ci_keel.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: {{ default "ci-go-runner" .Namespace }}
---
# The following role allows the runner under test to interact with the working state config map
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: run-cluster-admin
subjects:
  - kind: ServiceAccount
    name: default
    namespace: {{ default "ci-go-runner" .Namespace }}
roleRef:
  kind: ClusterRole
  name: studioml-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: studioml-role
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
---
# This secret is an open abitrary secret used to confirm the functional encryption and
# MUST never be used for a production system.
apiVersion: v1
kind: Secret
metadata:
  name: studioml-runner-passphrase-secret
  namespace: {{ default "ci-go-runner" .Namespace }}
type: Opaque
data:
  ssh-passphrase: UGFzc1BocmFzZQ==
---
# This secret is an open abitrary secret used to confirm the functional encryption and
# MUST never be used for a production system.
apiVersion: v1
kind: Secret
metadata:
  name: studioml-runner-key-secret
  namespace: {{ default "ci-go-runner" .Namespace }}
type: Opaque
data:
  ssh-privatekey: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpQcm9jLVR5cGU6IDQsRU5DUllQVEVECkRFSy1JbmZvOiBBRVMtMTI4LUNCQyw5MjVGMkVCOTgwNjM4OTFENUM0Q0U4MzhFNUEzODdERQoKOG1UOFlNY2RxS2o5M0F6TmRrUGd0R25LQkhwMzB1NlFENWUydC9FbXRLQ2dtQzcyVUVyR1N1a3dJamMvRENPNgptWWRIaU5BYnAxVEloY0ZyNms4eDVFUHRMRjlsUlhnV1FQT1lIUFh5K3NDTXpnNmRDSDZqVXNIQzUrbFFtRGY5ClRvUTdYdVdpUUVFbVhVdUcwNS9kMjYyWHFocktIR0hGOEMwUGdBQ0xoV1g0MW1mMEhpY05DY015WXJ1eURySWkKcDg5SjUrSEZRYzA1QkxuYnBHMDUyNWhyZDhuYWwyTHNUVjExaVpZaGxHVDlUWWM1b3dOUmEvWjlldml6QWdSOApkSkRoR2Q1bkVvN0NjaGI4VzczYVdPbjVrRmtscVk0NzRQMnZzOE13RDFXMjZCYTF2Z25ydWlHeWhoanorWXJsCnZ5MDNueUx1R3BPb24rNFRvTFlhWFRlY0VaYUtIMmNISFZBU0JkL3ZOaFEwTkIvTGgzNmhCTGJjc1kxaDZSM1EKMmxWZGVzRG5LREFEM2JSM3dhaXJGc2tYald2a2Y5UzFBeWN5NldlSGErck15NmlIRy9mdXdFUDlvai9ZR2grZgpmUm83M3RpbVRYWW5NRU8zME02SVBVSkM2T2RCQkphVkg5TzZ1cGRTKzBkU0o4RmZSZXNXRmJheCt3aHFldnFkCkpVeGdHdXp0N2xWanF0Q2Z2b2pnM3gyanB4UnpyRVhKWlRzajlDck51STk0R2lBOVc0aTl1YVR5cmo5empOTlAKa29pQU0rbTFtUGU1VC9ETTVLb3UwR2lvUVBtYlF6Zjh6aGFDR1doVVRvbUVEUWJSbTJhMlUzTllWa0xrQzhJVgpJY3BPOEplSUlxcHJsRW9JVTVGRGQxMU8yMkZSNExyS3VIS0dGaHlxY0F2MGU2SGxDcnZYMW1qZlllUVlUQnoyCkhvV0ErQnNuQXdaWHhwbzdMVzhaMU42S0ZlWFdPc0xyTlpUY3pFY0ZROWZzblk3aUtyTHN2N2tyUHArMHFoNWMKUXBuUDdkSGsycENHWmVXVnBrSU43NXk5QjNQcjd4YmdoalR5SW01cjhQcHNjVXRSdzVmaEVrSkVtWUVFQ3pIRQptN2ZTVzNMU2tuaFZBbXpNUzMyd3ppVjZrWWhiWWgxMmNYSHAvTVZKd3NUSXg1WkpXSURzaWJSS3h1RVhGYTFBCnNwMXY1Wk9Xek9aVDMrZ3NDVitFWExON2o5aG84bkxWRGxFYWJ2UG92NDhFVHBnV3lMV2JsRm5oVnI0Q3psNHcKN1B5cm5hVk5mdUNtS1BFcXVaZ3V3djVuSHdWOUdYOE5vNFZISEpPRCt5YnFZQ2VOMTA0T1NnSi9kaTFTdS9mYgpwQmo3SDFaS3FVRnY0ckYyQklUcFZON2g1emhWN0w2N0Jzd3pNYnRZMTJGRDVvMzhPM0NMK1dsZHZINDB6NW5nClc4UDhyeU5rVW45OU5oZ0VDNHFQVk40clJIYTAzV2pFalY5MXhFcWJZTVErVTc4L0o0Y1FnT3pjV3E3TzJCUXAKUkJLMDM5d1FYd1IrdTJlRFpUY1lnYVorN3haWU9NUVdybVpnVzB5S3I3eXVKQS8yWVVnQTNzM2ZrWVRWL0cxVwpCc0FYZ25yajhKQlE5R3lvMDFhaWs5SDJUYkVmakhSOW04WEJ0VTY4QWdLUlg1b0dZWlJ6STZwdmo2V0xrVmVLClJoc2MvRXRYVnM2b3N6TjF1KzR1SlMyRWtFT21Wbm4xQWRhUnZTb2FWMCtzMEdkMS84L1hqSW5UbUk3KzR6T1EKM1FKektEQ1A4dHQwaC8ycTNkM3ZsK1psblVUQ1g0UUVlZ2RZNU9vZFhsL3ZIc1g3UDJCaGNHLy8xdjNuMXE5dApCL1grejRMTVJhWk9YbzBRcXpVRTZBcGx3eEVqdEZVbGU1UUYvclJUZGV1MytOWUlIZ2JtNHF3VHk3RDAwYzA2CjlMMm5OSmFLTk8wVldhZHBxS3p0ZTF4SWdRUTNobE1UQ2JwU3VBRnNVN2hpUGEzdXphaDQ2ODl3V2hjZWMzQ3gKUHpaejc5b3FobVhsZGxJUFFjbGt1RWFOWEdWQnBCSXBmT0x3YlRaM0VTSFYzOEFWdGR1RHJ3S3U0ZXRDS1NzRQpjd29MRDRreXp0SUVWMkxxd1E0enBGZ1VrWHRpT0RVWnBxVUJyOVJoU0hUSG4zS3dHSmI4NzBJRGJhMVR2Y3R4CmhlamovME1tVEhuWEcxZlU5MmRqYUh6ejBiZWkram0wVDRScTh6M3lITWcwSzhSRTE3NDg3ZkRzYWxWR3JUdTEKMDZUUnQvZFRNUGZ4Uy8vajVuVDA0VFpraVAweUVSZTNPNkFvRVZhdUdSRHNSaE9nSWw1MXdiK0pkbGI1cTdMaQprdjcyRWxhaHBTVFFFbVIxUU1EeTVDV3U4VlQrTkZXSUZNK1N6SUcraStQaXhaVmtIU3VKak80Q0FmRWI5VitpCkQybFpOa1IyRkdkdGV6cjRTM0N6Y1dLdHdOcmtVbytWeDVCSlNsYThNZDd2THlGdEVqZ1lhbVlrdVErOGdmUG0KbnhkRHc2ZTcvdU1ldTRBQ3ZDUTBZbG5pdEc2TWE4UFZRUC90WDRFMy9iMEdhSVZEdDMrOWlVYjlLcFVoU0h2aQpsQXdpck0vVXhxV09SM3BUL1BkMWFPczJEMS8xdGdVZnJIMGswemJiQTN2SDNzSlg0d0VKQjExd0J1V1dicXJNCmhzRFRESGVheEFuRVRSdVZiODM2aUl2WFo5ODgrYUtXb2VuSWw3eXlmei9UbnBuYkhBRWJ2MkFIN0xHUld4cHgKUzZRK0FFT0tFdVp6NzRLY1dFeVpJajRSTGRLRytCVHdJSnE2YkZSQVpiQUxqcmdVQ2ZFWmVkN0dvNTVoU0JregpBQTFXbzJQazRWMC9kV1VuSUtXdURzZHdka0pSVEgyc0FudlNNbm85bmVLUWR2WHNxaXl4bGhDZnQ1bGRhempyCjYyUllpSXBZRE9QWllUc1ZNY1ZMNWZlM0pNbFpvc3JYZVBSdUdZaHhIVUhaeHFpZXVtK3N2UXpLNHIwQXBGNVIKTGhzM0RSSkJwMEZ2c1dtNFk4emlXWXBmT09JQ1Z2TlRuVUFRU2dGRW5PSWNxYk1uRDQ2aWFtU3RxQ1lBZ0YxdQpHRW1TNU9ydUFoVEh5TTcyVlhNdWRNeUZHVXQ4TFc0OWcwOExPQmNka254ZUpOcHdpNEtqcitJQmNDSU1NR2V4CmM3T1AvTEZxdi9XdHU1cDVLUFV0K3RYeEcwcWJLaEs4UXNlMkg4Nmk3M3Y0bG9TempDOWs3TnZreHd1SVM2Mm4KNjNjb2wxdmVacDlQSytkdUpmK1pRTXVIMkR6UmF3Nk9ucnMzTW53QjZlNXNQSnNFeDZybEZOUTN4V3ljV0QzeApkenJWRWk0MHIwUTNVcGhNUHg2V1lCcUtHVXlRajVKSXpHVjh1R1dTNENrdllvdlBIdTVmcjY1SUI4UEtXTyt6CjhZakpiNmlzbkpyTEdrTXpYL1RPZWpsbkFURmtHRFdaV2RKdlJwOWQ0VHE5THNNVXhuaHltbkNmZmI4cXVaKzUKL3JvdFN6RFp6eFFkSjY0K0NEZXVmU2taOXJaR0M3alQ0T09Nc2QyWGpTQzJpdmJQTDNqdkVrQUFWNlNSZE1COAorMG5BTnRZQXFiVlFBam85aER0NlNPQ2FoQ3FWTnRuRnBUUjd2c1dvRG1CbENUL2wrK0lqWTg3OVZrN0RYdG04Ckh5SHlWU0k2REM2bkdWdzlPNENJaXVZTllEc1dEcHRyS3pLNUcrWHN1ZmxlS3dzRCtTRHYvbzJJMlg5b2FtZUgKZWJPK2NkV0ozais4VXhjaVQvQ0N5MUMzYXRwQTFHUEttcXMzUGZXRjI5WkFqaDY1S244b0ZPM3duZ0VyMkI3TApPcENlWkFoVzJob0FTOTJBWFlSTmJUa1lRSzBnVm5kOEZJWUk3a0txcjRGM0xBdXhyYlVwd2VqOVlZSnZvb0VwCm91cUpIdG90NkVmVG11OEY4dXlWRmJOUlhYVld2RkltRmtTYkVPY25SRnFhcDdEa0hFcFRmVHE2ZGF0VWxLRjcKNDh0N2lJRnNXR3RNVDNOdTZRZXJBVVV3WWNKcVhOK3R5eS9ieGpwaFRYRVQ1RitZc0dQb05pQ1V5Mmltek4vOQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
  ssh-publickey: LS0tLS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JSUNDZ0tDQWdFQXdhbDFTWFlvbW5HR3lKRjRzQ2JzaUFyeW9JemI3RFhNci9PN2xINDJ0eHJSanZmY29tK1IKeHhQVmVyMllyVFpRZ3c0bmJ2OER6VXhKZUQzRjFKWXVudkxkZXBRQTlRcjJjYkFRNVdxdnlJRkhXOFZQK2VsWgpFdTByZ0RBdm42SXppT1plZGw1dS9LQVZSZnNqVSszRU93OFgrdlUvK2lwUmFZRjVPNTlXQkd0cWd6UnVPQjhKCjdFUFVpc3QvUWs1ZkVkSlo4cUlyQUtmTDlaSTNwWjlUOHhuRVVsVXdvMTcyR0o3c0NmZUFZeElaMC9YUkphZVIKa2RwM1lmMi94WFlZdytpcExUQmQ2cFBRWUF5NFcyMHVFOTBRR1JMRHV0eGJnM3NySzRYbWRFWGF0ZmE5MGFvagpscUJXOVcwTFV2djZHYlNydWE5TzBrVWdVN2NqdGpxRWd3ZmJBbHR5MUF3UjFGTzhjUTYyTVp5Wk50bVVsSm1lCmZrTjYzRThuR0FsMkRFU1hrL2xCN3lsTXloOXNwTjFCbVlXOTcxU2ZzZVVsK1dmajZJZzNuZFQ4US9ReWd5dFAKdnV0ZnBpZXEyRWpWdnlBSnF1QzRkQlAxZ0FMMExRNTZmYWY5WjEwa2x1S3duUnJUZEZSMHUxci9UYldVZmZJTApIeU4zZWdzb3Nqd1RhZTRPUW51SjQ2ck8wM1dnNEc0UStZTEYrRWRBeUFWOVNNWlZhSTR0ZlhQMlYwR2dVWkhUCmNnbk1WZFAxTmVvS252aEgwQ0hvTzF1NDZGVGxWOTQ4VTZ5a3ZKSlVSUG5GVXo3T09qKzJqb3ppWkVkLzdqZWsKMCtRb0dzY2h5SXpxRmJDQUtQS3FLMnZKQ1pPUHRRWVR3VVc3bGgrQXFpUU9mdE1xbk1mWXhJRUNBd0VBQVE9PQotLS0tLUVORCBSU0EgUFVCTElDIEtFWS0tLS0tCg==
---
apiVersion: v1
kind: Secret
metadata:
  name: studioml-signing
  namespace: {{ default "ci-go-runner" .Namespace }}
type: Opaque
data:
  info: RHVtbXkgU2VjcmV0IHNvIHJlc291cmNlIHJlbWFpbnMgcHJlc2VudA==
  rmq_cpu_andrei_: c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUZJVG8wNlBrOHNxQ01vTUhQYVFpUTdCWTNwamY3T0U4QkRjc25Zb3ptSUcga211dGNoQGF3c2Rldgo=
---
apiVersion: v1
kind: Secret
metadata:
  name: studioml-report-keys
  namespace: {{ default "ci-go-runner" .Namespace }}
type: Opaque
data:
  info: RHVtbXkgU2VjcmV0IHNvIHJlc291cmNlIHJlbWFpbnMgcHJlc2VudA==
  rmq_cpu_andrei_: LS0tLS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JSUNDZ0tDQWdFQXZETmRWMitIem9mS2gwUVVCcDJnVWh4aG14RC91WFZac0VCNmRrL3lWaFllcHFIU01DaGcKWXlRaHJpeXhZNlM3U2luT2Q2UUNtMFFlK2JRRWZYODFlMjFQSjhCZVBqTTY2bDRGZ0ZhTEVPN0tLQkxwWlFkaAo5ZFVRWWJ2aXVDaUxyLzRtajJHaVNob01nUGVzTGJjZkxNeTM0bUZMWVJ5OTMvRVc1YjhuenBNQ2JxaDgwM1pjClJqQmRjMUhKdS9mVjVGVy9hd0JBV0NwZHVUWUUwb3pxODB5UmdyOGJQS29sV0RHajVoL0g2TnAxbE9qUlpVZFgKa3NKK2RJbHBLUGpDeUNiaXBTVHlZWnNyWE1CcHJteHRMa1BFTWtzYURnVjJSYkl2aUNCWlRBM3RnOTYyTGhQYwp4TFZ6VGhFdWxyZ3JrNmRDYnRLWU9oUkRIeld5VGwrYWtyN3pGSHo4RnVyRnI4YzJLV3hVZmd4SWMxN1ViR0c0ClZpbWgySmhyZmROREpWTDdoMDZNK2J0c3hsbzhtZER6S3kzc0NqV2pJNngxVEhqTXRoQXRCbC9SWWJHOEVnQ20KQWhVWjRMNGNZVldMcmQwUWQwMERVT0QvV3I3Z0VZcThVQ04xRkN3UFQ2Mjk2WWlHbktyNDF3VUFuQWV0QjJ4NQpnbzRDc0JRZ3AyVkhOMis3T0s0Z0xFQ0F5cGZzems5dm9EdE1iWmF3cHkzZ1c2U2tLeUo4SlovalNNRUZBTGM1CmFsbThFNWwzR3hUTFo3c3AwOVovN25KR3FISHlmQjlzdzVXS2RIOXV5eDQ0MVNOTWZnSlhmd25JbVR1Rm5RbWgKNi9ub2dqbHRNamFXQWJBYmRNUHlvdmZmRHRzVUhjVHhNYXlockUrWU8vb21RTlNZNnhCcTd4RUNBd0VBQVE9PQotLS0tLUVORCBSU0EgUFVCTElDIEtFWS0tLS0tCg==
---
apiVersion: v1
kind: Secret
metadata:
  name: docker-registry-config
  namespace: {{ default "ci-go-runner" .Namespace }}
type: Opaque
data:
    registry.yaml: '{{ .Registry | b64enc }}'
---
apiVersion: v1
kind: Secret
metadata:
  name: release-github-token
  namespace: {{ default "ci-go-runner" .Namespace }}
type: Opaque
data:
  github_token: '{{ expandenv "$GITHUB_TOKEN" | b64enc }}'
---
apiVersion: v1
kind: ConfigMap
metadata: 
  name: build-env
  namespace: {{ default "ci-go-runner" .Namespace }}
data:
  KeelCI: "KeelCI"
  LOGXI: "*=INF"
  RABBITMQ_DEFAULT_USER: "UserUser"
  RABBITMQ_DEFAULT_PASS: "PasswordPassword"
  MINIO_ACCESS_KEY: "UserUser"
  MINIO_SECRET_KEY: "PasswordPassword"
  MINIO_TEST_SERVER: "${MINIO_SERVICE_SERVICE_HOST}:${MINIO_SERVICE_SERVICE_PORT}"
  AMQP_URL: "amqp://${RABBITMQ_DEFAULT_USER}:${RABBITMQ_DEFAULT_PASS}@${RABBITMQ_SERVICE_SERVICE_HOST}:${RABBITMQ_SERVICE_SERVICE_PORT}/%2f?connection_attempts=2&retry_delay=.5&socket_timeout=5"
  CLEAR_TEXT_MESSAGES: "true"
#  REQUEST_SIGNATURES_DIR: "/runner/certs/queues/signing"
#  RESPONSE_SIGNATURES_DIR: "/runner/certs/queues/response-encrypt"
---
# This service exposes rabbit MQ to the cluster members
apiVersion: v1
kind: Service
metadata:
  labels:
    component: rabbitmq
  name: rabbitmq-service
  namespace: {{ default "ci-go-runner" .Namespace }}
spec:
  ports:
  - name: rmq-client
    port: 5672
  - name: rmq-admin
    port: 15672
  selector:
    app: taskQueue
    component: rabbitmq
---
# The replication controller encapsulates the pod(s) used to run RabbitMQ
apiVersion: v1
kind: ReplicationController
metadata:
  labels:
    component: rabbitmq
  name: rabbitmq-controller
  namespace: {{ default "ci-go-runner" .Namespace }}
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: taskQueue
        component: rabbitmq
    spec:
      containers:
      - image: rabbitmq
        name: rabbitmq
        ports:
        - containerPort: 5672
        - containerPort: 15672
        resources:
          limits:
            cpu: 1
            ephemeral-storage: "4Gi"
          requests:
            ephemeral-storage: "4Gi"
        envFrom:
        - configMapRef:
            name: build-env
        lifecycle:
          postStart:
            exec:
              command:
                - "/bin/bash"
                - "-c"
                - >
                  set -euo pipefail ;
                  IFS=$'\n\t' ;
                  echo "Starting the install of the management plugin" ;
                  sleep 30 ;
                  rabbitmq-plugins enable rabbitmq_management ;
                  apt-get -y update ; apt-get install -y wget python ;
                  wget -q -O /usr/local/bin/rabbitmqadmin http://localhost:15672/cli/rabbitmqadmin ;
                  chmod +x /usr/local/bin/rabbitmqadmin
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  # This name uniquely identifies the PVC. Will be used in deployment below.
  name: minio-pv-claim
  namespace: {{ default "ci-go-runner" .Namespace }}
  labels:
    app: minio-storage-claim
spec:
  # Read more about access modes here: https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes
  accessModes:
    - ReadWriteOnce
  resources:
    # This is the request for storage. Should be available in the cluster.
    requests:
      storage: 15Gi
  # Uncomment and add storageClass specific to your requirements below. Read more https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class-1
  #storageClassName:
---
apiVersion: apps/v1
kind: Deployment
metadata:
  # This name uniquely identifies the Deployment
  name: minio-deployment
  namespace: {{ default "ci-go-runner" .Namespace }}
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: minio
  template:
    metadata:
      labels:
        # Label is used as selector in the service.
        app: minio
    spec:
      # Refer to the PVC created earlier
      volumes:
      - name: storage
        persistentVolumeClaim:
          # Name of the PVC created earlier
          claimName: minio-pv-claim
      containers:
      - name: minio
        # Pulls the default Minio image from Docker Hub
        image: minio/minio
        args:
        - server
        - /storage
        envFrom:
        - configMapRef:
            name: build-env
        ports:
        - containerPort: 9000
        # Mount the volume into the pod
        volumeMounts:
        - name: storage # must match the volume name, above
          mountPath: "/storage"
---
apiVersion: v1
kind: Service
metadata:
  name: minio-service
  namespace: {{ default "ci-go-runner" .Namespace }}
spec:
  type: LoadBalancer
  ports:
    - port: 9000
      targetPort: 9000
      protocol: TCP
  selector:
    app: minio
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  # This name uniquely identifies the PVC. Will be used in deployment below.
  name: build-pv-claim
  namespace: {{ default "ci-go-runner" .Namespace }}
  labels:
    app: build-storage-claim
spec:
  # Read more about access modes here: https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes
  accessModes:
    - ReadWriteMany
  resources:
    # This is the request for storage. Should be available in the cluster.
    requests:
      storage: 30Gi
  # Uncomment and add storageClass specific to your requirements below. Read more https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class-1
  #storageClassName:
---
# Run the integration build as a deployment, the lifecycle will be dealt with by the CMD entry
apiVersion: apps/v1
kind: Deployment
metadata:
  name: build
  namespace: {{ default "ci-go-runner" .Namespace }}
  labels:
      keel.sh/policy: force
      keel.sh/match-tag: "true"
      keel.sh/trigger: poll
spec:
  selector:
    matchLabels:
      # Label is used as selector in the service.
      app: build
  template:
    metadata:
      labels:
        # Label is used as selector in the service.
        app: build
    spec:
      automountServiceAccountToken: true
      volumes:
        - name: aws-sqs
          secret:
            optional: true
            secretName: studioml-runner-aws-sqs
            items:
            - key: credentials
              path: credentials
            - key: config
              path: config
        - name: message-encryption
          secret:
            optional: false
            secretName: studioml-runner-key-secret
            items:
            - key: ssh-privatekey
              path: ssh-privatekey
            - key: ssh-publickey
              path: ssh-publickey
        - name: encryption-passphrase
          secret:
            optional: false
            secretName: studioml-runner-passphrase-secret
            items:
            - key: ssh-passphrase
              path: ssh-passphrase
        - name: queue-signing
          secret:
            optional: false
            secretName: studioml-signing
        - name: response-queue-signing
          secret:
            optional: false
            secretName: studioml-report-keys
        - name: build-storage
          persistentVolumeClaim:
            # Name of the PVC created earlier
            claimName: build-pv-claim
        - name: podinfo
          downwardAPI:
            items:
              - path: "namespace"
                fieldRef:
                  fieldPath: metadata.namespace
              - path: "annotations"
                fieldRef:
                  fieldPath: metadata.annotations
              - path: "labels"
                fieldRef:
                  fieldPath: metadata.labels
      containers:
      - name: build
        env:
          - name: GITHUB_TOKEN
            valueFrom:
              secretKeyRef:
                name: release-github-token
                key: github_token
          - name: K8S_POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: K8S_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        envFrom:
        - configMapRef:
            name: build-env
        image: {{ $branch := .duat.gitBranch | replace "/" "_" | replace "-" "_"}}{{ .Image | empty | ternary "quay.io/leafai/studio-go-runner-standalone-build:" ""}}{{ .Image | empty | ternary $branch .Image }}
        imagePullPolicy: Always
        resources:
          limits:
            memory: "6Gi"
            cpu: 2
            nvidia.com/gpu: {{ expandenv "$NVIDIA_VISIBLE_DEVICES" | empty | ternary "0" "2" }}
        volumeMounts:
          - name: build-storage # must match the volume name, above
            mountPath: "/build"
          - name: podinfo
            mountPath: /etc/podinfo
            readOnly: false
          - name: aws-sqs
            mountPath: "/runner/certs/aws-sqs/default"
            readOnly: true
          - name: message-encryption
            mountPath: "/runner/certs/message/encryption"
            readOnly: true
          - name: encryption-passphrase
            mountPath: "/runner/certs/message/passphrase"
            readOnly: true
          - name: queue-signing
            mountPath: "/runner/certs/queues/signing"
            readOnly: true
          - name: response-queue-signing
            mountPath: "/runner/certs/queues/reponse-encrypt"
            readOnly: true
        lifecycle:
          postStart:
            exec:
              command:
                - "/bin/bash"
                - "-c"
                - >
                  set -euo pipefail ;
                  IFS=$'\n\t' ;
                  echo "Starting the keel modifications" $K8S_POD_NAME ;
                  kubectl label deployment build keel.sh/policy- --namespace={{ default "ci-go-runner" .Namespace }} ;
                  kubectl scale --namespace {{ default "ci-go-runner" .Namespace }} --replicas=1 rc/rabbitmq-controller ;
                  kubectl scale --namespace {{ default "ci-go-runner" .Namespace }} --replicas=1 deployment/minio-deployment ;
                  curl -v --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H "Authorization: Bearer $(cat /var/runsecrets/kubernetes.io/serviceaccount/token)" https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_PORT_443_TCP_PORT/api/v1/namespaces/$K8S_NAMESPACE/pods/$K8S_POD_NAME
          preStop:
            exec:
              command:
                - "/bin/bash"
                - "-c"
                - >
                  set -euo pipefail ;
                  IFS=$'\n\t' ;
                  echo "Starting the namespace injections etc" $K8S_POD_NAME ;
                  kubectl label deployment build keel.sh/policy=force --namespace={{ default "ci-go-runner" .Namespace }} ;
                  kubectl scale --namespace {{ default "ci-go-runner" .Namespace }} --replicas=0 rc/rabbitmq-controller ;
                  kubectl scale --namespace {{ default "ci-go-runner" .Namespace }} --replicas=0 deployment/minio-deployment ;
                  for (( ; ; )) ;
                  do ;
                      sleep 10 ;
                  done