Kaniko + ECR + Secrets

参考

https://github.com/argoproj/argo-workflows/blob/master/examples/influxdb-ci.yaml

https://github.com/argoproj/argo-workflows/blob/master/examples/input-artifact-git.yaml

apiVersion: argoproj.io/v1alpha1
kind: Sensor
metadata:
  name: lizhegithub
  namespace: argo
spec:
  template:
    serviceAccountName: operate-workflow-sa
  dependencies:
    - name: fe-dep
      eventSourceName: lizhegithub
      eventName: lizhegitwebhook
  triggers:
    - template:
        name: lizhe-workflow-trigger
        argoWorkflow:
          group: argoproj.io
          version: v1alpha1
          resource: workflows
          operation: submit
          source:
            resource:
              apiVersion: argoproj.io/v1alpha1
              kind: WorkflowTemplate
              metadata:
                generateName: lizhebuildkit-
                namespace: argo
              spec:
                templates:
                  - name: main
                    dag:
                      tasks:
                        - name: clean
                          template: clean
                          arguments: {}
                        - name: clone
                          template: clone
                          arguments:
                            parameters:
                              - name: repo
                                value: '{{workflow.parameters.repo}}'
                              - name: branch
                                value: '{{workflow.parameters.branch}}'
                          depends: clean
                        - name: getcommitid
                          template: getcommitid
                          arguments: {}
                          depends: clone
                        - name: mountcommitid
                          template: mountcommitid
                          arguments: {}
                          depends: getcommitid
                        - name: build
                          template: build
                          arguments: {}
                          depends: mountcommitid
                        - name: image
                          template: image
                          arguments:
                            parameters:
                              - name: image
                                value: '{{workflow.parameters.image}}'
                              - name: commitid
                                value: '{{tasks.mountcommitid.outputs.parameters.commitid}}'
                          depends: build
                        - name: deploy
                          template: deploy
                          arguments: {}
                          depends: image
                  - name: clean
                    container:
                      name: ''
                      image: k8s.gcr.io/busybox
                      command:
                        - /bin/sh
                      args:
                        - '-c'
                        - 'rm -rf /work/*'
                      workingDir: /work
                      volumeMounts:
                        - name: work
                          mountPath: /work
                  - name: clone
                    inputs:
                      artifacts:
                      - name: argo-source
                        path: /src
                        git:
                          repo: '{{workflow.parameters.repo}}'
                          revision: '{{workflow.parameters.branch}}'
                          usernameSecret:
                            name: github-creds
                            key: username
                          passwordSecret:
                            name: github-creds
                            key: password
                    container:
                      image: k8s.gcr.io/busybox
                      command:
                        - /bin/sh
                      args:
                        - '-c'
                        - cp -rf /src/. /work/ && ls /work
                      workingDir: /src
                      volumeMounts:
                        - name: work
                          mountPath: /work
                  - name: getcommitid
                    inputs: {}
                    outputs: {}
                    metadata: {}
                    container:
                      name: ''
                      image: xxxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/getcommitid
                      command:
                        - /bin/bash
                      args:
                        - '-c'
                        - /getcommitid.sh
                      workingDir: /work
                      volumeMounts:
                        - name: work
                          mountPath: /work
                  - name: mountcommitid
                    outputs:
                      parameters:
                        - name: commitid
                          valueFrom:
                            path: /work/commitid.txt
                            default: mockup_commitid
                    metadata: {}
                    container:
                      name: ''
                      image: k8s.gcr.io/busybox
                      command:
                        - /bin/sh
                      args:
                        - '-c'
                        - ls /work
                      workingDir: /work
                      resources: {}
                      volumeMounts:
                        - name: work
                          mountPath: /work
                  - name: build
                    container:
                      name: ''
                      image: 'xxxxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/node-alpine'
                      command:
                        - sh
                      args:
                        - -c
                        - 'yarn install && yarn build'
                      workingDir: /work
                      env:
                        - name: ENVTEST
                          value: helloworld
                      volumeMounts:
                        - name: work
                          mountPath: /work
                  - name: image
                    inputs:
                      parameters:
                        - name: image
                        - name: commitid
                    container:
                      name: ''
                      image: gcr.io/kaniko-project/executor@sha256:f652f28537fa76e8f4f9393de13a064f0206003c451ce2ad6e4359fd5a21acbc
                      args:
                        - '-f'
                        - /work/Dockerfile
                        - '-c'
                        - /work
                        - --destination={{inputs.parameters.image}}:{{inputs.parameters.commitid}}
                      workingDir: /work
                      env:
                        - name: envkey
                          value: envvalue
                      resources: {}
                      volumeMounts:
                      - name: docker-config
                        mountPath: /kaniko/.docker/
                      - name: aws-secret
                        mountPath: /root/.aws/
                      - name: work
                        mountPath: /work
                    volumes:
                    - name: docker-config
                      configMap:
                        name: docker-config
                    - name: aws-secret
                      secret:
                        secretName: aws-secret
                  - name: deploy
                    container:
                      name: ''
                      image: 'xxxxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/sedcommitid:latest'
                      command:
                        - /main.sh
                      args:
                        - path/deploy.yaml
                      workingDir: /
                      env:
                        - name: GIT_URL
                          valueFrom:
                            secretKeyRef:
                              key: lizhe
                              name: giturl
                        - name: REPO
                          value: bank-devops
                        - name: BRANCH
                          value: main
                        - name: USER_NAME
                          value: lizhe
                        - name: USER_EMAIL
                          value: YOUR@EMAIL.com
                      volumeMounts:
                        - name: work
                          mountPath: /work
                entrypoint: main
                imagePullSecrets:
                - name: regcred
                arguments:
                  parameters:
                    - name: repo
                      value: https://github.com/xxxx/xxxxxx.git
                    - name: branch
                      value: develop
                    - name: image
                      value: xxxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/target
                volumeClaimTemplates:
                  - metadata:
                      name: work
                      creationTimestamp: null
                    spec:
                      accessModes:
                        - ReadWriteOnce
                      resources:
                        requests:
                          storage: 2Gi
                      storageClassName: gp2
                    status: {}
                ttlStrategy:
                  secondsAfterCompletion: 1800
                  secondsAfterSuccess: 1800
                  secondsAfterFailure: 1800
Send a Message