ci: prebuilt CI images for ansible and k8s pipelines

apk add + pip install + ansible-galaxy ran on every job across ~12 pipelines and dominated wall time. Bake the toolsets into two images pushed to Gitea's container registry; consuming pipelines pull instead. ci-ansible: ansible + community.{proxmox,docker} + proxmoxer/requests + utility CLIs (sops, aws-cli, jq, sshpass, ...). ci-k8s: talosctl (pinned to v1.12.6), kubectl (stable at build time), flux + sops/openssl/bind-tools. Tags YYYY-MM-DD plus :latest. Build pipeline triggers on changes under ci/images/** or manual PIPELINE=build-ci-images.
2026-04-29 16:22:28 +02:00
parent 358e337446
commit 4901848992
3 changed files with 98 additions and 0 deletions
@@ -0,0 +1,48 @@
+when:
+  - event: push
+    path:
+      - "ci/images/**"
+      - ".woodpecker/build-ci-images.yml"
+  - event: manual
+    evaluate: 'PIPELINE == "build-ci-images"'
+
+steps:
+  - name: build-ansible
+    image: gcr.io/kaniko-project/executor:v1.23.2-debug
+    directory: ci/images/ansible
+    depends_on: []
+    environment:
+      GITEA_USER: gitea_admin
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG=$(date +%Y-%m-%d)
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/gitea_admin/ci-ansible:$TAG \
+          --destination gitea.renner.uno/gitea_admin/ci-ansible:latest
+
+  - name: build-k8s
+    image: gcr.io/kaniko-project/executor:v1.23.2-debug
+    directory: ci/images/k8s
+    depends_on: []
+    environment:
+      GITEA_USER: gitea_admin
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG=$(date +%Y-%m-%d)
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/gitea_admin/ci-k8s:$TAG \
+          --destination gitea.renner.uno/gitea_admin/ci-k8s:latest
@@ -0,0 +1,26 @@
+FROM alpine:3.21
+
+RUN apk add --no-cache \
+      ansible \
+      aws-cli \
+      bash \
+      bind-tools \
+      ca-certificates \
+      curl \
+      git \
+      jq \
+      openssh-client \
+      openssl \
+      python3 \
+      py3-pip \
+      rsync \
+      sops \
+      sshpass
+
+RUN pip3 install --break-system-packages --no-cache-dir \
+      proxmoxer \
+      requests
+
+RUN ansible-galaxy collection install \
+      community.proxmox \
+      community.docker
@@ -0,0 +1,24 @@
+FROM alpine:3.21
+
+ARG TALOS_VERSION=v1.12.6
+
+RUN apk add --no-cache \
+      bash \
+      bind-tools \
+      ca-certificates \
+      curl \
+      git \
+      openssh-client \
+      openssl \
+      sops
+
+RUN curl -sfL -o /usr/local/bin/talosctl \
+      "https://github.com/siderolabs/talos/releases/download/${TALOS_VERSION}/talosctl-linux-amd64" \
+ && chmod +x /usr/local/bin/talosctl
+
+RUN KUBECTL_VERSION="$(curl -sfL https://dl.k8s.io/release/stable.txt)" \
+ && curl -sfL -o /usr/local/bin/kubectl \
+      "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+ && chmod +x /usr/local/bin/kubectl
+
+RUN curl -sfL https://fluxcd.io/install.sh | bash