temporal: Remove from tos1 and add proteus worker

helmfile.d/proteus.yaml.gotmpl

@@ -6,15 +6,15 @@ commonLabels:
 
 releases:
 - name: manifests
-  namespace: helmsman
+  namespace: proteus
   chart: manifests
-  condition: helmsman.enabled
+  condition: proteus.enabled
   missingFileHandler: Info
   values:
   - ../values/env.yaml
   - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/helmsman/env.yaml.gotmpl
+  - ../values/proteus/env.yaml.gotmpl
-  - ../values/helmsman/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/proteus/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   hooks:
   - events: [ prepare, cleanup ]
     showlogs: true
@@ -23,5 +23,5 @@ releases:
     - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
     - '{{`{{ .Release.Chart }}`}}'
     - '{{`{{ .Environment.Name }}`}}'
-    - ../values/helmsman/manifests
+    - ../values/proteus/manifests
     - manifests

values/helmsman/manifests/pvc.yaml

@@ -1,87 +0,0 @@
-# Both PVCs are the same cephfs `data` filesystem mounted at root: /data exposes the
-# hdd/data tree (ingest output), /work exposes the kraken/fvcom tree (case rundirs).
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-helmsman-data
-spec:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  claimRef:
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    name: ekman-data
-    namespace: helmsman
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-helmsman-data
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ekman-data
-  namespace: helmsman
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-helmsman-data
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-helmsman-work
-spec:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  claimRef:
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    name: ekman-work
-    namespace: helmsman
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-helmsman-work
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ekman-work
-  namespace: helmsman
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-helmsman-work

values/helmsman/manifests/slurm-token.yaml

@@ -1,10 +0,0 @@
-# Kyverno (sync-slurm-token) clones the real token from prod-atlantis into this secret.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: slurm-access-token
-  namespace: helmsman
-  annotations:
-    kyverno/clone: "true"
-type: Opaque
-data: {}

values/helmsman/manifests/workerdeployment.yaml

@@ -1,55 +0,0 @@
-apiVersion: temporal.io/v1alpha1
-kind: WorkerDeployment
-metadata:
-  name: helmsman
-  namespace: helmsman
-spec:
-  replicas: 1
-  workerOptions:
-    temporalNamespace: prod-helmsman
-    connectionRef:
-      name: temporal
-  rollout:
-    strategy: AllAtOnce
-  sunset: {}
-  template:
-    spec:
-      securityContext:
-        runAsUser: 0
-        runAsGroup: 0
-      containers:
-        - name: helmsman
-          image: git.oceanbox.io/oceanbox/churn/helmsman:v2.3.3
-          resources:
-            requests:
-              memory: 1Gi
-            limits:
-              memory: 8Gi
-          env:
-            - name: CHURN_TOOLS
-              value: binary
-            - name: DATA_ROOT
-              value: /data/hdd/data
-            - name: DATA_DIR
-              value: /work/kraken/fvcom/nml
-            - name: SLURM_BASE_URL
-              value: https://slurmrestd.ekman.oceanbox.io/
-            - name: SLURM_API
-              value: /slurm/v0.0.42/
-            - name: SLURM_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: slurm-access-token
-                  key: token
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: work
-              mountPath: /work
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: ekman-data
-        - name: work
-          persistentVolumeClaim:
-            claimName: ekman-work

values/proteus/env-ekman.yaml.gotmpl

@@ -1,2 +1,2 @@
-helmsman:
+proteus:
   enabled: true

values/proteus/env.yaml.gotmpl

@@ -1,3 +1,3 @@
-helmsman:
+proteus:
   enabled: false
   autosync: false

values/proteus/manifests/connection.yaml

@@ -2,6 +2,6 @@ apiVersion: temporal.io/v1alpha1
 kind: Connection
 metadata:
   name: temporal
-  namespace: helmsman
+  namespace: proteus
 spec:
   hostPort: temporal-frontend.temporal:7233

values/proteus/manifests/proteus.yaml

@@ -2,7 +2,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: helmsman
+  name: proteus
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -10,7 +10,7 @@ metadata:
   - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    namespace: helmsman
+    namespace: proteus
     server: 'https://kubernetes.default.svc'
   sources:
   - repoURL: {{ .Values.clusterConfig.manifests }}
@@ -24,7 +24,7 @@ spec:
       - name: HELMFILE_ENVIRONMENT
         value: default
       - name: HELMFILE_FILE_PATH
-        value: helmsman.yaml.gotmpl
+        value: proteus.yaml.gotmpl
   project: sys
   syncPolicy:
     managedNamespaceMetadata:
@@ -33,7 +33,7 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true
-    {{- if .Values.helmsman.autosync }}
+    {{- if .Values.proteus.autosync }}
     automated:
       prune: true
     {{- end }}

values/proteus/manifests/rbac.yaml

@@ -0,0 +1,55 @@
+# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`).
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-dev-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-prod-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus

values/proteus/manifests/workerdeployment.yaml

@@ -0,0 +1,138 @@
+# TEMPORAL_NAMESPACE  : {env}-atlantis
+# ARCHIVE_PVC                             : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue)
+# PROTEUS_EVENTS_QUEUE                     : {env}-proteus-job-events (queue the env's Atlantis binding reads)
+# RABBITMQ_CONNSTRING secret               : the broker that env's Atlantis consumes from (prod+beta share prod)
+# ---
+# apiVersion: temporal.io/v1alpha1
+# kind: WorkerDeployment
+# metadata:
+#   name: proteus-prod
+#   namespace: proteus
+# spec:
+#   replicas: 1
+#   workerOptions:
+#     temporalNamespace: prod-atlantis
+#     connectionRef:
+#       name: temporal
+#   rollout:
+#     strategy: AllAtOnce
+#   sunset: {}
+#   template:
+#     spec:
+#       securityContext:
+#         runAsUser: 0
+#         runAsGroup: 0
+#       containers:
+#         - name: proteus
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           resources:
+#             requests:
+#               memory: 256Mi
+#             limits:
+#               memory: 1Gi
+#           env:
+#             - name: TEMPORAL_TASK_QUEUES
+#               value: plume,xtract
+#             - name: TEMPORAL_NAMESPACE
+#               value: prod-atlantis
+#             - name: APP_ENV
+#               value: prod
+#             - name: ARCHIVE_PVC
+#               value: prod-queue-ceph-archives
+#             - name: PROTEUS_EVENTS_QUEUE
+#               value: prod-proteus-job-events
+#             - name: RABBITMQ_CONNSTRING
+#               valueFrom:
+#                 secretKeyRef:
+#                   name: proteus-rabbitmq-prod
+#                   key: connString
+# ---
+# apiVersion: temporal.io/v1alpha1
+# kind: WorkerDeployment
+# metadata:
+#   name: proteus-beta
+#   namespace: proteus
+# spec:
+#   replicas: 1
+#   workerOptions:
+#     temporalNamespace: beta-atlantis
+#     connectionRef:
+#       name: temporal
+#   rollout:
+#     strategy: AllAtOnce
+#   sunset: {}
+#   template:
+#     spec:
+#       securityContext:
+#         runAsUser: 0
+#         runAsGroup: 0
+#       containers:
+#         - name: proteus
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           resources:
+#             requests:
+#               memory: 256Mi
+#             limits:
+#               memory: 1Gi
+#           env:
+#             - name: TEMPORAL_TASK_QUEUES
+#               value: plume,xtract
+#             - name: TEMPORAL_NAMESPACE
+#               value: beta-atlantis
+#             - name: APP_ENV
+#               value: beta
+#             # beta schedules into prod-queue (same as prod), so the same archive PVC.
+#             - name: ARCHIVE_PVC
+#               value: prod-queue-ceph-archives
+#             - name: PROTEUS_EVENTS_QUEUE
+#               value: beta-proteus-job-events
+#             # beta shares the prod broker (its Atlantis binding uses prod-atlantis-rabbitmq).
+#             - name: RABBITMQ_CONNSTRING
+#               valueFrom:
+#                 secretKeyRef:
+#                   name: proteus-rabbitmq-prod
+#                   key: connString
+# ---
+apiVersion: temporal.io/v1alpha1
+kind: WorkerDeployment
+metadata:
+  name: proteus-staging
+  namespace: proteus
+spec:
+  replicas: 1
+  workerOptions:
+    temporalNamespace: staging-atlantis
+    connectionRef:
+      name: temporal
+  rollout:
+    strategy: AllAtOnce
+  sunset: {}
+  template:
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: proteus
+          image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+          resources:
+            requests:
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+          env:
+            - name: TEMPORAL_TASK_QUEUES
+              value: plume,xtract
+            - name: TEMPORAL_NAMESPACE
+              value: staging-atlantis
+            - name: APP_ENV
+              value: staging
+            - name: ARCHIVE_PVC
+              value: dev-queue-ceph-archives
+            - name: PROTEUS_EVENTS_QUEUE
+              value: staging-proteus-job-events
+            - name: RABBITMQ_CONNSTRING
+              valueFrom:
+                secretKeyRef:
+                  name: proteus-rabbitmq-staging
+                  key: connString

values/temporal/env-oceanbox.yaml.gotmpl

@@ -1,4 +1,4 @@
 temporal:
-  enabled: true
+  enabled: false
   autosync: false
-  ingress: true
+  ingress: false