pikasTech-apistate-development/.tekton/sub2rank-nc01-pac.yaml

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: "sub2rank-nc01-{{ revision }}"
  namespace: devops-infra
  annotations:
    pipelinesascode.tekton.dev/on-event: "[push]"
    pipelinesascode.tekton.dev/on-target-branch: "[master]"
    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'master' && node == 'NC01'"
    pipelinesascode.tekton.dev/max-keep-runs: "8"
    unidesk.ai/pac-admission-provenance: admission-pac-v2:platform-infra-sub2rank-nc01
    unidesk.ai/owning-config-ref: "config/platform-infra/sub2rank.yaml#delivery"
    unidesk.ai/effective-config-sha256: sha256:e4d95e74410816956a8f848eb379bf73d26bab130db498fd69a442c0a1725e5d
    unidesk.ai/source-artifact-renderer: sub2rank-platform-service
    unidesk.ai/source-artifact-mode: embedded-pipeline-spec
  labels:
    app.kubernetes.io/name: sub2rank
    app.kubernetes.io/part-of: platform-infra
    unidesk.ai/node: NC01
    unidesk.ai/source-commit: "{{ revision }}"
    unidesk.ai/trigger: pipelines-as-code
spec:
  timeouts:
    pipeline: 600s
  pipelineSpec:
    params:
      - name: git-read-url
        type: string
        default: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-sub2rank.git
      - name: source-branch
        type: string
        default: master
      - name: revision
        type: string
      - name: source-stage-ref
        type: string
      - name: config-path
        type: string
        default: config/sub2rank.yaml
      - name: dockerfile
        type: string
        default: Dockerfile
      - name: image-repository
        type: string
        default: 127.0.0.1:5000/sub2rank/sub2rank
      - name: tools-image
        type: string
        default: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
      - name: buildkit-image
        type: string
        default: 127.0.0.1:5000/hwlab/buildkit:rootless
      - name: build-network
        type: string
        default: host
      - name: build-http-proxy
        type: string
        default: http://127.0.0.1:10808
      - name: build-https-proxy
        type: string
        default: http://127.0.0.1:10808
      - name: build-all-proxy
        type: string
        default: http://127.0.0.1:10808
      - name: build-no-proxy
        type: string
        default: "localhost,127.0.0.1,::1,127.0.0.1:5000,localhost:5000,.svc,.svc.cluster.local,.cluster.local,hyueapi.com,.hyueapi.com"
      - name: gitops-read-url
        type: string
        default: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      - name: gitops-write-url
        type: string
        default: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      - name: gitops-branch
        type: string
        default: unidesk-host-gitops
      - name: gitops-manifest-path
        type: string
        default: deploy/gitops/platform-infra/sub2rank-nc01/resources.yaml
      - name: gitops-release-state-path
        type: string
        default: deploy/gitops-state/platform-infra/sub2rank-nc01.json
      - name: gitops-max-push-attempts
        type: string
        default: "3"
      - name: gitops-author-name
        type: string
        default: UniDesk Sub2Rank CI
      - name: gitops-author-email
        type: string
        default: sub2rank-ci@unidesk.local
      - name: manifest-template-b64
        type: string
        default: YXBpVmVyc2lvbjogdjEKa2luZDogQ29uZmlnTWFwCm1ldGFkYXRhOgogIG5hbWU6IHN1YjJyYW5rLWNvbmZpZwogIG5hbWVzcGFjZTogcGxhdGZvcm0taW5mcmEKICBsYWJlbHM6CiAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuawogICAgYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogcGxhdGZvcm0taW5mcmEKICAgIGFwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnk6IHVuaWRlc2sKYmluYXJ5RGF0YToKICBzdWIycmFuay55YW1sOiAiX19TVUIyUkFOS19DT05GSUdfQkFTRTY0X18iCi0tLQphcGlWZXJzaW9uOiB2MQpraW5kOiBQZXJzaXN0ZW50Vm9sdW1lQ2xhaW0KbWV0YWRhdGE6CiAgbmFtZTogc3ViMnJhbmstZGF0YQogIG5hbWVzcGFjZTogcGxhdGZvcm0taW5mcmEKICBsYWJlbHM6CiAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuawogICAgYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogcGxhdGZvcm0taW5mcmEKICAgIGFwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnk6IHVuaWRlc2sKc3BlYzoKICBhY2Nlc3NNb2RlczoKICAgIC0gUmVhZFdyaXRlT25jZQogIHJlc291cmNlczoKICAgIHJlcXVlc3RzOgogICAgICBzdG9yYWdlOiAxR2kKLS0tCmFwaVZlcnNpb246IHYxCmtpbmQ6IFNlcnZpY2UKbWV0YWRhdGE6CiAgbmFtZTogc3ViMnJhbmsKICBuYW1lc3BhY2U6IHBsYXRmb3JtLWluZnJhCiAgbGFiZWxzOgogICAgYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogc3ViMnJhbmsKICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICBhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5OiB1bmlkZXNrCnNwZWM6CiAgdHlwZTogQ2x1c3RlcklQCiAgc2VsZWN0b3I6CiAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuawogIHBvcnRzOgogICAgLSBuYW1lOiBodHRwCiAgICAgIHBvcnQ6IDgwODAKICAgICAgdGFyZ2V0UG9ydDogaHR0cAotLS0KYXBpVmVyc2lvbjogYXBwcy92MQpraW5kOiBEZXBsb3ltZW50Cm1ldGFkYXRhOgogIG5hbWU6IHN1YjJyYW5rCiAgbmFtZXNwYWNlOiBwbGF0Zm9ybS1pbmZyYQogIGxhYmVsczoKICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rCiAgICBhcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBwbGF0Zm9ybS1pbmZyYQogICAgYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieTogdW5pZGVzawpzcGVjOgogIHJlcGxpY2FzOiAxCiAgc3RyYXRlZ3k6CiAgICB0eXBlOiBSZWNyZWF0ZQogIHNlbGVjdG9yOgogICAgbWF0Y2hMYWJlbHM6CiAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rCiAgdGVtcGxhdGU6CiAgICBtZXRhZGF0YToKICAgICAgbGFiZWxzOgogICAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rCiAgICAgICAgYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogcGxhdGZvcm0taW5mcmEKICAgICAgYW5ub3RhdGlvbnM6CiAgICAgICAgdW5pZGVzay5haS9zdWIycmFuay1jb25maWctc2hhMjU2OiAiX19TVUIyUkFOS19DT05GSUdfU0hBMjU2X18iCiAgICAgICAgdW5pZGVzay5haS9zdWIycmFuay1kZXBsb3ltZW50LWhhc2g6ICJmNmZhMWMwMjZjMjEwMzc2IgogICAgICAgIHVuaWRlc2suYWkvc291cmNlLWNvbW1pdDogIl9fU1VCMlJBTktfU09VUkNFX0NPTU1JVF9fIgogICAgICAgIHVuaWRlc2suYWkvcHVibGljLWJhc2UtdXJsOiAiaHR0cHM6Ly9yYW5rLnBpa2FweXRob24uY29tIgogICAgc3BlYzoKICAgICAgc2VjdXJpdHlDb250ZXh0OgogICAgICAgIGZzR3JvdXA6IDEwMDAKICAgICAgY29udGFpbmVyczoKICAgICAgICAtIG5hbWU6IHN1YjJyYW5rCiAgICAgICAgICBpbWFnZTogIl9fU1VCMlJBTktfSU1BR0VfUkVGX18iCiAgICAgICAgICBpbWFnZVB1bGxQb2xpY3k6IElmTm90UHJlc2VudAogICAgICAgICAgY29tbWFuZDoKICAgICAgICAgICAgLSAiYnVuIgogICAgICAgICAgICAtICJzcmMvc2VydmVyLnRzIgogICAgICAgICAgICAtICItLWNvbmZpZyIKICAgICAgICAgICAgLSAiL2V0Yy9zdWIycmFuay9zdWIycmFuay55YW1sIgogICAgICAgICAgICAtICItLXJ1bnRpbWUiCiAgICAgICAgICAgIC0gIms4cyIKICAgICAgICAgIHBvcnRzOgogICAgICAgICAgICAtIG5hbWU6IGh0dHAKICAgICAgICAgICAgICBjb250YWluZXJQb3J0OiA4MDgwCiAgICAgICAgICBlbnY6CiAgICAgICAgICAgIC0gbmFtZTogU1VCMlJBTktfQURNSU5fVE9LRU4KICAgICAgICAgICAgICB2YWx1ZUZyb206CiAgICAgICAgICAgICAgICBzZWNyZXRLZXlSZWY6CiAgICAgICAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLXNlY3JldHMKICAgICAgICAgICAgICAgICAga2V5OiBTVUIyUkFOS19BRE1JTl9UT0tFTgogICAgICAgICAgICAtIG5hbWU6IFNVQjJBUElfQURNSU5fRU1BSUwKICAgICAgICAgICAgICB2YWx1ZUZyb206CiAgICAgICAgICAgICAgICBzZWNyZXRLZXlSZWY6CiAgICAgICAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLXNlY3JldHMKICAgICAgICAgICAgICAgICAga2V5OiBTVUIyQVBJX0FETUlOX0VNQUlMCiAgICAgICAgICAgIC0gbmFtZTogU1VCMkFQSV9BRE1JTl9QQVNTV09SRAogICAgICAgICAgICAgIHZhbHVlRnJvbToKICAgICAgICAgICAgICAgIHNlY3JldEtleVJlZjoKICAgICAgICAgICAgICAgICAgbmFtZTogc3ViMnJhbmstc2VjcmV0cwogICAgICAgICAgICAgICAgICBrZXk6IFNVQjJBUElfQURNSU5fUEFTU1dPUkQKICAgICAgICAgIHJlYWRpbmVzc1Byb2JlOgogICAgICAgICAgICBodHRwR2V0OgogICAgICAgICAgICAgIHBhdGg6IC9oZWFsdGgKICAgICAgICAgICAgICBwb3J0OiBodHRwCiAgICAgICAgICAgIGluaXRpYWxEZWxheVNlY29uZHM6IDMKICAgICAgICAgICAgcGVyaW9kU2Vjb25kczogMTAKICAgICAgICAgICAgdGltZW91dFNlY29uZHM6IDMKICAgICAgICAgICAgZmFpbHVyZVRocmVzaG9sZDogNgogICAgICAgICAgbGl2ZW5lc3NQcm9iZToKICAgICAgICAgICAgaHR0cEdldDoKICAgICAgICAgICAgICBwYXRoOiAvaGVhbHRoCiAgICAgICAgICAgICAgcG9ydDogaHR0cAogICAgICAgICAgICBpbml0aWFsRGVsYXlTZWNvbmRzOiAzCiAgICAgICAgICAgIHBlcmlvZFNlY29uZHM6IDEwCiAgICAgICAgICAgIHRpbWVvdXRTZWNvbmRzOiAzCiAgICAgICAgICAgIGZhaWx1cmVUaHJlc2hvbGQ6IDYKICAgICAgICAgIHZvbHVtZU1vdW50czoKICAgICAgICAgICAgLSBuYW1lOiBhcHAtY29uZmlnCiAgICAgICAgICAgICAgbW91bnRQYXRoOiAvZXRjL3N1YjJyYW5rL3N1YjJyYW5rLnlhbWwKICAgICAgICAgICAgICBzdWJQYXRoOiBzdWIycmFuay55YW1sCiAgICAgICAgICAgICAgcmVhZE9ubHk6IHRydWUKICAgICAgICAgICAgLSBuYW1lOiBkYXRhCiAgICAgICAgICAgICAgbW91bnRQYXRoOiAvdmFyL2xpYi9zdWIycmFuawogICAgICB2b2x1bWVzOgogICAgICAgIC0gbmFtZTogYXBwLWNvbmZpZwogICAgICAgICAgY29uZmlnTWFwOgogICAgICAgICAgICBuYW1lOiBzdWIycmFuay1jb25maWcKICAgICAgICAtIG5hbWU6IGRhdGEKICAgICAgICAgIHBlcnNpc3RlbnRWb2x1bWVDbGFpbToKICAgICAgICAgICAgY2xhaW1OYW1lOiBzdWIycmFuay1kYXRhCi0tLQphcGlWZXJzaW9uOiB2MQpraW5kOiBDb25maWdNYXAKbWV0YWRhdGE6CiAgbmFtZTogc3ViMnJhbmstZnJwYy1jb25maWcKICBuYW1lc3BhY2U6IHBsYXRmb3JtLWluZnJhCiAgbGFiZWxzOgogICAgYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogc3ViMnJhbmstZnJwYwogICAgYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50OiB0dW5uZWwKICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICBhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5OiB1bmlkZXNrCmRhdGE6CiAgZnJwYy50b21sOiB8CiAgICBzZXJ2ZXJBZGRyID0gIjgyLjE1Ni4yMy4yMjAiCiAgICBzZXJ2ZXJQb3J0ID0gMjIwMDAKICAgIGxvZ2luRmFpbEV4aXQgPSB0cnVlCiAgICBhdXRoLnRva2VuID0gInt7IC5FbnZzLkZSUF9UT0tFTiB9fSIKICAgIAogICAgW1twcm94aWVzXV0KICAgIG5hbWUgPSAicGxhdGZvcm0taW5mcmEtc3ViMnJhbmstbmMwMS13ZWIiCiAgICB0eXBlID0gInRjcCIKICAgIGxvY2FsSVAgPSAic3ViMnJhbmsucGxhdGZvcm0taW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWwiCiAgICBsb2NhbFBvcnQgPSA4MDgwCiAgICByZW1vdGVQb3J0ID0gMjIwOTUKICAgIAotLS0KYXBpVmVyc2lvbjogYXBwcy92MQpraW5kOiBEZXBsb3ltZW50Cm1ldGFkYXRhOgogIG5hbWU6IHN1YjJyYW5rLWZycGMKICBuYW1lc3BhY2U6IHBsYXRmb3JtLWluZnJhCiAgbGFiZWxzOgogICAgYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogc3ViMnJhbmstZnJwYwogICAgYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50OiB0dW5uZWwKICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICBhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5OiB1bmlkZXNrCiAgICB1bmlkZXNrLmFpL3J1bnRpbWUtbm9kZTogTkMwMQogICAgdW5pZGVzay5haS9wdWJsaWMtaG9zdG5hbWU6IHJhbmsucGlrYXB5dGhvbi5jb20Kc3BlYzoKICByZXBsaWNhczogMQogIHN0cmF0ZWd5OgogICAgdHlwZTogUmVjcmVhdGUKICBzZWxlY3RvcjoKICAgIG1hdGNoTGFiZWxzOgogICAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuay1mcnBjCiAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudDogdHVubmVsCiAgdGVtcGxhdGU6CiAgICBtZXRhZGF0YToKICAgICAgbGFiZWxzOgogICAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rLWZycGMKICAgICAgICBhcHAua3ViZXJuZXRlcy5pby9jb21wb25lbnQ6IHR1bm5lbAogICAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICAgIGFubm90YXRpb25zOgogICAgICAgIHVuaWRlc2suYWkvcHVibGljLWJhc2UtdXJsOiAiaHR0cHM6Ly9yYW5rLnBpa2FweXRob24uY29tIgogICAgICAgIHVuaWRlc2suYWkvZnJwLXNlcnZlcjogIjgyLjE1Ni4yMy4yMjA6MjIwMDAiCiAgICAgICAgdW5pZGVzay5haS9mcnAtcmVtb3RlLXBvcnQ6ICIyMjA5NSIKICAgICAgICB1bmlkZXNrLmFpL2ZycGMtY29uZmlnLXNoYTI1NjogIjFkOGY1OGE2ZjU4MjQ3ZGEzMzJkNDBkZWE1YzFkN2I3YzY4NDU1YTU5OTVhYTNiMWQ5NjE1NzA2ZWMxYzk0ZTYiCiAgICBzcGVjOgogICAgICBjb250YWluZXJzOgogICAgICAgIC0gbmFtZTogZnJwYwogICAgICAgICAgaW1hZ2U6IDEyNy4wLjAuMTo1MDAwL2h3bGFiL2ZycGM6djAuNjguMQogICAgICAgICAgaW1hZ2VQdWxsUG9saWN5OiBJZk5vdFByZXNlbnQKICAgICAgICAgIGFyZ3M6CiAgICAgICAgICAgIC0gLWMKICAgICAgICAgICAgLSAvZXRjL2ZycC9mcnBjLnRvbWwKICAgICAgICAgIGVudjoKICAgICAgICAgICAgLSBuYW1lOiBGUlBfVE9LRU4KICAgICAgICAgICAgICB2YWx1ZUZyb206CiAgICAgICAgICAgICAgICBzZWNyZXRLZXlSZWY6CiAgICAgICAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLXNlY3JldHMKICAgICAgICAgICAgICAgICAga2V5OiBGUlBfVE9LRU4KICAgICAgICAgIHZvbHVtZU1vdW50czoKICAgICAgICAgICAgLSBuYW1lOiBmcnBjLWNvbmZpZwogICAgICAgICAgICAgIG1vdW50UGF0aDogL2V0Yy9mcnAvZnJwYy50b21sCiAgICAgICAgICAgICAgc3ViUGF0aDogZnJwYy50b21sCiAgICAgICAgICAgICAgcmVhZE9ubHk6IHRydWUKICAgICAgdm9sdW1lczoKICAgICAgICAtIG5hbWU6IGZycGMtY29uZmlnCiAgICAgICAgICBjb25maWdNYXA6CiAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLWZycGMtY29uZmlnCg==
    workspaces:
      - name: source
    tasks:
      - name: source-validate
        workspaces:
          - name: source
            workspace: source
        taskSpec:
          params:
            - name: git-read-url
            - name: source-branch
            - name: revision
            - name: source-stage-ref
            - name: config-path
            - name: dockerfile
            - name: image-repository
            - name: tools-image
            - name: buildkit-image
            - name: build-network
            - name: build-http-proxy
            - name: build-https-proxy
            - name: build-all-proxy
            - name: build-no-proxy
            - name: gitops-read-url
            - name: gitops-write-url
            - name: gitops-branch
            - name: gitops-manifest-path
            - name: gitops-release-state-path
            - name: gitops-max-push-attempts
            - name: gitops-author-name
            - name: gitops-author-email
            - name: manifest-template-b64
          workspaces:
            - name: source
          steps:
            - name: checkout-and-cli-validate
              image: $(params.tools-image)
              imagePullPolicy: IfNotPresent
              env:
                - name: HTTP_PROXY
                  value: $(params.build-http-proxy)
                - name: http_proxy
                  value: $(params.build-http-proxy)
                - name: HTTPS_PROXY
                  value: $(params.build-https-proxy)
                - name: https_proxy
                  value: $(params.build-https-proxy)
                - name: ALL_PROXY
                  value: $(params.build-all-proxy)
                - name: all_proxy
                  value: $(params.build-all-proxy)
                - name: NO_PROXY
                  value: $(params.build-no-proxy)
                - name: no_proxy
                  value: $(params.build-no-proxy)
              script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nrm -rf \"$root/repo\"\ngit clone --filter=blob:none --no-checkout \"$(params.git-read-url)\" \"$root/repo\"\ncd \"$root/repo\"\ngit fetch --depth=1 --filter=blob:none origin \"+$(params.source-stage-ref):refs/remotes/origin/sub2rank-source-snapshot\"\ngit checkout --detach \"$(params.revision)\"\ntest \"$(git rev-parse HEAD)\" = \"$(params.revision)\"\nbun install --frozen-lockfile\nbun scripts/sub2rank-cli.ts --config \"$(params.config-path)\" config validate\nchmod -R a+rX,g+rwX \"$root/repo\"\nprintf '{\"ok\":true,\"phase\":\"source-validate\",\"sourceCommit\":\"%s\",\"configPath\":\"%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$(params.config-path)\""
        params:
          - name: git-read-url
            value: $(params.git-read-url)
          - name: source-branch
            value: $(params.source-branch)
          - name: revision
            value: $(params.revision)
          - name: source-stage-ref
            value: $(params.source-stage-ref)
          - name: config-path
            value: $(params.config-path)
          - name: dockerfile
            value: $(params.dockerfile)
          - name: image-repository
            value: $(params.image-repository)
          - name: tools-image
            value: $(params.tools-image)
          - name: buildkit-image
            value: $(params.buildkit-image)
          - name: build-network
            value: $(params.build-network)
          - name: build-http-proxy
            value: $(params.build-http-proxy)
          - name: build-https-proxy
            value: $(params.build-https-proxy)
          - name: build-all-proxy
            value: $(params.build-all-proxy)
          - name: build-no-proxy
            value: $(params.build-no-proxy)
          - name: gitops-read-url
            value: $(params.gitops-read-url)
          - name: gitops-write-url
            value: $(params.gitops-write-url)
          - name: gitops-branch
            value: $(params.gitops-branch)
          - name: gitops-manifest-path
            value: $(params.gitops-manifest-path)
          - name: gitops-release-state-path
            value: $(params.gitops-release-state-path)
          - name: gitops-max-push-attempts
            value: $(params.gitops-max-push-attempts)
          - name: gitops-author-name
            value: $(params.gitops-author-name)
          - name: gitops-author-email
            value: $(params.gitops-author-email)
          - name: manifest-template-b64
            value: $(params.manifest-template-b64)
      - name: image-build
        runAfter:
          - source-validate
        workspaces:
          - name: source
            workspace: source
        taskSpec:
          params:
            - name: git-read-url
            - name: source-branch
            - name: revision
            - name: source-stage-ref
            - name: config-path
            - name: dockerfile
            - name: image-repository
            - name: tools-image
            - name: buildkit-image
            - name: build-network
            - name: build-http-proxy
            - name: build-https-proxy
            - name: build-all-proxy
            - name: build-no-proxy
            - name: gitops-read-url
            - name: gitops-write-url
            - name: gitops-branch
            - name: gitops-manifest-path
            - name: gitops-release-state-path
            - name: gitops-max-push-attempts
            - name: gitops-author-name
            - name: gitops-author-email
            - name: manifest-template-b64
          workspaces:
            - name: source
          steps:
            - name: build-and-push
              image: $(params.buildkit-image)
              imagePullPolicy: IfNotPresent
              env:
                - name: HTTP_PROXY
                  value: $(params.build-http-proxy)
                - name: http_proxy
                  value: $(params.build-http-proxy)
                - name: HTTPS_PROXY
                  value: $(params.build-https-proxy)
                - name: https_proxy
                  value: $(params.build-https-proxy)
                - name: ALL_PROXY
                  value: $(params.build-all-proxy)
                - name: all_proxy
                  value: $(params.build-all-proxy)
                - name: NO_PROXY
                  value: $(params.build-no-proxy)
                - name: no_proxy
                  value: $(params.build-no-proxy)
                - name: BUILDKITD_FLAGS
                  value: "--oci-worker-no-process-sandbox --oci-worker-net=host --allow-insecure-entitlement network.host"
                - name: SOURCE_ROOT
                  value: $(workspaces.source.path)/repo
                - name: SOURCE_COMMIT
                  value: $(params.revision)
                - name: IMAGE_REPOSITORY
                  value: $(params.image-repository)
                - name: DOCKERFILE
                  value: $(params.dockerfile)
                - name: BUILD_NETWORK
                  value: $(params.build-network)
                - name: BUILD_METADATA_FILE
                  value: $(workspaces.source.path)/build-metadata.json
                - name: BUILD_RESULT_FILE
                  value: $(workspaces.source.path)/build-result.json
              securityContext:
                privileged: true
                runAsUser: 1000
                runAsGroup: 1000
              script: "#!/bin/sh\nset -eu\nexec \"$(workspaces.source.path)/repo/scripts/ci/build-image.sh\""
        params:
          - name: git-read-url
            value: $(params.git-read-url)
          - name: source-branch
            value: $(params.source-branch)
          - name: revision
            value: $(params.revision)
          - name: source-stage-ref
            value: $(params.source-stage-ref)
          - name: config-path
            value: $(params.config-path)
          - name: dockerfile
            value: $(params.dockerfile)
          - name: image-repository
            value: $(params.image-repository)
          - name: tools-image
            value: $(params.tools-image)
          - name: buildkit-image
            value: $(params.buildkit-image)
          - name: build-network
            value: $(params.build-network)
          - name: build-http-proxy
            value: $(params.build-http-proxy)
          - name: build-https-proxy
            value: $(params.build-https-proxy)
          - name: build-all-proxy
            value: $(params.build-all-proxy)
          - name: build-no-proxy
            value: $(params.build-no-proxy)
          - name: gitops-read-url
            value: $(params.gitops-read-url)
          - name: gitops-write-url
            value: $(params.gitops-write-url)
          - name: gitops-branch
            value: $(params.gitops-branch)
          - name: gitops-manifest-path
            value: $(params.gitops-manifest-path)
          - name: gitops-release-state-path
            value: $(params.gitops-release-state-path)
          - name: gitops-max-push-attempts
            value: $(params.gitops-max-push-attempts)
          - name: gitops-author-name
            value: $(params.gitops-author-name)
          - name: gitops-author-email
            value: $(params.gitops-author-email)
          - name: manifest-template-b64
            value: $(params.manifest-template-b64)
      - name: gitops-publish
        runAfter:
          - image-build
        workspaces:
          - name: source
            workspace: source
        taskSpec:
          params:
            - name: git-read-url
            - name: source-branch
            - name: revision
            - name: source-stage-ref
            - name: config-path
            - name: dockerfile
            - name: image-repository
            - name: tools-image
            - name: buildkit-image
            - name: build-network
            - name: build-http-proxy
            - name: build-https-proxy
            - name: build-all-proxy
            - name: build-no-proxy
            - name: gitops-read-url
            - name: gitops-write-url
            - name: gitops-branch
            - name: gitops-manifest-path
            - name: gitops-release-state-path
            - name: gitops-max-push-attempts
            - name: gitops-author-name
            - name: gitops-author-email
            - name: manifest-template-b64
          workspaces:
            - name: source
          steps:
            - name: publish-digest-manifest
              image: $(params.tools-image)
              imagePullPolicy: IfNotPresent
              env:
                - name: HTTP_PROXY
                  value: $(params.build-http-proxy)
                - name: http_proxy
                  value: $(params.build-http-proxy)
                - name: HTTPS_PROXY
                  value: $(params.build-https-proxy)
                - name: https_proxy
                  value: $(params.build-https-proxy)
                - name: ALL_PROXY
                  value: $(params.build-all-proxy)
                - name: all_proxy
                  value: $(params.build-all-proxy)
                - name: NO_PROXY
                  value: $(params.build-no-proxy)
                - name: no_proxy
                  value: $(params.build-no-proxy)
              script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nexec bun \"$root/repo/scripts/ci/publish-gitops.mjs\" \\\n  --source-root \"$root/repo\" \\\n  --source-commit \"$(params.revision)\" \\\n  --config-path \"$(params.config-path)\" \\\n  --metadata \"$root/build-metadata.json\" \\\n  --manifest-template-b64 \"$(params.manifest-template-b64)\" \\\n  --image-repository \"$(params.image-repository)\" \\\n  --gitops-read-url \"$(params.gitops-read-url)\" \\\n  --gitops-write-url \"$(params.gitops-write-url)\" \\\n  --gitops-branch \"$(params.gitops-branch)\" \\\n  --manifest-path \"$(params.gitops-manifest-path)\" \\\n  --release-state-path \"$(params.gitops-release-state-path)\" \\\n  --max-push-attempts \"$(params.gitops-max-push-attempts)\" \\\n  --author-name \"$(params.gitops-author-name)\" \\\n  --author-email \"$(params.gitops-author-email)\" \\\n  --worktree \"$root/gitops\""
        params:
          - name: git-read-url
            value: $(params.git-read-url)
          - name: source-branch
            value: $(params.source-branch)
          - name: revision
            value: $(params.revision)
          - name: source-stage-ref
            value: $(params.source-stage-ref)
          - name: config-path
            value: $(params.config-path)
          - name: dockerfile
            value: $(params.dockerfile)
          - name: image-repository
            value: $(params.image-repository)
          - name: tools-image
            value: $(params.tools-image)
          - name: buildkit-image
            value: $(params.buildkit-image)
          - name: build-network
            value: $(params.build-network)
          - name: build-http-proxy
            value: $(params.build-http-proxy)
          - name: build-https-proxy
            value: $(params.build-https-proxy)
          - name: build-all-proxy
            value: $(params.build-all-proxy)
          - name: build-no-proxy
            value: $(params.build-no-proxy)
          - name: gitops-read-url
            value: $(params.gitops-read-url)
          - name: gitops-write-url
            value: $(params.gitops-write-url)
          - name: gitops-branch
            value: $(params.gitops-branch)
          - name: gitops-manifest-path
            value: $(params.gitops-manifest-path)
          - name: gitops-release-state-path
            value: $(params.gitops-release-state-path)
          - name: gitops-max-push-attempts
            value: $(params.gitops-max-push-attempts)
          - name: gitops-author-name
            value: $(params.gitops-author-name)
          - name: gitops-author-email
            value: $(params.gitops-author-email)
          - name: manifest-template-b64
            value: $(params.manifest-template-b64)
  taskRunTemplate:
    serviceAccountName: sub2rank-nc01-tekton-runner
    podTemplate:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      securityContext:
        fsGroup: 1000
  params:
    - name: git-read-url
      value: "{{ git_read_url }}"
    - name: source-branch
      value: "{{ source_branch }}"
    - name: revision
      value: "{{ revision }}"
    - name: source-stage-ref
      value: "{{ source_snapshot_prefix }}/{{ revision }}"
    - name: config-path
      value: config/sub2rank.yaml
    - name: dockerfile
      value: Dockerfile
    - name: image-repository
      value: "{{ image_repository }}"
    - name: tools-image
      value: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
    - name: buildkit-image
      value: 127.0.0.1:5000/hwlab/buildkit:rootless
    - name: build-network
      value: host
    - name: build-http-proxy
      value: http://127.0.0.1:10808
    - name: build-https-proxy
      value: http://127.0.0.1:10808
    - name: build-all-proxy
      value: http://127.0.0.1:10808
    - name: build-no-proxy
      value: "localhost,127.0.0.1,::1,127.0.0.1:5000,localhost:5000,.svc,.svc.cluster.local,.cluster.local,hyueapi.com,.hyueapi.com"
    - name: gitops-read-url
      value: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
    - name: gitops-write-url
      value: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
    - name: gitops-branch
      value: "{{ gitops_branch }}"
    - name: gitops-manifest-path
      value: "{{ gitops_manifest_path }}"
    - name: gitops-release-state-path
      value: deploy/gitops-state/platform-infra/sub2rank-nc01.json
    - name: gitops-max-push-attempts
      value: "3"
    - name: gitops-author-name
      value: UniDesk Sub2Rank CI
    - name: gitops-author-email
      value: sub2rank-ci@unidesk.local
    - name: manifest-template-b64
      value: YXBpVmVyc2lvbjogdjEKa2luZDogQ29uZmlnTWFwCm1ldGFkYXRhOgogIG5hbWU6IHN1YjJyYW5rLWNvbmZpZwogIG5hbWVzcGFjZTogcGxhdGZvcm0taW5mcmEKICBsYWJlbHM6CiAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuawogICAgYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogcGxhdGZvcm0taW5mcmEKICAgIGFwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnk6IHVuaWRlc2sKYmluYXJ5RGF0YToKICBzdWIycmFuay55YW1sOiAiX19TVUIyUkFOS19DT05GSUdfQkFTRTY0X18iCi0tLQphcGlWZXJzaW9uOiB2MQpraW5kOiBQZXJzaXN0ZW50Vm9sdW1lQ2xhaW0KbWV0YWRhdGE6CiAgbmFtZTogc3ViMnJhbmstZGF0YQogIG5hbWVzcGFjZTogcGxhdGZvcm0taW5mcmEKICBsYWJlbHM6CiAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuawogICAgYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogcGxhdGZvcm0taW5mcmEKICAgIGFwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnk6IHVuaWRlc2sKc3BlYzoKICBhY2Nlc3NNb2RlczoKICAgIC0gUmVhZFdyaXRlT25jZQogIHJlc291cmNlczoKICAgIHJlcXVlc3RzOgogICAgICBzdG9yYWdlOiAxR2kKLS0tCmFwaVZlcnNpb246IHYxCmtpbmQ6IFNlcnZpY2UKbWV0YWRhdGE6CiAgbmFtZTogc3ViMnJhbmsKICBuYW1lc3BhY2U6IHBsYXRmb3JtLWluZnJhCiAgbGFiZWxzOgogICAgYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogc3ViMnJhbmsKICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICBhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5OiB1bmlkZXNrCnNwZWM6CiAgdHlwZTogQ2x1c3RlcklQCiAgc2VsZWN0b3I6CiAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuawogIHBvcnRzOgogICAgLSBuYW1lOiBodHRwCiAgICAgIHBvcnQ6IDgwODAKICAgICAgdGFyZ2V0UG9ydDogaHR0cAotLS0KYXBpVmVyc2lvbjogYXBwcy92MQpraW5kOiBEZXBsb3ltZW50Cm1ldGFkYXRhOgogIG5hbWU6IHN1YjJyYW5rCiAgbmFtZXNwYWNlOiBwbGF0Zm9ybS1pbmZyYQogIGxhYmVsczoKICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rCiAgICBhcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBwbGF0Zm9ybS1pbmZyYQogICAgYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieTogdW5pZGVzawpzcGVjOgogIHJlcGxpY2FzOiAxCiAgc3RyYXRlZ3k6CiAgICB0eXBlOiBSZWNyZWF0ZQogIHNlbGVjdG9yOgogICAgbWF0Y2hMYWJlbHM6CiAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rCiAgdGVtcGxhdGU6CiAgICBtZXRhZGF0YToKICAgICAgbGFiZWxzOgogICAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rCiAgICAgICAgYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogcGxhdGZvcm0taW5mcmEKICAgICAgYW5ub3RhdGlvbnM6CiAgICAgICAgdW5pZGVzay5haS9zdWIycmFuay1jb25maWctc2hhMjU2OiAiX19TVUIyUkFOS19DT05GSUdfU0hBMjU2X18iCiAgICAgICAgdW5pZGVzay5haS9zdWIycmFuay1kZXBsb3ltZW50LWhhc2g6ICJmNmZhMWMwMjZjMjEwMzc2IgogICAgICAgIHVuaWRlc2suYWkvc291cmNlLWNvbW1pdDogIl9fU1VCMlJBTktfU09VUkNFX0NPTU1JVF9fIgogICAgICAgIHVuaWRlc2suYWkvcHVibGljLWJhc2UtdXJsOiAiaHR0cHM6Ly9yYW5rLnBpa2FweXRob24uY29tIgogICAgc3BlYzoKICAgICAgc2VjdXJpdHlDb250ZXh0OgogICAgICAgIGZzR3JvdXA6IDEwMDAKICAgICAgY29udGFpbmVyczoKICAgICAgICAtIG5hbWU6IHN1YjJyYW5rCiAgICAgICAgICBpbWFnZTogIl9fU1VCMlJBTktfSU1BR0VfUkVGX18iCiAgICAgICAgICBpbWFnZVB1bGxQb2xpY3k6IElmTm90UHJlc2VudAogICAgICAgICAgY29tbWFuZDoKICAgICAgICAgICAgLSAiYnVuIgogICAgICAgICAgICAtICJzcmMvc2VydmVyLnRzIgogICAgICAgICAgICAtICItLWNvbmZpZyIKICAgICAgICAgICAgLSAiL2V0Yy9zdWIycmFuay9zdWIycmFuay55YW1sIgogICAgICAgICAgICAtICItLXJ1bnRpbWUiCiAgICAgICAgICAgIC0gIms4cyIKICAgICAgICAgIHBvcnRzOgogICAgICAgICAgICAtIG5hbWU6IGh0dHAKICAgICAgICAgICAgICBjb250YWluZXJQb3J0OiA4MDgwCiAgICAgICAgICBlbnY6CiAgICAgICAgICAgIC0gbmFtZTogU1VCMlJBTktfQURNSU5fVE9LRU4KICAgICAgICAgICAgICB2YWx1ZUZyb206CiAgICAgICAgICAgICAgICBzZWNyZXRLZXlSZWY6CiAgICAgICAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLXNlY3JldHMKICAgICAgICAgICAgICAgICAga2V5OiBTVUIyUkFOS19BRE1JTl9UT0tFTgogICAgICAgICAgICAtIG5hbWU6IFNVQjJBUElfQURNSU5fRU1BSUwKICAgICAgICAgICAgICB2YWx1ZUZyb206CiAgICAgICAgICAgICAgICBzZWNyZXRLZXlSZWY6CiAgICAgICAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLXNlY3JldHMKICAgICAgICAgICAgICAgICAga2V5OiBTVUIyQVBJX0FETUlOX0VNQUlMCiAgICAgICAgICAgIC0gbmFtZTogU1VCMkFQSV9BRE1JTl9QQVNTV09SRAogICAgICAgICAgICAgIHZhbHVlRnJvbToKICAgICAgICAgICAgICAgIHNlY3JldEtleVJlZjoKICAgICAgICAgICAgICAgICAgbmFtZTogc3ViMnJhbmstc2VjcmV0cwogICAgICAgICAgICAgICAgICBrZXk6IFNVQjJBUElfQURNSU5fUEFTU1dPUkQKICAgICAgICAgIHJlYWRpbmVzc1Byb2JlOgogICAgICAgICAgICBodHRwR2V0OgogICAgICAgICAgICAgIHBhdGg6IC9oZWFsdGgKICAgICAgICAgICAgICBwb3J0OiBodHRwCiAgICAgICAgICAgIGluaXRpYWxEZWxheVNlY29uZHM6IDMKICAgICAgICAgICAgcGVyaW9kU2Vjb25kczogMTAKICAgICAgICAgICAgdGltZW91dFNlY29uZHM6IDMKICAgICAgICAgICAgZmFpbHVyZVRocmVzaG9sZDogNgogICAgICAgICAgbGl2ZW5lc3NQcm9iZToKICAgICAgICAgICAgaHR0cEdldDoKICAgICAgICAgICAgICBwYXRoOiAvaGVhbHRoCiAgICAgICAgICAgICAgcG9ydDogaHR0cAogICAgICAgICAgICBpbml0aWFsRGVsYXlTZWNvbmRzOiAzCiAgICAgICAgICAgIHBlcmlvZFNlY29uZHM6IDEwCiAgICAgICAgICAgIHRpbWVvdXRTZWNvbmRzOiAzCiAgICAgICAgICAgIGZhaWx1cmVUaHJlc2hvbGQ6IDYKICAgICAgICAgIHZvbHVtZU1vdW50czoKICAgICAgICAgICAgLSBuYW1lOiBhcHAtY29uZmlnCiAgICAgICAgICAgICAgbW91bnRQYXRoOiAvZXRjL3N1YjJyYW5rL3N1YjJyYW5rLnlhbWwKICAgICAgICAgICAgICBzdWJQYXRoOiBzdWIycmFuay55YW1sCiAgICAgICAgICAgICAgcmVhZE9ubHk6IHRydWUKICAgICAgICAgICAgLSBuYW1lOiBkYXRhCiAgICAgICAgICAgICAgbW91bnRQYXRoOiAvdmFyL2xpYi9zdWIycmFuawogICAgICB2b2x1bWVzOgogICAgICAgIC0gbmFtZTogYXBwLWNvbmZpZwogICAgICAgICAgY29uZmlnTWFwOgogICAgICAgICAgICBuYW1lOiBzdWIycmFuay1jb25maWcKICAgICAgICAtIG5hbWU6IGRhdGEKICAgICAgICAgIHBlcnNpc3RlbnRWb2x1bWVDbGFpbToKICAgICAgICAgICAgY2xhaW1OYW1lOiBzdWIycmFuay1kYXRhCi0tLQphcGlWZXJzaW9uOiB2MQpraW5kOiBDb25maWdNYXAKbWV0YWRhdGE6CiAgbmFtZTogc3ViMnJhbmstZnJwYy1jb25maWcKICBuYW1lc3BhY2U6IHBsYXRmb3JtLWluZnJhCiAgbGFiZWxzOgogICAgYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogc3ViMnJhbmstZnJwYwogICAgYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50OiB0dW5uZWwKICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICBhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5OiB1bmlkZXNrCmRhdGE6CiAgZnJwYy50b21sOiB8CiAgICBzZXJ2ZXJBZGRyID0gIjgyLjE1Ni4yMy4yMjAiCiAgICBzZXJ2ZXJQb3J0ID0gMjIwMDAKICAgIGxvZ2luRmFpbEV4aXQgPSB0cnVlCiAgICBhdXRoLnRva2VuID0gInt7IC5FbnZzLkZSUF9UT0tFTiB9fSIKICAgIAogICAgW1twcm94aWVzXV0KICAgIG5hbWUgPSAicGxhdGZvcm0taW5mcmEtc3ViMnJhbmstbmMwMS13ZWIiCiAgICB0eXBlID0gInRjcCIKICAgIGxvY2FsSVAgPSAic3ViMnJhbmsucGxhdGZvcm0taW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWwiCiAgICBsb2NhbFBvcnQgPSA4MDgwCiAgICByZW1vdGVQb3J0ID0gMjIwOTUKICAgIAotLS0KYXBpVmVyc2lvbjogYXBwcy92MQpraW5kOiBEZXBsb3ltZW50Cm1ldGFkYXRhOgogIG5hbWU6IHN1YjJyYW5rLWZycGMKICBuYW1lc3BhY2U6IHBsYXRmb3JtLWluZnJhCiAgbGFiZWxzOgogICAgYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogc3ViMnJhbmstZnJwYwogICAgYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50OiB0dW5uZWwKICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICBhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5OiB1bmlkZXNrCiAgICB1bmlkZXNrLmFpL3J1bnRpbWUtbm9kZTogTkMwMQogICAgdW5pZGVzay5haS9wdWJsaWMtaG9zdG5hbWU6IHJhbmsucGlrYXB5dGhvbi5jb20Kc3BlYzoKICByZXBsaWNhczogMQogIHN0cmF0ZWd5OgogICAgdHlwZTogUmVjcmVhdGUKICBzZWxlY3RvcjoKICAgIG1hdGNoTGFiZWxzOgogICAgICBhcHAua3ViZXJuZXRlcy5pby9uYW1lOiBzdWIycmFuay1mcnBjCiAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudDogdHVubmVsCiAgdGVtcGxhdGU6CiAgICBtZXRhZGF0YToKICAgICAgbGFiZWxzOgogICAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL25hbWU6IHN1YjJyYW5rLWZycGMKICAgICAgICBhcHAua3ViZXJuZXRlcy5pby9jb21wb25lbnQ6IHR1bm5lbAogICAgICAgIGFwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IHBsYXRmb3JtLWluZnJhCiAgICAgIGFubm90YXRpb25zOgogICAgICAgIHVuaWRlc2suYWkvcHVibGljLWJhc2UtdXJsOiAiaHR0cHM6Ly9yYW5rLnBpa2FweXRob24uY29tIgogICAgICAgIHVuaWRlc2suYWkvZnJwLXNlcnZlcjogIjgyLjE1Ni4yMy4yMjA6MjIwMDAiCiAgICAgICAgdW5pZGVzay5haS9mcnAtcmVtb3RlLXBvcnQ6ICIyMjA5NSIKICAgICAgICB1bmlkZXNrLmFpL2ZycGMtY29uZmlnLXNoYTI1NjogIjFkOGY1OGE2ZjU4MjQ3ZGEzMzJkNDBkZWE1YzFkN2I3YzY4NDU1YTU5OTVhYTNiMWQ5NjE1NzA2ZWMxYzk0ZTYiCiAgICBzcGVjOgogICAgICBjb250YWluZXJzOgogICAgICAgIC0gbmFtZTogZnJwYwogICAgICAgICAgaW1hZ2U6IDEyNy4wLjAuMTo1MDAwL2h3bGFiL2ZycGM6djAuNjguMQogICAgICAgICAgaW1hZ2VQdWxsUG9saWN5OiBJZk5vdFByZXNlbnQKICAgICAgICAgIGFyZ3M6CiAgICAgICAgICAgIC0gLWMKICAgICAgICAgICAgLSAvZXRjL2ZycC9mcnBjLnRvbWwKICAgICAgICAgIGVudjoKICAgICAgICAgICAgLSBuYW1lOiBGUlBfVE9LRU4KICAgICAgICAgICAgICB2YWx1ZUZyb206CiAgICAgICAgICAgICAgICBzZWNyZXRLZXlSZWY6CiAgICAgICAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLXNlY3JldHMKICAgICAgICAgICAgICAgICAga2V5OiBGUlBfVE9LRU4KICAgICAgICAgIHZvbHVtZU1vdW50czoKICAgICAgICAgICAgLSBuYW1lOiBmcnBjLWNvbmZpZwogICAgICAgICAgICAgIG1vdW50UGF0aDogL2V0Yy9mcnAvZnJwYy50b21sCiAgICAgICAgICAgICAgc3ViUGF0aDogZnJwYy50b21sCiAgICAgICAgICAgICAgcmVhZE9ubHk6IHRydWUKICAgICAgdm9sdW1lczoKICAgICAgICAtIG5hbWU6IGZycGMtY29uZmlnCiAgICAgICAgICBjb25maWdNYXA6CiAgICAgICAgICAgIG5hbWU6IHN1YjJyYW5rLWZycGMtY29uZmlnCg==
  workspaces:
    - name: source
      volumeClaimTemplate:
        spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 4Gi