Skip to content

Commit 120022a

Browse files
christophermay07christophermay07
committed
Create GitLab CI libraries for PSR workflows: minimal, typical,
everything
1 parent d125a20 commit 120022a

13 files changed

+1575
-0
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.vscode/

‎README.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,98 @@
11
# ploigos-gitlab-library
22

3+
TODO, Section 1 (as pulled from top of workflow files):
4+
5+
## - separatePlatformConfig: need separate runners for true/false scenarios (including documentation on how/why)
6+
# /* Directory into which platform configuration is mounted, if applicable */
7+
# PLATFORM_CONFIG_DIR: "/opt/platform-config"
8+
#
9+
# /* Additional mounts for agent containers, if separatePlatformConfig == true */
10+
# String PLATFORM_MOUNTS = params.separatePlatformConfig ? """
11+
# - mountPath: ${PLATFORM_CONFIG_DIR}/config.yml
12+
# name: ploigos-platform-config
13+
# subPath: config.yml
14+
# - mountPath: ${PLATFORM_CONFIG_DIR}/config-secrets.yml
15+
# name: ploigos-platform-config-secrets
16+
# subPath: config-secrets.yml
17+
# """ : ""
18+
#
19+
# /* Additional volumes for the agent Pod, if separatePlatformConfig == true */
20+
# String PLATFORM_VOLUMES = params.separatePlatformConfig ? """
21+
# - name: ploigos-platform-config
22+
# configMap:
23+
# name: ploigos-platform-config
24+
# - name: ploigos-platform-config-secrets
25+
# secret:
26+
# secretName: ploigos-platform-config-secrets
27+
# """ : ""
28+
29+
# /* Combine this app's local config with platform-level config, if separatePlatformConfig == true */
30+
# String PSR_CONFIG_ARG = params.separatePlatformConfig ?
31+
# "${PLATFORM_CONFIG_DIR} ${params.stepRunnerConfigDir}" : "${params.stepRunnerConfigDir}"
32+
33+
## - trustedCABundleConfig should be known at platform level, not app level; the runner should know this, not the pipeline
34+
# /* Additional mount for agent containers, if trustedCaConfig == true */
35+
# String TLS_MOUNTS = params.trustedCABundleConfig ? """
36+
# - name: trusted-ca
37+
# mountPath: /etc/pki/ca-trust/source/anchors
38+
# readOnly: true
39+
# """ : ""
40+
41+
# /* Additional volume for agent containers, if trustedCaConfig == true */
42+
# String TLS_VOLUMES = params.trustedCABundleConfig ? """
43+
# - name: trusted-ca
44+
# configMap:
45+
# name: ${params.trustedCABundleConfigMapName}
46+
# items:
47+
# - key: ca-bundle.crt
48+
# path: tls-ca-bundle.pem
49+
# """ : ""
50+
51+
## Other pod configs that look like they belong with runner?? Might be able to configure in pipeline...
52+
## imagePullPolicy: "${params.workflowWorkersImagePullPolicy}"
53+
## tty: true
54+
## imagePullPolicy: "${params.workflowWorkersImagePullPolicy}"
55+
56+
## - `command: ['sh', '-c', 'update-ca-trust && cat']`; how do we make this happen in GitLab
57+
58+
## - Jenkins / Tekton workflows have pod labels based on variables, but GitLab doesn't carry the same functionality:
59+
## - https://docs.gitlab.com/runner/install/kubernetes.html#set-pod-labels-to-ci-environment-variables-keys
60+
61+
##
62+
##
63+
## NOTE: Branch-matching regex expressions are hard-coded and duplicated at the moment, due to an
64+
## open issue with GitLab: https://gitlab.com/gitlab-org/gitlab/-/issues/35438
65+
##
66+
## NOTE: Rules pulled in from the extends cannot be merged, so must duplicate here; see:
67+
## https://docs.gitlab.com/ee/ci/yaml/#merge-details
68+
## https://github.com/yaml/yaml/issues/48
69+
70+
TODO, Section 2:
71+
72+
- DOCUMENTATION: This README needs to be super-awesome like the other two runners
73+
74+
- DOCUMENTATION: Explicitly spell out what the minimal / standard pipeline look like, what the imported workflow looks like, and how the files in the repo with the workflow are laid out.
75+
76+
- Separate out the `config/` dir to a separate repo, but be sure the necessary pieces are documented in this README
77+
78+
- NOTE: See TODO section in gitlab-ci-minimal.yml (need to move TODOs out of there later anyway)
79+
80+
- Need to manually add all dirs under '/builds' that need to pass from step to step, until GitLab Runner 13.12+ is installed (see the note on this below)
81+
82+
- The "setup_workflow_step_runner" job mounts '/home/ploigos', but it's not dynamic, so pulls the previous build. Need to clean the folder, but the find+rm takes forever. Can't use rm -rf due to pipefail when trying to remove .* (attempts to remove . and .., then fails script). NOTE: Can we just rm -rf specific folders we know will be huge, *then* call the find+rm??
83+
84+
- DOCUMENTATION: List out hard-coded values that cannot be set as variables, and where they live (so far: URLs for include; regex for rules)
85+
86+
- DOCUMENTATION: When setting up the GitLab CI Runner in OpenShift, load 'config.toml' into a ConfigMap (see config/config-toml.yml).
87+
88+
NOTE: Until GitLab CI Runner 13.12+ can be loaded on OpenShift, artifacts will be passed between steps. As of 13.12, the `/builds` folder can be mounted in a PVC, and passed between jobs.
89+
90+
91+
Considerations for setting up a GitLab CI Runner for Ploigos:
92+
93+
* The runner tags MUST be hard-coded, and cannot use a variable value (see: https://gitlab.com/gitlab-org/gitlab-foss/-/issues/24207 ). To work around this, one job can be created for each combination of tags. Rules can then be set based on the desired variables to pick up the correct job, which will have the appropriate tags hard-coded.
94+
95+
* Unlike Jenkins/Tekton pipelines, the GitLab CI Ploigos implementation does not allow for the CA bundle to be dynamically chosen per pipeline; this should be decided upon as a platform-level config in advance, and baked into the Runner as appropriate.
96+
97+
98+
NOTE: Human-readable job names can't be set; GitLab CI will always parse the job name, and possibly make minor changes to it (e.g., forced capitalization of the first letter of the job). See: https://gitlab.com/gitlab-org/gitlab/-/issues/23672

‎config/config-toml.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
kind: ConfigMap
2+
apiVersion: v1
3+
metadata:
4+
name: gitlab-runner-ploigos-config-toml
5+
data:
6+
## See: https://docs.gitlab.com/runner/executors/kubernetes.html
7+
config.toml: |
8+
## TODO: Can we have concurrency right now, given the hard-coded volume names?
9+
#concurrent = 4
10+
11+
[[runners]]
12+
executor = "kubernetes"
13+
14+
[runners.custom_build_dir]
15+
enabled = true
16+
17+
[runners.kubernetes]
18+
## TODO: Is this correct, or should be "always"?
19+
pull_policy = "if-not-present"
20+
21+
# Namespace to run Kubernetes jobs in.
22+
namespace = "gitlab-runner"
23+
24+
#namespace_overwrite_allowed = "ci-.*"
25+
26+
#bearer_token_overwrite_allowed = true
27+
28+
# Default Docker image to use for jobs when none is specified.
29+
image = "ploigos/ploigos-base:latest"
30+
31+
# A list of secrets that are used to authenticate Docker image pulling.
32+
#image_pull_secrets = ["docker-registry-credentials"]
33+
34+
[runners.kubernetes.pod_security_context]
35+
run_as_non_root = true
36+
run_as_user = 1001
37+
# NOTE: fs_group is not defaulting to 0; this must be done explicitly
38+
fs_group = 0
39+
40+
#[runners.kubernetes.node_selector]
41+
# gitlab = "true"
42+
43+
#cpu_limit = "1"
44+
#memory_limit = "1Gi"
45+
#service_cpu_limit = "1"
46+
#service_memory_limit = "1Gi"
47+
#helper_cpu_limit = "500m"
48+
#helper_memory_limit = "100Mi"
49+
poll_interval = 5
50+
poll_timeout = 3600
51+
52+
## Node Scheduling ##
53+
54+
#[runners.kubernetes.node_selector]
55+
# gitlab = "true"
56+
57+
#[runners.kubernetes.node_tolerations]
58+
# "node-role.kubernetes.io/master" = "NoSchedule"
59+
# "custom.toleration=value" = "NoSchedule"
60+
# "empty.value=" = "PreferNoSchedule"
61+
# "onlyKey" = ""
62+
63+
## Volumes ##
64+
65+
## TODO: Do we need something besides the home dir? Until proven otherwise, using the larger PVC (below)!
66+
[[runners.kubernetes.volumes.pvc]]
67+
name = "gitlab-ci-pvc"
68+
mount_path = "/home/ploigos"
69+
70+
#########################################################################################
71+
## TODO:
72+
##
73+
## THE FOLLOWING IS NEEDED, BUT CANNOT BE UNCOMMENTED W/O GITLAB RUNNER 13.12 OR LATER!!!
74+
#########################################################################################
75+
76+
#[[runners.kubernetes.volumes.pvc]]
77+
# name = "gitlab-ci-build-pvc"
78+
# mount_path = "/builds"
79+
80+
[[runners.kubernetes.volumes.secret]]
81+
name = "pgp-keys-ploigos-workflow-ref-quarkus-mvn-gitlab-std-fruit"
82+
mount_path = "/var/pgp-private-keys"
83+
84+
#[[runners.kubernetes.volumes.config_map]]
85+
# name = "trusted-ca"
86+
# mount_path = "/etc/pki/ca-trust/source/anchors"
87+
# read_only = true
88+
# [runners.kubernetes.volumes.config_map.items]
89+
# "key" = "ca-bundle.crt"
90+
# "path" = "tls-ca-bundle.pem"
91+
92+
## TODO: Can we define /opt/platform-config as a var somewhere in the toml?
93+
## TODO: Need the following two to occur only when separatePlatformConfig == true
94+
95+
#[[runners.kubernetes.volumes.config_map]]
96+
# name = "ploigos-platform-config"
97+
# mount_path = "/opt/platform-config/config.yml"
98+
# sub_path = "config.yml"
99+
100+
#[[runners.kubernetes.volumes.secret]]
101+
# name = "ploigos-platform-config-secrets"
102+
# mount_path = "/opt/platform-config/config-secrets.yml"
103+
# sub_path = "config-secrets.yml"
104+
105+
## TODO: Other vars in the Tekton CI script, that may or may not need to be translated here:
106+
107+
## This flag also adds two workspaces to the pipeline template:
108+
## - ploigos-platform-config: for mounting a ConfigMap
109+
## - ploigos-platform-config-secrets: for mounting a Secret
110+
#separatePlatformConfig: false
111+

‎config/gitlab-runner.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: apps.gitlab.com/v1beta2
2+
kind: Runner
3+
metadata:
4+
name: gitlab-ploigos-runner
5+
spec:
6+
gitlabUrl: 'https://gitlab.apps.tssc.rht-set.com/'
7+
buildImage: 'ploigos/ploigos-tool-maven:v0.16.0'
8+
token: gitlab-runner-secret
9+
tags: openshift
10+
config: gitlab-runner-ploigos-config-toml
11+
envVars:
12+
- name: REGISTER_RUN_UNTAGGED
13+
value: "true"

‎config/rb-ploigos.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: gitlab-runner-sa-ploigos-run-as-user-1001
5+
namespace: gitlab-runner
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: ClusterRole
9+
name: ploigos-run-as-user-1001
10+
subjects:
11+
- kind: ServiceAccount
12+
name: gitlab-runner-sa

0 commit comments

Comments
 (0)