339 lines
12 KiB
Plaintext
339 lines
12 KiB
Plaintext
pipeline {
|
|
agent {
|
|
kubernetes {
|
|
defaultContainer 'python'
|
|
yaml """
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
labels:
|
|
atlas.bstein.dev/workload: hermes-webui-image-builder
|
|
spec:
|
|
serviceAccountName: hermes-image-builder
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
restartPolicy: Never
|
|
securityContext:
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
nodeSelector:
|
|
kubernetes.io/arch: arm64
|
|
node-role.kubernetes.io/worker: "true"
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values:
|
|
- titan-04
|
|
- titan-14
|
|
- titan-18
|
|
- titan-19
|
|
- titan-22
|
|
- titan-24
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
preference:
|
|
matchExpressions:
|
|
- key: hardware
|
|
operator: In
|
|
values:
|
|
- rpi5
|
|
imagePullSecrets:
|
|
- name: harbor-bstein-robot
|
|
containers:
|
|
- name: jnlp
|
|
image: jenkins/inbound-agent@sha256:8eda4fe2a66bcf6a5e43436d9918fc14c306204dc8fcd75f4e15e0e6e5dc759a
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
- name: python
|
|
image: registry.bstein.dev/bstein/python@sha256:269541d3387baae008df4608ead893dba2b5cdaad1a5a380731a88992d34b808
|
|
command: ["sleep"]
|
|
args: ["99d"]
|
|
tty: true
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
- name: kaniko
|
|
image: gcr.io/kaniko-project/executor@sha256:c3109d5926a997b100c4343944e06c6b30a6804b2f9abe0994d3de6ef92b028e
|
|
command: ["/busybox/sh", "-c"]
|
|
args: ["/busybox/sleep 99d"]
|
|
tty: true
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID"]
|
|
privileged: false
|
|
runAsUser: 0
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 1Gi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 4Gi
|
|
"""
|
|
}
|
|
}
|
|
parameters {
|
|
booleanParam(
|
|
name: 'PUBLISH_IMAGE',
|
|
defaultValue: false,
|
|
description: 'Publish the reviewed main revision to Harbor.'
|
|
)
|
|
string(
|
|
name: 'EXPECTED_SOURCE_REVISION',
|
|
defaultValue: '',
|
|
description: 'Full reviewed commit that must be contained by atlas/titan-iac main.'
|
|
)
|
|
string(
|
|
name: 'CONFIRM_PUBLISH',
|
|
defaultValue: '',
|
|
description: 'Enter PUBLISH HERMES WEBUI to confirm the release.'
|
|
)
|
|
}
|
|
environment {
|
|
HERMES_IMAGE = 'registry.bstein.dev/bstein/hermes-webui'
|
|
}
|
|
options {
|
|
disableConcurrentBuilds()
|
|
buildDiscarder(logRotator(daysToKeepStr: '30', numToKeepStr: '100', artifactDaysToKeepStr: '30', artifactNumToKeepStr: '100'))
|
|
skipDefaultCheckout(true)
|
|
timeout(time: 150, unit: 'MINUTES')
|
|
}
|
|
stages {
|
|
stage('Checkout reviewed source') {
|
|
steps {
|
|
checkout scm
|
|
}
|
|
}
|
|
stage('Enforce release boundary') {
|
|
steps {
|
|
container('jnlp') {
|
|
sh '''
|
|
set -eu
|
|
mkdir -p build
|
|
test "${PUBLISH_IMAGE}" = "true"
|
|
test "${CONFIRM_PUBLISH}" = "PUBLISH HERMES WEBUI"
|
|
case "${EXPECTED_SOURCE_REVISION}" in
|
|
*[!0-9a-f]*|'')
|
|
echo "EXPECTED_SOURCE_REVISION must be a lowercase full commit" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
test "${#EXPECTED_SOURCE_REVISION}" -eq 40
|
|
git fetch --no-tags origin main
|
|
git checkout --detach origin/main
|
|
actual_revision="$(git rev-parse HEAD)"
|
|
test "${actual_revision}" = "$(git rev-parse origin/main)"
|
|
git merge-base --is-ancestor "${EXPECTED_SOURCE_REVISION}" "${actual_revision}"
|
|
test -z "$(git status --porcelain)"
|
|
test -f dockerfiles/Dockerfile.hermes-webui
|
|
case "${BUILD_NUMBER}" in
|
|
''|0*|*[!0-9]*)
|
|
echo "BUILD_NUMBER must be a positive decimal integer" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
printf '%s\n' \
|
|
"${HERMES_IMAGE}:git-${actual_revision}-build-${BUILD_NUMBER}" \
|
|
> build/hermes-webui.destination
|
|
printf '%s\n' "${actual_revision}" > build/hermes-webui.source-revision
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
stage('Validate reviewed WebUI source') {
|
|
steps {
|
|
container('python') {
|
|
sh '''
|
|
set -eu
|
|
python3 -m pip install --disable-pip-version-check --no-cache-dir \
|
|
--target=/tmp/hermes-webui-release-test-deps \
|
|
pytest==8.3.4 PyYAML==6.0.2
|
|
PYTHONPATH=/tmp/hermes-webui-release-test-deps \
|
|
python3 -m pytest -q \
|
|
testing/tests/test_hermes_webui_brand.py \
|
|
testing/tests/test_hermes_webui_release.py \
|
|
testing/tests/test_hermes_oci_promote.py \
|
|
testing/tests/test_hermes_image_automation.py
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
stage('Reject replay before publish') {
|
|
steps {
|
|
withCredentials([usernamePassword(
|
|
credentialsId: 'harbor-robot',
|
|
usernameVariable: 'HARBOR_USER',
|
|
passwordVariable: 'HARBOR_PASSWORD'
|
|
)]) {
|
|
sh '''
|
|
set -eu
|
|
set +x
|
|
destination="$(cat build/hermes-webui.destination)"
|
|
source_revision="$(cat build/hermes-webui.source-revision)"
|
|
python3 ci/scripts/hermes_webui_release.py assert-absent \
|
|
--source-revision "${source_revision}" \
|
|
--build-number "${BUILD_NUMBER}" \
|
|
--destination "${destination}"
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
stage('Build and publish without a daemon') {
|
|
steps {
|
|
container('kaniko') {
|
|
withCredentials([usernamePassword(
|
|
credentialsId: 'harbor-robot',
|
|
usernameVariable: 'HARBOR_USER',
|
|
passwordVariable: 'HARBOR_PASSWORD'
|
|
)]) {
|
|
sh '''#!/busybox/sh
|
|
set -eu
|
|
set +x
|
|
config_path=/kaniko/.docker/config.json
|
|
destination="$(cat build/hermes-webui.destination)"
|
|
source_revision="$(cat build/hermes-webui.source-revision)"
|
|
umask 077
|
|
auth="$(printf '%s:%s' "${HARBOR_USER}" "${HARBOR_PASSWORD}" | /busybox/base64 | /busybox/tr -d '\n')"
|
|
/busybox/mkdir -p /kaniko/.docker
|
|
/busybox/printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\n' "${auth}" > "${config_path}"
|
|
unset HARBOR_USER HARBOR_PASSWORD auth
|
|
trap '/busybox/rm -f "${config_path}"' EXIT HUP INT TERM
|
|
umask 022
|
|
/kaniko/executor \
|
|
--registry-mirror=harbor-core.harbor.svc.cluster.local \
|
|
--insecure-registry=harbor-core.harbor.svc.cluster.local \
|
|
--context="dir://${WORKSPACE}" \
|
|
--dockerfile="${WORKSPACE}/dockerfiles/Dockerfile.hermes-webui" \
|
|
--destination="${destination}" \
|
|
--digest-file="${WORKSPACE}/build/hermes-webui.digest" \
|
|
--image-name-tag-with-digest-file="${WORKSPACE}/build/hermes-webui.image" \
|
|
--label="org.opencontainers.image.revision=${source_revision}" \
|
|
--label="org.opencontainers.image.source=https://scm.bstein.dev/atlas/titan-iac" \
|
|
--label="org.opencontainers.image.title=hermes-webui" \
|
|
--cleanup \
|
|
--push-retry=3
|
|
/busybox/chmod 644 build/hermes-webui.digest build/hermes-webui.image
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
}
|
|
stage('Render reviewed Flux handoff') {
|
|
steps {
|
|
withCredentials([usernamePassword(
|
|
credentialsId: 'harbor-robot',
|
|
usernameVariable: 'HARBOR_USER',
|
|
passwordVariable: 'HARBOR_PASSWORD'
|
|
)]) {
|
|
sh '''
|
|
set -eu
|
|
set +x
|
|
destination="$(cat build/hermes-webui.destination)"
|
|
source_revision="$(cat build/hermes-webui.source-revision)"
|
|
python3 ci/scripts/hermes_webui_release.py render \
|
|
--digest-file build/hermes-webui.digest \
|
|
--image-file build/hermes-webui.image \
|
|
--source-revision "${source_revision}" \
|
|
--build-number "${BUILD_NUMBER}" \
|
|
--destination "${destination}" \
|
|
--chat-manifest services/hermes/chat-statefulset.yaml \
|
|
--dashboard-manifest services/hermes/deployment.yaml \
|
|
--output-dir build/hermes-webui-release
|
|
test -s build/hermes-webui-release/hermes-webui-image-update.patch
|
|
test -s build/hermes-webui-release/hermes-webui-image.json
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
stage('Verify and archive release evidence') {
|
|
steps {
|
|
sh '''
|
|
set -eu
|
|
expected_files="$(printf '%s\n' \
|
|
build/hermes-webui.destination \
|
|
build/hermes-webui.digest \
|
|
build/hermes-webui.image \
|
|
build/hermes-webui.source-revision \
|
|
build/hermes-webui-release/hermes-chat-statefulset.yaml \
|
|
build/hermes-webui-release/hermes-dashboard-deployment.yaml \
|
|
build/hermes-webui-release/hermes-webui-image.json \
|
|
build/hermes-webui-release/hermes-webui-image-update.patch \
|
|
| LC_ALL=C sort)"
|
|
actual_files="$(find build -type f -print | LC_ALL=C sort)"
|
|
test "${actual_files}" = "${expected_files}"
|
|
destination="$(cat build/hermes-webui.destination)"
|
|
source_revision="$(cat build/hermes-webui.source-revision)"
|
|
python3 ci/scripts/hermes_webui_release.py verify-evidence \
|
|
--digest-file build/hermes-webui.digest \
|
|
--image-file build/hermes-webui.image \
|
|
--source-revision "${source_revision}" \
|
|
--build-number "${BUILD_NUMBER}" \
|
|
--destination "${destination}" \
|
|
--chat-manifest services/hermes/chat-statefulset.yaml \
|
|
--dashboard-manifest services/hermes/deployment.yaml \
|
|
--output-dir build/hermes-webui-release
|
|
'''
|
|
archiveArtifacts(
|
|
artifacts: 'build/hermes-webui.destination,build/hermes-webui.digest,build/hermes-webui.image,build/hermes-webui.source-revision,build/hermes-webui-release/hermes-chat-statefulset.yaml,build/hermes-webui-release/hermes-dashboard-deployment.yaml,build/hermes-webui-release/hermes-webui-image.json,build/hermes-webui-release/hermes-webui-image-update.patch',
|
|
allowEmptyArchive: false,
|
|
fingerprint: true
|
|
)
|
|
}
|
|
}
|
|
stage('Publish Flux release tag') {
|
|
steps {
|
|
withCredentials([usernamePassword(
|
|
credentialsId: 'harbor-robot',
|
|
usernameVariable: 'HARBOR_USER',
|
|
passwordVariable: 'HARBOR_PASSWORD'
|
|
)]) {
|
|
sh '''
|
|
set -eu
|
|
set +x
|
|
destination="$(cat build/hermes-webui.destination)"
|
|
source_revision="$(cat build/hermes-webui.source-revision)"
|
|
python3 ci/scripts/hermes_oci_promote.py \
|
|
--destination "${destination}" \
|
|
--digest-file build/hermes-webui.digest \
|
|
--source-revision "${source_revision}" \
|
|
--build-number "${BUILD_NUMBER}"
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|