Update Helm release kube-prometheus-stack to v86.3.2

Reviewed-on: #241

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.16.5
+version: v1.42.29
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.16.5
+appVersion: v1.42.29
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.16.5
+  tag: v1.42.29
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v2.16.5
+version: v1.42.29
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v2.16.5"
+appVersion: "v1.42.29"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v2.16.5
+  tag: v1.42.29
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.16.5
+version: v1.42.29
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.16.5
+appVersion: v1.42.29
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v2.16.5
+  tag: v1.42.29
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.5.20
+  version: 9.5.21
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 86.2.3
+  version: 86.3.2
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/proteus.yaml.gotmpl

@@ -6,15 +6,15 @@ commonLabels:
 
 releases:
 - name: manifests
-  namespace: helmsman
+  namespace: proteus
   chart: manifests
-  condition: helmsman.enabled
+  condition: proteus.enabled
   missingFileHandler: Info
   values:
   - ../values/env.yaml
   - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/helmsman/env.yaml.gotmpl
-  - ../values/helmsman/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/proteus/env.yaml.gotmpl
+  - ../values/proteus/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   hooks:
   - events: [ prepare, cleanup ]
     showlogs: true
@@ -23,5 +23,5 @@ releases:
     - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
     - '{{`{{ .Release.Chart }}`}}'
     - '{{`{{ .Environment.Name }}`}}'
-    - ../values/helmsman/manifests
+    - ../values/proteus/manifests
     - manifests

values/argo/manifests/sys-project.yaml

@@ -108,6 +108,8 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: ingest
     server: https://kubernetes.default.svc
+  - namespace: proteus
+    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/

values/atlantis/kustomize/prod/actor-config.yaml

@@ -8,6 +8,3 @@ data:
   XTRACT_QUEUE: "prod-queue"
   PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
   PLUME_QUEUE: "prod-queue"
-  TEMPORAL_ADDRESS: "temporal-frontend.temporal:7233"
-  TEMPORAL_NAMESPACE: "prod-atlantis"
-  TEMPORAL_TASK_QUEUE: "atlantis"

values/atlantis/kustomize/prod/appsettings.json

@@ -46,7 +46,7 @@
       "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
       "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
     },
-    "sentryUrl": "https://793f73e5a9278cb638c0acd175b9289d@o4509530141622272.ingest.de.sentry.io/4509530195492944",
+    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
     "plainAuthUsers": [
         {
             "username": "admin",

values/atlantis/values/values-beta.yaml.gotmpl

@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.15.1
+  tag: v2.17.0
 
 podAnnotations:
   dapr.io/app-id: "beta-atlantis"
@@ -11,7 +11,7 @@ env:
   - name: APP_NAMESPACE
     value: beta-atlantis
   - name: APP_VERSION
-    value: "2.15.1-beta"
+    value: "2.17.0-beta"
   - name: LOG_LEVEL
     value: "1"
   - name: ANALYTICS_WEB_ID

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: a6570af2-debug
+  tag: 04417cca-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/docs/values/values-staging.yaml

@@ -1,6 +1,6 @@
 fullnameOverride: staging-docs
 image:
-  tag: "761b6908-debug"
+  tag: "9fe77f4b-debug"
 ingress:
   enabled: true
   className: "haproxy"

values/helmsman/manifests/pvc.yaml

@@ -1,87 +0,0 @@
-# Both PVCs are the same cephfs `data` filesystem mounted at root: /data exposes the
-# hdd/data tree (ingest output), /work exposes the kraken/fvcom tree (case rundirs).
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-helmsman-data
-spec:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  claimRef:
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    name: ekman-data
-    namespace: helmsman
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-helmsman-data
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ekman-data
-  namespace: helmsman
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-helmsman-data
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-helmsman-work
-spec:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  claimRef:
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    name: ekman-work
-    namespace: helmsman
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-helmsman-work
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ekman-work
-  namespace: helmsman
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-helmsman-work

values/helmsman/manifests/slurm-token.yaml

@@ -1,10 +0,0 @@
-# Kyverno (sync-slurm-token) clones the real token from prod-atlantis into this secret.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: slurm-access-token
-  namespace: helmsman
-  annotations:
-    kyverno/clone: "true"
-type: Opaque
-data: {}

values/helmsman/manifests/workerdeployment.yaml

@@ -1,55 +0,0 @@
-apiVersion: temporal.io/v1alpha1
-kind: WorkerDeployment
-metadata:
-  name: helmsman
-  namespace: helmsman
-spec:
-  replicas: 1
-  workerOptions:
-    temporalNamespace: prod-helmsman
-    connectionRef:
-      name: temporal
-  rollout:
-    strategy: AllAtOnce
-  sunset: {}
-  template:
-    spec:
-      securityContext:
-        runAsUser: 0
-        runAsGroup: 0
-      containers:
-        - name: helmsman
-          image: git.oceanbox.io/oceanbox/churn/helmsman:v2.3.3
-          resources:
-            requests:
-              memory: 1Gi
-            limits:
-              memory: 8Gi
-          env:
-            - name: CHURN_TOOLS
-              value: binary
-            - name: DATA_ROOT
-              value: /data/hdd/data
-            - name: DATA_DIR
-              value: /work/kraken/fvcom/nml
-            - name: SLURM_BASE_URL
-              value: https://slurmrestd.ekman.oceanbox.io/
-            - name: SLURM_API
-              value: /slurm/v0.0.42/
-            - name: SLURM_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: slurm-access-token
-                  key: token
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: work
-              mountPath: /work
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: ekman-data
-        - name: work
-          persistentVolumeClaim:
-            claimName: ekman-work

values/ingest/manifests/workerdeployment-py.yaml

@@ -19,12 +19,12 @@ spec:
         runAsGroup: 0
       containers:
         - name: ingest-py
-          image: git.oceanbox.io/oceanbox/churn/ingest-py:v2.3.4
+          image: git.oceanbox.io/oceanbox/churn/ingest-py:v2.3.11
           resources:
             requests:
               memory: 512Mi
             limits:
-              memory: 3Gi
+              memory: 15Gi
           env:
             - name: DATA_ROOT
               value: /data/hdd/data

values/ingest/manifests/workerdeployment.yaml

@@ -19,12 +19,12 @@ spec:
         runAsGroup: 0
       containers:
         - name: ingest
-          image: git.oceanbox.io/oceanbox/churn/ingest:v2.3.4
+          image: git.oceanbox.io/oceanbox/churn/ingest:v2.3.11
           resources:
             requests:
               memory: 512Mi
             limits:
-              memory: 2Gi
+              memory: 15Gi
           env:
             - name: DATA_ROOT
               value: /data/hdd/data

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "f998d919-debug"
+  tag: "ae027c94-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/proteus/env-ekman.yaml.gotmpl

@@ -1,2 +1,2 @@
-helmsman:
+proteus:
   enabled: true

values/proteus/env.yaml.gotmpl

@@ -1,3 +1,3 @@
-helmsman:
+proteus:
   enabled: false
   autosync: false

values/proteus/manifests/connection.yaml

@@ -2,6 +2,6 @@ apiVersion: temporal.io/v1alpha1
 kind: Connection
 metadata:
   name: temporal
-  namespace: helmsman
+  namespace: proteus
 spec:
   hostPort: temporal-frontend.temporal:7233

values/proteus/manifests/network.yaml

@@ -0,0 +1,42 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: proteus-egress
+  namespace: proteus
+spec:
+  endpointSelector:
+    matchLabels: {}
+  egress:
+  # Temporal frontend (in-cluster on ekman)
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: temporal
+    toPorts:
+    - ports:
+      - port: "7233"
+        protocol: TCP
+  # k8s API server (for batch/v1 Job create/poll/delete)
+  - toEntities:
+    - kube-apiserver
+  # DNS
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: "53"
+        protocol: UDP
+      - port: "53"
+        protocol: TCP
+  # RabbitMQ on oceanbox via NodePort (prod: 30672, staging: 31672)
+  - toCIDR:
+    - 10.255.241.0/24
+    toPorts:
+    - ports:
+      - port: "30672"
+        protocol: TCP
+      - port: "31672"
+        protocol: TCP
+{{- end }}

values/proteus/manifests/proteus.yaml

@@ -2,7 +2,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: helmsman
+  name: proteus
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -10,7 +10,7 @@ metadata:
   - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    namespace: helmsman
+    namespace: proteus
     server: 'https://kubernetes.default.svc'
   sources:
   - repoURL: {{ .Values.clusterConfig.manifests }}
@@ -24,16 +24,13 @@ spec:
       - name: HELMFILE_ENVIRONMENT
         value: default
       - name: HELMFILE_FILE_PATH
-        value: helmsman.yaml.gotmpl
-  project: sys
+        value: proteus.yaml.gotmpl
+  project: atlantis
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: sys
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true
-    {{- if .Values.helmsman.autosync }}
+    {{- if .Values.proteus.autosync }}
     automated:
       prune: true
     {{- end }}

values/proteus/manifests/rbac.yaml

@@ -0,0 +1,55 @@
+# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`).
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-dev-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-prod-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus

values/proteus/manifests/workerdeployment.yaml

@@ -0,0 +1,138 @@
+# TEMPORAL_NAMESPACE  : {env}-atlantis
+# ARCHIVE_PVC                             : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue)
+# PROTEUS_EVENTS_QUEUE                     : {env}-proteus-job-events (queue the env's Atlantis binding reads)
+# RABBITMQ_CONNSTRING secret               : the broker that env's Atlantis consumes from (prod+beta share prod)
+# ---
+# apiVersion: temporal.io/v1alpha1
+# kind: WorkerDeployment
+# metadata:
+#   name: proteus-prod
+#   namespace: proteus
+# spec:
+#   replicas: 1
+#   workerOptions:
+#     temporalNamespace: prod-atlantis
+#     connectionRef:
+#       name: temporal
+#   rollout:
+#     strategy: AllAtOnce
+#   sunset: {}
+#   template:
+#     spec:
+#       securityContext:
+#         runAsUser: 0
+#         runAsGroup: 0
+#       containers:
+#         - name: proteus
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           resources:
+#             requests:
+#               memory: 256Mi
+#             limits:
+#               memory: 1Gi
+#           env:
+#             - name: TEMPORAL_TASK_QUEUES
+#               value: plume,xtract
+#             - name: TEMPORAL_NAMESPACE
+#               value: prod-atlantis
+#             - name: APP_ENV
+#               value: prod
+#             - name: ARCHIVE_PVC
+#               value: prod-queue-ceph-archives
+#             - name: PROTEUS_EVENTS_QUEUE
+#               value: prod-proteus-job-events
+#             - name: RABBITMQ_CONNSTRING
+#               valueFrom:
+#                 secretKeyRef:
+#                   name: proteus-rabbitmq-prod
+#                   key: connString
+# ---
+# apiVersion: temporal.io/v1alpha1
+# kind: WorkerDeployment
+# metadata:
+#   name: proteus-beta
+#   namespace: proteus
+# spec:
+#   replicas: 1
+#   workerOptions:
+#     temporalNamespace: beta-atlantis
+#     connectionRef:
+#       name: temporal
+#   rollout:
+#     strategy: AllAtOnce
+#   sunset: {}
+#   template:
+#     spec:
+#       securityContext:
+#         runAsUser: 0
+#         runAsGroup: 0
+#       containers:
+#         - name: proteus
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
+#           resources:
+#             requests:
+#               memory: 256Mi
+#             limits:
+#               memory: 1Gi
+#           env:
+#             - name: TEMPORAL_TASK_QUEUES
+#               value: plume,xtract
+#             - name: TEMPORAL_NAMESPACE
+#               value: beta-atlantis
+#             - name: APP_ENV
+#               value: beta
+#             # beta schedules into prod-queue (same as prod), so the same archive PVC.
+#             - name: ARCHIVE_PVC
+#               value: prod-queue-ceph-archives
+#             - name: PROTEUS_EVENTS_QUEUE
+#               value: beta-proteus-job-events
+#             # beta shares the prod broker (its Atlantis binding uses prod-atlantis-rabbitmq).
+#             - name: RABBITMQ_CONNSTRING
+#               valueFrom:
+#                 secretKeyRef:
+#                   name: proteus-rabbitmq-prod
+#                   key: connString
+# ---
+apiVersion: temporal.io/v1alpha1
+kind: WorkerDeployment
+metadata:
+  name: proteus-staging
+  namespace: proteus
+spec:
+  replicas: 1
+  workerOptions:
+    temporalNamespace: staging-atlantis
+    connectionRef:
+      name: temporal
+  rollout:
+    strategy: AllAtOnce
+  sunset: {}
+  template:
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: proteus
+          image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
+          resources:
+            requests:
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+          env:
+            - name: TEMPORAL_TASK_QUEUES
+              value: plume,xtract
+            - name: TEMPORAL_NAMESPACE
+              value: staging-atlantis
+            - name: APP_ENV
+              value: staging
+            - name: ARCHIVE_PVC
+              value: dev-queue-ceph-archives
+            - name: PROTEUS_EVENTS_QUEUE
+              value: staging-proteus-job-events
+            - name: RABBITMQ_CONNSTRING
+              valueFrom:
+                secretKeyRef:
+                  name: proteus-rabbitmq-staging
+                  key: connString

values/temporal/env-oceanbox.yaml.gotmpl

@@ -1,4 +1,4 @@
 temporal:
-  enabled: true
+  enabled: false
   autosync: false
-  ingress: true
+  ingress: false

values/temporal/manifests/ingress-grpc.yaml

@@ -8,6 +8,7 @@ metadata:
     cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
     nginx.ingress.kubernetes.io/backend-protocol: GRPC
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     oceanbox.io/expose: internal
   labels:
     app.kubernetes.io/name: temporal