From 257df7fe710d1f89754fa839aeefd5ac3712c921 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Moritz=20J=C3=B6rg?= Date: Thu, 25 Jun 2026 21:09:13 +0200 Subject: [PATCH] temporal: Remove from tos1 and add proteus worker --- ...lmsman.yaml.gotmpl => proteus.yaml.gotmpl} | 10 +- values/helmsman/manifests/pvc.yaml | 87 ----------- values/helmsman/manifests/slurm-token.yaml | 10 -- .../helmsman/manifests/workerdeployment.yaml | 55 ------- .../env-ekman.yaml.gotmpl | 2 +- values/{helmsman => proteus}/env.yaml.gotmpl | 2 +- .../manifests/connection.yaml | 2 +- .../manifests/proteus.yaml} | 8 +- values/proteus/manifests/rbac.yaml | 55 +++++++ .../proteus/manifests/workerdeployment.yaml | 138 ++++++++++++++++++ values/temporal/env-oceanbox.yaml.gotmpl | 4 +- 11 files changed, 207 insertions(+), 166 deletions(-) rename helmfile.d/{helmsman.yaml.gotmpl => proteus.yaml.gotmpl} (71%) delete mode 100644 values/helmsman/manifests/pvc.yaml delete mode 100644 values/helmsman/manifests/slurm-token.yaml delete mode 100644 values/helmsman/manifests/workerdeployment.yaml rename values/{helmsman => proteus}/env-ekman.yaml.gotmpl (61%) rename values/{helmsman => proteus}/env.yaml.gotmpl (77%) rename values/{helmsman => proteus}/manifests/connection.yaml (85%) rename values/{helmsman/manifests/helmsman.yaml => proteus/manifests/proteus.yaml} (88%) create mode 100644 values/proteus/manifests/rbac.yaml create mode 100644 values/proteus/manifests/workerdeployment.yaml diff --git a/helmfile.d/helmsman.yaml.gotmpl b/helmfile.d/proteus.yaml.gotmpl similarity index 71% rename from helmfile.d/helmsman.yaml.gotmpl rename to helmfile.d/proteus.yaml.gotmpl index a4f950b4..098afdb4 100644 --- a/helmfile.d/helmsman.yaml.gotmpl +++ b/helmfile.d/proteus.yaml.gotmpl @@ -6,15 +6,15 @@ commonLabels: releases: - name: manifests - namespace: helmsman + namespace: proteus chart: manifests - condition: helmsman.enabled + condition: proteus.enabled missingFileHandler: Info values: - ../values/env.yaml - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml - - ../values/helmsman/env.yaml.gotmpl - - ../values/helmsman/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl + - ../values/proteus/env.yaml.gotmpl + - ../values/proteus/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl hooks: - events: [ prepare, cleanup ] showlogs: true @@ -23,5 +23,5 @@ releases: - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}' - '{{`{{ .Release.Chart }}`}}' - '{{`{{ .Environment.Name }}`}}' - - ../values/helmsman/manifests + - ../values/proteus/manifests - manifests diff --git a/values/helmsman/manifests/pvc.yaml b/values/helmsman/manifests/pvc.yaml deleted file mode 100644 index 972377fb..00000000 --- a/values/helmsman/manifests/pvc.yaml +++ /dev/null @@ -1,87 +0,0 @@ -# Both PVCs are the same cephfs `data` filesystem mounted at root: /data exposes the -# hdd/data tree (ingest output), /work exposes the kraken/fvcom tree (case rundirs). -apiVersion: v1 -kind: PersistentVolume -metadata: - name: pv-helmsman-data -spec: - accessModes: - - ReadWriteMany - capacity: - storage: 1Gi - claimRef: - apiVersion: v1 - kind: PersistentVolumeClaim - name: ekman-data - namespace: helmsman - csi: - driver: rook-ceph.cephfs.csi.ceph.com - nodeStageSecretRef: - name: rook-csi-cephfs-node - namespace: rook-ceph - volumeAttributes: - clusterID: rook-ceph - fsName: data - rootPath: / - staticVolume: "true" - volumeHandle: pv-helmsman-data - persistentVolumeReclaimPolicy: Retain - volumeMode: Filesystem ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: ekman-data - namespace: helmsman -spec: - accessModes: - - ReadWriteMany - resources: - requests: - storage: 1Gi - storageClassName: "" - volumeMode: Filesystem - volumeName: pv-helmsman-data ---- -apiVersion: v1 -kind: PersistentVolume -metadata: - name: pv-helmsman-work -spec: - accessModes: - - ReadWriteMany - capacity: - storage: 1Gi - claimRef: - apiVersion: v1 - kind: PersistentVolumeClaim - name: ekman-work - namespace: helmsman - csi: - driver: rook-ceph.cephfs.csi.ceph.com - nodeStageSecretRef: - name: rook-csi-cephfs-node - namespace: rook-ceph - volumeAttributes: - clusterID: rook-ceph - fsName: data - rootPath: / - staticVolume: "true" - volumeHandle: pv-helmsman-work - persistentVolumeReclaimPolicy: Retain - volumeMode: Filesystem ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: ekman-work - namespace: helmsman -spec: - accessModes: - - ReadWriteMany - resources: - requests: - storage: 1Gi - storageClassName: "" - volumeMode: Filesystem - volumeName: pv-helmsman-work diff --git a/values/helmsman/manifests/slurm-token.yaml b/values/helmsman/manifests/slurm-token.yaml deleted file mode 100644 index 21e64b94..00000000 --- a/values/helmsman/manifests/slurm-token.yaml +++ /dev/null @@ -1,10 +0,0 @@ -# Kyverno (sync-slurm-token) clones the real token from prod-atlantis into this secret. -apiVersion: v1 -kind: Secret -metadata: - name: slurm-access-token - namespace: helmsman - annotations: - kyverno/clone: "true" -type: Opaque -data: {} diff --git a/values/helmsman/manifests/workerdeployment.yaml b/values/helmsman/manifests/workerdeployment.yaml deleted file mode 100644 index 9409d349..00000000 --- a/values/helmsman/manifests/workerdeployment.yaml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: temporal.io/v1alpha1 -kind: WorkerDeployment -metadata: - name: helmsman - namespace: helmsman -spec: - replicas: 1 - workerOptions: - temporalNamespace: prod-helmsman - connectionRef: - name: temporal - rollout: - strategy: AllAtOnce - sunset: {} - template: - spec: - securityContext: - runAsUser: 0 - runAsGroup: 0 - containers: - - name: helmsman - image: git.oceanbox.io/oceanbox/churn/helmsman:v2.3.3 - resources: - requests: - memory: 1Gi - limits: - memory: 8Gi - env: - - name: CHURN_TOOLS - value: binary - - name: DATA_ROOT - value: /data/hdd/data - - name: DATA_DIR - value: /work/kraken/fvcom/nml - - name: SLURM_BASE_URL - value: https://slurmrestd.ekman.oceanbox.io/ - - name: SLURM_API - value: /slurm/v0.0.42/ - - name: SLURM_TOKEN - valueFrom: - secretKeyRef: - name: slurm-access-token - key: token - volumeMounts: - - name: data - mountPath: /data - - name: work - mountPath: /work - volumes: - - name: data - persistentVolumeClaim: - claimName: ekman-data - - name: work - persistentVolumeClaim: - claimName: ekman-work diff --git a/values/helmsman/env-ekman.yaml.gotmpl b/values/proteus/env-ekman.yaml.gotmpl similarity index 61% rename from values/helmsman/env-ekman.yaml.gotmpl rename to values/proteus/env-ekman.yaml.gotmpl index 4305d2ba..60d83eb9 100644 --- a/values/helmsman/env-ekman.yaml.gotmpl +++ b/values/proteus/env-ekman.yaml.gotmpl @@ -1,2 +1,2 @@ -helmsman: +proteus: enabled: true diff --git a/values/helmsman/env.yaml.gotmpl b/values/proteus/env.yaml.gotmpl similarity index 77% rename from values/helmsman/env.yaml.gotmpl rename to values/proteus/env.yaml.gotmpl index 878e5c26..773c46e7 100644 --- a/values/helmsman/env.yaml.gotmpl +++ b/values/proteus/env.yaml.gotmpl @@ -1,3 +1,3 @@ -helmsman: +proteus: enabled: false autosync: false diff --git a/values/helmsman/manifests/connection.yaml b/values/proteus/manifests/connection.yaml similarity index 85% rename from values/helmsman/manifests/connection.yaml rename to values/proteus/manifests/connection.yaml index 0d35dcb0..558d8c61 100644 --- a/values/helmsman/manifests/connection.yaml +++ b/values/proteus/manifests/connection.yaml @@ -2,6 +2,6 @@ apiVersion: temporal.io/v1alpha1 kind: Connection metadata: name: temporal - namespace: helmsman + namespace: proteus spec: hostPort: temporal-frontend.temporal:7233 diff --git a/values/helmsman/manifests/helmsman.yaml b/values/proteus/manifests/proteus.yaml similarity index 88% rename from values/helmsman/manifests/helmsman.yaml rename to values/proteus/manifests/proteus.yaml index cb3579ec..c6a4dd49 100644 --- a/values/helmsman/manifests/helmsman.yaml +++ b/values/proteus/manifests/proteus.yaml @@ -2,7 +2,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: helmsman + name: proteus namespace: argocd annotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true @@ -10,7 +10,7 @@ metadata: - resources-finalizer.argocd.argoproj.io spec: destination: - namespace: helmsman + namespace: proteus server: 'https://kubernetes.default.svc' sources: - repoURL: {{ .Values.clusterConfig.manifests }} @@ -24,7 +24,7 @@ spec: - name: HELMFILE_ENVIRONMENT value: default - name: HELMFILE_FILE_PATH - value: helmsman.yaml.gotmpl + value: proteus.yaml.gotmpl project: sys syncPolicy: managedNamespaceMetadata: @@ -33,7 +33,7 @@ spec: syncOptions: - CreateNamespace=true - ApplyOutOfSyncOnly=true - {{- if .Values.helmsman.autosync }} + {{- if .Values.proteus.autosync }} automated: prune: true {{- end }} diff --git a/values/proteus/manifests/rbac.yaml b/values/proteus/manifests/rbac.yaml new file mode 100644 index 00000000..9d568683 --- /dev/null +++ b/values/proteus/manifests/rbac.yaml @@ -0,0 +1,55 @@ +# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`). +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: proteus-dev-queue + namespace: dev-queue +rules: + - apiGroups: ["batch"] + resources: ["jobs"] + verbs: ["create", "delete", "get", "list", "watch"] + - apiGroups: [""] + resources: ["pods", "pods/log"] + verbs: ["get", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: proteus-dev-queue + namespace: dev-queue +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: proteus-dev-queue +subjects: + - kind: ServiceAccount + name: default + namespace: proteus +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: proteus-prod-queue + namespace: prod-queue +rules: + - apiGroups: ["batch"] + resources: ["jobs"] + verbs: ["create", "delete", "get", "list", "watch"] + - apiGroups: [""] + resources: ["pods", "pods/log"] + verbs: ["get", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: proteus-prod-queue + namespace: prod-queue +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: proteus-prod-queue +subjects: + - kind: ServiceAccount + name: default + namespace: proteus diff --git a/values/proteus/manifests/workerdeployment.yaml b/values/proteus/manifests/workerdeployment.yaml new file mode 100644 index 00000000..d580c9ae --- /dev/null +++ b/values/proteus/manifests/workerdeployment.yaml @@ -0,0 +1,138 @@ +# TEMPORAL_NAMESPACE : {env}-atlantis +# ARCHIVE_PVC : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue) +# PROTEUS_EVENTS_QUEUE : {env}-proteus-job-events (queue the env's Atlantis binding reads) +# RABBITMQ_CONNSTRING secret : the broker that env's Atlantis consumes from (prod+beta share prod) +# --- +# apiVersion: temporal.io/v1alpha1 +# kind: WorkerDeployment +# metadata: +# name: proteus-prod +# namespace: proteus +# spec: +# replicas: 1 +# workerOptions: +# temporalNamespace: prod-atlantis +# connectionRef: +# name: temporal +# rollout: +# strategy: AllAtOnce +# sunset: {} +# template: +# spec: +# securityContext: +# runAsUser: 0 +# runAsGroup: 0 +# containers: +# - name: proteus +# image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME +# resources: +# requests: +# memory: 256Mi +# limits: +# memory: 1Gi +# env: +# - name: TEMPORAL_TASK_QUEUES +# value: plume,xtract +# - name: TEMPORAL_NAMESPACE +# value: prod-atlantis +# - name: APP_ENV +# value: prod +# - name: ARCHIVE_PVC +# value: prod-queue-ceph-archives +# - name: PROTEUS_EVENTS_QUEUE +# value: prod-proteus-job-events +# - name: RABBITMQ_CONNSTRING +# valueFrom: +# secretKeyRef: +# name: proteus-rabbitmq-prod +# key: connString +# --- +# apiVersion: temporal.io/v1alpha1 +# kind: WorkerDeployment +# metadata: +# name: proteus-beta +# namespace: proteus +# spec: +# replicas: 1 +# workerOptions: +# temporalNamespace: beta-atlantis +# connectionRef: +# name: temporal +# rollout: +# strategy: AllAtOnce +# sunset: {} +# template: +# spec: +# securityContext: +# runAsUser: 0 +# runAsGroup: 0 +# containers: +# - name: proteus +# image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME +# resources: +# requests: +# memory: 256Mi +# limits: +# memory: 1Gi +# env: +# - name: TEMPORAL_TASK_QUEUES +# value: plume,xtract +# - name: TEMPORAL_NAMESPACE +# value: beta-atlantis +# - name: APP_ENV +# value: beta +# # beta schedules into prod-queue (same as prod), so the same archive PVC. +# - name: ARCHIVE_PVC +# value: prod-queue-ceph-archives +# - name: PROTEUS_EVENTS_QUEUE +# value: beta-proteus-job-events +# # beta shares the prod broker (its Atlantis binding uses prod-atlantis-rabbitmq). +# - name: RABBITMQ_CONNSTRING +# valueFrom: +# secretKeyRef: +# name: proteus-rabbitmq-prod +# key: connString +# --- +apiVersion: temporal.io/v1alpha1 +kind: WorkerDeployment +metadata: + name: proteus-staging + namespace: proteus +spec: + replicas: 1 + workerOptions: + temporalNamespace: staging-atlantis + connectionRef: + name: temporal + rollout: + strategy: AllAtOnce + sunset: {} + template: + spec: + securityContext: + runAsUser: 0 + runAsGroup: 0 + containers: + - name: proteus + image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME + resources: + requests: + memory: 256Mi + limits: + memory: 1Gi + env: + - name: TEMPORAL_TASK_QUEUES + value: plume,xtract + - name: TEMPORAL_NAMESPACE + value: staging-atlantis + - name: APP_ENV + value: staging + - name: ARCHIVE_PVC + value: dev-queue-ceph-archives + - name: PROTEUS_EVENTS_QUEUE + value: staging-proteus-job-events + - name: RABBITMQ_CONNSTRING + valueFrom: + secretKeyRef: + name: proteus-rabbitmq-staging + key: connString diff --git a/values/temporal/env-oceanbox.yaml.gotmpl b/values/temporal/env-oceanbox.yaml.gotmpl index d5a66617..7e6377e2 100644 --- a/values/temporal/env-oceanbox.yaml.gotmpl +++ b/values/temporal/env-oceanbox.yaml.gotmpl @@ -1,4 +1,4 @@ temporal: - enabled: true + enabled: false autosync: false - ingress: true + ingress: false