90 lines
3 KiB
Text
90 lines
3 KiB
Text
let _presets = (import "schemas/lib/concerns_presets.ncl").presets in
|
|
|
|
{
|
|
buildkit_lite | default = {
|
|
namespace | default = "build-system",
|
|
deployment | default = "buildkit",
|
|
port | default = 1234,
|
|
image | default = "moby/buildkit:v0.13.2",
|
|
replicas | default = 1,
|
|
|
|
resources | default = {
|
|
requests = { cpu = "500m", memory = "512Mi" },
|
|
limits = { cpu = "4", memory = "4Gi" },
|
|
},
|
|
|
|
privileged | default = true,
|
|
registry_secret | default = "zot-credentials",
|
|
|
|
live_check | default = {
|
|
strategy = 'k8s_pods,
|
|
namespace = "build-system",
|
|
selector = "buildkit",
|
|
},
|
|
|
|
requires | default = {
|
|
capabilities = ["k8s-cluster-access", "buildkit-daemon"],
|
|
},
|
|
|
|
provides | default = {
|
|
service = "buildkit_lite",
|
|
interface = "buildkit-tcp",
|
|
},
|
|
|
|
grpc | default = {
|
|
keepalive_time | default = "30s",
|
|
keepalive_timeout | default = "10s",
|
|
},
|
|
|
|
vpn_service | default = {
|
|
enabled = false,
|
|
nodeport = 31234,
|
|
external_ips = [],
|
|
service_name = "vpn",
|
|
},
|
|
|
|
mtls | default = {
|
|
enabled = false,
|
|
ca_secret = "buildkit-mtls-ca",
|
|
server_cert_secret = "buildkit-mtls-server",
|
|
cert_mount_path = "/etc/buildkit/certs",
|
|
cert_manager = {
|
|
enabled = false,
|
|
cluster_issuer_name = "buildkit-selfsigned-issuer",
|
|
ca_issuer_name = "buildkit-ca-issuer",
|
|
ca_common_name = "buildkit-mtls-ca",
|
|
ca_duration = "43800h",
|
|
ca_renew_before = "720h",
|
|
server_common_name = "buildkitd",
|
|
server_dns_names = ["buildkitd"],
|
|
server_ip_sans = [],
|
|
server_duration = "2160h",
|
|
server_renew_before = "360h",
|
|
},
|
|
},
|
|
|
|
operations | default = {
|
|
install = true,
|
|
health = true,
|
|
},
|
|
|
|
# Cache backing for /var/lib/buildkit. Off by default (anonymous image VOLUME);
|
|
# opt in per instance to use a bounded PVC + buildkitd GC ceiling.
|
|
cache | default = {
|
|
enabled = false,
|
|
size = "10Gi",
|
|
# local-path by default: the buildkit cache is disposable, so node-local disk is
|
|
# the right backing — not a paid cloud volume. gckeepstorage is the real size bound.
|
|
storage_class = "local-path",
|
|
mount_path = "/var/lib/buildkit",
|
|
gc_keep_storage = "8GB",
|
|
},
|
|
|
|
# ServiceConcerns — lite builder; no persistent state, registry traffic in-cluster.
|
|
# tls.kind flips to 'enforced when vpn_service.enabled AND mtls.enabled in the instance overlay.
|
|
concerns | default = _presets.infrastructure_glue & {
|
|
tls | force = { kind = 'disabled, reason = "TCP inside cluster; mTLS not required for in-cluster port-forward path" },
|
|
backup | force = { kind = 'disabled, reason = "no persistent state; BuildKit cache is ephemeral layer storage on the pod" },
|
|
},
|
|
},
|
|
}
|