Update ghcr.io/juanfont/headscale Docker tag to v0.28.0

helmfile.d/kueue.yaml.gotmpl

@@ -8,7 +8,7 @@ releases:
 - name: kueue
   namespace: kueue-system
   chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.15.0
+  version: 0.16.2
   condition: kueue.enabled
   values:
   - ../values/kueue/values/values.yaml

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.55
+  version: 0.2.56
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 82.10.1
+  version: 82.10.3
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/rabbitmq.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: {{ .Environment.Name }}-rabbitmq
   namespace: rabbitmq
   chart: bitnami/rabbitmq
-  version: 16.0.14
+  version: 13.0.3
   condition: rabbitmq.enabled
   values:
   - ../values/rabbitmq/values/values.yaml

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.7.2
+  version: 7.7.3
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 11.4.0
+  version: 12.0.0
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

nix/kueuectl.nix

@@ -0,0 +1,19 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "kueuectl";
+  version = "0.16.3";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "kueue";
+    rev = "v${version}";
+    hash = "sha256-JbU+ZoQ+YriaiIbbVCe45OTYycxYRanLhmQAdpE+xQ4=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [ "cmd/kueuectl" ];
+}

shell.nix

@@ -7,6 +7,7 @@ let
     overlays = [ ];
   };
   treefmt = import ./nix/treefmt.nix { };
+  kueuectl = pkgs.callPackage ./nix/kueuectl.nix { };
 in
 pkgs.mkShellNoCC {
   packages = [
@@ -27,6 +28,7 @@ pkgs.mkShellNoCC {
     pkgs.kubectl-rook-ceph
 
     # other tools activate when needed
+    kueuectl
     # pkgs.step-cli
     # pkgs.linkerd
     # pkgs.cmctl
@@ -40,7 +42,7 @@ pkgs.mkShellNoCC {
   ];
 
   # Environment variables
-  ARGOCD_ENV_CLUSTER_NAME = "hel1";
+  ARGOCD_ENV_CLUSTER_NAME = "ekman";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
   API_SERVER_IP = "localhost";
   API_SERVER_PORT = "7445";

values/cilium/env-ekman.yaml.gotmpl

@@ -1,8 +1,11 @@
 cilium:
   enabled: true
-  # WireGuard cannot be used during migration -- Flannel nodes have no WireGuard
+  clustermesh:
-  # keys so encrypted traffic is unreadable by them.
+    enabled: false
-  # TODO: re-enable after migration
+    clusterId: 2
+    # NodePort until L2LB is available (kubeproxyless)
+    apiserverServiceType: NodePort
+  # TODO: WireGuard blocks all traffic on ekman -- disable until root cause is found.
   encryption:
     enabled: false
   envoy:

values/cilium/env-oceanbox.yaml.gotmpl

@@ -1,5 +1,8 @@
 cilium:
   enabled: true
+  clustermesh:
+    enabled: false
+    clusterId: 1
   nodePort:
     enabled: true
   l2announcement:

values/cilium/env.yaml.gotmpl

@@ -30,4 +30,8 @@ cilium:
   loadbalancerPool:
     enabled: false
     cidr: []
+  clustermesh:
+    enabled: false
+    clusterId: 0
+    apiserverServiceType: LoadBalancer
   cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}

values/cilium/values/cilium.yaml.gotmpl

@@ -1,3 +1,16 @@
+cluster:
+  name: {{ .Values.cilium.cluster }}
+  id: {{ .Values.cilium.clustermesh.clusterId }}
+{{- if .Values.cilium.clustermesh.enabled }}
+clustermesh:
+  useAPIServer: true
+  apiserver:
+    service:
+      type: {{ .Values.cilium.clustermesh.apiserverServiceType }}
+    tls:
+      auto:
+        method: helm
+{{- end }}
 authentication:
   mutual:
     spire:
@@ -90,7 +103,7 @@ operator:
   prometheus:
     enabled: true
     port: 12301
-    serviceMointor:
+    serviceMonitor:
       enabled: true
       port: 12302
   rollOutPods: true

values/docs/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "e9fd3fc6-debug"
+  tag: "0d279bb9-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/headscale-router/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 
 args: [ "serve" ]
 

values/headscale/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 
 args: ["serve"]
 

values/jobset/manifests/jobset.yaml

@@ -38,7 +38,7 @@ spec:
    - group: ""
      kind: Secret
      name: jobset-webhook-server-cert
-     namespace: default
+     namespace: jobset-system
      jsonPointers:
        - /data
 {{- end }}

values/kueue/env-rossby.yaml.gotmpl

@@ -1,3 +0,0 @@
-kueue:
-  enabled: true
-  autosync: false

values/kueue/manifests/clusterQueue.yaml

@@ -1,51 +1,68 @@
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: ResourceFlavor
 metadata:
   name: compute # Just needs to exist, can be managed with tains/tolerations
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  nodeLabels:
+    node-role.kubernetes.io/compute: compute
+    topology.kubernetes.io/group: c1 # Only run on C1 for now
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: ClusterQueue
 metadata:
-   name: jobs
+   name: cluster-queue
+   annotations:
+     argocd.argoproj.io/sync-wave: "2"
 spec:
-  cohort: general
   namespaceSelector: {} # Accept workloads from any namespace
-  preemption:
+  queueingStrategy: BestEffortFIFO
-    withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
+  # preemption:
+    # withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
   resourceGroups:
    - coveredResources: ["cpu", "memory"] # Cover both memory and cpu resources
      flavors:
        - name: compute
          resources:
            - name: "cpu"
-             nominalQuota: '4'
+             nominalQuota: '32'
            - name: "memory"
-             nominalQuota: 8Gi
+             nominalQuota: 64Gi
+# ---
+# apiVersion: kueue.x-k8s.io/v1beta2
+# kind: LocalQueue
+# metadata:
+#   name: prod-queue
+#   namespace: prod-queue
+# spec:
+#   clusterQueue: cluster-queue
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: v1
-kind: LocalQueue
+kind: Namespace
 metadata:
-  name: prod-queue
+  name: dev-queue
-  namespace: prod-sorcerer
+  annotations:
-spec:
+    argocd.argoproj.io/sync-wave: "2"
-  clusterQueue: jobs
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: LocalQueue
 metadata:
   name: staging-queue
-  namespace: staging-sorcerer
+  namespace: dev-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
-  clusterQueue: jobs
+  clusterQueue: cluster-queue
----
+# ---
-apiVersion: kueue.x-k8s.io/v1beta1
+# apiVersion: kueue.x-k8s.io/v1beta2
-kind: WorkloadPriorityClass
+# kind: WorkloadPriorityClass
-metadata:
+# metadata:
-  name: "normal"
+#   name: "normal"
-value: 100
+# value: 100
----
+# ---
-apiVersion: kueue.x-k8s.io/v1beta1
+# apiVersion: kueue.x-k8s.io/v1beta2
-kind: WorkloadPriorityClass
+# kind: WorkloadPriorityClass
-metadata:
+# metadata:
-  name: "high"
+#   name: "high"
-value: 200 # Higher value = higher priority
+# value: 200 # Higher value = higher priority

values/kueue/manifests/ing.yaml

@@ -1,89 +0,0 @@
-{{- if eq .Values.clusterConfig.cluster "ekman"}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kueueviz-ingress
-  namespace: kueue-system
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
-spec:
-  rules:
-    - host: kueue.dev.tos.obx
-      http:
-        paths:
-          - path: /ws
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /api(/|$)(.*)
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-frontend
-                port:
-                  number: 8080
-  tls:
-    - hosts:
-        - kueue.dev.tos.obx
-      secretName: kueueviz-tls
-{{- end}}
----
-{{- if eq .Values.clusterConfig.cluster "rossby"}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kueueviz-ingress
-  namespace: kueue-system
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-spec:
-  rules:
-    - host: kueue.dev.vtn.obx
-      http:
-        paths:
-          - path: /ws
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /api(/|$)(.*)
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-frontend
-                port:
-                  number: 8080
-  tls:
-    - hosts:
-        - kueue.dev.vtn.obx
-      secretName: kueueviz-tls
-{{- end}}

values/kueue/manifests/kueue.yaml

@@ -5,6 +5,7 @@ metadata:
   name: kueue
   namespace: argocd
   annotations:
+    argocd.argoproj.io/sync-wave: "1"
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     argocd.argoproj.io/compare-options: ServerSideDiff=true
   finalizers:
@@ -27,7 +28,7 @@ spec:
         value: {{ .Values.kueue.env }}
       - name: HELMFILE_FILE_PATH
         value: kueue.yaml.gotmpl
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+  - repoURL: {{ .Values.clusterConfig.manifests }}
     targetRevision: main
     ref: values
   syncPolicy:
@@ -41,4 +42,3 @@ spec:
       selfHeal: false
     {{- end }}
 {{- end }}
-

values/kueue/values/values-ekman.yaml

@@ -1,9 +0,0 @@
-kueueViz:
-  backend:
-    env:
-      - name: KUEUEVIZ_ALLOWED_ORIGINS
-        value: "https://kueue.dev.tos.obx"
-  frontend:
-    env:
-      - name: REACT_APP_WEBSOCKET_URL
-        value: "wss://kueue.dev.tos.obx"

values/kueue/values/values-rossby.yaml

@@ -1,9 +0,0 @@
-kueueViz:
-  backend:
-    env:
-      - name: KUEUEVIZ_ALLOWED_ORIGINS
-        value: "https://kueue.dev.vtn.obx"
-  frontend:
-    env:
-      - name: REACT_APP_WEBSOCKET_URL
-        value: "wss://kueue.dev.vtn.obx"

values/kueue/values/values.yaml

@@ -1,12 +1,6 @@
-controllerManager:
+managerConfig:
-  featureGates:
-    - name: TopologyAwareScheduling
-      enabled: true
-    - name: LocalQueueMetrics
-      enabled: true
-  managerConfig:
   controllerManagerConfigYaml: |
-      apiVersion: config.kueue.x-k8s.io/v1beta1
+    apiVersion: config.kueue.x-k8s.io/v1beta2
     kind: Configuration
     integrations:
       frameworks:
@@ -14,8 +8,7 @@ controllerManager:
         - jobset.x-k8s.io/jobset
     internalCertManagement:
       enable: false
-enableCertManager: false
+enableCertManager: true
 enablePrometheus: true
 metrics:
   prometheusNamespace: prometheus
-enableKueueViz: true

values/velero/values/velero.yaml.gotmpl

@@ -72,7 +72,3 @@ metrics:
        for: 15m
        labels:
          severity: critical
-kubectl:
-  image:
-      repository: docker.io/bitnamilegacy/kubectl
-      tag: 1.33.4