update certs

chains/chains-config.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-chains
-  name: chains-config
-  namespace: tekton-chains
-data:
-   artifacts.taskrun.format: in-toto
-   artifacts.taskrun.storage: tekton
-   artifacts.taskrun.signer: x509
-   artifacts.pipelinerun.format: in-toto
-   artifacts.pipelinerun.storage: tekton
-   artifacts.pipelinerun.signer: x509
-   artifacts.oci.storage: tekton
-   artifacts.oci.signer: ""
-   builder.id: http://tekton.internal.jpace121.net

chains/tekton-feature-flags.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-   name: feature-flags
-   namespace: tekton-pipelines
-data:
-   enable-api-fields: "alpha"
-   enable-provenance-in-status: "true"

deployments/kanboard-deployment.yaml

@@ -1,104 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: kanboard-pvc
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-path
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kanboard-deployment
-  labels:
-    app: kanboard
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: kanboard
-  template:
-    metadata:
-      labels:
-        app: kanboard
-    spec:
-      containers:
-      - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.4.0
-        args:
-        - --cookie-secret=`$COOKIE_SECRET`
-        - --cookie-secure=false
-        - --email-domain=*
-        - --provider=keycloak-oidc
-        - --client-id=kanboard
-        - --client-secret=oT6dMBS87jc385utLumMoffJ9MqLEGRY
-        - --redirect-url=https://kanboard.jpace121.net
-        - --oidc-issuer-url=https://auth.jpace121.net/realms/jpace121-main
-        - --reverse-proxy=true
-        - --upstream=http://localhost:80/
-        - --http-address=0.0.0.0:8080
-        ports:
-        - containerPort: 8080
-        env:
-        - name: COOKIE_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: kanboard-cookie
-              key: cookie-secret
-      - name: kanboard-app
-        image: 192.168.1.149:8443/kanboard:latest
-        ports:
-        - containerPort: 80
-        - containerPort: 443
-        env:
-        - name: DATABASE_URL
-          value: "postgres://postgres:jdsjkksksklw@localhost/kanboard"
-      - name: kanboard-db
-        image: docker.io/library/postgres:bullseye
-        env:
-        - name: POSTGRES_DB
-          value: "kanboard"
-        - name: POSTGRES_PASSWORD
-          value: "jdsjkksksklw"
-        volumeMounts:
-        - name: db-storage
-          mountPath: "/var/lib/postgresql/data"
-      volumes:
-      - name: db-storage
-        persistentVolumeClaim:
-          claimName: kanboard-pvc
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanboard-service
-spec:
-  selector:
-    app: kanboard
-  ports:
-    - protocol: TCP
-      targetPort: 8080
-      port: 80
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kanboard-ingress
-spec:
-  rules:
-  - host: kanboard.jpace121.net
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: kanboard-service
-            port:
-              number: 80

deployments/mosquitto.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mosquitto-deployment
-  labels:
-    app: mosquitto
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mosquitto
-  template:
-    metadata:
-      labels:
-        app: mosquitto
-    spec:
-      containers:
-      - name: mosquitto
-        image: 192.168.1.149:8443/mosquitto:0.0.7
-        args: ["-v", "-c", "/opt/mqtt/mosquitto.conf"]
-        volumeMounts:
-          - mountPath: /opt/mqtt
-            name: mosquitto-conf
-        ports:
-          - containerPort: 9000
-            name: websockets-port
-          - containerPort: 9001
-            name: mqtt-port
-      volumes:
-      - name: mosquitto-conf
-        configMap:
-          name: mosquitto-conf
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mosquitto-service
-spec:
-  selector:
-    app: mosquitto
-  type: LoadBalancer
-  ports:
-    - protocol: TCP
-      port: 9000
-      name: websockets-port
-    - protocol: TCP
-      port: 9001
-      name: mqtt-port
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mosquitto-conf
-data:
-  acl.yaml: |
-    default:
-        can_read: true
-        can_write: false
-    jimmy:
-        can_read: true
-        can_write: true
-  keys.yaml: |
-    default:
-    - /opt/mqtt/jpace121-key.pem
-    - /opt/mqtt/service-key.pem
-  mosquitto.conf: |
-    per_listener_settings false
-    allow_anonymous false
-    log_type all
-
-    auth_plugin /usr/lib/libj7s-plugin.so
-    auth_opt_key_file /opt/mqtt/keys.yaml
-    auth_opt_acl_file /opt/mqtt/acl.yaml
-
-    listener 9000
-    protocol websockets
-
-    listener 9001
-    protocol mqtt
-  service-key.pem: |
-    -----BEGIN PUBLIC KEY-----
-    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9DBwMe+eHkYLfq076sFq75gepyaL4LQtX8qVlGjJCtLxV308L2d8XGC35VBxrIbx8Bs5sKT4e5s9suzO8FhGMQ==
-    -----END PUBLIC KEY-----
-  jpace121-key.pem: |
-    -----BEGIN PUBLIC KEY-----
-    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEqdtuaoyDj8jCtgB9qfUMwDe//VLAF1HTXHTQ7OS8i/S3wjOC4YOHxRy9kYQ3LdE44r7kIX6DR8VLJ3srctQ0xw==
-    -----END PUBLIC KEY-----

deployments/onedev.yaml

@@ -1,340 +0,0 @@
----
-# Source: onedev/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: onedev
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: onedev/templates/secret.yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: onedev-mysql
-stringData:
-  password: changeit
----
-# Source: onedev/templates/persistentvolumeclaim.yaml
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: onedev
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-    tier: onedev
-  annotations:
-    "helm.sh/resource-policy": keep
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Gi
----
-# Source: onedev/templates/persistentvolumeclaim.yaml
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: onedev-mysql
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-    tier: mysql
-  annotations:
-    "helm.sh/resource-policy": keep
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 20Gi
----
-# Source: onedev/templates/clusterrole.yaml
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: onedev
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-rules:
-  - apiGroups: [""]
-    resources: ["namespaces"]
-    verbs: ["get", "list", "create", "delete"] #require this permission to run builds in isolated namespaces
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterrolebindings"]
-    verbs: ["get", "list", "create", "delete"] #require this permission to bind cluster roles to service account of running builds
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"] #require this permission to search nodes matching executor criterias
-  - apiGroups: [""]
-    resources: ["services", "pods", "pods/log", "pods/exec", "secrets", "configmaps", "events"]
-    verbs: ["get", "list", "watch", "create", "patch", "delete"] #require this permission to run builds as pods
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    verbs: ["get", "list", "create", "patch", "delete"] #require this permission to run builds as pods
----
-# Source: onedev/templates/clusterrolebinding.yaml
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: onedev
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-subjects:
-  - kind: ServiceAccount
-    namespace: default
-    name: onedev
-roleRef:
-  kind: ClusterRole
-  name: onedev
-  apiGroup: rbac.authorization.k8s.io
----
-# Source: onedev/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: onedev
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-    tier: onedev
-  annotations:
-    null
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 80
-      targetPort: 6610
-      protocol: TCP
-    - name: ssh
-      port: 2222
-      targetPort: 6611
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    tier: onedev
----
-# Source: James Custom
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: onedev-ssh
-spec:
-  type: NodePort
-  ports:
-    - name: ssh
-      port: 22
-      targetPort: 6611
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    tier: onedev
----
-# Source: onedev/templates/service.yaml
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: onedev-mysql
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-    tier: mysql
-spec:
-  ports:
-    - port: 3306
-  selector:
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    tier: mysql
----
-# Source: onedev/templates/deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: onedev
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-    tier: onedev
-spec:
-  replicas: 1 # only allow one replicas as OneDev doesn't support clustering
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: onedev
-      app.kubernetes.io/instance: onedev
-      tier: onedev
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      name: onedev
-      labels:
-        app.kubernetes.io/name: onedev
-        app.kubernetes.io/instance: onedev
-        tier: onedev
-    spec:
-      serviceAccountName: onedev
-      nodeSelector: 
-        kubernetes.io/os: linux
-      containers:
-        - name: onedev
-          resources:
-            requests:
-              memory: 1024Mi
-          volumeMounts:
-          - mountPath: "/opt/onedev"
-            name: onedev
-          image: "1dev/server:7.9.2"
-          ports:
-            - containerPort: 6610
-            - containerPort: 6611
-          env:
-          - name: k8s_service
-            value: onedev
-          - name: ingress_host
-            value: onedev.intenral.jpace121.net
-          - name: ingress_tls
-            value: "false"
-          - name: hibernate_dialect
-            value: org.hibernate.dialect.MySQL5InnoDBDialect
-          - name: hibernate_connection_driver_class
-            value: com.mysql.cj.jdbc.Driver
-          - name: hibernate_connection_url
-            value: jdbc:mysql://onedev-mysql:3306/onedev?serverTimezone=UTC&allowPublicKeyRetrieval=true&useSSL=false
-          - name: hibernate_connection_username
-            value: root
-          - name: hibernate_connection_password
-            valueFrom:
-              secretKeyRef:
-                name: onedev-mysql
-                key: password
-          - name: hibernate_hikari_maximumPoolSize
-            value: "25"
-      initContainers:
-        - name: init
-          image: busybox
-          command: ["sh", "-c", "until nslookup onedev-mysql.default.svc.cluster.local; do echo waiting for mysql; sleep 2; done;"]
-      volumes:
-        - name: onedev
-          persistentVolumeClaim:
-            claimName: onedev
----
-# Source: onedev/templates/deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: onedev-mysql
-  labels:
-    helm.sh/chart: onedev-7.8.5
-    app.kubernetes.io/name: onedev
-    app.kubernetes.io/instance: onedev
-    app.kubernetes.io/version: "7.8.5"
-    app.kubernetes.io/managed-by: Helm
-    tier: mysql
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: onedev
-      app.kubernetes.io/instance: onedev
-      tier: mysql 
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      name: onedev-mysql
-      labels:
-        app.kubernetes.io/name: onedev
-        app.kubernetes.io/instance: onedev
-        tier: mysql
-    spec:
-      nodeSelector: 
-        kubernetes.io/os: linux
-      containers:
-        - name: mysql
-          image: mysql:5.7
-          args:
-            - "--character-set-server=utf8mb4"
-            - "--collation-server=utf8mb4_unicode_ci"
-            - "--ignore-db-dir=lost+found"
-          env:
-            - name: MYSQL_DATABASE
-              value: onedev
-            - name: MYSQL_ROOT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: onedev-mysql
-                  key: password
-          ports:
-            - containerPort: 3306
-          resources:
-            requests:
-              memory: 256Mi
-          volumeMounts:
-            - name: mysql
-              mountPath: /var/lib/mysql
-          readinessProbe:
-            exec:
-              command:
-                - bash
-                - "-c"
-                - |
-                  mysql -uroot -p$MYSQL_ROOT_PASSWORD -e 'SELECT 1'
-            initialDelaySeconds: 5
-            periodSeconds: 2
-            timeoutSeconds: 1
-      volumes:
-        - name: mysql
-          persistentVolumeClaim:
-            claimName: onedev-mysql
----
-# Source: onedev/templates/ingress.yaml
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: onedev
-spec:
-  rules:
-    - host: onedev.internal.jpace121.net
-      http:
-        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: onedev
-              port:
-                number: 80

deployments/pvc-copy.yaml

@@ -1,44 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pvc-copy-deployment
-  labels:
-    app: pvc-copy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pvc-copy
-  template:
-    metadata:
-      labels:
-        app: pvc-copy
-    spec:
-      containers:
-      - name: pvc-copy
-        image: 192.168.1.149:8443/jwp-build:latest
-        volumeMounts:
-          - mountPath: /var/original-pvc
-            name: original-pvc
-          - mountPath: /var/new-pvc
-            name: new-pvc
-      volumes:
-      - name: original-pvc
-        persistentVolumeClaim:
-          claimName: kanboard-pvc
-      - name: new-pvc
-        persistentVolumeClaim:
-          claimName: kanboard-pvc-nfs
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: kanboard-pvc-nfs
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: nfs-client
-  resources:
-    requests:
-      storage: 2Gi

deployments/squid.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: squid-deployment
-  labels:
-    app: squid
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: squid
-  template:
-    metadata:
-      labels:
-        app: squid
-    spec:
-      containers:
-      - name: squid
-        image: 192.168.1.149:8443/squid:0.3
-        volumeMounts:
-          - mountPath: /var/spool/squid
-            name: squid-volume
-        ports:
-          - containerPort: 3128
-            name: squid-port
-      volumes:
-      - name: squid-volume
-        emptyDir: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: squid-service
-spec:
-  selector:
-    app: squid
-  ports:
-    - protocol: TCP
-      targetPort: 3128
-      port: 3128
-      name: squid-port

deployments/test-branch-pipeline.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: test-branch-pipeline-deployment
-  namespace: j7s-ci
-  labels:
-    app: test-branch-pipeline
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: test-branch-pipeline
-  template:
-    metadata:
-      labels:
-        app: test-branch-pipeline
-    spec:
-      volumes:
-         - name: ssh-volume
-           secret:
-              secretName: git-credentials
-      containers:
-      - name: branch-pipeline
-        image: 192.168.1.149:8443/j7s_branch_trigger:0.2
-        command: ["/bin/bash", "-c"]
-        volumeMounts:
-           - mountPath: /ssh-volume
-             name: ssh-volume
-        env:
-           - name: J7S_REPO
-             value: "ssh://git.jpace121.net:2222/tests/job-test"
-           - name: J7S_URL
-             value: http://el-test-pipeline-listener.j7s-ci.svc.cluster.local:8080
-        args:
-           - |
-            cp -r /ssh-volume ~/.ssh
-            chmod 700 ~/.ssh
-            chmod -R 400 ~/.ssh/*
-
-            j7s_branch_trigger

dns/dns.yaml

@@ -1,31 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: coredns
-  namespace: kube-system
-data:
-  Corefile: |
-    .:53 {
-        errors
-        health
-        hosts {
-          192.168.1.128 tekton.internal.jpace121.net
-          192.168.1.128 k3s
-          192.168.1.128 harbor.internal.jpace121.net
-          192.168.1.135 k3s-node1
-          10.100.100.1 git.jpace121.net
-          fallthrough
-        }
-        ready
-        kubernetes cluster.local in-addr.arpa ip6.arpa {
-          pods insecure
-          fallthrough in-addr.arpa ip6.arpa
-        }
-        prometheus :9153
-        forward . /etc/resolv.conf
-        cache 30
-        reload
-        loadbalance
-    }
-  NodeHosts: |
-    #192.168.1.128 k3s

docs/cluster-v2-design.md

@@ -330,20 +330,33 @@ nmcli connection up id br0
 ```
 
 ### Kubeseal Use
+```
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test-secret
+  namespace: my-namespace
+type: Opaque 
+data: 
+  username: dmFsdWUtMQ0K 
+  password: dmFsdWUtMg0KDQo=
+stringData: 
+  hostname: myapp.mydomain.com
+```
 cat secret.yaml | kubeseal --format yaml > sealedsecret.yaml
 
 # Actual Install Notes
 
 ## To Do List
 
-Infra Cluster:
+Infra Cluster: [x]
 - On Host:
     1. CoreDNS [x]
     2. Wireguard [x]
 - On Cluster:
-    1. Keycloak
-    2. Kanboard
-    3. OneDev
+    1. Keycloak [x]
+    2. Kanboard [x]
+    3. Gitea [x]
     4. Harbor [x]
 
 Main Cluster:
@@ -351,14 +364,19 @@ Main Cluster:
     1. Wireguard [x]
 - On Cluster:
     1. Tekton
-    2. MQTT Broker
-    3. Squid
-    4. j7s-os-deployment
+       Base install [ ]
+       Add namespace
+       Push images
+       Update tasks
+       Update jobs
     5. Flux
+        1. MQTT Broker
+        2. Squid
+        3. j7s-os-deployment
 
 [x] Give accounts on Harbor to clusters.
 [ ] Push images to Harbor.
-[ ] Hubble.
+[x] Hubble.
 
 ## Regularly Scheduled Programming
 
@@ -400,7 +418,7 @@ On VM:
 sudo hostnamectl set-hostname j7s-cluster
 sudo systemctl disable firewalld --now
 sudo su
-export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.46.0.0/16 --service-cidr 10.47.0.0/16 --cluster-dns 10.47.0.10 --selinux"
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.46.0.0/16 --service-cidr 10.47.0.0/16 --cluster-dns 10.47.0.10 --selinux --resolv-conf /run/systemd/resolve/resolv.conf"
 curl -sfL https://get.k3s.io | sh -s -
 exit
 sudo cp /etc/rancher/k3s/k3s.yaml ~/j7s-cluster.yaml
@@ -638,4 +656,31 @@ ngress-nginx-controller             LoadBalancer   10.45.94.103    192.168.1.112
 ```
 > 10.100.100.7:31566
 
+### Tekton
 
+kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
+kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml
+kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/interceptors.yaml
+kubectl apply --filename https://storage.googleapis.com/tekton-releases/dashboard/latest/release.yaml
+
+### Keycloak
+kubectl describe pv pvc-4bcbb023-e686-4082-855f-d062ff418c74 --namespace keycloak
+`/var/lib/rancher/k3s/storage/pvc-4bcbb023-e686-4082-855f-d062ff418c74_keycloak_keycloak-db-pvc`
+`scp /tmp/db-backup.tar.gz jimmy@192.168.1.112:.`
+```
+sudo su
+chown root:root ./db-backup.tar.gz
+cd /var/lib/rancher/k3s/storage/pvc-4bcbb023-e686-4082-855f-d062ff418c74_keycloak_keycloak-db-pvc
+rm -rf *
+tar xpvzf /home/jimmy/db-backup.tar.gz
+sudo chown -R systemd-oom:systemd-oom *
+```
+
+# Bugs
+After installation of fedora neeeded to run:
+
+```
+sudo lvextend /dev/mapper/fedora_fedora-root -l+100%FREE
+sudo xfs_growfs /dev/mapper/fedora_fedora-root
+```
+in the VM so the root directory wasn't limited to 15Gb.

docs/rotating_k3s_certs.md

@@ -0,0 +1,37 @@
+# Rotating k8s certs
+
+Problem: k3s client certs, including the admin cert expire after 1 year.
+
+To see cert:
+```
+cat ~/.kube/config | grep client-certificate-data | cut -f2 -d : | tr -d ' ' | base64 -d | openssl x509 -text -out -
+```
+
+```
+ssh jimmy@192.168.1.103
+sudo systemctl stop k3s
+sudo k3s certificate rotate
+sudo systemctl start k3s
+
+
+```
+
+```
+sudo cp /etc/rancher/k3s/k3s.yaml ~/j7s-cluster.yaml
+sudo chown jimmy:jimmy ~/j7s-cluster.yaml
+exit
+
+```
+
+```
+rm  ~/.kube/j7s-cluster.yaml
+scp jimmy@192.168.1.103:~/j7s-cluster.yaml /home/jimmy/.kube/.
+# Use text editor to fix IP in file.
+
+```
+
+```
+export KUBECONFIG=~/.kube/j7s-cluster.yaml
+kubectl get nodes
+```
+

docs/updating-ca.md

@@ -0,0 +1,47 @@
+# Updating CA
+
+## What is it?
+
+My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.
+
+The original one was built using cfssl.
+I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to
+renew the cert, I just built a new CA from scratch.
+
+Here is how.
+
+## Make the CA
+
+```
+cd ~/Develop/jpace121-certificate-authority
+j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca
+```
+
+## Tell Nginx
+
+```
+scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem
+```
+Then restart nginx.
+
+## Tell Keycloak
+
+```
+base64 -w 0 ca/cert.pem
+```
+
+Copy to keycloak-config.yaml.
+
+Deploy.
+
+```
+export KUBECONFIG=~/.kube/infra.yaml
+kubectl apply -f keycloak-config.yaml
+kubectl apply -f deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```
+
+Watch the logs:
+```
+kubectl logs -n keycloak deployment/keycloak-deployment keycloak
+```

docs/updating-keycloak.md

@@ -0,0 +1,17 @@
+# Updating Keycloak
+
+If keycloak needs to be updated for harbor to work, you can't really pull the image
+from Harbor, so we directly import the image into the cluster.
+See the steps I followed below.
+
+```
+podman build -f images/Dockerfile -t harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 .
+podman save harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 -o keycloak.tar
+scp keycloak.tar jimmy@192.168.1.112:.
+ssh jimmy@192.168.1.112
+sudo k3s ctr images import keycloak.tar
+sudo k3s ctr images ls
+exit
+kubectl apply -f manifests/deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```

docs/upgrading-k3s-notes.md

@@ -0,0 +1,53 @@
+# Notes on updating k3s and cilium
+
+Notes:
+1. Cilium need to be uninstalled with the cilium cli version it was installed with,
+   then reinstalled using the new cilium cli and the new installation instructions.
+2. K3S can be updated by calling the install script with the same options as before.
+
+
+Update k3s.
+Update cilium.
+
+Update k3s.
+
+j7s-cluster:
+```
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.46.0.0/16 --service-cidr 10.47.0.0/16 --cluster-dns 10.47.0.10 --selinux --resolv-conf /run/systemd/resolve/resolv.conf"
+curl -sfL https://get.k3s.io | sh -s -
+```
+
+infra-cluster:
+```
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.44.0.0/16 --service-cidr 10.45.0.0/16 --cluster-dns 10.45.0.10 --selinux"
+curl -sfL https://get.k3s.io | sh -s -
+```
+
+I don't know why I needed resolve-conf in one but not the other, but I did confirm it was not set in the infra-cluster systemd file...
+
+Update cilium:
+
+
+1. Move cilium binary to cilium-original
+
+For j7s-cluster:
+2. `export KUBECONFIG=~/.kube/j7s-cluster.yaml`
+3. `cilium-original uninstall`
+4. `cilium install --version 1.15.5 --set=ipam.operator.clusterPoolIPv4PodCIDRList="10.46.0.0/16"`
+5. `ssh jimmy@192.168.1.103`
+6. `sudo su`
+7. `iptables-save |  grep -v '\-A' | iptables-restore`
+8. `exit` `exit`
+
+
+For infra cluster:
+2. `export KUBECONFIG=~/.kube/infra.yaml`
+3. `cilium-original uninstall`
+4. `cilium install --version 1.15.5 --set=ipam.operator.clusterPoolIPv4PodCIDRList="10.44.0.0/16"`
+wait......
+5. `ssh jimmy@192.168.1.112`
+6. `sudo su`
+7. `iptables-save |  grep -v '\-A' | iptables-restore`
+8. `exit` `exit`
+
+I didn't wait where I put wait..... and had to rstart k3s...

images/Dockerfile_ansible-podman

@@ -1,4 +0,0 @@
-FROM quay.io/podman/stable:v4.2.1
-
-RUN dnf update && \
-    dnf install -y ansible git

images/Dockerfile_buildah

@@ -1,6 +0,0 @@
-FROM quay.io/buildah/upstream:latest
-
-# Add skopeo.
-RUN dnf install -y skopeo \
-    --exclude container-selinux \
-    --enablerepo=updates-testing

images/Dockerfile_curl

@@ -1,6 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y \
-       curl \
-       jq

images/Dockerfile_gitssh

@@ -1,6 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y \
-       git \
-       openssh-client

images/Dockerfile_j7s-image-build

@@ -1,9 +0,0 @@
-FROM quay.io/centos/centos:stream9
-RUN dnf install -y 'dnf-command(copr)' && \
-    dnf copr enable -y @osbuild/osbuild && \
-    dnf install -y osbuild osbuild-tools osbuild-ostree make sudo git
-RUN useradd -m -G wheel -s /bin/bash -u 1000 j7s && \
-    bash -c 'echo "%wheel  ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers.d/container' && \
-    chmod 0440 /etc/sudoers.d/container
-USER j7s
-ENTRYPOINT ["bash"]

images/Dockerfile_vcs

@@ -1,10 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y curl
-RUN curl -s https://packagecloud.io/install/repositories/dirk-thomas/vcstool/script.deb.sh | bash
-RUN apt update -y && \
-    apt install -y \
-       git \
-       openssh-client \
-       python3-vcstool

infra-cluster/gitea/manifests/config-map.yaml

@@ -11,6 +11,7 @@ metadata:
 data:
   GITEA____APP_NAME: "Forge"
   GITEA__server__DOMAIN: "git.jpace121.net"
+  GITEA__server__PUBLIC_URL_DETECTION: "never"
   GITEA__server__SSH_DOMAIN: "git.jpace121.net"
   GITEA__server__HTTP_PORT: "3000"
   GITEA__server__ROOT_URL: https://git.jpace121.net/
@@ -19,9 +20,9 @@ data:
   GITEA__server__LFS_START_SERVER: "true"
   GITEA__server__LFS_OFFLINE_MODE: "true"
   GITEA__server__LANDING_PAGE: "explore"
-  GITEA__database__PATH: "/data/gitea/gitea.db"
+  GITEA__database__PATH: "/data/gitea/gitea.db?_journal_mode=WAL&"
   GITEA__database__DB_TYPE: "sqlite3"
   GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
   GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
   GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
-  GITEA__webhook__ALLOWED_HOST_LIST: "0x2A"
+  GITEA__security__ALLOWED_HOST_LIST: "0x2A"

infra-cluster/gitea/manifests/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: gitea-app
-        image: docker.io/gitea/gitea:1.19.0
+        image: docker.io/gitea/gitea:28.1
         ports:
         - containerPort: 3000
         - containerPort: 2222

infra-cluster/keycloak/images/Dockerfile

@@ -0,0 +1,4 @@
+FROM quay.io/keycloak/keycloak:26.8
+WORKDIR /opt/keycloak
+RUN ./bin/kc.sh build \
+    --db postgres

infra-cluster/keycloak/manifests/deployment.yaml

@@ -0,0 +1,89 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak-deployment
+  namespace: keycloak
+  labels:
+    app: keycloak
+spec:
+  replicas: 1
+  strategy:
+     type: Recreate
+  selector:
+    matchLabels:
+      app: keycloak
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      containers:
+      - name: keycloak-db
+        image: docker.io/library/postgres:bullseye
+        volumeMounts:
+        - name: db-storage
+          mountPath: "/var/lib/postgresql/data"
+        env:
+        - name: POSTGRES_DB
+          value: keycloak
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: keycloak-db-secret
+              key: POSTGRES_PASSWORD
+        lifecycle:
+          preStop:
+            exec:
+              command: ["/usr/local/bin/pg_ctl stop -D /var/lib/postgresql/data -w -t 60 -m fast"]
+      - name: keycloak
+        image: harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0
+        env:
+        - name: KC_LOG_LEVEL
+          value: DEBUG
+        - name: KEYCLOAK_ADMIN
+          value: admin
+        - name: KEYCLOAK_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: keycloak-secret
+              key: KEYCLOAK_ADMIN_PASSWORD
+        - name: KC_DB
+          value: postgres
+        - name: KC_DB_USERNAME
+          value: postgres
+        - name: KC_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: keycloak-secret
+              key: KC_DB_PASSWORD
+        - name: KC_SPI_X509CERT_LOOKUP_PROVIDER
+          value: "nginx"
+        - name: KC_SPI_X509CERT_LOOKUP__NGINX__SSL_CLIENT_CERT
+          value: "ssl-client-cert"
+        - name: KC_TRUSTSTORE_PATHS
+          value: "/opt/keycloak-config/jpace121-ca.pem"
+        - name: KC_HTTPS_CLIENT_AUTH
+          value: "request"
+        - name: KC_HOSTNAME
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_ADMIN
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_STRICT
+          value: "true"
+        - name: KC_PROXY_HEADERS
+          value: "xforwarded"
+        - name: KC_HTTP_ENABLED
+          value: "true"
+        volumeMounts:
+        - name: keycloak-config
+          mountPath: /opt/keycloak-config/
+        args:
+        - start
+      volumes:
+      - name: db-storage
+        persistentVolumeClaim:
+          claimName: keycloak-db-pvc
+      - name: keycloak-config
+        configMap:
+          name: keycloak-config

infra-cluster/keycloak/manifests/ingress.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak-ingress
+  namespace: keycloak
+  annotations:
+     nginx.ingress.kubernetes.io/proxy-buffering: "on"
+     nginx.ingress.kubernetes.io/proxy-buffer-size: "512k"
+spec:
+  rules:
+  - host: auth.jpace121.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: keycloak-service
+            port:
+              number: 8080

infra-cluster/keycloak/manifests/keycloak-config.yaml

@@ -0,0 +1,8 @@
+---
+kind: ConfigMap
+metadata:
+  name: keycloak-config
+  namespace: keycloak
+apiVersion: v1
+binaryData:
+  jpace121-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJsVENDQVRxZ0F3SUJBZ0lVWUc1c2tnbTJoQUtKWXlwa01ldFhZU0FMaEl3d0NnWUlLb1pJemowRUF3SXcKSnpFWU1CWUdBMVVFQ2d3UGFuQmhZMlV4TWpFdWJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQWdGdzB5TmpFdwpNVEF4TlRVeE5EQmFHQTh5TVRJMk1Ea3hOakUxTlRFME1Gb3dKekVZTUJZR0ExVUVDZ3dQYW5CaFkyVXhNakV1CmJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJBakUKdEpVSFZqbTl3eWRuUnhXbFd6U3lKTWRNMGVIbjNSNGZ2STFYbE1uU2VYOXlQN2VxU3pXRm4ydmZvbTJJaCtJUAozK2tRNlVkeCtVaE1UK2h2ZGJ5alFqQkFNQTRHQTFVZER3RUIvd1FFQXdJQmhqQWRCZ05WSFE0RUZnUVVDalI2CkJDQ0huSk5RRXFlK3FmOGZqQjI3bEZBd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBS0JnZ3Foa2pPUFFRREFnTkoKQURCR0FpRUE0VTJmVldIeUIyODdyT2gwMFo1L3lSYlBqNVpoWDg3U3JwSTVHN2k3b0NRQ0lRRFJ3WmlxYmRsRQptaGZiSC94Rm1VemY5TExzYVArbGpzU2VjcytYU1pES2dRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

infra-cluster/keycloak/manifests/pvc.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: keycloak-db-pvc
+  namespace: keycloak
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

infra-cluster/keycloak/manifests/service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak-service
+  namespace: keycloak
+spec:
+  selector:
+    app: keycloak
+  ports:
+    - protocol: TCP
+      targetPort: 8080
+      port: 8080

infra-cluster/keycloak/namespaces/keycloak.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: harbor
+  name: keycloak

infra-cluster/keycloak/secrets/keycloak-secret-sealed.yaml

@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: keycloak-secret
+  namespace: keycloak
+spec:
+  encryptedData:
+    KC_DB_PASSWORD: AgCwkQkNAxQXZ+Qpz7UAod6z912Gwj7cNX9pmBeEGMisADDC5o29mZpETaaby3Sn/SHJ0IjBusNwRlbd6ROflQbOdHFuZl30walUWE0kRQg4LcwBMQav19USzJ1IF4cu4uudD4jigbolAHZ1XeSgHJl7jAunmibX8aHhGZtxlvHB2cHTRuA+Gz4EFkbKEJY+7LHfZqPG3J/uig9wAKIEGl2T6qNsPfA5yN9eL0MPdHkTpRuUaIPGpDZOnF8O6B8ItvP9XYRx+IsNcfYWMviKBdBVkZCGvHprcG7gZbVoOksbeRh64BbIKsMm3HMrm85BS30ldTLDuVYB97yUWXrsYDwaIK5ElBj5ALuR8cJ1argTL9ykIm7x9piuWqZeM8kj8NFRSkGP+cJdec83qP0Co1nVnsjh09yyT21LHjBWPM7jTPWz7Q5b2wUSbNBedP/XvHgVAjl8HTsL+MIJI+BLisxh51N0tB9kyCBvBc3yOo4QQpusf1lpBa/6rqZUpkIcbaamcY+l4IGcx68D7iYGkV6/xgYTRuhd/WmGj5C6sV4wfvE6bW4RindRfllkidFyAiJJlIApXdb0Sj8Mht4HUG02n+eszjcdjO68MpXStXnaY1A4jGXEqxG/jkuw9WC9AIIqzEHqbG7nqDP7vkQqcJmUZPPeenc+pHNuJRA6BSfBNHJNYYrOn4OvkFOMj1BMhCkag7VK/Q+YEsBn5Ng0UjjxZskG
+    KEYCLOAK_ADMIN_PASSWORD: AgCF3NAAFvhv1TohUYkSeQ3nzUdvdL5W/2NawychQf3IJIfxIxT4cxm5xBJq9LD6WQZ39Tj9Qn7+ccZjzc1LwBqCwHECHCKFZ6ccJlblp4gneVPbvppx+ZN7RM0zlTCRluaP10STxp+tvzH8aG2p41+RRCd4maUjASu/kgpdgrzS4Cag0KbI+DLjd2Ep4772D55kVjXaSOUIVf0P22gyS2SuwC0cPLt97jX/cknIRSi5ojg0sxqvIQWxTep7iL1D4cFr4ZAOViU7jGOt3ncSWjLu20Nfc30lcKQFXe8pAOkE6n17Jw91856L3eRh5+RcpcKqvHLuLffJVeWIUkqFud1qliSxc61ulfTeQIMAdMi8ZzYq72fo/U/0Vr1PAO5UshptYOWvzfp6tVSif5Jhk+icWVlHriuRRQu585TjTYU679+qHXF0tNWe/QQBxUH0RvVahlye63UtJ08eLvNBWKc2y2/rJaIOx6UxPg+itb7HuRJxUejsUWCMttwAIrytChjnL2SKhFDkNVZ7Kw+BxPfWQdobSaP1NYaCaTYTlnXmp7ANWtLEiyJdcbk9u46VUUl7gGsEsGdusspNmOPQb/iU4yglBmAjV1cUNXYMrj+jiLyli6NTfQsVFt9rwBnXvU/HzhVz8e2YfmqrKy+YRdj/w9PJ2bCasKjmv78eWmkPYTYETzhuA6pm4NLzBsViTzgcUaYOabp1LDw87XXbElDJrkIkLvfHnsPEC5+kBoWPzXit65U=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: keycloak-secret
+      namespace: keycloak
+    type: Opaque
+

infra-cluster/keycloak/secrets/sealed-db-secret.yaml

@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: keycloak-db-secret
+  namespace: keycloak
+spec:
+  encryptedData:
+    POSTGRES_PASSWORD: AgATymQkJVhzyGItgEMClsbLdNQA33C8c2ioetx53NaM1MZl40pX8sGW/gGVCGw8VzXjL8WUS/HeVrK12Q6w8E1Z/SWHOeuEpRqyEw99ElrodlILolRUEetr9ytMpJXMEAHeJl+UgSED9IcwrgkPSjlbwnZXgRrqO2gjO5dPie/tsx8Dkjc//oaXJHRaKA62MN9Bjom/V/tP5EnTEJaPTpprmFnW8TqfLJp+XeiPWMqg4FjtP+1oeGoa1jf4b5aaT8SpLHg8q4DWuXOQQb4Xxid3q8hRPi4PLokJb5xjN8PcyMxibr3bZTVj8VpxRkXIrWVRlOz/W8W+96PNH1mY+aSpidowFG1I8Npd59UY4pgoXdPm3hD4DVEy1T9qv5B1D8Duu9GjRloMp/qbcbTvbnRf8xkF3jBucAVOxI5/6BE4VYZxwNojsnYPTdlqdR7n/fvhcFIwSVlisYFrR2cXHJIRMO2Ir6NV7i4/YnPgI+zuWvIiGGGWndKNNcX/5KtZbHn9AZHZi3A23BMjm+Up4V1JeLxdNCcmPsZB3Von5TqJpg9lyR6/NvE8k80HP17GO9f/phLBwu8Q8uJtn0eLwNkc0jCZScDg8CyYKEFMb1Oiq+7WhVp9YucURhS3jqsdb2QRNDacAhKqegB9kAGaIJMx3tZd6rrO8jkozBsuCt/otQVGni4yHzK2nN79O9MiLyd2suofQYr6D3C2vcaYRRdfS4GV
+  template:
+    metadata:
+      creationTimestamp: null
+      name: keycloak-db-secret
+      namespace: keycloak
+    type: Opaque
+

j7s-cluster/bootstrap.sh

@@ -0,0 +1,7 @@
+flux bootstrap git \
+  --author-email=flux@internal.jpace121.net \
+  --author-name=Flux \
+  --context=j7s \
+  --url=ssh://git@git.jpace121.net:2222/cd/flux-cluster.git \
+  --branch=master \
+  --path=clusters/j7s-cluster

jobs/cache-check.yaml

@@ -1,21 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: cache-check
-spec:
-  template:
-    spec:
-      containers:
-      - name: cache-check
-        image: docker.io/debian:bullseye-slim
-        env:
-        - name: http_proxy
-          value: http://squid-service:3128
-        command: ["bash"]
-        args:
-          - "-c"
-          - >-
-            apt update -y &&
-            apt upgrade -y
-      restartPolicy: Never
-  backoffLimit: 1

jobs/nfs-test.yaml

@@ -1,33 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: test-claim
-spec:
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Mi
----
-kind: Pod
-apiVersion: v1
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: test-pod
-    image: busybox:stable
-    command:
-      - "/bin/sh"
-    args:
-      - "-c"
-      - "touch /mnt/SUCCESS && exit 0 || exit 1"
-    volumeMounts:
-      - name: nfs-pvc
-        mountPath: "/mnt"
-  restartPolicy: "Never"
-  volumes:
-    - name: nfs-pvc
-      persistentVolumeClaim:
-        claimName: test-claim

jobs/test-trigger-check.yaml

@@ -1,21 +0,0 @@
-# Keeping this as an example, but the test pipeline was changed
-# at one point to show interoperability with PRs.
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: test-trigger-check
-  namespace: j7s-ci
-spec:
-  template:
-    spec:
-      containers:
-      - name: test-trigger-check
-        image: 192.168.1.149:8443/curl:latest
-        command: ["bash"]
-        args:
-          - "-c"
-          - >-
-            curl -X POST http://el-test-pipeline-listener.j7s-ci.svc.cluster.local:8080 -H 'Content-Type: application/json' -d '{}'
-      restartPolicy: Never
-  backoffLimit: 0

namespaces/j7s-ci.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: j7s-ci

namespaces/nfs-subdir-external-provisioner.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nfs-subdir-external-provisioner

pipelines/dev-contain-pipeline.yaml

@@ -1,55 +0,0 @@
-# A pipeline to build and deploy dev_contain packages.
-# Steps:
-#   Clone the dev_contain repo from gitea and checkout packaging branch.
-#   Call ansible play to build.
-#   Optionally, call play to deploy
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: dev-contain-pipeline
-  namespace: j7s-ci
-spec:
-  description: "Build and deploy dev_contain packages."
-  params:
-  - name: branch
-    type: string
-    description: The branch in the repo to call the build script in.
-  - name: deploy
-    type: string
-    description: "'true' if we should deploy the image using ansible."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  - name: deploy-credentials
-    description: tekton credentials to deployment server
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/packaging/dev_contain
-    - name: branch
-      value: $(params.branch)
-    taskRef:
-      name: j7s-git-clone
-  - name: build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: deploy-credentials
-    params:
-    - name: deploy
-      value: $(params.deploy)
-    - name: ansible-file-path
-      value: .
-    taskRef:
-      name: j7s-ansible-build

pipelines/j7s-os-pipeline.yaml

@@ -1,79 +0,0 @@
-# A pipeline to build j7s-os images.
-# Steps:
-#   Clone the j7s-os repo from onedev.
-#   Call make <> in the repo.
-#   Build and push a new deployment container.
-#   Deploy the deployment container as a service.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: j7s-os-pipeline
-  namespace: j7s-ci
-spec:
-  description: Build and deploy j7s-os images.
-  params:
-  - name: make-image-name
-    type: string
-    description: The name of image to make in the os repo.
-  - name: branch
-    type: string
-    default: main
-    description: branch of j7s-os image to build.
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: My ssh credentials
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/public/j7s-os
-    - name: branch
-      value: $(params.branch)
-    taskRef:
-      name: j7s-git-clone
-  - name: image-build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: image-name
-      value: $(params.make-image-name)
-    taskRef:
-      name: j7s-os-image-build
-  - name: build-deploy-image
-    runAfter: ["image-build"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: commit
-      value: $(params.make-image-name)
-    - name: image
-      value: j7s-os-deploy
-    - name: registry
-      value: 192.168.1.149:8443
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    taskRef:
-      name: j7s-os-buildah
-  - name: deploy-image
-    runAfter: ["build-deploy-image"]
-    workspaces:
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: image
-      value: 192.168.1.149:8443/j7s-os-deploy
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    taskRef:
-      name: j7s-os-k8s-deploy

pipelines/ostree-package-pipeline.yaml

@@ -1,48 +0,0 @@
-# A pipeline to build and deploy my fork of the debian packaging for ostree.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: ostree-package-pipeline
-  namespace: j7s-ci
-spec:
-  description: "Package fork of ostree."
-  params:
-  - name: deploy
-    type: string
-    description: "'true' if we should deploy the image using ansible."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  - name: deploy-credentials
-    description: tekton credentials to deployment server
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/packaging/ostree
-    - name: branch
-      value: jamesp/latest
-    taskRef:
-      name: j7s-git-clone
-  - name: build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: deploy-credentials
-    params:
-    - name: deploy
-      value: $(params.deploy)
-    - name: ansible-file-path
-      value: ./j7s-build-files
-    taskRef:
-      name: j7s-ansible-build

pipelines/simple-ros-pipeline.yaml

@@ -1,63 +0,0 @@
-# A pipeline to build the simple ros test containers.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: simple-ros-pipeline
-  namespace: j7s-ci
-spec:
-  description: Build a image with a simple ros image.
-  workspaces:
-  - name: shared-data
-  - name: git-credentials
-  - name: cosign-credentials
-  tasks:
-  - name: ros-clone
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/j7s-simple-ws
-    - name: branch
-      value: master
-    - name: repos-file
-      value: source.repos
-    taskRef:
-      name: j7s-ros-clone
-  - name: image-build
-    runAfter: ["ros-clone"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: cosign-credentials
-      workspace: cosign-credentials
-    params:
-    - name: registry
-      value: 192.168.1.149:8443
-    - name: name
-      value: simple-ros
-    - name: version
-      value: 0.1
-    - name: containerfile
-      value: ./docker/Dockerfile
-    taskRef:
-      name: j7s-buildah
-  results:
-  - name: image-ARTIFACT_OUTPUTS
-    type: object
-    value:
-       uri: $(tasks.image-build.results.image-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.image-build.results.image-ARTIFACT_OUTPUTS.digest)
-  - name: commit-ARTIFACT_INPUTS
-    type: object
-    value:
-       uri: $(tasks.ros-clone.results.workspace-git-commit-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.ros-clone.results.workspace-git-commit-ARTIFACT_OUTPUTS.digest)
-  - name: vcs-exact-file-ARTIFACT_INPUTS
-    type: object
-    value:
-       uri: $(tasks.ros-clone.results.vcs-exact-file-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.ros-clone.results.vcs-exact-file-ARTIFACT_OUTPUTS.digest)

pipelines/test-pipeline.yaml

@@ -1,60 +0,0 @@
-# A pipeline to test the infrasture around calling pipelines.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: test-pipeline
-  namespace: j7s-ci
-spec:
-  description: "A test pipeline."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  params:
-  - name: pr-id
-    description: ID number of the current PR.
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/job-test
-    - name: branch
-      value: master
-    taskRef:
-      name: j7s-git-clone
-  - name: cat-readme
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    taskSpec:
-      workspaces:
-      - name: source
-      steps:
-      - image: docker.io/debian:bullseye-slim
-        script: |
-          set -x
-          cat $(workspaces.source.path)/README.md
-          exit 0
-  finally:
-    - name: notify-onedev
-      params:
-        - name: tekton-login-secret-name
-          value: onedev-api-key
-        - name: feedback-url
-          value: https://git.jpace121.net/
-        - name: pr-id
-          value: $(params.pr-id)
-        - name: run-name
-          value: $(context.pipelineRun.name)
-        - name: status
-          value: $(tasks.status)
-      taskRef:
-        name: j7s-onedev-pr-review

pipelines/test-report-pipeline.yaml

@@ -1,60 +0,0 @@
-# A pipeline to test the infrasture around calling pipelines.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: test-report-pipeline
-  namespace: j7s-ci
-spec:
-  description: "A test pipeline."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  params:
-  - name: hash
-    default: HEAD
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/job-test
-    - name: hash
-      value: $(params.hash)
-    taskRef:
-      name: j7s-git-clone-hash
-  - name: cat-readme
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    taskSpec:
-      workspaces:
-      - name: source
-      steps:
-      - image: docker.io/debian:bullseye-slim
-        script: |
-          set -x
-          cat $(workspaces.source.path)/README.md
-          exit 0
-  finally:
-    - name: notify-onedev
-      params:
-        - name: tekton-login-secret-name
-          value: onedev-api-key
-        - name: feedback-url
-          value: https://git.jpace121.net/
-        - name: project-id
-          value: 9
-        - name: run-name
-          value: $(context.pipelineRun.name)
-        - name: status
-          value: $(tasks.status)
-      taskRef:
-        name: j7s-onedev-file-bug

runs/dev-contain-debian.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-debian-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/debian"
-  - name: deploy
-    value: "true"

runs/dev-contain-rpm.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-rpm-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/fedora"
-  - name: deploy
-    value: "true"

runs/j7s-os-test.yaml

@@ -1,25 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: j7s-os-test-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: j7s-os-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 3Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  params:
-  - name: make-image-name
-    value: cs9-qemu-minimal-ostree.x86_64.repo
-  - name: branch
-    value: main

runs/j7s-ros-clone.yaml

@@ -1,27 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  generateName: j7s-ros-clone-
-  namespace: j7s-ci
-spec:
-  taskRef:
-    name: j7s-ros-clone
-  workspaces:
-  - name: output
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 0.5Gi
-  - name: ssh-directory
-    secret:
-      secretName: git-credentials
-  params:
-  - name: url
-    value: "ssh://git.jpace121.net:2222/tests/j7s-simple-ws"
-  - name: branch
-    value: "master"
-  - name: repos-file
-    value: source.repos

runs/ostree-package.yaml

@@ -1,26 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: ostree-package-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: ostree-package-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: deploy
-    value: "true"

runs/simple-ros-pipeline.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: simple-ros-pipeline-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: simple-ros-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: cosign-credentials
-    secret:
-      secretName: container-signing-secret

runs/test-report-pipeline.yaml

@@ -1,20 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: test-report-pipeline-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: test-report-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials

scripts/Dockerfile_flask

@@ -1,11 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y python3-flask && \
-    mkdir /app
-
-COPY test.py /app/test.py
-
-WORKDIR /app
-ENV FLASK_APP=test
-CMD ["flask", "run", "--host", "0.0.0.0"]

scripts/bootstrap-flux.bash

@@ -1,5 +0,0 @@
-flux bootstrap git \
-  --url=ssh://git.jpace121.net:2222/cd/flux-infra \
-  --branch=master \
-  --author-name=flux \
-  --path=cluster

scripts/debug-pod.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: jimmy-debug-pod
-  namespace: j7s-ci
-spec:
-  containers:
-  - image: docker.io/debian:bullseye-slim
-    name: jimmy-debug-pod
-    command: ["tail"]
-    args: ["-f", "/dev/null"]
-    volumeMounts:
-    - mountPath: /pvc
-      name: pvc-mount
-  volumes:
-  - name: pvc-mount
-    persistentVolumeClaim:
-      claimName: pvc-3244e44354

scripts/issue-body.json

@@ -1,10 +0,0 @@
-{
-"projectId" : 9 ,
-"title" : "Hi From Curl" ,
-"description" : "This was posted from curl." ,
-"confidential" : false ,
-"milestoneIds" : [ ] ,
-"fields" : {
-"Type" : "Build Failure"
-}
-}

scripts/registry/list-images.sh

@@ -1,2 +0,0 @@
-# See all images in cluster registry.
-curl -k -X GET -u $USERNAME:$PASSWORD https://192.168.1.128:8443/v2/_catalog

scripts/registry/list-tags.sh

@@ -1 +0,0 @@
-skopeo list-tags docker://192.168.1.149:8443/simple-ros

scripts/test.py

@@ -1,22 +0,0 @@
-from flask import Flask
-from flask import request
-import logging
-
-app = Flask(__name__)
-
-logger = logging.getLogger('j7s-app')
-logger.setLevel(logging.INFO)
-handler = logging.StreamHandler()
-logger.addHandler(handler)
-
-
-@app.route("/", defaults={"path": ""}, methods = ['POST', 'GET'])
-@app.route('/<path:path>', methods=['POST', 'GET'])
-def root(path):
-    logger.info("Path")
-    logger.info(path)
-    logger.info("Headers:")
-    logger.info(request.headers)
-    logger.info("Body:")
-    logger.info(request.json)
-    return "<p>Hello</p>"

scripts/test_onedev_issue.bash

@@ -1,4 +0,0 @@
-curl -u tekton:$TEKTON_API_KEY \
-     -d@issue-body.json \
-     -H "Content-Type: application/json" \
-     https://git.jpace121.net/~api/issues

serviceaccounts/tekton-bot.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tekton-bot
-  namespace: j7s-ci
-secrets:
-  - name: git-credentials
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tekton-bot-eventlistener-binding
-  namespace: j7s-ci
-subjects:
-- kind: ServiceAccount
-  name: tekton-bot
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-roles
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: tekton-bot-eventlistener-clusterbinding
-subjects:
-- kind: ServiceAccount
-  name: tekton-bot
-  namespace: j7s-ci
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-clusterroles

tasks/j7s-ansible-build.yaml

@@ -1,29 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-ansible-build
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: source
-  - name: ssh-directory
-  params:
-  - name: deploy
-  - name: ansible-file-path
-  steps:
-  - image: 192.168.1.149:8443/ansible-podman:latest
-    securityContext:
-      privileged: true
-    script: |
-      #!/usr/bin/env bash
-      set -ex
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      cd $(workspaces.source.path)
-      ansible-playbook -vvvv --skip-tags deploy -i $(params.ansible-file-path)/inventory.yaml $(params.ansible-file-path)/build.yaml
-
-      if [[ $(params.deploy) == "true" ]]; then
-        ansible-playbook -vvvv --tags deploy -i $(params.ansible-file-path)/inventory.yaml $(params.ansible-file-path)/build.yaml
-      fi

tasks/j7s-buildah.yaml

@@ -1,84 +0,0 @@
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-buildah
-  namespace: j7s-ci
-spec:
-  description: Build and push a container image.
-  params:
-  - name: registry
-    description: Registry to push to.
-  - name: name
-    description: Name of the image.
-  - name: version
-    description: Version for the image.
-  - name: containerfile
-    description: Path of the Containerfile relative to source.
-  workspaces:
-  - name: source
-  - name: cosign-credentials
-  steps:
-  - name: build
-    image: 192.168.1.149:8443/buildah:latest
-    workingDir: $(workspaces.source.path)
-    script: |
-      set -x
-      # Login
-      buildah login --tls-verify=false --username=$USERNAME --password=$PASSWORD $(params.registry)
-      mkdir ~/.sigstore
-      cp $(workspaces.cosign-credentials.path)/* ~/.sigstore
-      cat <<EOF > ~/.sigstore/param-file.yaml
-      privateKeyFile: "$HOME/.sigstore/cosign.key"
-      privateKeyPassphraseFile: "$HOME/.sigstore/cosign.password"
-      EOF
-      mkdir -p /etc/containers/registries.d/
-      cat <<EOF > /etc/containers/registries.d/james-registry.yaml
-      docker:
-         $(params.registry):
-            use-sigstore-attachments: true
-      EOF
-      # Build
-      buildah --storage-driver=overlay bud --tls-verify=false --no-cache \
-        -f $(params.containerfile)  -t $(params.name):$(params.version) .
-      # Push
-      skopeo copy --dest-tls-verify=false --sign-by-sigstore=$HOME/.sigstore/param-file.yaml \
-              containers-storage:localhost/$(params.name):$(params.version) \
-              docker://$(params.registry)/$(params.name):$(params.version)
-      skopeo copy --dest-tls-verify=false --sign-by-sigstore=$HOME/.sigstore/param-file.yaml \
-              containers-storage:localhost/$(params.name):$(params.version) \
-              docker://$(params.registry)/$(params.name):latest
-      # Indicate results.
-      HASH=`skopeo inspect containers-storage:localhost/$(params.name):$(params.version) --format={{.Digest}}`
-      cat <<EOF > $(results.image-ARTIFACT_OUTPUTS.path)
-      {
-         "uri": "$(params.registry)/$(params.name):$(params.version)",
-         "digest": "$HASH"
-      }
-    env:
-    - name: USERNAME
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: username
-    - name: PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: password
-    volumeMounts:
-    - name: varlibcontainers
-      mountPath: /var/lib/containers
-    securityContext:
-      privileged: true
-  volumes:
-  - name: varlibcontainers
-    emptyDir: {}
-  results:
-  - name: image-ARTIFACT_OUTPUTS
-    type: object
-    properties:
-       uri:
-          type: string
-       digest:
-          type: string

tasks/j7s-git-clone-hash.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-git-clone-hash
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: output
-  - name: ssh-directory
-  params:
-  - name: url
-  - name: hash
-  steps:
-  - image: 192.168.1.149:8443/gitssh:latest
-    script: |
-      set -x
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      git clone $(params.url) $(workspaces.output.path)
-      cd $(workspaces.output.path)
-      git checkout $(params.hash)

tasks/j7s-git-clone.yaml

@@ -1,21 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-git-clone
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: output
-  - name: ssh-directory
-  params:
-  - name: url
-  - name: branch
-  steps:
-  - image: 192.168.1.149:8443/gitssh:latest
-    script: |
-      set -x
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      git clone --single-branch --branch $(params.branch) $(params.url) $(workspaces.output.path)

tasks/j7s-onedev-file-bug.yaml

@@ -1,50 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-onedev-file-bug
-  namespace: j7s-ci
-spec:
-  params:
-  - name: tekton-login-secret-name
-  - name: feedback-url
-  - name: project-id
-  - name: run-name
-  - name: status
-  steps:
-  - image: 192.168.1.149:8443/curl:latest
-    script: |
-      #!/usr/bin/env bash
-      set -e
-
-      function make_request {
-      cat <<EOF > request.json
-      {
-          "projectId": $(params.project-id),
-          "title": "Failed run: $(params.run-name).",
-          "description": "Build Failed!",
-          "confidential": false,
-          "milestoneIds": [],
-          "fields": {"Type": "Build Failure"}
-      }
-      EOF
-      }
-
-      case "$(params.status)" in
-         "Succeeded" | "Completed")
-            echo "Build was successful!"
-           ;;
-         "Failed" | "None")
-            echo "Build failed. :("
-            make_request
-            curl -u tekton:$TEKTON_API_KEY \
-                 -H "Content-Type: application/json" \
-                 -d@request.json \
-                 $(params.feedback-url)/~api/issues
-           ;;
-      esac
-    env:
-    - name: TEKTON_API_KEY
-      valueFrom:
-        secretKeyRef:
-          name: $(params.tekton-login-secret-name)
-          key: accesstoken

tasks/j7s-onedev-pr-review.yaml

@@ -1,53 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-onedev-pr-review
-  namespace: j7s-ci
-spec:
-  params:
-  - name: tekton-login-secret-name
-  - name: feedback-url
-  - name: pr-id
-  - name: run-name
-  - name: status
-  steps:
-  - image: 192.168.1.149:8443/curl:latest
-    script: |
-      #!/usr/bin/env bash
-      set -e
-
-      STATUS=""
-      case "$(params.status)" in
-         "Succeeded" | "Completed")
-            echo "Build was successful!"
-            STATUS="Sucess! :) "
-           ;;
-         "Failed" | "None")
-            STATUS="Error! :( "
-           ;;
-      esac
-
-      # Make a comment on the PR.
-      cat <<EOF > comment.json
-      {
-        "userId": $TEKTON_USER_ID,
-        "requestId": $(params.pr-id),
-        "date": "`date +"%Y-%m-%dT%H:%M:%S%:z"`",
-        "content": "$STATUS Tekton run: $(params.run-name)."
-      }
-      EOF
-      curl -u tekton:$TEKTON_API_KEY \
-           -H "Content-Type: application/json" \
-           -d@comment.json \
-           $(params.feedback-url)/~api/pull-request-comments
-    env:
-    - name: TEKTON_API_KEY
-      valueFrom:
-        secretKeyRef:
-          name: $(params.tekton-login-secret-name)
-          key: accesstoken
-    - name: TEKTON_USER_ID
-      valueFrom:
-        secretKeyRef:
-          name: $(params.tekton-login-secret-name)
-          key: userid

tasks/j7s-os-buildah.yaml

@@ -1,53 +0,0 @@
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-os-buildah
-  namespace: j7s-ci
-spec:
-  description: Build the deployment container image for j7s-os.
-  params:
-  - name: image
-    description: Reference of the image buildah will produce.
-  - name: commit
-    description: Repo directory to put inside the image.
-  - name: registry
-    description: Registry to push to.
-  - name: version
-    description: Version for the image.
-  workspaces:
-  - name: source
-  steps:
-  - name: build
-    image: quay.io/buildah/stable:v1.23.3
-    workingDir: $(workspaces.source.path)
-    script: |
-      set -x
-      # Login
-      buildah login --tls-verify=false --username=$USERNAME --password=$PASSWORD $(params.registry)
-      # Build
-      buildah --storage-driver=overlay bud --tls-verify=false --no-cache \
-        --build-arg commit=./$(params.commit) \
-        -f ./hosting/Dockerfile -t $(params.image):$(params.version) .
-      # Push
-      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):$(params.version)
-      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):latest
-    env:
-    - name: USERNAME
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: username
-    - name: PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: registry-login-secret
-          key: password
-    volumeMounts:
-    - name: varlibcontainers
-      mountPath: /var/lib/containers
-    securityContext:
-      privileged: true
-  volumes:
-  - name: varlibcontainers
-    emptyDir: {}

tasks/j7s-os-image-build.yaml

@@ -1,22 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-os-image-build
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: source
-  params:
-  - name: image-name
-  results:
-  - name: version-string
-  steps:
-  - image: 192.168.1.149:8443/j7s-image-build:latest
-    securityContext:
-      privileged: true
-    script: |
-      set -x
-      sudo chown -R j7s:j7s $(workspaces.source.path)
-      cd $(workspaces.source.path)
-      make $(params.image-name)
-      echo -n `date +%Y%m%d%H%M`-`git describe --no-match --always --dirty` | tee $(results.version-string.path)

tasks/j7s-os-k8s-deploy.yaml

@@ -1,45 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-os-k8s-deploy
-  namespace: j7s-ci
-spec:
-  params:
-    - name: image
-      description: The image to deploy.
-    - name: version
-      description: The version of the image to deploy.
-  workspaces:
-    - name: ssh-directory
-  steps:
-    - name: update-with-flux
-      image: 192.168.1.149:8443/gitssh:latest
-      script: |
-        #!/usr/bin/env bash
-        set -x
-        cp -r $(workspaces.ssh-directory.path) ~/.ssh
-        chmod 700 ~/.ssh
-        chmod -R 400 ~/.ssh/*
-        git config --global user.name tekton
-        git config --global user.email tekton@internal.jpace121.net
-
-        git clone ssh://git.jpace121.net:2222/cd/flux-apps flux-apps
-        cd flux-apps
-        cat <<EOF > j7s-os-deploy/patch.yaml
-        ---
-        apiVersion: apps/v1
-        kind: Deployment
-        metadata:
-          name: j7s-os-app-deployment
-        spec:
-          template:
-            spec:
-              containers:
-              - name: j7s-os-app
-                image: $(params.image):$(params.version)
-        EOF
-
-        git add ./j7s-os-deploy
-        git commit -m "Update j7s-os-deploy to version $(params.version)"
-        git push origin master
-

tasks/j7s-ros-clone.yaml

@@ -1,56 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: j7s-ros-clone
-  namespace: j7s-ci
-spec:
-  workspaces:
-  - name: output
-  - name: ssh-directory
-  params:
-  - name: url
-  - name: branch
-  - name: repos-file
-  results:
-  - name: workspace-git-commit-ARTIFACT_OUTPUTS
-    type: object
-    properties:
-       uri:
-          type: string
-       digest:
-          type: string
-  - name: vcs-exact-file-ARTIFACT_OUTPUTS
-    type: object
-    properties:
-       uri:
-          type: string
-       digest:
-          type: string
-  steps:
-  - image: 192.168.1.149:8443/vcs:latest
-    script: |
-      set -x
-      cp -r $(workspaces.ssh-directory.path) ~/.ssh
-      chmod 700 ~/.ssh
-      chmod -R 400 ~/.ssh/*
-
-      git clone --single-branch --branch $(params.branch) $(params.url) $(workspaces.output.path)
-      cd $(workspaces.output.path)
-      mkdir src
-      vcs import src < $(params.repos-file)
-
-      # Git hash is really sha1, rehashing to workaround Tekton bug.
-      GITHASH=`git rev-parse HEAD | sha256sum | cut -f 1 -d " "`
-      VCSEXACTHASH=`vcs export --exact ./src | sha256sum | cut -f 1 -d " "`
-      cat <<EOF > $(results.workspace-git-commit-ARTIFACT_OUTPUTS.path)
-      {
-         "uri": "$(params.url)",
-         "digest": "sha256:$GITHASH"
-      }
-      EOF
-      cat <<EOF > $(results.vcs-exact-file-ARTIFACT_OUTPUTS.path)
-      {
-         "uri": "vcs-exact-file",
-         "digest": "sha256:$VCSEXACTHASH"
-      }
-      EOF

triggers/test-trigger.yaml

@@ -1,59 +0,0 @@
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: EventListener
-metadata:
-  name: test-pipeline-listener
-  namespace: j7s-ci
-spec:
-  serviceAccountName: tekton-bot
-  triggers:
-    - name: test-pipeline-trigger
-      bindings:
-        - ref: test-pipeline-binding
-      template:
-        ref: test-pipeline-template
-  resources:
-    kubernetesResource:
-      serviceType: ClusterIP
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerBinding
-metadata:
-  name: test-pipeline-binding
-  namespace: j7s-ci
-spec:
-  params:
-    - name: hash
-      value: $(body.hash)
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerTemplate
-metadata:
-  name: test-pipeline-template
-  namespace: j7s-ci
-spec:
-  params:
-  - name: hash
-  resourcetemplates:
-  - apiVersion: tekton.dev/v1beta1
-    kind: PipelineRun
-    metadata:
-      generateName: test-pipeline-
-    spec:
-      pipelineRef:
-        name: test-report-pipeline
-      params:
-      - name: hash
-        value: "$(tt.params.hash)"
-      workspaces:
-      - name: shared-data
-        volumeClaimTemplate:
-          spec:
-            accessModes:
-            - ReadWriteOnce
-            resources:
-              requests:
-                  storage: 1Gi
-      - name: git-credentials
-        secret:
-          secretName: git-credentials