Add D601 Tekton CI
This commit is contained in:
Codex
@@ -0,0 +1,84 @@
|
||||
# UniDesk CI On D601 k3s
|
||||
|
||||
UniDesk CI is hosted on the D601 native k3s cluster with Tekton Pipelines and Tekton Triggers. It is CI only. CD remains the existing `deploy.json` / `deploy apply` / `codex deploy <commit>` path, and no Tekton task may roll out production services.
|
||||
|
||||
## Components
|
||||
|
||||
- Tekton Pipelines: `v1.12.0`.
|
||||
- Tekton Triggers: `v0.34.0`.
|
||||
- UniDesk CI namespace: `unidesk-ci`.
|
||||
- Manifests: `src/components/microservices/k3sctl-adapter/k3s/ci/`.
|
||||
- CLI entry: `bun scripts/cli.ts ci install|status|run|logs`.
|
||||
|
||||
The CLI reaches D601 through the existing `k3sctl-adapter` Host SSH maintenance bridge and then runs native `KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl ...`. It does not require backend-core to be running and does not expose a new public port.
|
||||
|
||||
## Pipeline Scope
|
||||
|
||||
Each commit CI run performs:
|
||||
|
||||
- `git clone` and checkout of the requested repository revision.
|
||||
- `bun install --frozen-lockfile` at the repo root and `src/`, because `bun scripts/cli.ts check` compiles all `src/components` and needs the component workspace lockfile for frontend React dependencies.
|
||||
- `bun scripts/cli.ts check`.
|
||||
- Temporary `code-queue-ci-read` Deployment and ClusterIP Service in `unidesk-ci`.
|
||||
- Code Queue read performance checks against the production PostgreSQL through `d601-tcp-egress-gateway`.
|
||||
|
||||
`ci install` also prewarms the D601 k3s containerd runtime with the Tekton entrypoint/workingdir helper images, `oven/bun:1-debian`, `alpine/git:2.45.2` and `unidesk-code-queue:d601`. Missing images are pulled through the node-local provider-gateway WS egress proxy and then imported into native k3s containerd with digests preserved, so PipelineRun pods do not hang on external registry pulls.
|
||||
|
||||
Git clone and dependency downloads inside the repo check task use `d601-provider-egress-proxy.unidesk.svc.cluster.local:18789`; the NO_PROXY list keeps the in-cluster read service, D601 TCP egress gateway and any in-cluster CI Git mirror on the cluster network.
|
||||
|
||||
Steps that call the Kubernetes API directly clear inherited proxy variables so service-account HTTPS calls to `kubernetes.default.svc` do not accidentally use the Code Queue image's Docker Compose proxy defaults.
|
||||
The rollout poll reads the Deployment main resource rather than the `/status` subresource, keeping CI RBAC limited to the same app/service resources it creates and deletes.
|
||||
The performance probe scans recent Code Queue tasks until it finds one with trace steps, so a newly selected task without persisted step detail does not make the whole gate fail before measuring the trace endpoints.
|
||||
|
||||
The temporary Code Queue service uses:
|
||||
|
||||
- `CODE_QUEUE_SERVICE_ROLE=read`.
|
||||
- `CODE_QUEUE_SCHEDULER_ENABLED=false`.
|
||||
- `CODE_QUEUE_STARTUP_OA_BACKFILL_ENABLED=false`.
|
||||
- `CODE_QUEUE_NOTIFY_CLAUDEQQ_ENABLED=false`.
|
||||
- D601 k3s `d601-provider-egress-proxy` for external/OA Event Flow fetches, with `d601-tcp-egress-gateway` and the CI read service in `NO_PROXY`.
|
||||
- EmptyDir state/log mounts.
|
||||
|
||||
This means the CI service can read existing tasks, Trace summaries, Trace steps and Trace step details from the main database, but it must not schedule, mutate, notify, backfill or become deployment truth.
|
||||
|
||||
## Performance Gate
|
||||
|
||||
The initial budgets live in `unidesk-ci/unidesk-ci-budgets`:
|
||||
|
||||
- Code Queue first overview payload through the temporary read service, used as the service-side first-paint proxy: `2000ms`.
|
||||
- `GET /api/tasks/{id}/trace-summary`: `700ms`.
|
||||
- `GET /api/tasks/{id}/trace-steps`: `900ms`.
|
||||
- `GET /api/tasks/{id}/trace-step`: `700ms`.
|
||||
- `GET /api/tasks/overview` p95 over 10 samples: `900ms`.
|
||||
|
||||
These are absolute budgets. Historical relative baselines can be added later by writing metrics to a dedicated CI table or object store; they should not be mixed into production task tables.
|
||||
|
||||
## Commands
|
||||
|
||||
Install or refresh CI:
|
||||
|
||||
```bash
|
||||
bun scripts/cli.ts ci install
|
||||
```
|
||||
|
||||
Check status:
|
||||
|
||||
```bash
|
||||
bun scripts/cli.ts ci status
|
||||
```
|
||||
|
||||
Run CI manually for a commit:
|
||||
|
||||
```bash
|
||||
bun scripts/cli.ts ci run --revision <commit>
|
||||
```
|
||||
|
||||
Inspect a run:
|
||||
|
||||
```bash
|
||||
bun scripts/cli.ts ci logs <pipelineRunName>
|
||||
```
|
||||
|
||||
## Trigger Boundary
|
||||
|
||||
`unidesk-ci.triggers.yaml` installs the EventListener, TriggerBinding and TriggerTemplate, but the EventListener remains a normal in-cluster Service. Do not expose it through NodePort, LoadBalancer or an unrestricted public ingress. If GitHub or another Git remote needs webhook delivery, add a UniDesk-controlled frontend/backend route with secret verification and then proxy to the EventListener; keep frontend and provider ingress as the only unrestricted public entry points.
|
||||
@@ -73,6 +73,12 @@ The reconciler selects the executor from `config.json`:
|
||||
|
||||
Existing service-specific commands such as Code Queue deploy should converge onto this reconciler path instead of keeping a parallel implementation.
|
||||
|
||||
## CI Separation
|
||||
|
||||
Continuous integration is intentionally separate from this deploy reconciler. D601 k3s hosts Tekton CI resources described in `docs/reference/ci.md`, but those PipelineRuns only clone, check and run read-only performance gates. They must not call `deploy apply`, `codex deploy`, `kubectl rollout restart` for production services, or mutate `deploy.json`.
|
||||
|
||||
The Code Queue performance gate may create a temporary `code-queue-ci-read` service and read the main PostgreSQL through the existing `d601-tcp-egress-gateway`. Because it runs with `CODE_QUEUE_SERVICE_ROLE=read`, scheduler/backfill/notification disabled and EmptyDir state, it is not deployment truth and does not need a temporary database for the current read-only checks.
|
||||
|
||||
## Version Stamping And Verification
|
||||
|
||||
Every successful deployment must stamp the source version in the runtime:
|
||||
|
||||
@@ -18,6 +18,7 @@
|
||||
- command.ts (Bounded command execution helpers)
|
||||
- output.ts (JSON output helpers)
|
||||
- e2e.ts (Public frontend/provider ingress, internal core/database, and Playwright frontend E2E checks)
|
||||
- ci.ts (D601 k3s Tekton CI install/status/manual-run/logs helpers; CI only, no CD)
|
||||
- logs/ (Generated service logs; ignored by git)
|
||||
- .state/ (Generated job state and compose env; ignored by git)
|
||||
- docs/
|
||||
@@ -32,6 +33,7 @@
|
||||
- provider-gateway.md (Provider connection and host SSH maintenance bridge)
|
||||
- observability.md (Logs and status visibility)
|
||||
- e2e.md (Delivery gate, Playwright frontend E2E, and database persistence checks)
|
||||
- ci.md (D601 k3s Tekton CI, read-only production database performance gate, and trigger boundary)
|
||||
- src/ (TypeScript component monorepo)
|
||||
- package.json (Component workspace metadata)
|
||||
- bun.lock (Component dependency lockfile)
|
||||
@@ -88,4 +90,5 @@
|
||||
- code-queue/ (Codex/OpenCode queue backend; k3s-managed when exposed through UniDesk)
|
||||
- oa-event-flow/ (Unified OA event ledger, tag stream, and Trace/STEP stats center)
|
||||
- k3sctl-adapter/ (D601 k3s control-plane adapter and managed service manifests)
|
||||
- k3s/ci/ (Tekton CI install marker, Pipeline/Task, and in-cluster Trigger manifests)
|
||||
- example-service/
|
||||
|
||||
Reference in New Issue
Block a user