From 77cdc156c19d2767ce0f89a050be535cd8295d33 Mon Sep 17 00:00:00 2001 From: pikastech Date: Tue, 21 Jul 2026 19:42:49 +0200 Subject: [PATCH] fix: remove legacy PaC delivery blockers --- .tekton/platform-infra-gitea-nc01-pac.yaml | 21 ++++++++++++++++ .tekton/web-probe-sentinel-nc01-pac.yaml | 25 +++++++++---------- config/platform-infra/pipelines-as-code.yaml | 6 +++++ .../src/hwlab-node-web-sentinel-cicd-jobs.ts | 21 ++++++++++------ 4 files changed, 53 insertions(+), 20 deletions(-) diff --git a/.tekton/platform-infra-gitea-nc01-pac.yaml b/.tekton/platform-infra-gitea-nc01-pac.yaml index 790ed0f9..1365da10 100644 --- a/.tekton/platform-infra-gitea-nc01-pac.yaml +++ b/.tekton/platform-infra-gitea-nc01-pac.yaml @@ -28,6 +28,12 @@ spec: - name: workspace emptyDir: sizeLimit: 2Gi + - name: gitea-auth + secret: + secretName: "{{gitops_secret_name}}" + items: + - key: token + path: token steps: - name: publish image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 @@ -41,6 +47,18 @@ spec: script: | #!/bin/sh set -eu + askpass=/workspace/gitea-askpass.sh + trap 'rm -f "$askpass"' EXIT + cat >"$askpass" <<'ASKPASS' + #!/bin/sh + case "$1" in + *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;; + *Password*) cat /workspace/gitea-auth/token ;; + *) exit 1 ;; + esac + ASKPASS + chmod 700 "$askpass" + export GITEA_USERNAME="{{gitops_username}}" GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0 rm -rf source platform-infra-gitea-gitops git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source cd source @@ -54,6 +72,9 @@ spec: volumeMounts: - name: workspace mountPath: /workspace + - name: gitea-auth + mountPath: /workspace/gitea-auth + readOnly: true - name: reconcile-public-edge image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 imagePullPolicy: IfNotPresent diff --git a/.tekton/web-probe-sentinel-nc01-pac.yaml b/.tekton/web-probe-sentinel-nc01-pac.yaml index 5a8126c7..6cb77b98 100644 --- a/.tekton/web-probe-sentinel-nc01-pac.yaml +++ b/.tekton/web-probe-sentinel-nc01-pac.yaml @@ -26,13 +26,12 @@ spec: - name: publish taskSpec: volumes: - - name: cache - persistentVolumeClaim: - claimName: hwlab-git-mirror-cache - - name: git-ssh + - name: gitea-auth secret: - secretName: git-mirror-github-ssh - defaultMode: 256 + secretName: "{{gitops_secret_name}}" + items: + - key: token + path: token - name: workspace emptyDir: sizeLimit: 8Gi @@ -79,9 +78,6 @@ spec: volumeMounts: - name: workspace mountPath: /workspace - - name: git-ssh - mountPath: /git-ssh - readOnly: true - name: prepare-buildkit-state image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 imagePullPolicy: IfNotPresent @@ -119,14 +115,17 @@ spec: - name: publish image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 imagePullPolicy: IfNotPresent + env: + - name: GITOPS_READ_URL + value: "{{gitops_read_url}}" + - name: GITOPS_USERNAME + value: "{{gitops_username}}" script: | #!/bin/sh exec /workspace/generated/publish.sh volumeMounts: - name: workspace mountPath: /workspace - - name: cache - mountPath: /cache - - name: git-ssh - mountPath: /git-ssh + - name: gitea-auth + mountPath: /workspace/gitea-auth readOnly: true diff --git a/config/platform-infra/pipelines-as-code.yaml b/config/platform-infra/pipelines-as-code.yaml index 6797b3a1..83dbd09d 100644 --- a/config/platform-infra/pipelines-as-code.yaml +++ b/config/platform-infra/pipelines-as-code.yaml @@ -547,6 +547,9 @@ consumers: deliveryObservation: runtimeEvidence: not-applicable closeoutGitOpsMirrorFlush: false + params: + gitops_username: unidesk-admin + gitops_secret_name: pac-gitea-sentinel-nc01-v03 - id: platform-infra-sub2rank-nc01 repositoryRef: sub2rank-nc01 node: NC01 @@ -1020,6 +1023,9 @@ templates: sentinel_id: "${nodeLower}-web-probe-sentinel" image_repository: "127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}" registry_probe_base: http://127.0.0.1:5000 + gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git + gitops_username: unidesk-admin + gitops_secret_name: "pac-gitea-sentinel-${nodeLower}-v03" gitops_branch: v0.3-gitops gitops_manifest_path: "deploy/gitops/node/${nodeLower}/web-probe-sentinel/web-probe-sentinel.yaml" pipeline_name: "hwlab-web-probe-sentinel-${nodeLower}-pac" diff --git a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts index 9af4ce6a..ca95bb5f 100644 --- a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts +++ b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts @@ -802,8 +802,9 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string, `job_name=${shellQuote(jobName)}`, `image_ref=${shellQuote(state.image.ref)}`, `image_repository=${shellQuote(state.image.repository)}`, - `gitops_repository=${shellQuote(stringAt(state.controlPlaneTarget, "source.repository"))}`, `gitops_branch=${shellQuote(stringAt(state.cicd, "argo.targetRevision"))}`, + "gitops_read_url=${GITOPS_READ_URL:?GITOPS_READ_URL is required}", + "gitops_username=${GITOPS_USERNAME:?GITOPS_USERNAME is required}", `files_b64=${shellQuote(filesB64)}`, "meta_dir=/workspace/meta", "event_log=/workspace/publish-events.log", @@ -814,10 +815,17 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string, "emit_failed() { code=$?; if [ \"$code\" -ne 0 ]; then trace_id=$(printf '%s' \"${TRACEPARENT:-}\" | cut -d- -f2); printf '{\"ok\":false,\"status\":\"failed\",\"traceId\":\"%s\",\"firstBreak\":{\"code\":\"child-process-exit-nonzero\",\"phase\":\"%s\",\"reason\":\"GitOps publish command exited non-zero\",\"valuesRedacted\":true},\"error\":{\"type\":\"ChildProcessError\",\"code\":\"EXIT_NONZERO\",\"phase\":\"%s\",\"exitCode\":%s,\"stderrSummary\":\"bounded step logs contain the command failure\",\"valuesRedacted\":true},\"exitCode\":%s,\"jobName\":\"%s\",\"valuesRedacted\":true}\\n' \"$trace_id\" \"${current_phase:-gitops-publish}\" \"${current_phase:-gitops-publish}\" \"$code\" \"$code\" \"$job_name\"; fi; exit \"$code\"; }", "trap emit_failed EXIT", "if [ -f \"$event_log\" ]; then cat \"$event_log\"; fi", - "mkdir -p /root/.ssh", - "cp /git-ssh/ssh-privatekey /root/.ssh/id_rsa", - "chmod 0400 /root/.ssh/id_rsa", - "export GIT_SSH_COMMAND='ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1'", + "askpass=/workspace/gitea-askpass.sh", + "cat >\"$askpass\" <<'ASKPASS'", + "#!/bin/sh", + "case \"$1\" in", + " *Username*) printf '%s\\n' \"${GITEA_USERNAME:?}\" ;;", + " *Password*) cat /workspace/gitea-auth/token ;;", + " *) exit 1 ;;", + "esac", + "ASKPASS", + "chmod 700 \"$askpass\"", + "export GITEA_USERNAME=\"$gitops_username\" GIT_ASKPASS=\"$askpass\" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0", "started_ms=$(read_meta started_ms)", "source_commit=$(read_meta source_commit)", "source_stage_ref=$(read_meta source_stage_ref)", @@ -852,9 +860,8 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string, "gitops_started_ms=$(now_ms)", "if [ \"$files_b64\" != \"W10=\" ]; then", " emit_stage gitops running \"$gitops_started_ms\"", - " gitops_cache=\"/cache/${gitops_repository}.git\"", " gitops_worktree=\"/tmp/$job_name/gitops\"", - " git clone --no-checkout \"$gitops_cache\" \"$gitops_worktree\"", + " git clone --no-checkout \"$gitops_read_url\" \"$gitops_worktree\"", " cd \"$gitops_worktree\"", " git fetch origin \"$gitops_branch\" || true", " if git rev-parse --verify \"refs/remotes/origin/$gitops_branch^{commit}\" >/dev/null 2>&1; then git checkout -B \"$gitops_branch\" \"refs/remotes/origin/$gitops_branch\"; else git checkout --orphan \"$gitops_branch\"; git rm -rf . >/dev/null 2>&1 || true; fi",