From 8e410f761ae57d53ac27d1a3cf7007d83af945c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Moritz=20J=C3=B6rg?= Date: Fri, 24 Jul 2026 14:09:24 +0200 Subject: [PATCH] proteus: Deploy for staging --- .../kustomize/staging/actor-config.yaml | 8 +- .../manifests/network/allow-temporal.yaml | 18 ++++ values/proteus/manifests/network.yaml | 13 +-- values/proteus/manifests/pvc.yaml | 37 ++++++++ values/proteus/manifests/rbac.yaml | 55 ------------ .../proteus/manifests/workerdeployment.yaml | 85 ++++++++++++++++--- 6 files changed, 132 insertions(+), 84 deletions(-) create mode 100644 values/atlantis/manifests/network/allow-temporal.yaml create mode 100644 values/proteus/manifests/pvc.yaml delete mode 100644 values/proteus/manifests/rbac.yaml diff --git a/values/atlantis/kustomize/staging/actor-config.yaml b/values/atlantis/kustomize/staging/actor-config.yaml index a158c52a..b8070ff4 100644 --- a/values/atlantis/kustomize/staging/actor-config.yaml +++ b/values/atlantis/kustomize/staging/actor-config.yaml @@ -3,10 +3,6 @@ kind: ConfigMap metadata: name: staging-atlantis-actor-config data: - XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.5.1" - XTRACT_QUEUE: "dev-queue" - PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.5.1" - PLUME_QUEUE: "dev-queue" - TEMPORAL_ADDRESS: "temporal-frontend.temporal:7233" + TEMPORAL_ADDRESS: "temporal-grpc.ekman.oceanbox.io:443" + TEMPORAL_TLS: "true" TEMPORAL_NAMESPACE: "staging-atlantis" - TEMPORAL_TASK_QUEUE: "atlantis" diff --git a/values/atlantis/manifests/network/allow-temporal.yaml b/values/atlantis/manifests/network/allow-temporal.yaml new file mode 100644 index 00000000..fa8c22b4 --- /dev/null +++ b/values/atlantis/manifests/network/allow-temporal.yaml @@ -0,0 +1,18 @@ +{{- if .Values.clusterConfig.cilium.enabled }} +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: allow-temporal + namespace: {{ .Release.Namespace }} +spec: + endpointSelector: + matchLabels: + app.kubernetes.io/name: atlantis + egress: + - toFQDNs: + - matchName: temporal-grpc.ekman.oceanbox.io + toPorts: + - ports: + - port: "443" + protocol: TCP +{{- end }} diff --git a/values/proteus/manifests/network.yaml b/values/proteus/manifests/network.yaml index 01ee1ca8..ed554da3 100644 --- a/values/proteus/manifests/network.yaml +++ b/values/proteus/manifests/network.yaml @@ -16,9 +16,6 @@ spec: - ports: - port: "7233" protocol: TCP - # k8s API server (for batch/v1 Job create/poll/delete) - - toEntities: - - kube-apiserver # DNS - toEndpoints: - matchLabels: @@ -30,15 +27,11 @@ spec: protocol: UDP - port: "53" protocol: TCP - # RabbitMQ on oceanbox: NodePorts (30672/31672) or MetalLB IPs on standard port 5672 + # OTel collector (tos1 LoadBalancer 10.255.241.12) for Temporal traces, exported cross-cluster - toCIDR: - - 10.255.241.0/24 + - 10.255.241.12/32 toPorts: - ports: - - port: "5672" - protocol: TCP - - port: "30672" - protocol: TCP - - port: "31672" + - port: "4317" protocol: TCP {{- end }} diff --git a/values/proteus/manifests/pvc.yaml b/values/proteus/manifests/pvc.yaml new file mode 100644 index 00000000..2c3c25ea --- /dev/null +++ b/values/proteus/manifests/pvc.yaml @@ -0,0 +1,37 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + name: pv-proteus-ceph-archives +spec: + accessModes: + - ReadWriteMany + capacity: + storage: 1Gi + csi: + driver: rook-ceph.cephfs.csi.ceph.com + nodeStageSecretRef: + name: rook-csi-cephfs-node + namespace: rook-ceph + volumeAttributes: + clusterID: rook-ceph + fsName: data + rootPath: / + staticVolume: "true" + volumeHandle: pv-proteus-ceph-archives + persistentVolumeReclaimPolicy: Retain + volumeMode: Filesystem +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: proteus-ceph-archives + namespace: proteus +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 1Gi + storageClassName: "" + volumeMode: Filesystem + volumeName: pv-proteus-ceph-archives diff --git a/values/proteus/manifests/rbac.yaml b/values/proteus/manifests/rbac.yaml deleted file mode 100644 index 9d568683..00000000 --- a/values/proteus/manifests/rbac.yaml +++ /dev/null @@ -1,55 +0,0 @@ -# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`). ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: proteus-dev-queue - namespace: dev-queue -rules: - - apiGroups: ["batch"] - resources: ["jobs"] - verbs: ["create", "delete", "get", "list", "watch"] - - apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: proteus-dev-queue - namespace: dev-queue -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: proteus-dev-queue -subjects: - - kind: ServiceAccount - name: default - namespace: proteus ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: proteus-prod-queue - namespace: prod-queue -rules: - - apiGroups: ["batch"] - resources: ["jobs"] - verbs: ["create", "delete", "get", "list", "watch"] - - apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: proteus-prod-queue - namespace: prod-queue -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: proteus-prod-queue -subjects: - - kind: ServiceAccount - name: default - namespace: proteus diff --git a/values/proteus/manifests/workerdeployment.yaml b/values/proteus/manifests/workerdeployment.yaml index cda766cc..2437a2ea 100644 --- a/values/proteus/manifests/workerdeployment.yaml +++ b/values/proteus/manifests/workerdeployment.yaml @@ -1,14 +1,10 @@ -# TEMPORAL_NAMESPACE : {env}-atlantis -# ARCHIVE_PVC : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue) -# Status/inbox/quota now flow via Temporal activities to the Atlantis notify worker; no RabbitMQ. -# --- # apiVersion: temporal.io/v1alpha1 # kind: WorkerDeployment # metadata: # name: proteus-prod # namespace: proteus # spec: -# replicas: 1 +# replicas: 2 # workerOptions: # temporalNamespace: prod-atlantis # connectionRef: @@ -21,14 +17,20 @@ # securityContext: # runAsUser: 0 # runAsGroup: 0 +# volumes: +# - name: archives +# persistentVolumeClaim: +# claimName: proteus-ceph-archives # containers: # - name: proteus -# image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME +# image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0 # resources: # requests: -# memory: 256Mi -# limits: +# cpu: "1" # memory: 1Gi +# limits: +# cpu: "2" +# memory: 4Gi # env: # - name: TEMPORAL_TASK_QUEUES # value: plume,xtract @@ -38,6 +40,32 @@ # value: prod # - name: ARCHIVE_PVC # value: prod-queue-ceph-archives +# - name: MAX_CONCURRENT_ACTIVITIES +# value: "2" +# - name: OTEL_EXPORTER_OTLP_ENDPOINT +# value: http://10.255.241.12:4317 +# volumeMounts: +# - name: archives +# mountPath: /data +# ports: +# - name: health +# containerPort: 8080 +# livenessProbe: +# httpGet: +# path: /healthz +# port: health +# initialDelaySeconds: 20 +# periodSeconds: 15 +# timeoutSeconds: 5 +# failureThreshold: 6 +# readinessProbe: +# httpGet: +# path: /readyz +# port: health +# initialDelaySeconds: 5 +# periodSeconds: 15 +# timeoutSeconds: 5 +# failureThreshold: 3 # --- # apiVersion: temporal.io/v1alpha1 # kind: WorkerDeployment @@ -73,10 +101,9 @@ # value: beta-atlantis # - name: APP_ENV # value: beta -# # beta schedules into prod-queue (same as prod), so the same archive PVC. # - name: ARCHIVE_PVC # value: prod-queue-ceph-archives -# --- +--- apiVersion: temporal.io/v1alpha1 kind: WorkerDeployment metadata: @@ -96,14 +123,20 @@ spec: securityContext: runAsUser: 0 runAsGroup: 0 + volumes: + - name: archives + persistentVolumeClaim: + claimName: proteus-ceph-archives containers: - name: proteus - image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0 + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" resources: requests: - memory: 256Mi - limits: + cpu: 500m memory: 1Gi + limits: + cpu: "2" + memory: 4Gi env: - name: TEMPORAL_TASK_QUEUES value: plume,xtract @@ -113,3 +146,29 @@ spec: value: staging - name: ARCHIVE_PVC value: dev-queue-ceph-archives + - name: MAX_CONCURRENT_ACTIVITIES + value: "2" + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: http://10.255.241.12:4317 + volumeMounts: + - name: archives + mountPath: /data + ports: + - name: health + containerPort: 8080 + livenessProbe: + httpGet: + path: /healthz + port: health + initialDelaySeconds: 20 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readyz + port: health + initialDelaySeconds: 5 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3