github.com/google/syzkaller@v0.0.0-20251211124644-a066d2bc4b02/syz-cluster/workflow/build-step/workflow-template.yaml (about)

     1  # Copyright 2025 syzkaller project authors. All rights reserved.
     2  # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
     3  
     4  apiVersion: argoproj.io/v1alpha1
     5  kind: WorkflowTemplate
     6  metadata:
     7    name: build-step-template
     8  spec:
     9    templates:
    10      - name: build-step
    11        retryStrategy:
    12          limit: "3"
    13          backoff:
    14            duration: "5m"
    15        securityContext:
    16          runAsUser: 10000
    17          fsGroup: 10000
    18        inputs:
    19          parameters:
    20            - name: findings
    21              value: "false"
    22            - name: test-name
    23              value: ""
    24            - name: smoke-build
    25              value: "false"
    26            # For some reason, "{{=workflow.parameters.session-id ?? ''}}" didn't work here.
    27            - name: session-id
    28              value: ""
    29          artifacts:
    30            - name: request
    31              path: /tmp/request.json
    32        initContainers:
    33        - name: setup-repo
    34          image: ${IMAGE_PREFIX}build-step:${IMAGE_TAG}
    35          imagePullPolicy: IfNotPresent
    36          command:
    37            - sh
    38            - -c
    39            - |
    40              git clone --reference /kernel-repo -c remote.origin.fetch="+refs/heads/*:refs/heads/*" /kernel-repo ./workdir
    41          env:
    42          - name: GIT_DISCOVERY_ACROSS_FILESYSTEM
    43            value: "1"
    44          - name: HOME # Otherwise it's failing with "warning: unable to access '/root/.config/git/attributes': Permission denied.".
    45            value: "/home/syzkaller"
    46          volumeMounts:
    47          - name: base-kernel-repo
    48            mountPath: /kernel-repo
    49            readOnly: true
    50          - name: workdir
    51            mountPath: /workdir
    52        container:
    53          image: ${IMAGE_PREFIX}build-step:${IMAGE_TAG}
    54          imagePullPolicy: IfNotPresent
    55          command: ["/bin/build-step"]
    56          args: [
    57            "--request", "/tmp/request.json",
    58            "--repository", "/workdir",
    59            "--output", "/output",
    60            "--session", "{{inputs.parameters.session-id}}",
    61            "--test_name", "{{inputs.parameters.test-name}}",
    62            "-findings={{inputs.parameters.findings}}",
    63            "-smoke_build={{inputs.parameters.smoke-build}}"
    64            ]
    65          resources:
    66            requests:
    67              cpu: 8
    68              memory: 32G
    69            limits:
    70              cpu: 32
    71              memory: 96G
    72          volumeMounts:
    73          - name: base-kernel-repo
    74            mountPath: /kernel-repo
    75            readOnly: true
    76          - name: workdir
    77            mountPath: /workdir
    78          - name: output
    79            mountPath: /output
    80          securityContext:
    81            privileged: true
    82            capabilities:
    83              add: ["SYS_ADMIN"] # We need to mount a loop device during the kernel build.
    84        volumes:
    85          - name: base-kernel-repo
    86            persistentVolumeClaim:
    87              claimName: base-kernel-repo-pv-claim
    88          - name: workdir
    89            emptyDir: {}
    90          - name: output
    91            emptyDir: {}
    92        outputs:
    93          parameters:
    94            - name: result
    95              valueFrom:
    96                path: /output/result.json
    97                default: ""
    98          artifacts:
    99            - name: kernel
   100              path: /output
   101              optional: true