temporal: Remove from tos1 and add proteus worker

values/proteus/env-ekman.yaml.gotmpl

@@ -0,0 +1,2 @@
+proteus:
+  enabled: true

values/proteus/env.yaml.gotmpl

@@ -0,0 +1,3 @@
+proteus:
+  enabled: false
+  autosync: false

values/proteus/manifests/connection.yaml

@@ -0,0 +1,7 @@
+apiVersion: temporal.io/v1alpha1
+kind: Connection
+metadata:
+  name: temporal
+  namespace: proteus
+spec:
+  hostPort: temporal-frontend.temporal:7233

values/proteus/manifests/proteus.yaml

@@ -0,0 +1,40 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: proteus
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: proteus
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: proteus.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+    {{- if .Values.proteus.autosync }}
+    automated:
+      prune: true
+    {{- end }}
+{{- end }}

values/proteus/manifests/rbac.yaml

@@ -0,0 +1,55 @@
+# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`).
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-dev-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-prod-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus

values/proteus/manifests/workerdeployment.yaml

@@ -0,0 +1,138 @@
+# TEMPORAL_NAMESPACE  : {env}-atlantis
+# ARCHIVE_PVC                             : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue)
+# PROTEUS_EVENTS_QUEUE                     : {env}-proteus-job-events (queue the env's Atlantis binding reads)
+# RABBITMQ_CONNSTRING secret               : the broker that env's Atlantis consumes from (prod+beta share prod)
+# ---
+# apiVersion: temporal.io/v1alpha1
+# kind: WorkerDeployment
+# metadata:
+#   name: proteus-prod
+#   namespace: proteus
+# spec:
+#   replicas: 1
+#   workerOptions:
+#     temporalNamespace: prod-atlantis
+#     connectionRef:
+#       name: temporal
+#   rollout:
+#     strategy: AllAtOnce
+#   sunset: {}
+#   template:
+#     spec:
+#       securityContext:
+#         runAsUser: 0
+#         runAsGroup: 0
+#       containers:
+#         - name: proteus
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           resources:
+#             requests:
+#               memory: 256Mi
+#             limits:
+#               memory: 1Gi
+#           env:
+#             - name: TEMPORAL_TASK_QUEUES
+#               value: plume,xtract
+#             - name: TEMPORAL_NAMESPACE
+#               value: prod-atlantis
+#             - name: APP_ENV
+#               value: prod
+#             - name: ARCHIVE_PVC
+#               value: prod-queue-ceph-archives
+#             - name: PROTEUS_EVENTS_QUEUE
+#               value: prod-proteus-job-events
+#             - name: RABBITMQ_CONNSTRING
+#               valueFrom:
+#                 secretKeyRef:
+#                   name: proteus-rabbitmq-prod
+#                   key: connString
+# ---
+# apiVersion: temporal.io/v1alpha1
+# kind: WorkerDeployment
+# metadata:
+#   name: proteus-beta
+#   namespace: proteus
+# spec:
+#   replicas: 1
+#   workerOptions:
+#     temporalNamespace: beta-atlantis
+#     connectionRef:
+#       name: temporal
+#   rollout:
+#     strategy: AllAtOnce
+#   sunset: {}
+#   template:
+#     spec:
+#       securityContext:
+#         runAsUser: 0
+#         runAsGroup: 0
+#       containers:
+#         - name: proteus
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           resources:
+#             requests:
+#               memory: 256Mi
+#             limits:
+#               memory: 1Gi
+#           env:
+#             - name: TEMPORAL_TASK_QUEUES
+#               value: plume,xtract
+#             - name: TEMPORAL_NAMESPACE
+#               value: beta-atlantis
+#             - name: APP_ENV
+#               value: beta
+#             # beta schedules into prod-queue (same as prod), so the same archive PVC.
+#             - name: ARCHIVE_PVC
+#               value: prod-queue-ceph-archives
+#             - name: PROTEUS_EVENTS_QUEUE
+#               value: beta-proteus-job-events
+#             # beta shares the prod broker (its Atlantis binding uses prod-atlantis-rabbitmq).
+#             - name: RABBITMQ_CONNSTRING
+#               valueFrom:
+#                 secretKeyRef:
+#                   name: proteus-rabbitmq-prod
+#                   key: connString
+# ---
+apiVersion: temporal.io/v1alpha1
+kind: WorkerDeployment
+metadata:
+  name: proteus-staging
+  namespace: proteus
+spec:
+  replicas: 1
+  workerOptions:
+    temporalNamespace: staging-atlantis
+    connectionRef:
+      name: temporal
+  rollout:
+    strategy: AllAtOnce
+  sunset: {}
+  template:
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: proteus
+          image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+          resources:
+            requests:
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+          env:
+            - name: TEMPORAL_TASK_QUEUES
+              value: plume,xtract
+            - name: TEMPORAL_NAMESPACE
+              value: staging-atlantis
+            - name: APP_ENV
+              value: staging
+            - name: ARCHIVE_PVC
+              value: dev-queue-ceph-archives
+            - name: PROTEUS_EVENTS_QUEUE
+              value: staging-proteus-job-events
+            - name: RABBITMQ_CONNSTRING
+              valueFrom:
+                secretKeyRef:
+                  name: proteus-rabbitmq-staging
+                  key: connString