Update Helm release argo-cd to v10

This reverts commit 45abe7cb15.

It turns out some temporal-related work needs doing before beta can be
deployed

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.29
+version: v2.24.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.29
+appVersion: v2.24.1
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.42.29
+  tag: v2.24.1
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.42.29
+version: v2.24.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.42.29"
+appVersion: "v2.24.1"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.42.29
+  tag: v2.24.1
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.29
+version: v2.24.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.29
+appVersion: v2.24.1
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.42.29
+  tag: v2.24.1
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.5.21
+  version: 10.2.2
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 1.0.16
+  version: 1.0.19
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests

helmfile.d/clickhouse.yaml.gotmpl

@@ -0,0 +1,53 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: clickhouse
+  url: ghcr.io/clickhouse
+  oci: true
+
+commonLabels:
+  tier: system
+
+releases:
+- name: clickhouse-operator
+  namespace: clickhouse
+  chart: clickhouse/clickhouse-operator-helm
+  version: 0.0.6
+  condition: clickhouse.enabled
+  values:
+  - ../values/clickhouse/values/operator.yaml.gotmpl
+  missingFileHandler: Info
+- name: clickhouse-cluster
+  namespace: clickhouse
+  chart: clickhouse/clickhouse-cluster-helm
+  version: 0.0.6
+  condition: clickhouse.enabled
+  needs:
+  - clickhouse/clickhouse-operator
+  values:
+  - ../values/clickhouse/values/cluster.yaml.gotmpl
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/clickhouse/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: clickhouse
+  chart: manifests
+  condition: clickhouse.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/clickhouse/env.yaml.gotmpl
+  - ../values/clickhouse/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/clickhouse/manifests
+    - manifests

helmfile.d/dragonfly.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
   namespace: dragonfly
   chart: dragonfly/dragonfly-operator
-  version: v1.5.0
+  version: v1.6.1
   condition: dragonfly.enabled
   values:
   - ../values/dragonfly/values/dragonfly.yaml.gotmpl

helmfile.d/ingress-haproxy.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: ingress-haproxy
   namespace: ingress-haproxy
   chart: haproxytech/kubernetes-ingress
-  version: 1.52.0
+  version: 1.52.1
   condition: haproxy.enabled
   values:
   - ../values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl

helmfile.d/kueue.yaml.gotmpl

@@ -8,7 +8,7 @@ releases:
 - name: kueue
   namespace: kueue-system
   chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.17.3
+  version: 0.18.1
   condition: kueue.enabled
   values:
   - ../values/kueue/values/values.yaml

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.3.8
+  version: 0.3.10
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,10 +12,10 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.158.1
+  version: 0.159.1
   condition: otel.enabled
   values:
-  - ../values/opentelemetry-collector/values/values.yaml
+  - ../values/opentelemetry-collector/values/values.yaml.gotmpl
   - ../values/opentelemetry-collector/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/postgres-operator.yaml.gotmpl

@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
   namespace: cnpg
   chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.6.0
+  version: 0.7.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl

helmfile.d/proteus.yaml.gotmpl

@@ -15,6 +15,7 @@ releases:
   - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
   - ../values/proteus/env.yaml.gotmpl
   - ../values/proteus/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/proteus/values/values-staging.yaml
   hooks:
   - events: [ prepare, cleanup ]
     showlogs: true

helmfile.d/spegel.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: spegel
   namespace: spegel
   chart: spegel/spegel
-  version: 0.7.1
+  version: 0.7.3
   condition: spegel.enabled
   values:
   - ../values/spegel/values/spegel.yaml.gotmpl

helmfile.d/temporal.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: temporal
   namespace: temporal
   chart: temporal/temporal
-  version: 1.2.0
+  version: 1.5.0
   condition: temporal.enabled
   missingFileHandler: Info
   values:

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.9.4
+  version: 7.10.10
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/uptermd.yaml.gotmpl

@@ -0,0 +1,43 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: upterm
+  url: https://upterm.dev
+
+commonLabels:
+  tier: system
+
+releases:
+- name: uptermd
+  namespace: uptermd
+  chart: upterm/uptermd
+  version: 0.2.0
+  condition: uptermd.enabled
+  values:
+  - ../values/uptermd/values/values.yaml
+  - ../values/uptermd/values/values-{{ .Environment.Name }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/uptermd/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: uptermd
+  chart: manifests
+  condition: uptermd.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/uptermd/env.yaml.gotmpl
+  - ../values/uptermd/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/uptermd/manifests
+    - manifests

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 12.0.3
+  version: 12.1.0
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

values/argo/env.yaml.gotmpl

@@ -27,5 +27,6 @@ argocd:
     image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
     imagePullSecrets:
       - gitlab-pull-secret
+  webhookSecret: ""
   additional_rbac_settings:
   - g, "eb17a659-4ce6-41bc-9153-d9b117c44479", role:org-admin

values/argo/manifests/sys-project.yaml

@@ -6,160 +6,163 @@ metadata:
   namespace: argocd
 spec:
   clusterResourceWhitelist:
-  - group: '*'
-    kind: '*'
+    - group: "*"
+      kind: "*"
   description: sys components project
   destinations:
-  - namespace: default
-    server: https://kubernetes.default.svc
-  - namespace: argocd
-    server: https://kubernetes.default.svc
-  - namespace: kube-system
-    server: https://kubernetes.default.svc
-  - namespace: ingress-nginx
-    server: https://kubernetes.default.svc
-  - namespace: prometheus
-    server: https://kubernetes.default.svc
-  - namespace: cnpg
-    server: https://kubernetes.default.svc
-  - namespace: cert-manager
-    server: https://kubernetes.default.svc
-  - namespace: kubernetes-dashboard
-    server: https://kubernetes.default.svc
-  - namespace: rabbitmq
-    server: https://kubernetes.default.svc
-  - namespace: sealed-secrets
-    server: https://kubernetes.default.svc
-  - namespace: gitlab
-    server: https://kubernetes.default.svc
-  - namespace: thanos
-    server: https://kubernetes.default.svc
-  - namespace: linkerd
-    server: https://kubernetes.default.svc
-  - namespace: linkerd-multicluster
-    server: https://kubernetes.default.svc
-  - namespace: observability
-    server: https://kubernetes.default.svc
-  - namespace: kyverno
-    server: https://kubernetes.default.svc
-  - namespace: velero
-    server: https://kubernetes.default.svc
-  - namespace: loki
-    server: https://kubernetes.default.svc
-  - namespace: tempo
-    server: https://kubernetes.default.svc
-  - namespace: x509-exporter
-    server: https://kubernetes.default.svc
-  - namespace: mariadb-operator
-    server: https://kubernetes.default.svc
-  - namespace: dragonfly
-    server: https://kubernetes.default.svc
-  - namespace: cilium-spire
-    server: https://kubernetes.default.svc
-  - namespace: cilium-test
-    server: https://kubernetes.default.svc
-  - namespace: cilium-secrets
-    server: https://kubernetes.default.svc
-  - namespace: openfga
-    server: https://kubernetes.default.svc
-  - namespace: staging-openfga
-    server: https://kubernetes.default.svc
-  - namespace: dapr-system
-    server: https://kubernetes.default.svc
-  - namespace: rook-ceph
-    server: https://kubernetes.default.svc
-  - namespace: csi-addon-manager
-    server: https://kubernetes.default.svc
-  - namespace: headscale
-    server: https://kubernetes.default.svc
-  - namespace: drupal
-    server: https://kubernetes.default.svc
-  - namespace: otel
-    server: https://kubernetes.default.svc
-  - namespace: opentelemetry
-    server: https://kubernetes.default.svc
-  - namespace: ncps
-    server: https://kubernetes.default.svc
-  - namespace: slinky
-    server: https://kubernetes.default.svc
-  - namespace: slurm
-    server: https://kubernetes.default.svc
-  - namespace: spegel
-    server: https://kubernetes.default.svc
-  - namespace: uptime
-    server: https://kubernetes.default.svc
-  - namespace: gitea
-    server: https://kubernetes.default.svc
-  - namespace: postfix
-    server: https://kubernetes.default.svc
-  - namespace: jobset-system
-    server: https://kubernetes.default.svc
-  - namespace: ingress-haproxy
-    server: https://kubernetes.default.svc
-  - namespace: dex
-    server: https://kubernetes.default.svc
-  - namespace: cra-agent
-    server: https://kubernetes.default.svc
-  - namespace: catalyst
-    server: https://kubernetes.default.svc
-  - namespace: niks3
-    server: https://kubernetes.default.svc
-  - namespace: temporal
-    server: https://kubernetes.default.svc
-  - namespace: ingest
-    server: https://kubernetes.default.svc
-  - namespace: proteus
-    server: https://kubernetes.default.svc
+    - namespace: default
+      server: https://kubernetes.default.svc
+    - namespace: argocd
+      server: https://kubernetes.default.svc
+    - namespace: kube-system
+      server: https://kubernetes.default.svc
+    - namespace: ingress-nginx
+      server: https://kubernetes.default.svc
+    - namespace: prometheus
+      server: https://kubernetes.default.svc
+    - namespace: cnpg
+      server: https://kubernetes.default.svc
+    - namespace: cert-manager
+      server: https://kubernetes.default.svc
+    - namespace: kubernetes-dashboard
+      server: https://kubernetes.default.svc
+    - namespace: rabbitmq
+      server: https://kubernetes.default.svc
+    - namespace: sealed-secrets
+      server: https://kubernetes.default.svc
+    - namespace: gitlab
+      server: https://kubernetes.default.svc
+    - namespace: thanos
+      server: https://kubernetes.default.svc
+    - namespace: linkerd
+      server: https://kubernetes.default.svc
+    - namespace: linkerd-multicluster
+      server: https://kubernetes.default.svc
+    - namespace: observability
+      server: https://kubernetes.default.svc
+    - namespace: kyverno
+      server: https://kubernetes.default.svc
+    - namespace: velero
+      server: https://kubernetes.default.svc
+    - namespace: loki
+      server: https://kubernetes.default.svc
+    - namespace: tempo
+      server: https://kubernetes.default.svc
+    - namespace: x509-exporter
+      server: https://kubernetes.default.svc
+    - namespace: mariadb-operator
+      server: https://kubernetes.default.svc
+    - namespace: dragonfly
+      server: https://kubernetes.default.svc
+    - namespace: cilium-spire
+      server: https://kubernetes.default.svc
+    - namespace: cilium-test
+      server: https://kubernetes.default.svc
+    - namespace: cilium-secrets
+      server: https://kubernetes.default.svc
+    - namespace: openfga
+      server: https://kubernetes.default.svc
+    - namespace: staging-openfga
+      server: https://kubernetes.default.svc
+    - namespace: dapr-system
+      server: https://kubernetes.default.svc
+    - namespace: rook-ceph
+      server: https://kubernetes.default.svc
+    - namespace: csi-addon-manager
+      server: https://kubernetes.default.svc
+    - namespace: headscale
+      server: https://kubernetes.default.svc
+    - namespace: drupal
+      server: https://kubernetes.default.svc
+    - namespace: otel
+      server: https://kubernetes.default.svc
+    - namespace: opentelemetry
+      server: https://kubernetes.default.svc
+    - namespace: ncps
+      server: https://kubernetes.default.svc
+    - namespace: slinky
+      server: https://kubernetes.default.svc
+    - namespace: slurm
+      server: https://kubernetes.default.svc
+    - namespace: spegel
+      server: https://kubernetes.default.svc
+    - namespace: uptime
+      server: https://kubernetes.default.svc
+    - namespace: gitea
+      server: https://kubernetes.default.svc
+    - namespace: postfix
+      server: https://kubernetes.default.svc
+    - namespace: jobset-system
+      server: https://kubernetes.default.svc
+    - namespace: ingress-haproxy
+      server: https://kubernetes.default.svc
+    - namespace: dex
+      server: https://kubernetes.default.svc
+    - namespace: cra-agent
+      server: https://kubernetes.default.svc
+    - namespace: catalyst
+      server: https://kubernetes.default.svc
+    - namespace: niks3
+      server: https://kubernetes.default.svc
+    - namespace: temporal
+      server: https://kubernetes.default.svc
+    - namespace: ingest
+      server: https://kubernetes.default.svc
+    - namespace: proteus
+      server: https://kubernetes.default.svc
+    - namespace: clickhouse
+      server: https://kubernetes.default.svc
   sourceRepos:
-  - https://argoproj.github.io/argo-helm
-  - https://kubernetes-sigs.github.io/metrics-server/
-  - https://git.oceanbox.io/platform/manifests.git
-  - https://git.oceanbox.io/platform/manifests
-  - https://git.oceanbox.io/oceanbox/manifests.git
-  - https://kubernetes.github.io/ingress-nginx
-  - https://cloudnative-pg.github.io/charts
-  - https://charts.jetstack.io
-  - https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
-  - https://github.com/kubernetes/dashboard
-  - https://bitnami-labs.github.io/sealed-secrets
-  - https://prometheus-community.github.io/helm-charts
-  - https://github.com/prometheus-community/helm-charts.git
-  - https://charts.gitlab.io/
-  - https://charts.bitnami.com/bitnami
-  - https://helm.linkerd.io/stable
-  - https://github.com/jaegertracing/jaeger-operator
-  - https://kyverno.github.io/kyverno/
-  - https://vmware-tanzu.github.io/helm-charts
-  - https://grafana.github.io/helm-charts
-  - https://charts.enix.io
-  - https://helm.mariadb.com/mariadb-operator
-  - https://helm.mariadb.com/mariadb-operator-crds
-  - https://helm.mariadb.com
-  - https://helm.cilium.io
-  - https://chartmuseum.github.io/charts
-  - https://dapr.github.io/helm-charts
-  - https://charts.gabe565.com
-  - ghcr.io/gabe565/charts
-  - https://open-telemetry.github.io/opentelemetry-helm-charts
-  - https://ghcr.io/slinkyproject/charts/slurm-operator
-  - https://ghcr.io/slinkyproject/charts/slurm-operator-crds
-  - https://bokysan.github.io/docker-postfix/
-  - ghcr.io/slinkyproject/charts
-  - ghcr.io/slinkyproject/charts/slurm-operator
-  - ghcr.io/slinkyproject/charts/slurm-operator-crds
-  - ghcr.io/spegel-org/helm-charts
-  - quay.io/cilium/charts
-  - quay.io/jetstack/charts
-  - quay.io/enix/charts
-  - registry.k8s.io/jobset/charts/jobset
-  - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
-  - docker.gitea.com
-  - https://operator.mariadb.com/mariadb-enterprise-operator
-  - https://ot-container-kit.github.io/helm-charts
-  - https://operator.mariadb.com
-  - https://twin.github.io/helm-charts
-  - https://charts.dexidp.io
-  - public.ecr.aws/diagrid/catalyst
-  - ghcr.io/haproxytech/helm-charts
-  - https://go.temporal.io/helm-charts
-  - docker.io/temporalio
+    - https://argoproj.github.io/argo-helm
+    - https://kubernetes-sigs.github.io/metrics-server/
+    - https://git.oceanbox.io/platform/manifests.git
+    - https://git.oceanbox.io/platform/manifests
+    - https://git.oceanbox.io/oceanbox/manifests.git
+    - https://kubernetes.github.io/ingress-nginx
+    - https://cloudnative-pg.github.io/charts
+    - https://charts.jetstack.io
+    - https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
+    - https://github.com/kubernetes/dashboard
+    - https://bitnami-labs.github.io/sealed-secrets
+    - https://prometheus-community.github.io/helm-charts
+    - https://github.com/prometheus-community/helm-charts.git
+    - https://charts.gitlab.io/
+    - https://charts.bitnami.com/bitnami
+    - https://helm.linkerd.io/stable
+    - https://github.com/jaegertracing/jaeger-operator
+    - https://kyverno.github.io/kyverno/
+    - https://vmware-tanzu.github.io/helm-charts
+    - https://grafana.github.io/helm-charts
+    - https://charts.enix.io
+    - https://helm.mariadb.com/mariadb-operator
+    - https://helm.mariadb.com/mariadb-operator-crds
+    - https://helm.mariadb.com
+    - https://helm.cilium.io
+    - https://chartmuseum.github.io/charts
+    - https://dapr.github.io/helm-charts
+    - https://charts.gabe565.com
+    - ghcr.io/gabe565/charts
+    - https://open-telemetry.github.io/opentelemetry-helm-charts
+    - https://ghcr.io/slinkyproject/charts/slurm-operator
+    - https://ghcr.io/slinkyproject/charts/slurm-operator-crds
+    - https://bokysan.github.io/docker-postfix/
+    - ghcr.io/slinkyproject/charts
+    - ghcr.io/slinkyproject/charts/slurm-operator
+    - ghcr.io/slinkyproject/charts/slurm-operator-crds
+    - ghcr.io/spegel-org/helm-charts
+    - quay.io/cilium/charts
+    - quay.io/jetstack/charts
+    - quay.io/enix/charts
+    - registry.k8s.io/jobset/charts/jobset
+    - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
+    - docker.gitea.com
+    - https://operator.mariadb.com/mariadb-enterprise-operator
+    - https://ot-container-kit.github.io/helm-charts
+    - https://operator.mariadb.com
+    - https://twin.github.io/helm-charts
+    - https://charts.dexidp.io
+    - public.ecr.aws/diagrid/catalyst
+    - ghcr.io/haproxytech/helm-charts
+    - https://go.temporal.io/helm-charts
+    - docker.io/temporalio
+    - ghcr.io/clickhouse

values/argo/values/argocd.yaml.gotmpl

@@ -49,8 +49,8 @@ configs:
         name: {{ .name }}
         config:
           issuer: https://login.microsoftonline.com/{{ .tenant }}/v2.0
-          clientID: ${{ .name | replace "-" "_" }}_client_id
-          clientSecret: ${{ .name | replace "-" "_" }}_client_secret
+          clientID: ${{ .secret_ref.name }}:client_id
+          clientSecret: ${{ .secret_ref.name }}:client_secret
           insecureSkipEmailVerified: true
           requestedIDTokenClaims:
             groups:
@@ -62,7 +62,7 @@ configs:
             - email
             - groups
       staticClients:
-      - id: ${{ .name | replace "-" "_" }}_client_id
+      - id: ${{ .secret_ref.name }}:client_id
         name: Kubernetes
         # These are kubectl oidc plugin internal URLs
         redirectURIs:
@@ -99,6 +99,11 @@ configs:
     argo-helm:
       type: helm
       url: https://argoproj.github.io/argo-helm
+  {{- if .Values.argocd.webhookSecret }}
+  secret:
+    extra:
+      webhook.gitea.secret: {{ .Values.argocd.webhookSecret }}
+  {{- end }}
   # UI changes based on env
   styles: |
     /* blue, orange, red depending on env */
@@ -129,29 +134,11 @@ controller:
       cpu: {{ .Values.argocd.resources.controller.cpu  | default "250m" }}
       memory: {{ .Values.argocd.resources.controller.memory  | default "1000Mi" }}
 
-# Mount azure ca as file for SAML auth
 dex:
   metrics:
     enabled: true
     serviceMonitor:
       enabled: true
-  {{- with .Values.clusterConfig.oidc }}
-  env:
-  {{- range . }}
-  {{- if eq .group "devel" }}
-  - name: {{ .name | replace "-" "_" }}_client_secret
-    valueFrom:
-      secretKeyRef:
-        name: {{ .secret_ref.name }}
-        key: client_secret
-  - name: {{ .name | replace "-" "_" }}_client_id
-    valueFrom:
-      secretKeyRef:
-        name: {{ .secret_ref.name }}
-        key: client_id
-  {{- end }}
-  {{- end }}
-  {{- end }}
 
 redis:
   metrics:

values/atlantis/kustomize/beta/actor-config.yaml

@@ -4,10 +4,7 @@ metadata:
   name: beta-atlantis-actor-config
 data:
   KUEUE_NAMESPACE: "prod-queue"
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.4.4"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.5.3"
   XTRACT_QUEUE: "prod-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.4.4"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.5.3"
   PLUME_QUEUE: "prod-queue"
-  TEMPORAL_ADDRESS: "temporal-frontend.temporal:7233"
-  TEMPORAL_NAMESPACE: "beta-atlantis"
-  TEMPORAL_TASK_QUEUE: "atlantis"

values/atlantis/kustomize/staging/actor-config.yaml

@@ -3,10 +3,6 @@ kind: ConfigMap
 metadata:
   name: staging-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.4.0"
-  XTRACT_QUEUE: "dev-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.4.0"
-  PLUME_QUEUE: "dev-queue"
-  TEMPORAL_ADDRESS: "temporal-frontend.temporal:7233"
+  TEMPORAL_ADDRESS: "temporal-grpc.ekman.oceanbox.io:443"
+  TEMPORAL_TLS: "true"
   TEMPORAL_NAMESPACE: "staging-atlantis"
-  TEMPORAL_TASK_QUEUE: "atlantis"

values/atlantis/manifests/network/allow-temporal.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-temporal
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: atlantis
+  egress:
+  - toFQDNs:
+    - matchName: temporal-grpc.ekman.oceanbox.io
+    toPorts:
+    - ports:
+      - port: "443"
+        protocol: TCP
+{{- end }}

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: 04417cca-debug
+  tag: 506ec0b2-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/clickhouse/env-oceanbox.yaml.gotmpl

@@ -0,0 +1,4 @@
+clickhouse:
+  enabled: true
+  s3:
+    enabled: true

values/clickhouse/env.yaml.gotmpl

@@ -0,0 +1,27 @@
+clickhouse:
+  enabled: false
+  autosync: true
+  clusterName: clickhouse
+  keeperName: clickhouse-keeper
+  serviceName: clickhouse-clickhouse-headless
+  storageClass: managed-nfs-storage
+  storage: 50Gi
+  keeperStorage: 5Gi
+  keeperReplicas: 3
+  resources:
+    cpuRequest: "1"
+    memoryRequest: 4Gi
+    memoryLimit: 8Gi
+  database: otel
+  user: default
+  credentialsSecret: clickhouse-credentials
+  credentialsKey: password
+  s3:
+    enabled: false
+    endpoint: "http://10.255.241.30:30080"
+    bucket: clickhouse
+    secret: clickhouse-s3
+    moveFactor: 0.2
+  ttl:
+    logs: 720h
+    traces: 336h

values/clickhouse/manifests/clickhouse.yaml

@@ -0,0 +1,42 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: clickhouse
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: clickhouse
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: clickhouse.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+    {{- if .Values.clickhouse.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+{{- end }}

values/clickhouse/manifests/network/CiliumNetworkPolicy-allow-grafana-read.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus
+  namespace: clickhouse
+spec:
+  description: Allow Grafana queries and Prometheus metric scraping
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "9000"
+              protocol: TCP
+            - port: "8123"
+              protocol: TCP
+            - port: "8080"
+              protocol: TCP
+            - port: "9363"
+              protocol: TCP
+{{- end }}

values/clickhouse/manifests/network/CiliumNetworkPolicy-allow-operator-and-intra.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-intra
+  namespace: clickhouse
+spec:
+  description: Allow all intra-namespace traffic (operator, ClickHouse servers, Keeper)
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: clickhouse
+{{- end }}

values/clickhouse/manifests/network/CiliumNetworkPolicy-allow-otel-write.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-otel-write
+  namespace: clickhouse
+spec:
+  description: Allow the opentelemetry collector to write to ClickHouse
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: otel
+      toPorts:
+        - ports:
+            - port: "9000"
+              protocol: TCP
+            - port: "8123"
+              protocol: TCP
+{{- end }}

values/clickhouse/values/cluster.yaml.gotmpl

@@ -0,0 +1,83 @@
+imageTag: "24.8"
+
+clickhouse:
+  enabled: true
+  meta:
+    name: {{ .Values.clickhouse.clusterName }}
+  spec:
+    shards: 1
+    replicas: 1
+    podTemplate:
+      nodeHostnameKey: kubernetes.io/hostname
+    settings:
+      defaultUserPassword:
+        secret:
+          name: {{ .Values.clickhouse.credentialsSecret }}
+          key: {{ .Values.clickhouse.credentialsKey }}
+      # Single replica: no cross-replica database sync needed. The operator's sync also
+      # breaks on the OTel-created (non-replicated) `otel` database. Revisit for multi-replica HA.
+      enableDatabaseSync: false
+      {{- if .Values.clickhouse.s3.enabled }}
+      extraConfig:
+        storage_configuration:
+          disks:
+            s3:
+              type: s3
+              endpoint: {{ .Values.clickhouse.s3.endpoint }}/{{ .Values.clickhouse.s3.bucket }}/data/
+              use_environment_credentials: true
+          policies:
+            tiered:
+              volumes:
+                hot:
+                  disk: default
+                cold:
+                  disk: s3
+              move_factor: {{ .Values.clickhouse.s3.moveFactor }}
+        merge_tree:
+          storage_policy: tiered
+      {{- end }}
+    containerTemplate:
+      resources:
+        requests:
+          cpu: {{ .Values.clickhouse.resources.cpuRequest }}
+          memory: {{ .Values.clickhouse.resources.memoryRequest }}
+        limits:
+          memory: {{ .Values.clickhouse.resources.memoryLimit }}
+      {{- if .Values.clickhouse.s3.enabled }}
+      env:
+      - name: AWS_ACCESS_KEY_ID
+        valueFrom:
+          secretKeyRef:
+            name: {{ .Values.clickhouse.s3.secret }}
+            key: AWS_ACCESS_KEY_ID
+      - name: AWS_SECRET_ACCESS_KEY
+        valueFrom:
+          secretKeyRef:
+            name: {{ .Values.clickhouse.s3.secret }}
+            key: AWS_SECRET_ACCESS_KEY
+      {{- end }}
+    dataVolumeClaimSpec:
+      accessModes:
+        - ReadWriteOnce
+      storageClassName: {{ .Values.clickhouse.storageClass }}
+      resources:
+        requests:
+          storage: {{ .Values.clickhouse.storage }}
+
+keeper:
+  enabled: true
+  meta:
+    name: {{ .Values.clickhouse.keeperName }}
+  spec:
+    replicas: {{ .Values.clickhouse.keeperReplicas }}
+    podTemplate:
+      nodeHostnameKey: kubernetes.io/hostname
+    podDisruptionBudget:
+      maxUnavailable: 1
+    dataVolumeClaimSpec:
+      accessModes:
+        - ReadWriteOnce
+      storageClassName: {{ .Values.clickhouse.storageClass }}
+      resources:
+        requests:
+          storage: {{ .Values.clickhouse.keeperStorage }}

values/clickhouse/values/operator.yaml.gotmpl

@@ -0,0 +1 @@
+# clickhouse-operator-helm values (chart defaults)

values/codex/values/values-staging.yaml

@@ -38,4 +38,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: e2ec1157-debug
+  tag: 7a4a367d-debug

values/docs/values/values-staging.yaml

@@ -1,6 +1,6 @@
 fullnameOverride: staging-docs
 image:
-  tag: "9fe77f4b-debug"
+  tag: "511c128c-debug"
 ingress:
   enabled: true
   className: "haproxy"

values/gitea/values/values.yaml

@@ -3,7 +3,7 @@ replicaCount: 1
 image:
   registry: "docker.gitea.com"
   repository: gitea
-  tag: "1.26.2"
+  tag: "1.26.4"
 
 resources:
   requests:
@@ -75,10 +75,11 @@ gitea:
       USERNAME: "nickname"
     mailer:
       ENABLED: true
-      FROM: "gitea@oceanbox.io"
-      PROTOCOL: "smtp"
-      SMTP_ADDR: "postfix-mail.postfix.svc.cluster.local"
+      FROM: "\"Oceanbox Gitea\" <no-reply@oceanbox.io>"
+      PROTOCOL: "smtp+starttls"
+      SMTP_ADDR: "mx.itpartner.no"
       SMTP_PORT: 587
+      USER: "no-reply@oceanbox.io"
     database:
       DB_TYPE: postgres
       MAX_OPEN_CONNS: 90
@@ -104,6 +105,11 @@ gitea:
         secretKeyRef:
           name: gitea-s3
           key: secret_key
+    - name: GITEA__mailer__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: gitea-smtp
+          key: password
     - name: GITEA__DATABASE__PASSWD
       valueFrom:
         secretKeyRef:

values/headscale/values/values.yaml

@@ -118,6 +118,7 @@ configMaps:
               "elianne.ersdal@oceanbox.io",
               "hanskristian.djuve@oceanbox.io",
               "erlend.mundal@oceanbox.io",
+              "hanna.fagrell@oceanbox.io",
             ],
             "group:manager": [
               "svenn.hanssen@oceanbox.io",
@@ -130,7 +131,6 @@ configMaps:
             "group:intern": [
               "haavahak@stud.ntnu.no",
               "haavahak@ntnu.no",
-              "hanna.fagrell@oceanbox.io",
             ],
             "group:ceph": [
               "jonas.juselius@oceanbox.io",

values/ingest/manifests/workerdeployment-py.yaml

@@ -19,7 +19,7 @@ spec:
         runAsGroup: 0
       containers:
         - name: ingest-py
-          image: git.oceanbox.io/oceanbox/churn/ingest-py:v2.3.11
+          image: git.oceanbox.io/oceanbox/churn/ingest-py:v0.1.6
           resources:
             requests:
               memory: 512Mi

values/ingest/manifests/workerdeployment.yaml

@@ -19,7 +19,7 @@ spec:
         runAsGroup: 0
       containers:
         - name: ingest
-          image: git.oceanbox.io/oceanbox/churn/ingest:v2.3.11
+          image: git.oceanbox.io/oceanbox/churn/ingest:v0.1.6
           resources:
             requests:
               memory: 512Mi

values/loki/env-oceanbox.yaml.gotmpl

@@ -1,4 +1,4 @@
 loki:
-  enabled: true
+  enabled: false
   autosync: false
 

values/loki/env.yaml.gotmpl

@@ -1,5 +1,5 @@
 loki:
-  enabled: true
+  enabled: false
   autosync: true
   compactor: true
   s3:

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "ae027c94-debug"
+  tag: "53080907-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/opentelemetry-collector/values/values.yaml.gotmpl

@@ -4,6 +4,14 @@ image:
 service:
   type: LoadBalancer
   loadBalancerIP: 10.255.241.12
+{{- if .Values.clickhouse.enabled }}
+extraEnvs:
+  - name: CH_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: {{ .Values.clickhouse.credentialsSecret }}
+        key: {{ .Values.clickhouse.credentialsKey }}
+{{- end }}
 config:
   # receivers:
     # prometheus/collector:
@@ -31,6 +39,20 @@ config:
       endpoint: http://loki-write-headless.loki:3100/otlp
       tls:
         insecure: true
+    {{- if .Values.clickhouse.enabled }}
+    clickhouse:
+      endpoint: tcp://{{ .Values.clickhouse.serviceName }}.clickhouse.svc:9000?dial_timeout=10s
+      database: {{ .Values.clickhouse.database }}
+      username: {{ .Values.clickhouse.user }}
+      password: ${env:CH_PASSWORD}
+      create_schema: true
+      logs_table_name: otel_logs
+      traces_table_name: otel_traces
+      ttl: {{ .Values.clickhouse.ttl.logs }}
+      timeout: 10s
+      retry_on_failure:
+        enabled: true
+    {{- end }}
     debug/metrics:
       verbosity: detailed
     debug/traces:
@@ -45,8 +67,7 @@ config:
       traces:
         receivers: [otlp] # zipkin
         processors: [batch]
-        exporters: [otlp]
-        # exporters: [otlphttp/traces,debug/traces]
+        exporters: [clickhouse]
       metrics:
         receivers: [otlp,prometheus] # prometheus/collector
         processors: [batch]
@@ -55,8 +76,7 @@ config:
       logs:
         receivers: [otlp]
         processors: [batch]
-        exporters: [otlphttp/logs]
-        # exporters: [otlphttp/logs,debug/logs]
+        exporters: [clickhouse]
 ports:
   metrics:
     enabled: true

values/prometheus/env-oceanbox.yaml.gotmpl

@@ -11,10 +11,7 @@ prometheus:
     persistence: true
     plugins:
     - volkovlabs-image-panel
-    - marcusolsson-static-datasource
-    - marcusolsson-calendar-panel
     - grafana-clock-panel
-    - redis-datasource
   thanos:
     enabled: true
   coredns:

values/prometheus/values/prometheus.yaml.gotmpl

@@ -108,11 +108,43 @@ grafana:
   defaultDashboardsEnabled: {{ .Values.prometheus.grafana.defaultDashboardsEnabled }}
   deploymentStrategy:
     type: Recreate
-  {{- if .Values.prometheus.grafana.plugins }}
+  {{- if .Values.prometheus.grafana.persistence }}
+  # This init container re-syncs the DB admin password
+  # to the secret before Grafana starts, so the reload can never 401 again.
+  extraInitContainers:
+  - name: sync-admin-password
+    image: docker.io/grafana/grafana:13.0.1-security-01
+    command:
+    - /bin/sh
+    - -c
+    - grafana cli --homepath=/usr/share/grafana admin reset-admin-password "{{ `$GF_ADMIN_PW` }}" || true
+    env:
+    - name: GF_PATHS_DATA
+      value: /var/lib/grafana
+    - name: GF_ADMIN_PW
+      valueFrom:
+        secretKeyRef:
+          name: prometheus-grafana
+          key: admin-password
+    volumeMounts:
+    - name: storage
+      mountPath: /var/lib/grafana
+  {{- end }}
+  {{- if or .Values.prometheus.grafana.plugins .Values.clickhouse.enabled }}
   plugins:
   {{- range .Values.prometheus.grafana.plugins }}
   - {{ . }}
   {{- end }}
+  {{- if .Values.clickhouse.enabled }}
+  - grafana-clickhouse-datasource
+  {{- end }}
+  {{- end }}
+  {{- if .Values.clickhouse.enabled }}
+  envValueFrom:
+    CLICKHOUSE_PASSWORD:
+      secretKeyRef:
+        name: {{ .Values.clickhouse.credentialsSecret }}
+        key: {{ .Values.clickhouse.credentialsKey }}
   {{- end }}
   grafana.ini:
     server:
@@ -219,9 +251,34 @@ grafana:
       createPrometheusReplicasDatasources: false
       label: grafana_datasource
     {{ end }}
-  {{- if or .Values.loki.enabled .Values.prometheus.additionalDataSources }}
+  {{- if or .Values.loki.enabled .Values.clickhouse.enabled .Values.prometheus.additionalDataSources }}
   additionalDataSources:
   {{- end }}
+  {{- if .Values.clickhouse.enabled }}
+  - name: ClickHouse
+    type: grafana-clickhouse-datasource
+    uid: clickhouse
+    access: proxy
+    editable: false
+    jsonData:
+      host: {{ .Values.clickhouse.serviceName }}.clickhouse.svc
+      port: 9000
+      protocol: native
+      username: {{ .Values.clickhouse.user }}
+      defaultDatabase: {{ .Values.clickhouse.database }}
+      logs:
+        defaultDatabase: {{ .Values.clickhouse.database }}
+        defaultTable: otel_logs
+        otelEnabled: true
+        otelVersion: latest
+      traces:
+        defaultDatabase: {{ .Values.clickhouse.database }}
+        defaultTable: otel_traces
+        otelEnabled: true
+        otelVersion: latest
+    secureJsonData:
+      password: ${CLICKHOUSE_PASSWORD}
+  {{- end }}
   {{- if .Values.tempo.enabled }}
   - name: Tempo
     type: tempo

values/proteus/manifests/network.yaml

@@ -16,9 +16,6 @@ spec:
     - ports:
       - port: "7233"
         protocol: TCP
-  # k8s API server (for batch/v1 Job create/poll/delete)
-  - toEntities:
-    - kube-apiserver
   # DNS
   - toEndpoints:
     - matchLabels:
@@ -30,13 +27,11 @@ spec:
         protocol: UDP
       - port: "53"
         protocol: TCP
-  # RabbitMQ on oceanbox via NodePort (prod: 30672, staging: 31672)
+  # OTel collector (tos1 LoadBalancer 10.255.241.12) for Temporal traces, exported cross-cluster
   - toCIDR:
-    - 10.255.241.0/24
+    - 10.255.241.12/32
     toPorts:
     - ports:
-      - port: "30672"
-        protocol: TCP
-      - port: "31672"
+      - port: "4317"
         protocol: TCP
 {{- end }}

values/proteus/manifests/pvc.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-proteus-ceph-archives
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-proteus-ceph-archives
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: proteus-ceph-archives
+  namespace: proteus
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-proteus-ceph-archives

values/proteus/manifests/rbac.yaml

@@ -1,55 +0,0 @@
-# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`).
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: proteus-dev-queue
-  namespace: dev-queue
-rules:
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["create", "delete", "get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods", "pods/log"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: proteus-dev-queue
-  namespace: dev-queue
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: proteus-dev-queue
-subjects:
-  - kind: ServiceAccount
-    name: default
-    namespace: proteus
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: proteus-prod-queue
-  namespace: prod-queue
-rules:
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["create", "delete", "get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods", "pods/log"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: proteus-prod-queue
-  namespace: prod-queue
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: proteus-prod-queue
-subjects:
-  - kind: ServiceAccount
-    name: default
-    namespace: proteus

values/proteus/manifests/workerdeployment.yaml

@@ -1,15 +1,10 @@
-# TEMPORAL_NAMESPACE  : {env}-atlantis
-# ARCHIVE_PVC                             : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue)
-# PROTEUS_EVENTS_QUEUE                     : {env}-proteus-job-events (queue the env's Atlantis binding reads)
-# RABBITMQ_CONNSTRING secret               : the broker that env's Atlantis consumes from (prod+beta share prod)
-# ---
 # apiVersion: temporal.io/v1alpha1
 # kind: WorkerDeployment
 # metadata:
 #   name: proteus-prod
 #   namespace: proteus
 # spec:
-#   replicas: 1
+#   replicas: 2
 #   workerOptions:
 #     temporalNamespace: prod-atlantis
 #     connectionRef:
@@ -22,14 +17,20 @@
 #       securityContext:
 #         runAsUser: 0
 #         runAsGroup: 0
+#       volumes:
+#         - name: archives
+#           persistentVolumeClaim:
+#             claimName: proteus-ceph-archives
 #       containers:
 #         - name: proteus
-#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
 #           resources:
 #             requests:
-#               memory: 256Mi
-#             limits:
+#               cpu: "1"
 #               memory: 1Gi
+#             limits:
+#               cpu: "2"
+#               memory: 4Gi
 #           env:
 #             - name: TEMPORAL_TASK_QUEUES
 #               value: plume,xtract
@@ -39,13 +40,32 @@
 #               value: prod
 #             - name: ARCHIVE_PVC
 #               value: prod-queue-ceph-archives
-#             - name: PROTEUS_EVENTS_QUEUE
-#               value: prod-proteus-job-events
-#             - name: RABBITMQ_CONNSTRING
-#               valueFrom:
-#                 secretKeyRef:
-#                   name: proteus-rabbitmq-prod
-#                   key: connString
+#             - name: MAX_CONCURRENT_ACTIVITIES
+#               value: "2"
+#             - name: OTEL_EXPORTER_OTLP_ENDPOINT
+#               value: http://10.255.241.12:4317
+#           volumeMounts:
+#             - name: archives
+#               mountPath: /data
+#           ports:
+#             - name: health
+#               containerPort: 8080
+#           livenessProbe:
+#             httpGet:
+#               path: /healthz
+#               port: health
+#             initialDelaySeconds: 20
+#             periodSeconds: 15
+#             timeoutSeconds: 5
+#             failureThreshold: 6
+#           readinessProbe:
+#             httpGet:
+#               path: /readyz
+#               port: health
+#             initialDelaySeconds: 5
+#             periodSeconds: 15
+#             timeoutSeconds: 5
+#             failureThreshold: 3
 # ---
 # apiVersion: temporal.io/v1alpha1
 # kind: WorkerDeployment
@@ -81,18 +101,9 @@
 #               value: beta-atlantis
 #             - name: APP_ENV
 #               value: beta
-#             # beta schedules into prod-queue (same as prod), so the same archive PVC.
 #             - name: ARCHIVE_PVC
 #               value: prod-queue-ceph-archives
-#             - name: PROTEUS_EVENTS_QUEUE
-#               value: beta-proteus-job-events
-#             # beta shares the prod broker (its Atlantis binding uses prod-atlantis-rabbitmq).
-#             - name: RABBITMQ_CONNSTRING
-#               valueFrom:
-#                 secretKeyRef:
-#                   name: proteus-rabbitmq-prod
-#                   key: connString
-# ---
+---
 apiVersion: temporal.io/v1alpha1
 kind: WorkerDeployment
 metadata:
@@ -112,27 +123,48 @@ spec:
       securityContext:
         runAsUser: 0
         runAsGroup: 0
+      volumes:
+        - name: archives
+          persistentVolumeClaim:
+            claimName: proteus-ceph-archives
       containers:
         - name: proteus
-          image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           resources:
             requests:
-              memory: 256Mi
-            limits:
+              cpu: 500m
               memory: 1Gi
+            limits:
+              cpu: "2"
+              memory: 4Gi
           env:
             - name: TEMPORAL_TASK_QUEUES
               value: plume,xtract
             - name: TEMPORAL_NAMESPACE
               value: staging-atlantis
-            - name: APP_ENV
-              value: staging
-            - name: ARCHIVE_PVC
-              value: dev-queue-ceph-archives
-            - name: PROTEUS_EVENTS_QUEUE
-              value: staging-proteus-job-events
-            - name: RABBITMQ_CONNSTRING
-              valueFrom:
-                secretKeyRef:
-                  name: proteus-rabbitmq-staging
-                  key: connString
+            - name: MAX_CONCURRENT_ACTIVITIES
+              value: "10"
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: http://10.255.241.12:4317
+          volumeMounts:
+            - name: archives
+              mountPath: /data
+          ports:
+            - name: health
+              containerPort: 8080
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            initialDelaySeconds: 20
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: 5
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 3

values/proteus/values/values-staging.yaml

@@ -0,0 +1,3 @@
+image:
+  repository: git.oceanbox.io/oceanbox/poseidon/proteus
+  tag: 7a4a367d-debug

values/sorcerer/kustomize/staging-ekman/deployment_patch.yaml

@@ -22,9 +22,4 @@
   value:
     secretRef:
       name: staging-sorcerer-env
-- op: add
-  path: /spec/template/spec/containers/0/envFrom/-
-  value:
-    configMapRef:
-      name: staging-sorcerer-kueue-config
 

values/sorcerer/kustomize/staging-ekman/kueue-config.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: staging-sorcerer-kueue-config
-data:
-  KUEUE_NAMESPACE: "dev-queue"
-  KUEUE_ARCHIVE_PVC: "dev-queue-ceph-archives"

values/sorcerer/kustomize/staging-ekman/kustomization.yaml

@@ -19,7 +19,6 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
-- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/staging-ekman/rbac.yaml

@@ -8,7 +8,6 @@ rules:
   - ""
   resourceNames:
   - staging-sorcerer-appsettings
-  - staging-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -24,24 +23,6 @@ rules:
   verbs:
   - get
   - watch
-- apiGroups:
-  - jobset.x-k8s.io
-  resources:
-  - jobsets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/log
-  verbs:
-  - get
-  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

values/sorcerer/values/values-staging.yaml

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: e2ec1157-debug
+  tag: 7a4a367d-debug
 podAnnotations:
   dapr.io/enabled: "true"
   dapr.io/app-id: "staging-sorcerer"

values/system/hel1/network/allow-itpartner-mail-egress.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-itpartner-mail-egress
+spec:
+  endpointSelector: {}
+  egress:
+  - toFQDNs:
+    - matchName: mx.itpartner.no
+    toPorts:
+    - ports:
+      - port: "587"
+        protocol: TCP
+      - port: "465"
+        protocol: TCP
+{{- end }}

values/tempo/env.yaml.gotmpl

@@ -1,5 +1,5 @@
 tempo:
-  enabled: true
+  enabled: false
   autosync: false
   s3:
     endpoint: 10.255.241.30:30080

values/temporal/env-ekman.yaml.gotmpl

@@ -1,6 +1,6 @@
 temporal:
   enabled: true
-  autosync: false
+  autosync: true
   ingress: true
   grpcIngress: true
   workerController: true

values/temporal/manifests/ingress.yaml

@@ -8,6 +8,8 @@ metadata:
     cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
+    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "24k"
     oceanbox.io/expose: internal
   labels:
     app.kubernetes.io/name: temporal

values/temporal/manifests/network/temporal-policies.yaml

@@ -60,4 +60,19 @@ spec:
         protocol: UDP
       - port: "53"
         protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-web-oidc-login
+  namespace: temporal
+spec:
+  description: Allow Temporal Web UI OIDC login to Entra ID
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: web
+  egress:
+  - toFQDNs:
+    - matchName: login.microsoftonline.com
+    - matchPattern: '*.microsoftonline.com'
 {{- end }}

values/temporal/manifests/temporal-db.yaml

@@ -12,9 +12,20 @@ spec:
     initdb:
       database: temporal
       owner: temporal
+  # headroom for ~240 server connections (30/pod x 8 pods) plus CNPG's own
+  postgresql:
+    parameters:
+      max_connections: "300"
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "2"
+      memory: 2Gi
   storage:
     resizeInUseVolumes: true
-    size: 10Gi
+    size: 20Gi
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: Database

values/temporal/values/temporal.yaml

@@ -1,8 +1,11 @@
 server:
+  replicaCount: 2
   config:
+    logLevel: "info"
     persistence:
       defaultStore: default
       visibilityStore: visibility
+      # immutable after first deploy
       numHistoryShards: 512
       datastores:
         default:
@@ -20,7 +23,7 @@ server:
             maxConns: 20
             maxIdleConns: 20
             maxConnLifetime: "1h"
-        # TODO: migrate visibility to Elasticsearch for advanced visibility search.
+        # NOTE: Postgres 12+ gives advanced visibility; no Elasticsearch needed.
         visibility:
           sql:
             createDatabase: false
@@ -41,8 +44,129 @@ server:
         timerType: histogram
         listenAddress: "0.0.0.0:9090"
 
+  metrics:
+    serviceMonitor:
+      enabled: true
+      interval: 30s
+
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
+
+  frontend:
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: frontend
+
+  history:
+    resources:
+      requests:
+        cpu: 250m
+        memory: 768Mi
+      limits:
+        cpu: "1"
+        memory: 1536Mi
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: history
+
+  matching:
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: matching
+
+  worker:
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: worker
+
+# no persistent debug pod; use temporalio/admin-tools on demand
+admintools:
+  enabled: false
+
 web:
   enabled: true
+  replicaCount: 2
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 250m
+      memory: 256Mi
+  podDisruptionBudget:
+    maxUnavailable: 1
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: ScheduleAnyway
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: temporal
+        app.kubernetes.io/instance: temporal
+        app.kubernetes.io/component: web
+  # NOTE: native OIDC SSO via Entra ID (same oceanbox-oidc secret as Grafana); gates UI login only
+  additionalEnv:
+    - name: TEMPORAL_AUTH_ENABLED
+      value: "true"
+    - name: TEMPORAL_AUTH_TYPE
+      value: "oidc"
+    - name: TEMPORAL_AUTH_PROVIDER_URL
+      value: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
+    - name: TEMPORAL_AUTH_CLIENT_ID
+      valueFrom:
+        secretKeyRef:
+          name: oceanbox-oidc
+          key: client_id
+    - name: TEMPORAL_AUTH_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: oceanbox-oidc
+          key: client_secret
+    - name: TEMPORAL_AUTH_CALLBACK_URL
+      value: "https://temporal.ekman.oceanbox.io/auth/sso/callback"
+    - name: TEMPORAL_AUTH_SCOPES
+      value: "openid,profile,email,offline_access"
 
 schema:
   useHelmHooks: false
+  # NOTE: run as an ArgoCD sync hook so the controller-mutated Job isn't diffed and stays OutOfSync forever
+  jobAnnotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation

values/umami/values/values-prod.yaml

@@ -6,7 +6,7 @@ image:
   # -- image pull policy
   # pullPolicy:
   # -- Overrides the image tag
-  tag: "3.1.0"
+  tag: "3.2.0"
 
 replicaCount: 1
 

values/uptermd/env-hel1.yaml.gotmpl

@@ -0,0 +1,2 @@
+uptermd:
+  enabled: true

values/uptermd/env.yaml.gotmpl

@@ -0,0 +1,3 @@
+uptermd:
+  enabled: false
+  autosync: false

values/uptermd/kustomize/base/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - _manifest.yaml

values/uptermd/kustomize/default/kustomization.yaml

@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - target:
+      kind: Ingress
+      name: uptermd
+    patch: |
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: uptermd
+  - target:
+      group: cert-manager.io
+      kind: Issuer
+      name: uptermd-letsencrypt
+    patch: |
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: Issuer
+      metadata:
+        name: uptermd-letsencrypt

values/uptermd/manifests/ingress.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: uptermd
+  namespace: uptermd
+  labels:
+    app.kubernetes.io/name: uptermd
+  annotations:
+    cert-manager.io/cluster-issuer: ca-issuer
+    haproxy.org/backend-protocol: h1
+    haproxy.org/timeout-tunnel: "3600s"
+    haproxy.org/timeout-client: "3600s"
+    haproxy.org/timeout-server: "3600s"
+spec:
+  ingressClassName: haproxy
+  rules:
+    - host: upterm.hel1.obx
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: uptermd
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - upterm.hel1.obx
+      secretName: uptermd-tls

values/uptermd/manifests/uptermd.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: uptermd
+  namespace: argocd
+spec:
+  destination:
+    namespace: uptermd
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: uptermd.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+    {{- if .Values.uptermd.autosync }}
+    automated:
+      prune: true
+    {{- end }}
+{{- end }}

values/uptermd/values/values.yaml

@@ -0,0 +1,20 @@
+replicaCount: 1
+
+websocket:
+  enabled: true
+
+service:
+  type: ClusterIP
+
+resources:
+  limits:
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 512Mi
+
+# No SSH host key is provided, so uptermd generates an ephemeral one on each
+# pod start
+host_keys: {}
+
+authorized_keys: []