pikasTech-unidesk/config/platform-infra/pipelines-as-code.yaml

version: 1
kind: platform-infra-pipelines-as-code
metadata:
  id: pac-gitea-consumers
  owner: unidesk
  spec: GH-1552/GH-1555/GH-1560
  relatedIssues:
    - 1552
    - 1555
    - 1557
    - 1560
    - 1649
    - 1760
    - 1769
    - 1802
    - 1811
defaults:
  targetId: NC01
  consumerId: hwlab-nc01-v03
display:
  timeZone: Asia/Shanghai
observability:
  configRef: config/platform-infra/observability.yaml
  tracesEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
  serviceName: unidesk-cicd
  propagation:
    - tracecontext
    - baggage
  sampling:
    mode: parentbased_traceidratio
    ratio: 1
  exporterFailure:
    warning: true
    blocking: false
    timeoutMs: 300
release:
  version: v0.48.0
  manifestUrl: https://github.com/openshift-pipelines/pipelines-as-code/releases/download/v0.48.0/release.k8s.yaml
  namespace: pipelines-as-code
  controllerServiceName: pipelines-as-code-controller
  controllerServicePort: 8080
  waitTimeoutSeconds: 55
deliveryProvenance:
  version: admission-pac-v2
  markerAnnotation: unidesk.ai/pac-admission-provenance
  child:
    enabled: false
    parentNameAnnotation: unidesk.ai/pac-parent-pipelinerun
    parentUidAnnotation: unidesk.ai/pac-parent-pipelinerun-uid
  controller:
    namespace: pipelines-as-code
    serviceAccountName: pipelines-as-code-controller
  queueTransition:
    controller:
      namespace: pipelines-as-code
      serviceAccountName: pipelines-as-code-watcher
    stateLabel: pipelinesascode.tekton.dev/state
    allowed:
      - fromSpecStatus: PipelineRunPending
        toSpecStatus: absent
        fromState: queued
        toState: started
  admission:
    policyName: unidesk-pac-delivery-provenance-v2
    bindingName: unidesk-pac-delivery-provenance-v2
    failurePolicy: Fail
    validationActions:
      - Deny
capabilities:
  sentinelInternalPublish:
    enabled: false
    admissionProvenance: unavailable
    trackingIssue: https://github.com/pikasTech/unidesk/issues/1769
closeout:
  gitOpsMirrorFlush:
    enabled: true
    waitTimeoutSeconds: 55
    maxAttempts: 5
targets:
  - id: JD01
    route: JD01:k3s
    namespace: agentrun-ci
    role: active-cicd-trigger-authority
    enabled: true
  - id: NC01
    route: NC01:k3s
    namespace: agentrun-ci
    role: active-cicd-trigger-authority
    enabled: true
gitea:
  configRef: "config/platform-infra/gitea.yaml#sourceAuthority.repositories"
  internalBaseUrl: http://gitea-http.devops-infra.svc.cluster.local:3000
  admin:
    sourceRoot: /root/.unidesk/.env
    sourceRef: gitea.auth
    format: line-pair
    usernameLine: 1
    passwordLine: 2
    apiUsername: unidesk-admin
  webhook:
    secretRoot: /root/.unidesk/.env
    secretSourceRef: pipelines-as-code.webhook
    events:
      - push
    branch: params.source_branch
repositories:
  - extends: templates.repositories.agentrunV02
    variables:
      NODE: JD01
      LANE: v02
    url: https://gitea.pikapython.com/mirrors/pikasTech-agentrun
  - extends: templates.repositories.agentrunV02
    variables:
      NODE: NC01
      LANE: v02
  - extends: templates.repositories.sentinelV03
    variables:
      NODE: JD01
      LANE: v03
      sourceSnapshotPrefix: refs/unidesk/snapshots/gitea-actions/unidesk-master
    url: https://gitea.pikapython.com/mirrors/pikasTech-unidesk
  - extends: templates.repositories.sentinelV03
    variables:
      NODE: NC01
      LANE: v03
      sourceSnapshotPrefix: refs/unidesk/snapshots/gitea-actions/unidesk-master-nc01
    params:
      unidesk_host_image_repository: 127.0.0.1:5000/unidesk/todo-note
      unidesk_host_registry_probe_base: http://127.0.0.1:5000
      unidesk_host_gitops_branch: unidesk-host-gitops
      unidesk_host_gitops_manifest_path: deploy/gitops/unidesk-host/todo-note.yaml
      unidesk_host_runtime_namespace: unidesk
      unidesk_host_runtime_deployment: todo-note
      unidesk_host_runtime_service: todo-note
      unidesk_host_runtime_service_port: "4288"
      unidesk_host_health_path: /health
      unidesk_host_health_url: http://todo-note.unidesk.svc.cluster.local:4288/health
  - id: sub2rank-nc01
    name: sub2rank-nc01
    namespace: devops-infra
    providerType: gitea
    url: https://gitea.pikapython.com/mirrors/pikasTech-sub2rank
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-sub2rank.git
    owner: mirrors
    repo: pikasTech-sub2rank
    secretName: pac-gitea-sub2rank-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-sub2rank.git
      source_branch: master
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/sub2rank-master-nc01
      node: NC01
      image_repository: 127.0.0.1:5000/sub2rank/sub2rank
      registry_probe_base: http://127.0.0.1:5000
      gitops_branch: unidesk-host-gitops
      gitops_manifest_path: deploy/gitops/platform-infra/sub2rank-nc01/resources.yaml
      pipeline_name: platform-infra-sub2rank-nc01-pac
      pipeline_run_prefix: sub2rank-nc01
      service_account: sub2rank-nc01-tekton-runner
      pipeline_timeout: 600s
      workspace_pvc_size: 4Gi
      runtime_namespace: platform-infra
      runtime_deployment: sub2rank
      runtime_service: sub2rank
      runtime_service_port: "8080"
      health_path: /health
      health_url: http://sub2rank.platform-infra.svc.cluster.local:8080/health
  - extends: templates.repositories.hwlabV03
    variables:
      NODE: JD01
      LANE: v03
    url: https://gitea.pikapython.com/mirrors/pikasTech-HWLAB
  - extends: templates.repositories.hwlabV03
    variables:
      NODE: NC01
      LANE: v03
  - id: selfmedia-nc01
    name: selfmedia-nc01
    namespace: selfmedia-ci
    providerType: gitea
    url: https://gitea.pikapython.com/mirrors/pikainc-selfmedia
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
    owner: mirrors
    repo: pikainc-selfmedia
    secretName: pac-gitea-selfmedia-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      source_branch: master
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
      node: NC01
      pipeline_name: selfmedia-nc01-pac
      pipeline_run_prefix: selfmedia-nc01
      service_account: selfmedia-nc01-tekton-runner
      pipeline_timeout: 2h0m0s
      image_repository: 127.0.0.1:5000/selfmedia/newsroom
      registry_probe_base: http://127.0.0.1:5000
      gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      gitops_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      gitops_branch: nc01-selfmedia-gitops
      gitops_username: unidesk-admin
      gitops_secret_name: pac-gitea-selfmedia-nc01
      gitops_manifest_path: deploy/gitops/nc01/resources.yaml
      runtime_namespace: selfmedia
      runtime_deployment: selfmedia
      runtime_service: selfmedia
      runtime_service_port: "4317"
      health_path: /healthz
      health_url: http://selfmedia.selfmedia.svc.cluster.local:4317/healthz
consumers:
  - extends: templates.consumers.agentrunV02
    variables:
      NODE: JD01
      LANE: v02
  - extends: templates.consumers.agentrunV02
    variables:
      NODE: NC01
      LANE: v02
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:agentrun-nc01-v02
      executionServiceAccountName: agentrun-nc01-v02-tekton-runner
      gitOps:
        repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
        targetRevision: nc01-v0.2-gitops
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: agentrun-control-plane
      configRef: config/agentrun.yaml#controlPlane.lanes.nc01-v02
      pipelineRunPath: .tekton/agentrun-nc01-v02.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - extends: templates.consumers.sentinelV03
    variables:
      NODE: JD01
      LANE: v03
  - extends: templates.consumers.sentinelV03
    variables:
      NODE: NC01
      LANE: v03
  - id: unidesk-host
    repositoryRef: sentinel-nc01-v03
    node: NC01
    lane: host-k8s
    namespace: devops-infra
    pipeline: unidesk-host-pac
    pipelineRunPrefix: unidesk-host-
    argoNamespace: argocd
    argoApplication: unidesk-host
    closeoutGitOpsMirrorFlush: true
    closeoutGitOpsMirrorLane: v03
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/unidesk-host
      destinationNamespace: unidesk
      automated: true
  - id: platform-infra-gitea-nc01
    repositoryRef: sentinel-nc01-v03
    node: NC01
    lane: platform-infra
    namespace: devops-infra
    pipeline: platform-infra-gitea-nc01-pac
    pipelineRunPrefix: platform-infra-gitea-nc01-
    argoNamespace: argocd
    argoApplication: platform-infra-gitea-nc01
    closeoutGitOpsMirrorFlush: false
  - id: platform-infra-sub2rank-nc01
    repositoryRef: sub2rank-nc01
    node: NC01
    lane: platform-infra
    namespace: devops-infra
    pipeline: platform-infra-sub2rank-nc01-pac
    pipelineRunPrefix: sub2rank-nc01
    argoNamespace: argocd
    argoApplication: sub2rank-nc01
    closeoutGitOpsMirrorFlush: true
    closeoutGitOpsMirrorLane: v03
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/platform-infra/sub2rank-nc01
      destinationNamespace: platform-infra
      automated: true
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:platform-infra-sub2rank-nc01
      executionServiceAccountName: sub2rank-nc01-tekton-runner
      gitOps:
        repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
        targetRevision: unidesk-host-gitops
    runnerServiceAccount:
      name: sub2rank-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: sub2rank-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: sub2rank-platform-service
      configRef: config/platform-infra/sub2rank.yaml#delivery
      pipelineRunPath: .tekton/sub2rank-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - extends: templates.consumers.hwlabV03
    variables:
      NODE: JD01
      LANE: v03
  - extends: templates.consumers.hwlabV03
    variables:
      NODE: NC01
      LANE: v03
    sourceArtifact:
      mode: remote-pipeline-annotation
      renderer: hwlab-runtime-lane
      configRef: config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01
      pipelinePath: ci/pipelines/hwlab-nc01-v03-ci-image-publish.yaml
      pipelineRunPath: .tekton/hwlab-nc01-v03-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: selfmedia-nc01
    repositoryRef: selfmedia-nc01
    node: NC01
    lane: selfmedia
    namespace: selfmedia-ci
    pipeline: selfmedia-nc01-pac
    pipelineRunPrefix: selfmedia-nc01
    argoNamespace: argocd
    argoApplication: selfmedia-nc01
    closeoutGitOpsMirrorFlush: false
    argoBootstrap:
      project: default
      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      targetRevision: nc01-selfmedia-gitops
      path: deploy/gitops/nc01
      destinationNamespace: selfmedia
      automated: true
      repositoryCredential:
        secretName: argocd-repo-selfmedia-nc01
        username: unidesk-admin
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:selfmedia-nc01
      executionServiceAccountName: selfmedia-nc01-tekton-runner
      gitOps:
        repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
        targetRevision: nc01-selfmedia-gitops
    runnerServiceAccount:
      name: selfmedia-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: selfmedia-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: selfmedia-runtime
      configRef: config/selfmedia.yaml#delivery.targets.NC01
      pipelineRunPath: .tekton/selfmedia-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
templates:
  repositories:
    agentrunV02:
      id: "agentrun-${nodeLower}-v02"
      name: "agentrun-${nodeLower}-v02"
      namespace: agentrun-ci
      providerType: gitea
      url: https://gitea.pikapython.com/mirrors/pikasTech-agentrun
      cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
      owner: mirrors
      repo: pikasTech-agentrun
      secretName: "pac-gitea-agentrun-${nodeLower}-v02"
      tokenKey: token
      webhookSecretKey: webhook.secret
      concurrencyLimit: 1
      params:
        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        git_write_url: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
        source_branch: v0.2
        node: "${NODE}"
        gitops_branch: "${nodeLower}-v0.2-gitops"
        source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/agentrun-v0.2
        pipeline_name: "agentrun-${nodeLower}-v02-ci-image-publish"
        pipeline_run_prefix: "agentrun-${nodeLower}-v02-ci"
        service_account: "agentrun-${nodeLower}-v02-tekton-runner"
        workspace_pvc_size: 2Gi
    sentinelV03:
      id: "sentinel-${nodeLower}-v03"
      name: "sentinel-${nodeLower}-v03"
      namespace: devops-infra
      providerType: gitea
      url: https://gitea.pikapython.com/mirrors/pikasTech-unidesk
      cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
      owner: mirrors
      repo: pikasTech-unidesk
      secretName: "pac-gitea-sentinel-${nodeLower}-v03"
      tokenKey: token
      webhookSecretKey: webhook.secret
      concurrencyLimit: 1
      params:
        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
        source_branch: master
        source_snapshot_prefix: "${sourceSnapshotPrefix}"
        node: "${NODE}"
        lane: v03
        sentinel_id: "${nodeLower}-web-probe-sentinel"
        image_repository: "127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}"
        registry_probe_base: http://127.0.0.1:5000
        gitops_branch: v0.3-gitops
        gitops_manifest_path: "deploy/gitops/node/${nodeLower}/web-probe-sentinel/web-probe-sentinel.yaml"
        pipeline_name: "hwlab-web-probe-sentinel-${nodeLower}-pac"
        pipeline_run_prefix: "hwlab-web-probe-sentinel-${nodeLower}"
        service_account: default
        otel_traces_endpoint: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
        otel_service_name: "unidesk-cicd-sentinel-${nodeLower}"
        otel_sampling_ratio: "1"
        otel_exporter_timeout_ms: "300"
    hwlabV03:
      id: "hwlab-${nodeLower}-v03"
      name: "hwlab-${nodeLower}-v03"
      namespace: hwlab-ci
      providerType: gitea
      url: https://gitea.pikapython.com/mirrors/pikasTech-HWLAB
      cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git
      owner: mirrors
      repo: pikasTech-HWLAB
      secretName: "pac-gitea-hwlab-${nodeLower}-v03"
      tokenKey: token
      webhookSecretKey: webhook.secret
      concurrencyLimit: 1
      params:
        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git
        git_write_url: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
        source_branch: v0.3
        gitops_branch: v0.3-gitops
        source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3
        pipeline_name: "hwlab-${nodeLower}-v03-ci-image-publish"
        pipeline_run_prefix: "hwlab-${nodeLower}-v03-ci-poll"
        service_account: "hwlab-${nodeLower}-v03-tekton-runner"
        workspace_pvc_size: 8Gi
        git_ssh_secret: hwlab-git-ssh
        pipeline_timeout: 1h0m0s
        node: "${NODE}"
        lane: v03
        runtime_namespace: hwlab-v03
  consumers:
    agentrunV02:
      id: "agentrun-${nodeLower}-v02"
      repositoryRef: "agentrun-${nodeLower}-v02"
      node: "${NODE}"
      lane: "${nodeLower}-v02"
      namespace: agentrun-ci
      pipeline: "agentrun-${nodeLower}-v02-ci-image-publish"
      pipelineRunPrefix: "agentrun-${nodeLower}-v02-ci"
      argoNamespace: argocd
      argoApplication: "agentrun-${nodeLower}-v02"
      closeoutGitOpsMirrorFlush: true
    sentinelV03:
      id: "sentinel-${nodeLower}-v03"
      repositoryRef: "sentinel-${nodeLower}-v03"
      node: "${NODE}"
      lane: v03
      namespace: devops-infra
      pipeline: "hwlab-web-probe-sentinel-${nodeLower}-pac"
      pipelineRunPrefix: "hwlab-web-probe-sentinel-${nodeLower}"
      argoNamespace: argocd
      argoApplication: "hwlab-web-probe-sentinel-${nodeLower}"
      closeoutGitOpsMirrorFlush: true
      closeoutGitOpsMirrorLane: v03
    hwlabV03:
      id: "hwlab-${nodeLower}-v03"
      repositoryRef: "hwlab-${nodeLower}-v03"
      node: "${NODE}"
      lane: v03
      namespace: hwlab-ci
      pipeline: "hwlab-${nodeLower}-v03-ci-image-publish"
      pipelineRunPrefix: "hwlab-${nodeLower}-v03-ci-poll"
      argoNamespace: argocd
      argoApplication: hwlab-node-v03
      closeoutGitOpsMirrorFlush: true