jakman85andClaude Opus 5.5
f65c12b395
Operator decision on PR #81: no CI job may reach a privileged daemon. The act runner is untouched. - platform/buildkit (+ clusters/base/buildkit.yaml): moby/buildkit v0.34.1-rootless pinned by digest, uid 1000, not privileged; caps drop ALL + SETUID/SETGID, seccomp/AppArmor Unconfined, read-only rootfs (each measured under podman). cert-manager CA + server/client certs, ClusterIP :1234, default-deny with ingress only from the act-runner pod (DinD masquerades jobs to it). No Kyverno exception: every applied policy matches app-namespace=true only. - Each Containerfile names its shipped stage and ends in a `verify` stage holding every former `docker run` assertion (uid 65532, RUN --network=none, writable-path inventory standing in for the read-only rootfs). The old `&& echo` checks that could never fail are real assertions now. - images.sh drives buildkitd with a pinned buildx (sha256-checked) via bake; PRs build verify targets with agent-runner FROM the in-run toolbox (target: context); main verifies, then pushes. Fails loudly when the builder secrets are absent or buildkitd is unreachable. - infra/gitea/buildkit-client-secret.sh copies the client cert into Actions secrets. Co-Authored-By: Claude Opus 5.5 <[email protected]>
25 lines
876 B
YAML
25 lines
876 B
YAML
---
|
|
# buildkitd.toml. Validated against the pinned image (v0.34.1-rootless): `buildctl debug workers
|
|
# -v` reports "Maximum used space: 4.29GB / Reserved space: 1.07GB" for the default policy.
|
|
#
|
|
# WHY 4GB. The cache lives in an emptyDir on the NODE's disk (deployment.yaml), and the nodes had
|
|
# 7-9 GB free when this was written. The largest image (toolbox) is ~1.4 GB uncompressed; the
|
|
# three images share their Fedora base. The emptyDir's sizeLimit sits above this cap, so GC
|
|
# trims the cache well before the kubelet would evict the pod for exceeding it.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: buildkitd-config
|
|
namespace: buildkit
|
|
labels:
|
|
app.kubernetes.io/name: buildkitd
|
|
data:
|
|
buildkitd.toml: |
|
|
[worker.oci]
|
|
enabled = true
|
|
gc = true
|
|
maxUsedSpace = "4GB"
|
|
reservedSpace = "1GB"
|
|
[worker.containerd]
|
|
enabled = false
|