helmsman: Scheduled workflows for fvcom

values/helmsman/env-ekman.yaml.gotmpl

@@ -0,0 +1,2 @@
+helmsman:
+  enabled: true

values/helmsman/env.yaml.gotmpl

@@ -0,0 +1,3 @@
+helmsman:
+  enabled: false
+  autosync: false

values/helmsman/manifests/connection.yaml

@@ -0,0 +1,7 @@
+apiVersion: temporal.io/v1alpha1
+kind: Connection
+metadata:
+  name: temporal
+  namespace: helmsman
+spec:
+  hostPort: temporal-frontend.temporal:7233

values/helmsman/manifests/helmsman.yaml

@@ -0,0 +1,40 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: helmsman
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: helmsman
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: helmsman.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+    {{- if .Values.helmsman.autosync }}
+    automated:
+      prune: true
+    {{- end }}
+{{- end }}

values/helmsman/manifests/pvc.yaml

@@ -0,0 +1,87 @@
+# Both PVCs are the same cephfs `data` filesystem mounted at root: /data exposes the
+# hdd/data tree (ingest output), /work exposes the kraken/fvcom tree (case rundirs).
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-helmsman-data
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: ekman-data
+    namespace: helmsman
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-helmsman-data
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ekman-data
+  namespace: helmsman
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-helmsman-data
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-helmsman-work
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: ekman-work
+    namespace: helmsman
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-helmsman-work
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ekman-work
+  namespace: helmsman
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-helmsman-work

values/helmsman/manifests/slurm-token.yaml

@@ -0,0 +1,10 @@
+# Kyverno (sync-slurm-token) clones the real token from prod-atlantis into this secret.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: slurm-access-token
+  namespace: helmsman
+  annotations:
+    kyverno/clone: "true"
+type: Opaque
+data: {}

values/helmsman/manifests/workerdeployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: temporal.io/v1alpha1
+kind: WorkerDeployment
+metadata:
+  name: helmsman
+  namespace: helmsman
+spec:
+  replicas: 1
+  workerOptions:
+    temporalNamespace: prod-helmsman
+    connectionRef:
+      name: temporal
+  rollout:
+    strategy: AllAtOnce
+  sunset: {}
+  template:
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: helmsman
+          image: git.oceanbox.io/oceanbox/churn/helmsman:v2.3.3
+          resources:
+            requests:
+              memory: 1Gi
+            limits:
+              memory: 8Gi
+          env:
+            - name: CHURN_TOOLS
+              value: binary
+            - name: DATA_ROOT
+              value: /data/hdd/data
+            - name: DATA_DIR
+              value: /work/kraken/fvcom/nml
+            - name: SLURM_BASE_URL
+              value: https://slurmrestd.ekman.oceanbox.io/
+            - name: SLURM_API
+              value: /slurm/v0.0.42/
+            - name: SLURM_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: slurm-access-token
+                  key: token
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: work
+              mountPath: /work
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: ekman-data
+        - name: work
+          persistentVolumeClaim:
+            claimName: ekman-work