platform/manifests
1
0
Fork 0
Code Issues 8 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

proteus: Deploy for staging

Browse Source
This commit is contained in:
Moritz Jörg
2026-07-24 14:09:24 +02:00
parent 16178cf2d6
commit 8e410f761a
6 changed files with 132 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
values/proteus/manifests/network.yaml
+3 -10
View File
@@ -16,9 +16,6 @@ spec:
- ports:
- port: "7233"
protocol: TCP
# k8s API server (for batch/v1 Job create/poll/delete)
- toEntities:
- kube-apiserver
# DNS
- toEndpoints:
- matchLabels:
@@ -30,15 +27,11 @@ spec:
protocol: UDP
- port: "53"
protocol: TCP
# RabbitMQ on oceanbox: NodePorts (30672/31672) or MetalLB IPs on standard port 5672
# OTel collector (tos1 LoadBalancer 10.255.241.12) for Temporal traces, exported cross-cluster
- toCIDR:
- 10.255.241.0/24
- 10.255.241.12/32
toPorts:
- ports:
- port: "5672"
protocol: TCP
- port: "30672"
protocol: TCP
- port: "31672"
- port: "4317"
protocol: TCP
{{- end }}
values/proteus/manifests/pvc.yaml
+37
View File
@@ -0,0 +1,37 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-proteus-ceph-archives
spec:
accessModes:
- ReadWriteMany
capacity:
storage: 1Gi
csi:
driver: rook-ceph.cephfs.csi.ceph.com
nodeStageSecretRef:
name: rook-csi-cephfs-node
namespace: rook-ceph
volumeAttributes:
clusterID: rook-ceph
fsName: data
rootPath: /
staticVolume: "true"
volumeHandle: pv-proteus-ceph-archives
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: proteus-ceph-archives
namespace: proteus
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: ""
volumeMode: Filesystem
volumeName: pv-proteus-ceph-archives
values/proteus/manifests/rbac.yaml
-55
View File
@@ -1,55 +0,0 @@
# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`).
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: proteus-dev-queue
namespace: dev-queue
rules:
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["create", "delete", "get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: proteus-dev-queue
namespace: dev-queue
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: proteus-dev-queue
subjects:
- kind: ServiceAccount
name: default
namespace: proteus
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: proteus-prod-queue
namespace: prod-queue
rules:
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["create", "delete", "get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: proteus-prod-queue
namespace: prod-queue
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: proteus-prod-queue
subjects:
- kind: ServiceAccount
name: default
namespace: proteus
values/proteus/manifests/workerdeployment.yaml
+72 -13
View File
@@ -1,14 +1,10 @@
# TEMPORAL_NAMESPACE : {env}-atlantis
# ARCHIVE_PVC : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue)
# Status/inbox/quota now flow via Temporal activities to the Atlantis notify worker; no RabbitMQ.
# ---
# apiVersion: temporal.io/v1alpha1
# kind: WorkerDeployment
# metadata:
# name: proteus-prod
# namespace: proteus
# spec:
# replicas: 1
# replicas: 2
# workerOptions:
# temporalNamespace: prod-atlantis
# connectionRef:
@@ -21,14 +17,20 @@
# securityContext:
# runAsUser: 0
# runAsGroup: 0
# volumes:
# - name: archives
# persistentVolumeClaim:
# claimName: proteus-ceph-archives
# containers:
# - name: proteus
# image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
# image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
# resources:
# requests:
# memory: 256Mi
# limits:
# cpu: "1"
# memory: 1Gi
# limits:
# cpu: "2"
# memory: 4Gi
# env:
# - name: TEMPORAL_TASK_QUEUES
# value: plume,xtract
@@ -38,6 +40,32 @@
# value: prod
# - name: ARCHIVE_PVC
# value: prod-queue-ceph-archives
# - name: MAX_CONCURRENT_ACTIVITIES
# value: "2"
# - name: OTEL_EXPORTER_OTLP_ENDPOINT
# value: http://10.255.241.12:4317
# volumeMounts:
# - name: archives
# mountPath: /data
# ports:
# - name: health
# containerPort: 8080
# livenessProbe:
# httpGet:
# path: /healthz
# port: health
# initialDelaySeconds: 20
# periodSeconds: 15
# timeoutSeconds: 5
# failureThreshold: 6
# readinessProbe:
# httpGet:
# path: /readyz
# port: health
# initialDelaySeconds: 5
# periodSeconds: 15
# timeoutSeconds: 5
# failureThreshold: 3
# ---
# apiVersion: temporal.io/v1alpha1
# kind: WorkerDeployment
@@ -73,10 +101,9 @@
# value: beta-atlantis
# - name: APP_ENV
# value: beta
# # beta schedules into prod-queue (same as prod), so the same archive PVC.
# - name: ARCHIVE_PVC
# value: prod-queue-ceph-archives
# ---
---
apiVersion: temporal.io/v1alpha1
kind: WorkerDeployment
metadata:
@@ -96,14 +123,20 @@ spec:
securityContext:
runAsUser: 0
runAsGroup: 0
volumes:
- name: archives
persistentVolumeClaim:
claimName: proteus-ceph-archives
containers:
- name: proteus
image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
resources:
requests:
memory: 256Mi
limits:
cpu: 500m
memory: 1Gi
limits:
cpu: "2"
memory: 4Gi
env:
- name: TEMPORAL_TASK_QUEUES
value: plume,xtract
@@ -113,3 +146,29 @@ spec:
value: staging
- name: ARCHIVE_PVC
value: dev-queue-ceph-archives
- name: MAX_CONCURRENT_ACTIVITIES
value: "2"
- name: OTEL_EXPORTER_OTLP_ENDPOINT
value: http://10.255.241.12:4317
volumeMounts:
- name: archives
mountPath: /data
ports:
- name: health
containerPort: 8080
livenessProbe:
httpGet:
path: /healthz
port: health
initialDelaySeconds: 20
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 6
readinessProbe:
httpGet:
path: /readyz
port: health
initialDelaySeconds: 5
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3