proteus: Deploy for staging

values/atlantis/kustomize/staging/actor-config.yaml

@@ -3,10 +3,6 @@ kind: ConfigMap
 metadata:
   name: staging-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.5.1"
+  TEMPORAL_ADDRESS: "temporal-grpc.ekman.oceanbox.io:443"
-  XTRACT_QUEUE: "dev-queue"
+  TEMPORAL_TLS: "true"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.5.1"
-  PLUME_QUEUE: "dev-queue"
-  TEMPORAL_ADDRESS: "temporal-frontend.temporal:7233"
   TEMPORAL_NAMESPACE: "staging-atlantis"
-  TEMPORAL_TASK_QUEUE: "atlantis"

values/atlantis/manifests/network/allow-temporal.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-temporal
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: atlantis
+  egress:
+  - toFQDNs:
+    - matchName: temporal-grpc.ekman.oceanbox.io
+    toPorts:
+    - ports:
+      - port: "443"
+        protocol: TCP
+{{- end }}

values/proteus/manifests/network.yaml

@@ -16,9 +16,6 @@ spec:
     - ports:
       - port: "7233"
         protocol: TCP
-  # k8s API server (for batch/v1 Job create/poll/delete)
-  - toEntities:
-    - kube-apiserver
   # DNS
   - toEndpoints:
     - matchLabels:
@@ -30,15 +27,11 @@ spec:
         protocol: UDP
       - port: "53"
         protocol: TCP
-  # RabbitMQ on oceanbox: NodePorts (30672/31672) or MetalLB IPs on standard port 5672
+  # OTel collector (tos1 LoadBalancer 10.255.241.12) for Temporal traces, exported cross-cluster
   - toCIDR:
-    - 10.255.241.0/24
+    - 10.255.241.12/32
     toPorts:
     - ports:
-      - port: "5672"
+      - port: "4317"
-        protocol: TCP
-      - port: "30672"
-        protocol: TCP
-      - port: "31672"
         protocol: TCP
 {{- end }}

values/proteus/manifests/pvc.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-proteus-ceph-archives
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-proteus-ceph-archives
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: proteus-ceph-archives
+  namespace: proteus
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-proteus-ceph-archives

values/proteus/manifests/rbac.yaml

@@ -1,55 +0,0 @@
-# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`).
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: proteus-dev-queue
-  namespace: dev-queue
-rules:
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["create", "delete", "get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods", "pods/log"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: proteus-dev-queue
-  namespace: dev-queue
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: proteus-dev-queue
-subjects:
-  - kind: ServiceAccount
-    name: default
-    namespace: proteus
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: proteus-prod-queue
-  namespace: prod-queue
-rules:
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["create", "delete", "get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods", "pods/log"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: proteus-prod-queue
-  namespace: prod-queue
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: proteus-prod-queue
-subjects:
-  - kind: ServiceAccount
-    name: default
-    namespace: proteus

values/proteus/manifests/workerdeployment.yaml

@@ -1,14 +1,10 @@
-# TEMPORAL_NAMESPACE  : {env}-atlantis
-# ARCHIVE_PVC                             : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue)
-# Status/inbox/quota now flow via Temporal activities to the Atlantis notify worker; no RabbitMQ.
-# ---
 # apiVersion: temporal.io/v1alpha1
 # kind: WorkerDeployment
 # metadata:
 #   name: proteus-prod
 #   namespace: proteus
 # spec:
-#   replicas: 1
+#   replicas: 2
 #   workerOptions:
 #     temporalNamespace: prod-atlantis
 #     connectionRef:
@@ -21,14 +17,20 @@
 #       securityContext:
 #         runAsUser: 0
 #         runAsGroup: 0
+#       volumes:
+#         - name: archives
+#           persistentVolumeClaim:
+#             claimName: proteus-ceph-archives
 #       containers:
 #         - name: proteus
-#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
 #           resources:
 #             requests:
-#               memory: 256Mi
+#               cpu: "1"
-#             limits:
 #               memory: 1Gi
+#             limits:
+#               cpu: "2"
+#               memory: 4Gi
 #           env:
 #             - name: TEMPORAL_TASK_QUEUES
 #               value: plume,xtract
@@ -38,6 +40,32 @@
 #               value: prod
 #             - name: ARCHIVE_PVC
 #               value: prod-queue-ceph-archives
+#             - name: MAX_CONCURRENT_ACTIVITIES
+#               value: "2"
+#             - name: OTEL_EXPORTER_OTLP_ENDPOINT
+#               value: http://10.255.241.12:4317
+#           volumeMounts:
+#             - name: archives
+#               mountPath: /data
+#           ports:
+#             - name: health
+#               containerPort: 8080
+#           livenessProbe:
+#             httpGet:
+#               path: /healthz
+#               port: health
+#             initialDelaySeconds: 20
+#             periodSeconds: 15
+#             timeoutSeconds: 5
+#             failureThreshold: 6
+#           readinessProbe:
+#             httpGet:
+#               path: /readyz
+#               port: health
+#             initialDelaySeconds: 5
+#             periodSeconds: 15
+#             timeoutSeconds: 5
+#             failureThreshold: 3
 # ---
 # apiVersion: temporal.io/v1alpha1
 # kind: WorkerDeployment
@@ -73,10 +101,9 @@
 #               value: beta-atlantis
 #             - name: APP_ENV
 #               value: beta
-#             # beta schedules into prod-queue (same as prod), so the same archive PVC.
 #             - name: ARCHIVE_PVC
 #               value: prod-queue-ceph-archives
-# ---
+---
 apiVersion: temporal.io/v1alpha1
 kind: WorkerDeployment
 metadata:
@@ -96,14 +123,20 @@ spec:
       securityContext:
         runAsUser: 0
         runAsGroup: 0
+      volumes:
+        - name: archives
+          persistentVolumeClaim:
+            claimName: proteus-ceph-archives
       containers:
         - name: proteus
-          image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           resources:
             requests:
-              memory: 256Mi
+              cpu: 500m
-            limits:
               memory: 1Gi
+            limits:
+              cpu: "2"
+              memory: 4Gi
           env:
             - name: TEMPORAL_TASK_QUEUES
               value: plume,xtract
@@ -113,3 +146,29 @@ spec:
               value: staging
             - name: ARCHIVE_PVC
               value: dev-queue-ceph-archives
+            - name: MAX_CONCURRENT_ACTIVITIES
+              value: "2"
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: http://10.255.241.12:4317
+          volumeMounts:
+            - name: archives
+              mountPath: /data
+          ports:
+            - name: health
+              containerPort: 8080
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            initialDelaySeconds: 20
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: 5
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 3