Nguyen Minh Phuc
50c2fe2a1e
ci / lint (push) Successful in 1m19s
ci / unit (push) Failing after 1m2s
ci / integration (push) Has been skipped
ci / types (push) Successful in 1m37s
ci / security (push) Failing after 38s
ci / dockerfile (push) Successful in 14s
ci / image (api) (push) Has been skipped
ci / image (reconciler) (push) Has been skipped
ci / image (worker) (push) Has been skipped
ci / bump (push) Has been skipped
Complete working build of the system learn-python/ teaches. 164 tests, mypy --strict clean, domain coverage 99%.
58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
# The other half of "CI does not deploy".
|
|
#
|
|
# CI's last act is a commit that changes image.*.digest in deploy/chart/values.yaml.
|
|
# ArgoCD notices that commit and syncs. There is no kubeconfig in CI, no `helm upgrade` in
|
|
# a pipeline step, and no human running kubectl. If you want to know what is running in the
|
|
# cluster, you read git — that is the whole property, and a single `kubectl apply` from a
|
|
# laptop is what destroys it (selfHeal below exists to undo exactly that).
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: svcforge
|
|
namespace: argocd
|
|
finalizers:
|
|
# Without this, deleting the Application orphans every resource it created.
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: default
|
|
source:
|
|
repoURL: https://gitea.oci-oci.duckdns.org/gitea_admin/svcforge.git
|
|
targetRevision: master
|
|
path: deploy/chart
|
|
helm:
|
|
releaseName: svcforge
|
|
# No valueFiles override and no `parameters:` block. values.yaml in the repo is the
|
|
# single source of truth — a parameter here would be a second place the deployed
|
|
# digest could come from, invisible in the chart's own diff.
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: svcforge
|
|
syncPolicy:
|
|
automated:
|
|
# Delete resources removed from the chart. Safe because the chart owns only svcforge
|
|
# itself; tenant releases are created by the worker's helm calls and are not part of
|
|
# this Application, so prune cannot reach them.
|
|
prune: true
|
|
# Revert manual edits. A hotfix applied by hand is a lie the next sync tells on.
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
# The migrate Job is a helm pre-install/pre-upgrade hook. ArgoCD maps helm hooks onto
|
|
# its own PreSync phase, so migrations still run before any new pod starts, and a
|
|
# non-zero exit fails the sync instead of rolling out pods onto an unmigrated schema.
|
|
- ApplyOutOfSyncOnly=true
|
|
retry:
|
|
limit: 3
|
|
backoff:
|
|
duration: 20s
|
|
factor: 2
|
|
maxDuration: 3m
|
|
# The migrate Job is a hook, so ArgoCD deletes and recreates it every sync; its
|
|
# generated fields would otherwise show as permanent drift and the app would never
|
|
# report Synced.
|
|
ignoreDifferences:
|
|
- group: batch
|
|
kind: Job
|
|
jsonPointers:
|
|
- /spec/template/metadata/labels
|