From 5341253573357ab04791592707f2bfacb025c9d5 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 26 Sep 2026 20:56:51 +1000
Subject: [PATCH] Add Ceph RGW bucket for the shared Go build cache (#489)

Go builds on CI and laptops each rebuild the same packages from scratch. A
GOCACHEPROG backend needs an S3 bucket plus credentials before anything can
point at it, so provision those first. The bucket lives in the woodpecker
namespace because CI is the primary consumer and reads the Secret there.

- add Bucket and ObjectStoreUser for the shared Go build cache
- use default (replicated) placement rather than the ec target, since a build
  cache is millions of small objects
- purge and drop the bucket and user on delete; the cache is disposable

Nothing consumes the bucket yet.

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/489
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 apps/base/woodpecker/gocache_bucket.yaml | 33 ++++++++++++++++++++++++
 apps/base/woodpecker/kustomization.yaml  |  1 +
 2 files changed, 34 insertions(+)
 create mode 100644 apps/base/woodpecker/gocache_bucket.yaml

diff --git a/apps/base/woodpecker/gocache_bucket.yaml b/apps/base/woodpecker/gocache_bucket.yaml
new file mode 100644
index 0000000..8541b60
--- /dev/null
+++ b/apps/base/woodpecker/gocache_bucket.yaml
@@ -0,0 +1,33 @@
+---
+# Shared Go build cache (GOCACHEPROG) for CI and developer laptops. Lives in the
+# woodpecker namespace because CI is the primary consumer and reads the Secret here.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: gocache
+  namespace: woodpecker
+spec:
+  displayName: "Go build cache owner"
+  uid: gocache
+  maxBuckets: 1
+  secretName: gocache-s3
+  retainOnDelete: false
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: gocache
+  namespace: woodpecker
+spec:
+  bucketName: gocache
+  ownerRef: gocache
+  versioning: false
+  # No placementTarget: default (replicated) placement, not the ec target the
+  # backup buckets use — a build cache is millions of small objects.
+  tags:
+    app: gocache
+    purpose: go-build-cache
+  retainOnDelete: false
+  # A cache bucket is never empty, and the operator refuses to delete a
+  # non-empty bucket without this, wedging the finalizer.
+  purgeOnDelete: true
diff --git a/apps/base/woodpecker/kustomization.yaml b/apps/base/woodpecker/kustomization.yaml
index 627a499..ae394e2 100644
--- a/apps/base/woodpecker/kustomization.yaml
+++ b/apps/base/woodpecker/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
   - cnpg_pooler.yaml
+  - gocache_bucket.yaml
   - serviceaccount_arrproxy_ci.yaml
   - serviceaccount_autobackup_operator_ci.yaml
   - serviceaccount_ghp.yaml