helmsman: Scheduled workflows for fvcom

charts/fapr/Chart.yaml

@@ -1,6 +0,0 @@
-apiVersion: v2
-name: fapr
-description: A Helm chart for Fapr (F# Dapr workflow orchestrator)
-type: application
-version: v0.1.0
-appVersion: v0.1.0

charts/fapr/templates/_helpers.tpl

@@ -1,61 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "fapr.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-*/}}
-{{- define "fapr.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "fapr.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "fapr.labels" -}}
-helm.sh/chart: {{ include "fapr.chart" . }}
-{{ include "fapr.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "fapr.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "fapr.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "fapr.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create -}}
-    {{ default (include "fapr.fullname" .) .Values.serviceAccount.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccount.name }}
-{{- end -}}
-{{- end -}}

charts/fapr/templates/deployment.yaml

@@ -1,85 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  replicas: {{ .Values.replicaCount }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "fapr.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "fapr.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "fapr.serviceAccountName" . }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      containers:
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: {{ .Values.service.port }}
-              protocol: TCP
-          env:
-            {{- toYaml .Values.env | nindent 12 }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 15
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 3
-            periodSeconds: 10
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: appsettings
-              mountPath: /app/appsettings.json
-              subPath: appsettings.json
-              readOnly: true
-      volumes:
-        - name: data
-        {{- if .Values.persistence.enabled }}
-          persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existingClaim | default (include "fapr.fullname" .) }}
-        {{- else }}
-          emptyDir: {}
-        {{- end }}
-        - name: appsettings
-          configMap:
-            name: {{ include "fapr.fullname" . }}-appsettings
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}

charts/fapr/templates/pvc.yaml

@@ -1,21 +0,0 @@
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-{{ include "fapr.labels" . | indent 4 }}
-spec:
-  accessModes:
-    - {{ .Values.persistence.accessMode | quote }}
-  resources:
-    requests:
-      storage: {{ .Values.persistence.size | quote }}
-{{- if .Values.persistence.storageClass }}
-{{- if (eq "-" .Values.persistence.storageClass) }}
-  storageClassName: ""
-{{- else }}
-  storageClassName: "{{ .Values.persistence.storageClass }}"
-{{- end }}
-{{- end }}
-{{- end }}

charts/fapr/templates/redis.yaml

@@ -1,49 +0,0 @@
-{{- if .Values.redis.enabled -}}
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: {{ include "fapr.fullname" . }}-redis
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    linkerd.io/inject: disabled
-  labels:
-    app.kubernetes.io/created-by: dragonfly-operator
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  args:
-    - --dbfilename=dump
-    - --maxmemory=$(MAX_MEMORY)Mi
-    - --proactor_threads=1
-    - --logtostderr
-    - --save_schedule=
-  env:
-    - name: MAX_MEMORY
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-          divisor: 1Mi
-  replicas: {{ .Values.redis.replicas | default "1" }}
-  resources:
-    requests:
-      cpu: {{ .Values.redis.resources.cpu | default "100m" }}
-      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
-    limits:
-      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
-  authentication:
-    passwordFromSecret:
-      name: {{ .Values.redis.secret.name | default (printf "%s-redis" (include "fapr.fullname" .)) | quote }}
-      key: {{ .Values.redis.secret.key | quote }}
-  {{- if .Values.redis.backup.enabled }}
-  snapshot:
-    dir: /data
-    cron: "0 3 * * *"
-    enableOnMasterOnly: false
-    persistentVolumeClaimSpec:
-      storageClassName: {{ .Values.redis.storageClass | default "managed-nfs-storage" }}
-      accessModes:
-        - ReadWriteOnce
-      resources:
-        requests:
-          storage: {{ .Values.redis.size | default "1Gi" }}
-  {{- end }}
-{{- end }}

charts/fapr/templates/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "fapr.selectorLabels" . | nindent 4 }}

charts/fapr/templates/serviceaccount.yaml

@@ -1,12 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "fapr.serviceAccountName" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/fapr/values.yaml

@@ -1,67 +0,0 @@
-# Default values for fapr.
-
-replicaCount: 1
-image:
-  repository: git.oceanbox.io/oceanbox/fapr/fapr
-  tag: v0.1.0
-  pullPolicy: IfNotPresent
-env:
-  - name: APP_NAME
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.name
-  - name: APP_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-imagePullSecrets:
-  - name: gitlab-pull-secret
-nameOverride: ""
-fullnameOverride: ""
-serviceAccount:
-  create: true
-  annotations: {}
-  name: ""
-podAnnotations: {}
-podSecurityContext:
-  fsGroup: 0
-securityContext:
-  capabilities:
-    drop:
-      - ALL
-  readOnlyRootFilesystem: false
-  runAsNonRoot: false
-  runAsUser: 0
-service:
-  type: ClusterIP
-  port: 8080
-persistence:
-  enabled: true
-  existingClaim: ""
-  size: 1Gi
-  storageClass: "ceph-rbd"
-  accessMode: ReadWriteMany
-redis:
-  enabled: true
-  replicas: 1
-  backup:
-    enabled: false
-  size: 1Gi
-  storageClass: "ceph-rbd"
-  secret:
-    name: ""
-    key: "redis-password"
-  resources:
-    cpu: 100m
-    memory: 128Mi
-resources: {}
-autoscaling:
-  enabled: false
-  minReplicas: 1
-  maxReplicas: 3
-  targetCPUUtilizationPercentage: 80
-serviceMonitor:
-  enabled: false
-nodeSelector: {}
-tolerations: []
-affinity: {}

helmfile.d/fapr.yaml.gotmpl

@@ -1,39 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-commonLabels:
-  tier: oceanbox
-
-releases:
-- name: {{ .Environment.Name }}-fapr
-  namespace: {{ .Environment.Name }}-fapr
-  chart: ../charts/fapr
-  condition: fapr.enabled
-  values:
-  - ../values/fapr/values/values.yaml
-  - ../values/fapr/values/values-{{ .Environment.Name }}.yaml
-  - ../values/fapr/values/values-{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/fapr/kustomize/{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}
-  missingFileHandler: Info
-- name: manifests
-  namespace: {{ .Environment.Name }}-fapr
-  chart: manifests
-  condition: fapr.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/fapr/env.yaml.gotmpl
-  - ../values/fapr/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/fapr/manifests
-    - manifests

helmfile.d/helmsman.yaml.gotmpl

@@ -0,0 +1,27 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: system
+
+releases:
+- name: manifests
+  namespace: helmsman
+  chart: manifests
+  condition: helmsman.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/helmsman/env.yaml.gotmpl
+  - ../values/helmsman/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/helmsman/manifests
+    - manifests

values/fapr/env.yaml.gotmpl

@@ -1,4 +0,0 @@
-fapr:
-  enabled: true
-  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
-  env: {{ .Environment.Name }}

values/fapr/kustomize/base/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - _manifest.yaml

values/fapr/kustomize/prod-ekman/appsettings.json

@@ -1,20 +0,0 @@
-{
-  "appName": "fapr",
-  "appEnv": "prod",
-  "logLevel": "Information",
-  "aromeOutputDir": "/data/hdd/data/AROME",
-  "aromeStartDate": "2026-04-24",
-  "nveOutputDir": "/data/hdd/data/river-data/Data",
-  "nveNdays": 5000,
-  "nveApiUrl": "https://chartserver.nve.no/ShowData.aspx?req=getchart&ver=1.0",
-  "riverrunBinary": "/app/riverrun",
-  "norshelfOutputDir": "/data/hdd/data/norshelf/sea_norshelf_files",
-  "norshelfStartDate": "2026-03-01",
-  "nemoOutputDir": "/data/hdd/data/NEMO",
-  "copernicusmarineBinary": "/usr/local/bin/copernicusmarine",
-  "copernicusUsername": "",
-  "copernicusPassword": "",
-  "murOutputDir": "/data/hdd/data/river-data/MUR/MUR_SST_nc",
-  "netrcPath": "/root/.netrc",
-  "norkystOutputDir": "/data/hdd/data/norkyst"
-}

values/fapr/kustomize/prod-ekman/cron-bindings.yaml

@@ -1,77 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-arome
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 6 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-nve
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 8 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-norshelf
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-nemo
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-mur
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 6 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-norkyst
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr

values/fapr/kustomize/prod-ekman/deployment_patch.yaml

@@ -1,3 +0,0 @@
-- op: add
-  path: /spec/template/spec/containers/0/envFrom
-  value: []

values/fapr/kustomize/prod-ekman/kustomization.yaml

@@ -1,21 +0,0 @@
-generatorOptions:
-  disableNameSuffixHash: true
-configMapGenerator:
-  - name: prod-fapr-appsettings
-    files:
-      - appsettings.json
-patches:
-  - target:
-      group: apps
-      version: v1
-      kind: Deployment
-    path: deployment_patch.yaml
-resources:
-  - ../base
-  - pv.yaml
-  - pvc.yaml
-  - secrets.yaml
-  - secretstore.yaml
-  - statestore.yaml
-  - tracing.yaml
-  - cron-bindings.yaml

values/fapr/kustomize/prod-ekman/pv.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-prod-fapr-ceph-data
-spec:
-  accessModes:
-    - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-prod-fapr-ceph-data
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem

values/fapr/kustomize/prod-ekman/pvc.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prod-fapr-ceph-data
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-prod-fapr-ceph-data

values/fapr/kustomize/prod-ekman/secrets.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: prod-fapr-redis
-type: Opaque
-data:

values/fapr/kustomize/prod-ekman/secretstore.yaml

@@ -1,12 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: secretstore
-spec:
-  type: secretstores.kubernetes
-  version: v1
-  metadata:
-    - name: defaultNamespace
-      value: prod-fapr
-scopes:
-  - prod-fapr

values/fapr/kustomize/prod-ekman/statestore.yaml

@@ -1,22 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: statestore
-spec:
-  type: state.redis
-  version: v1
-  metadata:
-    - name: redisHost
-      value: prod-fapr-redis:6379
-    - name: redisUsername
-      value: default
-    - name: redisPassword
-      secretKeyRef:
-        name: prod-fapr-redis
-        key: redis-password
-    - name: actorStateStore
-      value: "true"
-    - name: redisDB
-      value: "0"
-scopes:
-  - prod-fapr

values/fapr/kustomize/prod-ekman/tracing.yaml

@@ -1,11 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Configuration
-metadata:
-  name: tracing
-spec:
-  tracing:
-    samplingRate: "1"
-    otel:
-      endpointAddress: "10.255.241.12:4317"
-      protocol: grpc
-      isSecure: false

values/fapr/values/values-prod.yaml

@@ -1,55 +0,0 @@
-replicaCount: 1
-
-podAnnotations:
-  dapr.io/enabled: "true"
-  dapr.io/app-id: "prod-fapr"
-  dapr.io/app-port: "8080"
-  dapr.io/api-token-secret: "dapr-api-token"
-  dapr.io/config: "tracing"
-  dapr.io/app-protocol: "http"
-  dapr.io/log-as-json: "true"
-  dapr.io/sidecar-cpu-request: "10m"
-  dapr.io/sidecar-memory-request: "50Mi"
-
-env:
-  - name: APP_NAME
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.name
-  - name: APP_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-  - name: DAPR_API_TOKEN
-    valueFrom:
-      secretKeyRef:
-        name: dapr-api-token
-        key: token
-
-persistence:
-  enabled: true
-  existingClaim: prod-fapr-ceph-data
-
-redis:
-  enabled: true
-  replicas: 1
-  backup:
-    enabled: true
-  size: 2Gi
-  storageClass: "ceph-rbd"
-  secret:
-    name: "prod-fapr-redis"
-    key: "redis-password"
-  resources:
-    cpu: 100m
-    memory: 128Mi
-
-affinity:
-  nodeAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: "topology.kubernetes.io/group"
-              operator: In
-              values:
-                - srv

values/fapr/values/values.yaml

@@ -1 +0,0 @@
-# Base values for fapr - overridden per environment

values/helmsman/env-ekman.yaml.gotmpl

@@ -1,2 +1,2 @@
-fapr:
+helmsman:
   enabled: true

values/helmsman/env.yaml.gotmpl

@@ -0,0 +1,3 @@
+helmsman:
+  enabled: false
+  autosync: false

values/helmsman/manifests/connection.yaml

@@ -0,0 +1,7 @@
+apiVersion: temporal.io/v1alpha1
+kind: Connection
+metadata:
+  name: temporal
+  namespace: helmsman
+spec:
+  hostPort: temporal-frontend.temporal:7233

values/helmsman/manifests/helmsman.yaml

@@ -1,19 +1,17 @@
-{{ if .Values.clusterConfig.argo.enabled }}
+{{- if .Values.clusterConfig.argo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: {{ .Values.fapr.env }}-fapr
+  name: helmsman
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-    argocd.argoproj.io/compare-options: ServerSideDiff=true
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    namespace: {{ .Values.fapr.env }}-fapr
+    namespace: helmsman
-    server: https://kubernetes.default.svc
+    server: 'https://kubernetes.default.svc'
-  project: atlantis
   sources:
   - repoURL: {{ .Values.clusterConfig.manifests }}
     targetRevision: HEAD
@@ -24,19 +22,19 @@ spec:
       - name: CLUSTER_NAME
         value: {{ .Values.clusterConfig.cluster }}
       - name: HELMFILE_ENVIRONMENT
-        value: {{ .Values.fapr.env }}
+        value: default
       - name: HELMFILE_FILE_PATH
-        value: fapr.yaml.gotmpl
+        value: helmsman.yaml.gotmpl
-  - repoURL: https://git.oceanbox.io/platform/manifests.git
+  project: sys
-    targetRevision: main
-    ref: values
   syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true
-    {{- if .Values.fapr.autosync }}
+    {{- if .Values.helmsman.autosync }}
     automated:
       prune: true
-      selfHeal: false
     {{- end }}
 {{- end }}

values/helmsman/manifests/pvc.yaml

@@ -0,0 +1,87 @@
+# Both PVCs are the same cephfs `data` filesystem mounted at root: /data exposes the
+# hdd/data tree (ingest output), /work exposes the kraken/fvcom tree (case rundirs).
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-helmsman-data
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: ekman-data
+    namespace: helmsman
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-helmsman-data
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ekman-data
+  namespace: helmsman
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-helmsman-data
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-helmsman-work
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: ekman-work
+    namespace: helmsman
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-helmsman-work
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ekman-work
+  namespace: helmsman
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-helmsman-work

values/helmsman/manifests/slurm-token.yaml

@@ -0,0 +1,10 @@
+# Kyverno (sync-slurm-token) clones the real token from prod-atlantis into this secret.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: slurm-access-token
+  namespace: helmsman
+  annotations:
+    kyverno/clone: "true"
+type: Opaque
+data: {}

values/helmsman/manifests/workerdeployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: temporal.io/v1alpha1
+kind: WorkerDeployment
+metadata:
+  name: helmsman
+  namespace: helmsman
+spec:
+  replicas: 1
+  workerOptions:
+    temporalNamespace: prod-helmsman
+    connectionRef:
+      name: temporal
+  rollout:
+    strategy: AllAtOnce
+  sunset: {}
+  template:
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: helmsman
+          image: git.oceanbox.io/oceanbox/churn/helmsman:v2.3.3
+          resources:
+            requests:
+              memory: 1Gi
+            limits:
+              memory: 8Gi
+          env:
+            - name: CHURN_TOOLS
+              value: binary
+            - name: DATA_ROOT
+              value: /data/hdd/data
+            - name: DATA_DIR
+              value: /work/kraken/fvcom/nml
+            - name: SLURM_BASE_URL
+              value: https://slurmrestd.ekman.oceanbox.io/
+            - name: SLURM_API
+              value: /slurm/v0.0.42/
+            - name: SLURM_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: slurm-access-token
+                  key: token
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: work
+              mountPath: /work
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: ekman-data
+        - name: work
+          persistentVolumeClaim:
+            claimName: ekman-work