: application/json' -d '{}'
-      restartPolicy: Never
-  backoffLimit: 0

namespaces/harbor.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: harbor

namespaces/j7s-ci.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: j7s-ci

namespaces/nfs-subdir-external-provisioner.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nfs-subdir-external-provisioner

pipelines/dev-contain-pipeline.yaml

@@ -1,55 +0,0 @@
-# A pipeline to build and deploy dev_contain packages.
-# Steps:
-#   Clone the dev_contain repo from gitea and checkout packaging branch.
-#   Call ansible play to build.
-#   Optionally, call play to deploy
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: dev-contain-pipeline
-  namespace: j7s-ci
-spec:
-  description: "Build and deploy dev_contain packages."
-  params:
-  - name: branch
-    type: string
-    description: The branch in the repo to call the build script in.
-  - name: deploy
-    type: string
-    description: "'true' if we should deploy the image using ansible."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  - name: deploy-credentials
-    description: tekton credentials to deployment server
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/packaging/dev_contain
-    - name: branch
-      value: $(params.branch)
-    taskRef:
-      name: j7s-git-clone
-  - name: build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: deploy-credentials
-    params:
-    - name: deploy
-      value: $(params.deploy)
-    - name: ansible-file-path
-      value: .
-    taskRef:
-      name: j7s-ansible-build

pipelines/j7s-os-pipeline.yaml

@@ -1,79 +0,0 @@
-# A pipeline to build j7s-os images.
-# Steps:
-#   Clone the j7s-os repo from onedev.
-#   Call make <> in the repo.
-#   Build and push a new deployment container.
-#   Deploy the deployment container as a service.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: j7s-os-pipeline
-  namespace: j7s-ci
-spec:
-  description: Build and deploy j7s-os images.
-  params:
-  - name: make-image-name
-    type: string
-    description: The name of image to make in the os repo.
-  - name: branch
-    type: string
-    default: main
-    description: branch of j7s-os image to build.
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: My ssh credentials
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/public/j7s-os
-    - name: branch
-      value: $(params.branch)
-    taskRef:
-      name: j7s-git-clone
-  - name: image-build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: image-name
-      value: $(params.make-image-name)
-    taskRef:
-      name: j7s-os-image-build
-  - name: build-deploy-image
-    runAfter: ["image-build"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: commit
-      value: $(params.make-image-name)
-    - name: image
-      value: j7s-os-deploy
-    - name: registry
-      value: 192.168.1.149:8443
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    taskRef:
-      name: j7s-os-buildah
-  - name: deploy-image
-    runAfter: ["build-deploy-image"]
-    workspaces:
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: image
-      value: 192.168.1.149:8443/j7s-os-deploy
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    taskRef:
-      name: j7s-os-k8s-deploy

pipelines/ostree-package-pipeline.yaml

@@ -1,48 +0,0 @@
-# A pipeline to build and deploy my fork of the debian packaging for ostree.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: ostree-package-pipeline
-  namespace: j7s-ci
-spec:
-  description: "Package fork of ostree."
-  params:
-  - name: deploy
-    type: string
-    description: "'true' if we should deploy the image using ansible."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  - name: deploy-credentials
-    description: tekton credentials to deployment server
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/packaging/ostree
-    - name: branch
-      value: jamesp/latest
-    taskRef:
-      name: j7s-git-clone
-  - name: build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: deploy-credentials
-    params:
-    - name: deploy
-      value: $(params.deploy)
-    - name: ansible-file-path
-      value: ./j7s-build-files
-    taskRef:
-      name: j7s-ansible-build

pipelines/simple-ros-pipeline.yaml

@@ -1,63 +0,0 @@
-# A pipeline to build the simple ros test containers.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: simple-ros-pipeline
-  namespace: j7s-ci
-spec:
-  description: Build a image with a simple ros image.
-  workspaces:
-  - name: shared-data
-  - name: git-credentials
-  - name: cosign-credentials
-  tasks:
-  - name: ros-clone
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/j7s-simple-ws
-    - name: branch
-      value: master
-    - name: repos-file
-      value: source.repos
-    taskRef:
-      name: j7s-ros-clone
-  - name: image-build
-    runAfter: ["ros-clone"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: cosign-credentials
-      workspace: cosign-credentials
-    params:
-    - name: registry
-      value: 192.168.1.149:8443
-    - name: name
-      value: simple-ros
-    - name: version
-      value: 0.1
-    - name: containerfile
-      value: ./docker/Dockerfile
-    taskRef:
-      name: j7s-buildah
-  results:
-  - name: image-ARTIFACT_OUTPUTS
-    type: object
-    value:
-       uri: $(tasks.image-build.results.image-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.image-build.results.image-ARTIFACT_OUTPUTS.digest)
-  - name: commit-ARTIFACT_INPUTS
-    type: object
-    value:
-       uri: $(tasks.ros-clone.results.workspace-git-commit-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.ros-clone.results.workspace-git-commit-ARTIFACT_OUTPUTS.digest)
-  - name: vcs-exact-file-ARTIFACT_INPUTS
-    type: object
-    value:
-       uri: $(tasks.ros-clone.results.vcs-exact-file-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.ros-clone.results.vcs-exact-file-ARTIFACT_OUTPUTS.digest)

pipelines/test-pipeline.yaml

@@ -1,60 +0,0 @@
-# A pipeline to test the infrasture around calling pipelines.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: test-pipeline
-  namespace: j7s-ci
-spec:
-  description: "A test pipeline."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  params:
-  - name: pr-id
-    description: ID number of the current PR.
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/job-test
-    - name: branch
-      value: master
-    taskRef:
-      name: j7s-git-clone
-  - name: cat-readme
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    taskSpec:
-      workspaces:
-      - name: source
-      steps:
-      - image: docker.io/debian:bullseye-slim
-        script: |
-          set -x
-          cat $(workspaces.source.path)/README.md
-          exit 0
-  finally:
-    - name: notify-onedev
-      params:
-        - name: tekton-login-secret-name
-          value: onedev-api-key
-        - name: feedback-url
-          value: https://git.jpace121.net/
-        - name: pr-id
-          value: $(params.pr-id)
-        - name: run-name
-          value: $(context.pipelineRun.name)
-        - name: status
-          value: $(tasks.status)
-      taskRef:
-        name: j7s-onedev-pr-review

pipelines/test-report-pipeline.yaml

@@ -1,60 +0,0 @@
-# A pipeline to test the infrasture around calling pipelines.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: test-report-pipeline
-  namespace: j7s-ci
-spec:
-  description: "A test pipeline."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  params:
-  - name: hash
-    default: HEAD
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/job-test
-    - name: hash
-      value: $(params.hash)
-    taskRef:
-      name: j7s-git-clone-hash
-  - name: cat-readme
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    taskSpec:
-      workspaces:
-      - name: source
-      steps:
-      - image: docker.io/debian:bullseye-slim
-        script: |
-          set -x
-          cat $(workspaces.source.path)/README.md
-          exit 0
-  finally:
-    - name: notify-onedev
-      params:
-        - name: tekton-login-secret-name
-          value: onedev-api-key
-        - name: feedback-url
-          value: https://git.jpace121.net/
-        - name: project-id
-          value: 9
-        - name: run-name
-          value: $(context.pipelineRun.name)
-        - name: status
-          value: $(tasks.status)
-      taskRef:
-        name: j7s-onedev-file-bug

runs/dev-contain-debian.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-debian-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/debian"
-  - name: deploy
-    value: "true"

runs/dev-contain-rpm.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-rpm-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/fedora"
-  - name: deploy
-    value: "true"

runs/j7s-os-test.yaml

@@ -1,25 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: j7s-os-test-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: j7s-os-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 3Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  params:
-  - name: make-image-name
-    value: cs9-qemu-minimal-ostree.x86_64.repo
-  - name: branch
-    value: main

runs/j7s-ros-clone.yaml

@@ -1,27 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  generateName: j7s-ros-clone-
-  namespace: j7s-ci
-spec:
-  taskRef:
-    name: j7s-ros-clone
-  workspaces:
-  - name: output
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 0.5Gi
-  - name: ssh-directory
-    secret:
-      secretName: git-credentials
-  params:
-  - name: url
-    value: "ssh://git.jpace121.net:2222/tests/j7s-simple-ws"
-  - name: branch
-    value: "master"
-  - name: repos-file
-    value: source.repos

runs/ostree-package.yaml

@@ -1,26 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: ostree-package-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: ostree-package-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: deploy
-    value: "true"

runs/simple-ros-pipeline.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: simple-ros-pipeline-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: simple-ros-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: cosign-credentials
-    secret:
-      secretName: container-signing-secret

runs/test-report-pipeline.yaml

@@ -1,20 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: test-report-pipeline-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: test-report-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials

scripts/Dockerfile_flask

@@ -1,11 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y python3-flask && \
-    mkdir /app
-
-COPY test.py /app/test.py
-
-WORKDIR /app
-ENV FLASK_APP=test
-CMD ["flask", "run", "--host", "0.0.0.0"]

scripts/bootstrap-flux.bash

@@ -1,5 +0,0 @@
-flux bootstrap git \
-  --url=ssh://git.jpace121.net:2222/cd/flux-infra \
-  --branch=master \
-  --author-name=flux \
-  --path=cluster

scripts/debug-pod.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: jimmy-debug-pod
-  namespace: j7s-ci
-spec:
-  containers:
-  - image: docker.io/debian:bullseye-slim
-    name: jimmy-debug-pod
-    command: ["tail"]
-    args: ["-f", "/dev/null"]
-    volumeMounts:
-    - mountPath: /pvc
-      name: pvc-mount
-  volumes:
-  - name: pvc-mount
-    persistentVolumeClaim:
-      claimName: pvc-3244e44354

scripts/issue-body.json

@@ -1,10 +0,0 @@
-{
-"projectId" : 9 ,
-"title" : "Hi From Curl" ,
-"description" : "This was posted from curl." ,
-"confidential" : false ,
-"milestoneIds" : [ ] ,
-"fields" : {
-"Type" : "Build Failure"
-}
-}

scripts/registry/list-images.sh

@@ -1,2 +0,0 @@
-# See all images in cluster registry.
-curl -k -X GET -u $USERNAME:$PASSWORD https://192.168.1.128:8443/v2/_catalog

scripts/registry/list-tags.sh

@@ -1 +0,0 @@
-skopeo list-tags docker://192.168.1.149:8443/simple-ros

scripts/test.py

@@ -1,22 +0,0 @@
-from flask import Flask
-from flask import request
-import logging
-
-app = Flask(__name__)
-
-logger = logging.getLogger('j7s-app')
-logger.setLevel(logging.INFO)
-handler = logging.StreamHandler()
-logger.addHandler(handler)
-
-
-@app.route("/", defaults={"path": ""}, methods = ['POST', 'GET'])
-@app.route('/<path:path>', methods=['POST', 'GET'])
-def root(path):
-    logger.info("Path")
-    logger.info(path)
-    logger.info("Headers:")
-    logger.info(request.headers)
-    logger.info("Body:")
-    logger.info(request.json)
-    return "<p>Hello</p>"

scripts/test_onedev_issue.bash

@@ -1,4 +0,0 @@
-curl -u tekton:$TEKTON_API_KEY \
-     -d@issue-body.json \
-     -H "Content-Type: application/json" \
-     https://git.jpace121.net/~api/issues

serviceaccounts/tekton-bot.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tekton-bot
-  namespace: j7s-ci
-secrets:
-  - name: git-credentials
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tekton-bot-eventlistener-binding
-  namespace: j7s-ci
-subjects:
-- kind: ServiceAccount
-  name: tekton-bot
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-roles
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: tekton-bot-eventlistener-clusterbinding
-subjects:
-- kind: ServiceAccount
-  name: tekton-bot
-  namespace: j7s-ci
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-clusterroles

tasks/j7s-ansible-build.yaml

@@ -1,29 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-ansible-build
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: source
-  - name: ssh-directory
-  params:
-  - name: deploy
-  - name: ansible-file-path
-  steps:
-  - image: 192.168.1.149:8443/ansible-podman:latest
-    securityContext:
-      privileged: true
-    script: |
-      #!/usr/bin/env bash
-      set -ex
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      cd $(workspaces.source.path)
-      ansible-playbook -vvvv --skip-tags deploy -i $(params.ansible-file-path)/inventory.yaml $(params.ansible-file-path)/build.yaml
-
-      if [[ $(params.deploy) == "true" ]]; then
-        ansible-playbook -vvvv --tags deploy -i $(params.ansible-file-path)/inventory.yaml $(params.ansible-file-path)/build.yaml
-      fi

tasks/j7s-buildah.yaml

@@ -1,84 +0,0 @@
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-buildah
-  namespace: j7s-ci
-spec:
-  description: Build and push a container image.
-  params:
-  - name: registry
-    description: Registry to push to.
-  - name: name
-    description: Name of the image.
-  - name: version
-    description: Version for the image.
-  - name: containerfile
-    description: Path of the Containerfile relative to source.
-  workspaces:
-  - name: source
-  - name: cosign-credentials
-  steps:
-  - name: build
-    image: 192.168.1.149:8443/buildah:latest
-    workingDir: $(workspaces.source.path)
-    script: |
-      set -x
-      # Login
-      buildah login --tls-verify=false --username=$USERNAME --password=$PASSWORD $(params.registry)
-      mkdir ~/.sigstore
-      cp $(workspaces.cosign-credentials.path)/* ~/.sigstore
-      cat <<EOF > ~/.sigstore/param-file.yaml
-      privateKeyFile: "$HOME/.sigstore/cosign.key"
-      privateKeyPassphraseFile: "$HOME/.sigstore/cosign.password"
-      EOF
-      mkdir -p /etc/containers/registries.d/
-      cat <<EOF > /etc/containers/registries.d/james-registry.yaml
-      docker:
-         $(params.registry):
-            use-sigstore-attachments: true
-      EOF
-      # Build
-      buildah --storage-driver=overlay bud --tls-verify=false --no-cache \
-        -f $(params.containerfile)  -t $(params.name):$(params.version) .
-      # Push
-      skopeo copy --dest-tls-verify=false --sign-by-sigstore=$HOME/.sigstore/param-file.yaml \
-              containers-storage:localhost/$(params.name):$(params.version) \
-              docker://$(params.registry)/$(params.name):$(params.version)
-      skopeo copy --dest-tls-verify=false --sign-by-sigstore=$HOME/.sigstore/param-file.yaml \
-              containers-storage:localhost/$(params.name):$(params.version) \
-              docker://$(params.registry)/$(params.name):latest
-      # Indicate results.
-      HASH=`skopeo inspect containers-storage:localhost/$(params.name):$(params.version) --format={{.Digest}}`
-      cat <<EOF > $(results.image-ARTIFACT_OUTPUTS.path)
-      {
-         "uri": "$(params.registry)/$(params.name):$(params.version)",
-         "digest": "$HASH"
-      }
-    env:
-    - name: USERNAME
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: username
-    - name: PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: password
-    volumeMounts:
-    - name: varlibcontainers
-      mountPath: /var/lib/containers
-    securityContext:
-      privileged: true
-  volumes:
-  - name: varlibcontainers
-    emptyDir: {}
-  results:
-  - name: image-ARTIFACT_OUTPUTS
-    type: object
-    properties:
-       uri:
-          type: string
-       digest:
-          type: string

tasks/j7s-git-clone-hash.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-git-clone-hash
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: output
-  - name: ssh-directory
-  params:
-  - name: url
-  - name: hash
-  steps:
-  - image: 192.168.1.149:8443/gitssh:latest
-    script: |
-      set -x
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      git clone $(params.url) $(workspaces.output.path)
-      cd $(workspaces.output.path)
-      git checkout $(params.hash)

tasks/j7s-git-clone.yaml

@@ -1,21 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-git-clone
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: output
-  - name: ssh-directory
-  params:
-  - name: url
-  - name: branch
-  steps:
-  - image: 192.168.1.149:8443/gitssh:latest
-    script: |
-      set -x
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      git clone --single-branch --branch $(params.branch) $(params.url) $(workspaces.output.path)

tasks/j7s-onedev-file-bug.yaml

@@ -1,50 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-onedev-file-bug
-  namespace: j7s-ci
-spec:
-  params:
-  - name: tekton-login-secret-name
-  - name: feedback-url
-  - name: project-id
-  - name: run-name
-  - name: status
-  steps:
-  - image: 192.168.1.149:8443/curl:latest
-    script: |
-      #!/usr/bin/env bash
-      set -e
-
-      function make_request {
-      cat <<EOF > request.json
-      {
-          "projectId": $(params.project-id),
-          "title": "Failed run: $(params.run-name).",
-          "description": "Build Failed!",
-          "confidential": false,
-          "milestoneIds": [],
-          "fields": {"Type": "Build Failure"}
-      }
-      EOF
-      }
-
-      case "$(params.status)" in
-         "Succeeded" | "Completed")
-            echo "Build was successful!"
-           ;;
-         "Failed" | "None")
-            echo "Build failed. :("
-            make_request
-            curl -u tekton:$TEKTON_API_KEY \
-                 -H "Content-Type: application/json" \
-                 -d@request.json \
-                 $(params.feedback-url)/~api/issues
-           ;;
-      esac
-    env:
-    - name: TEKTON_API_KEY
-      valueFrom:
-        secretKeyRef:
-          name: $(params.tekton-login-secret-name)
-          key: accesstoken

tasks/j7s-onedev-pr-review.yaml

@@ -1,53 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-onedev-pr-review
-  namespace: j7s-ci
-spec:
-  params:
-  - name: tekton-login-secret-name
-  - name: feedback-url
-  - name: pr-id
-  - name: run-name
-  - name: status
-  steps:
-  - image: 192.168.1.149:8443/curl:latest
-    script: |
-      #!/usr/bin/env bash
-      set -e
-
-      STATUS=""
-      case "$(params.status)" in
-         "Succeeded" | "Completed")
-            echo "Build was successful!"
-            STATUS="Sucess! :) "
-           ;;
-         "Failed" | "None")
-            STATUS="Error! :( "
-           ;;
-      esac
-
-      # Make a comment on the PR.
-      cat <<EOF > comment.json
-      {
-        "userId": $TEKTON_USER_ID,
-        "requestId": $(params.pr-id),
-        "date": "`date +"%Y-%m-%dT%H:%M:%S%:z"`",
-        "content": "$STATUS Tekton run: $(params.run-name)."
-      }
-      EOF
-      curl -u tekton:$TEKTON_API_KEY \
-           -H "Content-Type: application/json" \
-           -d@comment.json \
-           $(params.feedback-url)/~api/pull-request-comments
-    env:
-    - name: TEKTON_API_KEY
-      valueFrom:
-        secretKeyRef:
-          name: $(params.tekton-login-secret-name)
-          key: accesstoken
-    - name: TEKTON_USER_ID
-      valueFrom:
-        secretKeyRef:
-          name: $(params.tekton-login-secret-name)
-          key: userid

tasks/j7s-os-buildah.yaml

@@ -1,53 +0,0 @@
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-os-buildah
-  namespace: j7s-ci
-spec:
-  description: Build the deployment container image for j7s-os.
-  params:
-  - name: image
-    description: Reference of the image buildah will produce.
-  - name: commit
-    description: Repo directory to put inside the image.
-  - name: registry
-    description: Registry to push to.
-  - name: version
-    description: Version for the image.
-  workspaces:
-  - name: source
-  steps:
-  - name: build
-    image: quay.io/buildah/stable:v1.23.3
-    workingDir: $(workspaces.source.path)
-    script: |
-      set -x
-      # Login
-      buildah login --tls-verify=false --username=$USERNAME --password=$PASSWORD $(params.registry)
-      # Build
-      buildah --storage-driver=overlay bud --tls-verify=false --no-cache \
-        --build-arg commit=./$(params.commit) \
-        -f ./hosting/Dockerfile -t $(params.image):$(params.version) .
-      # Push
-      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):$(params.version)
-      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):latest
-    env:
-    - name: USERNAME
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: username
-    - name: PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: password
-    volumeMounts:
-    - name: varlibcontainers
-      mountPath: /var/lib/containers
-    securityContext:
-      privileged: true
-  volumes:
-  - name: varlibcontainers
-    emptyDir: {}

tasks/j7s-os-image-build.yaml

@@ -1,22 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-os-image-build
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: source
-  params:
-  - name: image-name
-  results:
-  - name: version-string
-  steps:
-  - image: 192.168.1.149:8443/j7s-image-build:latest
-    securityContext:
-      privileged: true
-    script: |
-      set -x
-      sudo chown -R j7s:j7s $(workspaces.source.path)
-      cd $(workspaces.source.path)
-      make $(params.image-name)
-      echo -n `date +%Y%m%d%H%M`-`git describe --no-match --always --dirty` | tee $(results.version-string.path)

tasks/j7s-os-k8s-deploy.yaml

@@ -1,45 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-os-k8s-deploy
-  namespace: j7s-ci
-spec:
-  params:
-    - name: image
-      description: The image to deploy.
-    - name: version
-      description: The version of the image to deploy.
-  workspaces:
-    - name: ssh-directory
-  steps:
-    - name: update-with-flux
-      image: 192.168.1.149:8443/gitssh:latest
-      script: |
-        #!/usr/bin/env bash
-        set -x
-        cp -r $(workspaces.ssh-directory.path) ~/.ssh
-        chmod 700 ~/.ssh
-        chmod -R 400 ~/.ssh/*
-        git config --global user.name tekton
-        git config --global user.email tekton@internal.jpace121.net
-
-        git clone ssh://git.jpace121.net:2222/cd/flux-apps flux-apps
-        cd flux-apps
-        cat <<EOF > j7s-os-deploy/patch.yaml
-        ---
-        apiVersion: apps/v1
-        kind: Deployment
-        metadata:
-          name: j7s-os-app-deployment
-        spec:
-          template:
-            spec:
-              containers:
-              - name: j7s-os-app
-                image: $(params.image):$(params.version)
-        EOF
-
-        git add ./j7s-os-deploy
-        git commit -m "Update j7s-os-deploy to version $(params.version)"
-        git push origin master
-

tasks/j7s-ros-clone.yaml

@@ -1,56 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-ros-clone
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: output
-  - name: ssh-directory
-  params:
-  - name: url
-  - name: branch
-  - name: repos-file
-  results:
-  - name: workspace-git-commit-ARTIFACT_OUTPUTS
-    type: object
-    properties:
-       uri:
-          type: string
-       digest:
-          type: string
-  - name: vcs-exact-file-ARTIFACT_OUTPUTS
-    type: object
-    properties:
-       uri:
-          type: string
-       digest:
-          type: string
-  steps:
-  - image: 192.168.1.149:8443/vcs:latest
-    script: |
-      set -x
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      git clone --single-branch --branch $(params.branch) $(params.url) $(workspaces.output.path)
-      cd $(workspaces.output.path)
-      mkdir src
-      vcs import src < $(params.repos-file)
-
-      # Git hash is really sha1, rehashing to workaround Tekton bug.
-      GITHASH=`git rev-parse HEAD | sha256sum | cut -f 1 -d " "`
-      VCSEXACTHASH=`vcs export --exact ./src | sha256sum | cut -f 1 -d " "`
-      cat <<EOF > $(results.workspace-git-commit-ARTIFACT_OUTPUTS.path)
-      {
-         "uri": "$(params.url)",
-         "digest": "sha256:$GITHASH"
-      }
-      EOF
-      cat <<EOF > $(results.vcs-exact-file-ARTIFACT_OUTPUTS.path)
-      {
-         "uri": "vcs-exact-file",
-         "digest": "sha256:$VCSEXACTHASH"
-      }
-      EOF

triggers/test-trigger.yaml

@@ -1,59 +0,0 @@
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: EventListener
-metadata:
-  name: test-pipeline-listener
-  namespace: j7s-ci
-spec:
-  serviceAccountName: tekton-bot
-  triggers:
-    - name: test-pipeline-trigger
-      bindings:
-        - ref: test-pipeline-binding
-      template:
-        ref: test-pipeline-template
-  resources:
-    kubernetesResource:
-      serviceType: ClusterIP
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerBinding
-metadata:
-  name: test-pipeline-binding
-  namespace: j7s-ci
-spec:
-  params:
-    - name: hash
-      value: $(body.hash)
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerTemplate
-metadata:
-  name: test-pipeline-template
-  namespace: j7s-ci
-spec:
-  params:
-  - name: hash
-  resourcetemplates:
-  - apiVersion: tekton.dev/v1beta1
-    kind: PipelineRun
-    metadata:
-      generateName: test-pipeline-
-    spec:
-      pipelineRef:
-        name: test-report-pipeline
-      params:
-      - name: hash
-        value: "$(tt.params.hash)"
-      workspaces:
-      - name: shared-data
-        volumeClaimTemplate:
-          spec:
-            accessModes:
-            - ReadWriteOnce
-            resources:
-              requests:
-                  storage: 1Gi
-      - name: git-credentials
-        secret:
-          secretName: git-credentials