wip: Gateway Setup

This reverts commit e049ec06b7.

.envrc

@@ -1,13 +1,16 @@
 #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
-watch_file nix/sources.json
+watch_file npins/sources.json
-watch_file nix/checks.nix
 
 # Load .env file if it exists
 dotenv_if_exists
 
-# Set npins dir
-export NPINS_DIRECTORY="nix"
-
 # Activate development shell
-use nix
+if type lorri &>/dev/null; then
+    echo "direnv: using lorri from PATH ($(type -p lorri))"
+    eval "$(lorri direnv)"
+else
+    # fall back to using direnv's builtin nix support
+    # to prevent bootstrapping problems.
+    use nix
+fi

.gitlab-ci.yml

@@ -1,54 +0,0 @@
-# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
-default:
-  tags:
-    - nix
-
-include:
-  - project: oceanbox/gitlab-ci
-    ref: v4.5
-    file: template/Base.gitlab-ci.yml
-# stages:
-# - release
-
-# image:
-# name: alpine/helm:latest
-# entrypoint: ["/bin/bash", "-c"]
-
-# release:
-# stage: release
-# rules:
-# - if: "$CI_COMMIT_BRANCH =~ /^main/"
-# when: always
-# - when: never
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done
-
-# rebuild:
-# stage: release
-# rules:
-# - when: manual
-# allow_failure: true
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done

bootstrap/helmfile-cmp/Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/helmfile/helmfile:v1.1.9
+FROM ghcr.io/helmfile/helmfile:v1.3.1
 
 RUN mkdir -p /home/argocd/cmp-server/config/
 COPY plugin.yaml /home/argocd/cmp-server/config/

bootstrap/helmfile-cmp/deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-img=registry.gitlab.com/oceanbox/manifests/helmfile-cmp
+img=git.oceanbox.io/platform/manifests/helmfile-cmp
 tag=${1:-latest}
 
 docker build -t "${img}":"${tag}" .

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.35.2
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.35.2
+appVersion: v1.46.5
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/poseidon/atlantis
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.35.2
+  tag: v1.46.5
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -116,6 +116,5 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.35.2
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.35.2"
+appVersion: "v1.46.5"

charts/codex/values.yaml

@@ -6,11 +6,11 @@
 replicaCount: 1
 # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
 image:
-  repository: registry.gitlab.com/oceanbox/poseidon/codex
+  repository: git.oceanbox.io/oceanbox/poseidon/codex
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.35.2
+  tag: v1.46.5
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/diagrid-dashboard/templates/statestore.yaml

@@ -8,6 +8,7 @@ data:
     kind: Component
     metadata:
       name: statestore
+      namespace: {{ .Values.statestore.namespace | default "default" }}
     scopes:
       - {{ .Values.statestore.scope }}
     spec:
@@ -17,10 +18,10 @@ data:
         - name: redisUsername
           value: default
         - name: redisPassword
-          value: secret
+          value: {{ .Values.statestore.password | default "secret" }}
         - name: actorStateStore
           value: "true"
         - name: redisDB
-          value: "1"
+          value: "{{ .Values.statestore.redisDB | default "0" }}"
       type: state.redis
       version: v1

charts/diagrid-dashboard/values.yaml

@@ -5,6 +5,9 @@
 statestore:
   scope: my-scope
   redis: my-redis
+  namespace: default
+  password: secret
+  redisDB: "0"
 
 # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
 replicaCount: 1

charts/docs/templates/deployment.yaml

@@ -42,11 +42,11 @@ spec:
               value: "3"
           livenessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
           readinessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

charts/docs/templates/httproute.yaml

@@ -0,0 +1,46 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "docs.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.httpRoute.rules }}
+    - {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+    {{- end }}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-{{ $fullName }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  endpointSelector:
+    matchLabels:
+      {{- include "docs.selectorLabels" . | nindent 6 }}
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
+{{- end }}

charts/docs/values.yaml

@@ -3,7 +3,7 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository:  registry.gitlab.com/oceanbox/documentation
+  repository: git.oceanbox.io/oceanbox/documentation/docs
   tag: v0.1.0
   pullPolicy: IfNotPresent
 init:
@@ -21,8 +21,8 @@ env:
     valueFrom:
       fieldRef:
         fieldPath: metadata.namespace
-imagePullSecrets:
+# imagePullSecrets:
-  - name: gitea-pull-secret
+  # - name: gitea-pull-secret
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:
@@ -46,8 +46,13 @@ service:
   type: ClusterIP
   port: 8080
 ingress:
-  enabled: true
+  enabled: false
   className: nginx
+httpRoute:
+  enabled: false
+  parentRefs: []
+  hostnames: []
+  rules: []
 persistence:
   enabled: false
   size: 1G

charts/makai/templates/httproute.yaml

@@ -0,0 +1,46 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "makai.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "makai.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.httpRoute.rules }}
+    - {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+    {{- end }}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-{{ $fullName }}
+  labels:
+    {{- include "makai.labels" . | nindent 4 }}
+spec:
+  endpointSelector:
+    matchLabels:
+      {{- include "makai.selectorLabels" . | nindent 6 }}
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
+{{- end }}

charts/makai/values.yaml

@@ -46,8 +46,13 @@ service:
   type: ClusterIP
   port: 8080
 ingress:
-  enabled: true
+  enabled: false
   className: nginx
+httpRoute:
+  enabled: false
+  parentRefs: []
+  hostnames: []
+  rules: []
 persistence:
   enabled: false
   size: 1G

charts/plume/Chart.yaml

@@ -4,7 +4,12 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.6.7
+version: v1.6.13
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.6.7
+appVersion: v1.6.13
+dependencies:
+  - name: diagrid-dashboard
+    version: "0.1.0"
+    repository: "file://../diagrid-dashboard"
+    condition: diagrid-dashboard.enabled

charts/plume/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/plume
+  repository: git.oceanbox.io/oceanbox/plume/plume
-  tag: v1.6.7
+  tag: v1.6.13
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -90,3 +90,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
+diagrid-dashboard:
+  enabled: false

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.35.2
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.35.2
+appVersion: v1.46.5
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -4,8 +4,8 @@
 
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/poseidon/sorcerer
+  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.35.2
+  tag: v1.46.5
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -108,7 +108,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false
   statestore:

envs/environments.yaml.gotmpl

@@ -20,4 +20,11 @@ environments:
     - ../values/*/env.yaml.gotmpl
     - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
     missingFileHandler: Info
+  beta:
+    values:
+    - ../values/env.yaml
+    - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+    - ../values/*/env.yaml.gotmpl
+    - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+    missingFileHandler: Info
 

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 7.9.1
+  version: 9.4.10
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
   namespace: argocd
   chart: argo/argo-rollouts
-  version: 2.40.5
+  version: 2.40.6
   condition: argo.rollouts.enabled
   values:
   - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 0.45.27
+  version: 0.47.5
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests
@@ -66,4 +66,3 @@ releases:
     - '{{`{{ .Environment.Name }}`}}'
     - ../values/argo/manifests
     - _argo
-

helmfile.d/cert-manager.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: v1.19.2
+  version: v1.19.4
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/cilium.yaml.gotmpl

@@ -3,7 +3,8 @@ bases:
 
 repositories:
 - name: cilium
-  url: 'https://helm.cilium.io'
+  oci: true
+  url: 'quay.io/cilium/charts'
 
 commonLabels:
   tier: system
@@ -15,11 +16,11 @@ releases:
 - name: cilium
   namespace: kube-system
   chart: cilium/cilium
-  version: 1.16.2
+  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.19.1{{ else if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "ekman" }}1.19.1{{ else }}1.16.19{{ end }}
   condition: cilium.enabled
   values:
   - ../values/cilium/values/cilium.yaml.gotmpl
-  - ../values/cilium/values/cilium-{{ .Environment.Name }}.yaml.gotmpl
+  - ../values/cilium/values/cilium-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   missingFileHandler: Info
 - name: manifests
   namespace: cilium
@@ -55,4 +56,3 @@ releases:
     - '{{`{{ .Environment.Name }}`}}'
     - ../values/cilium/cilium-manifests
     - manifests
-

helmfile.d/docs.yaml.gotmpl

@@ -6,18 +6,19 @@ commonLabels:
 
 releases:
 - name: docs
-  namespace: {{ .Environment.Name }}-docs
+  namespace: docs
   chart: ../charts/docs
   condition: docs.enabled
   values:
   - ../values/docs/values/values.yaml
+  - ../values/docs/values/values.yaml.gotmpl
   - ../values/docs/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:
   - ../values/docs/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: {{ .Environment.Name }}-docs
+  namespace: docs
   chart: manifests
   condition: docs.enabled
   missingFileHandler: Info

helmfile.d/dragonfly.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
   namespace: dragonfly
   chart: dragonfly/dragonfly-operator
-  version: v1.3.1
+  version: v1.4.0
   condition: dragonfly.enabled
   values:
   - ../values/dragonfly/values/dragonfly.yaml.gotmpl

helmfile.d/gatus.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: gatus
   namespace: uptime
   chart: gatus/gatus
-  version: 1.4.5
+  version: 1.5.0
   condition: gatus.enabled
   values:
   - ../values/gatus/values/values.yaml

helmfile.d/gitea.yaml.gotmpl

@@ -17,6 +17,7 @@ releases:
   condition: gitea.enabled
   values:
   - ../values/gitea/values/values.yaml
+  - ../values/gitea/values/values.yaml.gotmpl
   - ../values/gitea/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/ingress-nginx.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
   namespace: ingress-nginx
   chart: ingress-nginx/ingress-nginx
-  version: 4.14.1
+  version: 4.14.3
   condition: nginx.enabled
   values:
   - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl

helmfile.d/jobset.yaml.gotmpl

@@ -0,0 +1,41 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: jobset
+  oci: true
+  url: registry.k8s.io/jobset/charts
+
+releases:
+- name: jobset
+  namespace: jobset-system
+  chart: jobset/jobset
+  version: 0.11.1
+  condition: jobset.enabled
+  values:
+  - ../values/jobset/values/jobset.yaml.gotmpl
+  - ../values/jobset/values/jobset-{{ .Environment.Name }}.yaml.gotmpl
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/jobset/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: jobset-system
+  chart: manifests
+  condition: jobset.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/jobset/env.yaml.gotmpl
+  - ../values/jobset/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/jobset/manifests
+    - manifests

helmfile.d/keycloak.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: {{ .Environment.Name }}-keycloak
   namespace: keycloak
   chart: bitnami/keycloak
-  version: 24.0.2
+  version: 24.9.0
   condition: keycloak.enabled
   values:
   - ../values/keycloak/values/values.yaml

helmfile.d/kyverno.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: kyverno
   namespace: kyverno
   chart: kyverno/kyverno
-  version: 3.6.1
+  version: 3.7.1
   condition: kyverno.enabled
   values:
   - ../values/kyverno/values/kyverno.yaml.gotmpl

helmfile.d/loki.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: loki
   namespace: loki
   chart: loki/loki
-  version: 6.42.0
+  version: 6.53.0
   condition: loki.enabled
   values:
   - ../values/loki/values/loki.yaml.gotmpl

helmfile.d/makai.yaml.gotmpl

@@ -6,18 +6,19 @@ commonLabels:
 
 releases:
 - name: makai
-  namespace: {{ .Environment.Name }}-makai
+  namespace: makai
   chart: ../charts/makai
   condition: makai.enabled
   values:
   - ../values/makai/values/values.yaml
+  - ../values/makai/values/values.yaml.gotmpl
   - ../values/makai/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:
   - ../values/makai/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: {{ .Environment.Name }}-makai
+  namespace: makai
   chart: manifests
   condition: makai.enabled
   missingFileHandler: Info

helmfile.d/mariadb-operator.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
   namespace: mariadb-operator
   chart: mariadb-operator/mariadb-operator
-  version: 25.10.3
+  version: 25.10.4
   condition: mariadb_operator.enabled
   values:
   - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.50
+  version: 0.2.55
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.142.1
+  version: 0.146.1
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/postgres-operator.yaml.gotmpl

@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
   namespace: cnpg
   chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.3.1
+  version: 0.5.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 72.7.0
+  version: 82.10.1
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/slurm-operator.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
   namespace: slinky
   chart: slurm-operator/slurm-operator
-  version: 0.4.1
+  version: 1.0.2
   condition: slurm_operator.enabled
   values:
   - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl

helmfile.d/slurm.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm
   namespace: slurm
   chart: slurm/slurm
-  version: 0.4.1
+  version: 1.0.2
   condition: slurm.enabled
   values:
   - ../values/slurm/values/slurm.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 6.0.1
+  version: 7.7.2
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 11.3.2
+  version: 11.4.0
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

nix/treefmt.nix

@@ -0,0 +1,71 @@
+{
+  sources ? import ../npins,
+  pkgs ? import sources.nixpkgs { },
+  treefmt ? import sources.treefmt-nix,
+}:
+let
+  globalExcludes = [
+    "npins/default.nix"
+    "attic"
+    "vcluster"
+    ".*vendor"
+    ".*chart/.*"
+    ".*schema.json"
+  ];
+in
+treefmt.evalModule pkgs {
+  projectRootFile = ".git/config";
+
+  settings = {
+    excludes = globalExcludes;
+  };
+
+  programs = {
+
+    # --- Nix formatting ---
+    nixfmt = {
+      enable = true;
+      package = pkgs.nixfmt-rfc-style;
+    };
+    statix.enable = true;
+    deadnix.enable = true;
+
+    # --- Shell ---
+    shellcheck = {
+      enable = true;
+      excludes = [
+        "vcluster/"
+        "attic/"
+      ];
+    };
+
+    shfmt.enable = true;
+
+    # --- YAML ---
+    yamllint = {
+      enable = true;
+      excludes = [
+        "attic/"
+        "charts/templates/"
+        "charts/"
+        "values/"
+        "vcluster/"
+      ];
+      settings = {
+        extends = "default";
+        rules = {
+          document-start = "disable";
+          line-length = {
+            max = 300;
+          };
+        };
+      };
+    };
+
+    # --- JSON ---
+    jsonfmt.enable = true;
+
+    # Optional: keep JSON sorted
+    # prettier.enable = true;
+  };
+}

npins/sources.json

@@ -18,6 +18,19 @@
       "name": "nixpkgs-unstable",
       "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre930822.ed142ab1b3a0/nixexprs.tar.xz",
       "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="
+    },
+    "treefmt-nix": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "numtide",
+        "repo": "treefmt-nix"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "337a4fe074be1042a35086f15481d763b8ddc0e7",
+      "url": "https://github.com/numtide/treefmt-nix/archive/337a4fe074be1042a35086f15481d763b8ddc0e7.tar.gz",
+      "hash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk="
     }
   },
   "version": 7

shell.nix

@@ -1,67 +1,53 @@
 let
-  sources = import ./nix;
+  sources = import ./npins;
   system = builtins.currentSystem;
   pkgs = import sources.nixpkgs {
     inherit system;
     config = { };
     overlays = [ ];
   };
-  checks = import ./nix/checks.nix;
+  treefmt = import ./nix/treefmt.nix { };
 in
 pkgs.mkShellNoCC {
-  name = "clstr";
+  packages = [
+    # dev tools
+    pkgs.just
+    pkgs.npins
+    treefmt.config.build.wrapper
 
-  packages =
+    # helm
-    with pkgs;
+    pkgs.helmfile
-    [
+    pkgs.kubernetes-helm
-      # dev tools
-      just
-      npins
 
-      # helm
+    # kubectl tools
-      helmfile
+    pkgs.kubectl-cnpg
-      kubernetes-helm
+    pkgs.kubectl-neat
+    pkgs.kubectl-graph
+    pkgs.kubectl-klock
+    pkgs.kubectl-rook-ceph
 
-      # kubectl tools
+    # other tools activate when needed
-      kubectl-cnpg
+    # pkgs.step-cli
-      kubectl-neat
+    # pkgs.linkerd
-      kubelogin
+    # pkgs.cmctl
-      kubelogin-oidc
+    # pkgs.rclone
-      kubectl-rook-ceph
+    # pkgs.velero
-      kubectl-graph
+    # pkgs.renovate
-      kubectl-klock
+    # pkgs.graphviz
-      graphviz
+    # pkgs.hubble
-
+    # pkgs.dapr-cli
-      # other tools activate when needed
+  ];
-      # step-cli
-      # linkerd
-      # cmctl
-      # rclone
-      # velero
-      renovate
-
-      # dapr
-      dapr-cli
-    ]
-    ++ checks.enabledPackages;
 
   # Environment variables
   ARGOCD_ENV_CLUSTER_NAME = "ekman";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
 
-  shellHook = builtins.concatStringsSep "\n" [
-    checks.shellHook
-  ];
-
   # Alternative shells
   passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {
     ci-shell = {
       packages = [
         pkgs.npins
       ];
-      shellHook = ''
-        export NPINS_DIRECTORY="nix"
-      '';
     };
   };
 }

values/argo/env.yaml.gotmpl

@@ -24,11 +24,7 @@ argocd:
       cpu: 250m
   repoServers:
   - name: "helmfile-cmp"
-    image: "registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest"
+    image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
-    imagePullSecrets:
-      - gitlab-pull-secret
-  - name: "kustomize-helm-with-rewrite"
-    image: "registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest"
     imagePullSecrets:
       - gitlab-pull-secret
   additional_rbac_settings:

values/argo/manifests/argo.yaml

@@ -28,6 +28,7 @@ spec:
     managedNamespaceMetadata:
       labels:
         component: sys
+        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/argo/manifests/httproute.yaml

@@ -0,0 +1,40 @@
+{{- if .Values.clusterConfig.gatewayAPI.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  parentRefs:
+  - name: shared-gateway
+    namespace: kube-system
+    sectionName: https-internal
+  hostnames:
+  - argocd.{{ .Values.clusterConfig.domain }}
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: "/"
+    backendRefs:
+    - name: argocd-server
+      port: 80
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-argocd
+  namespace: argocd
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: argocd-server
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": argocd
+{{- end }}

values/argo/manifests/sys-project.yaml

@@ -92,9 +92,13 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: postfix
     server: https://kubernetes.default.svc
+  - namespace: jobset-system
+    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
+  - https://git.oceanbox.io/platform/manifests.git
+  - https://git.oceanbox.io/platform/manifests
   - https://gitlab.com/oceanbox/manifests.git
   - https://kubernetes.github.io/ingress-nginx
   - https://cloudnative-pg.github.io/charts
@@ -127,6 +131,9 @@ spec:
   - ghcr.io/slinkyproject/charts/slurm-operator
   - ghcr.io/slinkyproject/charts/slurm-operator-crds
   - ghcr.io/spegel-org/helm-charts
+  - quay.io/cilium/charts
+  - quay.io/jetstack/charts
+  - registry.k8s.io/jobset/charts/jobset
   - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
   - docker.gitea.com
   - https://operator.mariadb.com/mariadb-enterprise-operator

values/argo/values/argocd.yaml.gotmpl

@@ -4,18 +4,21 @@ global:
 ## Ref: https://github.com/argoproj/argo-cd
 ##
 configs:
-  {{- if .Values.argocd.anyNamespaces.enabled }}
   params:
+    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
+    server.insecure: "true"
+    {{- end }}
+    {{- if .Values.argocd.anyNamespaces.enabled }}
     applicationsetcontroller.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
     # TODO(kai): anyapp will disable PR review apps. Look into anyapp settings to fix it
     applicationsetcontroller.enable.scm.providers: "false"
     application.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
-  {{- end }}
+    {{- end }}
   cm:
     application.resourceTrackingMethod: annotation+label
     application.instanceLabelKey: app.kubernetes.io/instance
     create: true
-    # NOTE(kai): callback URL for dex
+    # NOTE: callback URL for dex
     url: "https://argocd.{{ .Values.clusterConfig.domain }}"
     resource.compareoptions: |
       ignoreAggregatedRoles: true
@@ -81,6 +84,7 @@ configs:
       p, role:org-admin, applications, *, */*, allow
       p, role:org-admin, projects, *, *, allow
       p, role:org-admin, logs, get, *, allow
+      p, role:org-admin, logs, get, */*, allow
       p, role:org-admin, clusters, get, *, allow
       p, role:org-admin, clusters, update, *, allow
       p, role:org-admin, repositories, get, *, allow
@@ -167,7 +171,7 @@ repoServer:
   extraContainers:
   - command:
     - /var/run/argocd/argocd-cmp-server
-    image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
+    image: {{ .image }}
     env:
     - name: HELM_GIT_ACCESS_TOKEN
       valueFrom:
@@ -176,25 +180,6 @@ repoServer:
           name: oceanbox-gitops-repo
           optional: false
     imagePullPolicy: Always
-    name: helmfile-cmp
-    securityContext:
-      runAsNonRoot: true
-      runAsUser: 999
-    terminationMessagePath: /dev/termination-log
-    terminationMessagePolicy: File
-    volumeMounts:
-    - mountPath: /var/run/argocd
-      name: var-files
-    - mountPath: /home/argocd/cmp-server/plugins
-      name: plugins
-    - mountPath: /tmp
-      name: cmp-tmp
-    - mountPath: /helm-working-dir
-      name: helm-working-dir
-  - command:
-    - /var/run/argocd/argocd-cmp-server
-    image: {{ .image }}
-    imagePullPolicy: Always
     name: {{ .name }}
     securityContext:
       runAsNonRoot: true
@@ -208,6 +193,8 @@ repoServer:
       name: plugins
     - mountPath: /tmp
       name: cmp-tmp
+    - mountPath: /helm-working-dir
+      name: helm-working-dir
   volumes:
   - name: cmp-tmp
     emptyDir: {}
@@ -254,6 +241,9 @@ server:
     serviceMonitor:
       enabled: true
   ingress:
+    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
+    enabled: false
+    {{- else }}
     enabled: true
     ingressClassName: nginx
     annotations:
@@ -270,6 +260,7 @@ server:
       - secretName: argocd-tls
         hosts:
           - "argocd.{{ .Values.clusterConfig.domain }}"
+    {{- end }}
 applicationSet:
   metrics:
     enabled: true
@@ -283,10 +274,6 @@ applicationSet:
     ingressClassName: nginx
     annotations:
       cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
-      # {{- with .Values.clusterConfig.ingress_whitelist}}
-      # NOTE(kai): include gitlab and github webhook ranges
-      # nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }},192.30.252.0/22,140.82.112.0/20,34.74.226.27/28,34.74.226.0/24
-      # {{- end }}
     hostname: "argocd-applicationset.{{ .Values.clusterConfig.domain }}"
     tls:
       - secretName: argocd-applicationset-tls

values/atlantis/env-oceanbox.yaml.gotmpl

@@ -1,3 +1,2 @@
 atlantis:
   enabled: true
-

values/atlantis/env.yaml.gotmpl

@@ -1,5 +1,4 @@
 atlantis:
   enabled: false
-  autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}
+  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
   env: {{ .Environment.Name }}
-

values/atlantis/kustomize/beta/appsettings.json

@@ -0,0 +1,96 @@
+{
+    "oidc": {
+        "issuer": "https://auth.oceanbox.io/realms/oceanbox",
+        "authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
+        "token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
+        "jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
+        "userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
+        "end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
+        "device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
+        "clientId": "atlantis",
+        "clientSecret": "",
+        "scopes": [
+            "openid",
+            "email",
+            "offline_access",
+            "profile"
+        ],
+        "audiences": [
+            "atlantis",
+            "atlantis_dev",
+            "sorcerer",
+            "sorcerer_dev"
+        ]
+    },
+    "sso": {
+        "cookieDomain": ".oceanbox.io",
+        "cookieName": ".obx.beta",
+        "ttl": 12.0,
+        "signedOutRedirectUri": "https://maps.beta.oceanbox.io",
+        "realm": "atlantis",
+        "environment": "prod",
+        "keyStore": {
+            "kind": "azure",
+            "uri": "https://atlantis.blob.core.windows.net",
+            "key": "dataprotection-keys"
+        },
+        "keyVault": {
+            "kind": "azure",
+            "uri": "https://atlantisvault.vault.azure.net",
+            "key": "dataencryption-keys"
+        }
+    },
+    "fga": {
+      "apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
+      "apiKey": "",
+      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
+      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
+    },
+    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
+    "plainAuthUsers": [
+        {
+            "username": "admin",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "sorcerer",
+            "password": "fire tre to en",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "archivist",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        }
+    ],
+    "plume": "plume.data.oceanbox.io",
+    "redis": "beta-atlantis-redis:6379",
+    "objectStore": "https://atlantis.blob.core.windows.net",
+    "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
+    "sorcerer" : "https://sorcerer.beta.ekman.oceanbox.io",
+    "allowedOrigins": [
+        "https://maps.beta.oceanbox.io"
+    ],
+    "appName": "atlantis",
+    "appEnv": "prod",
+    "appNamespace": "atlantis",
+    "appVersion": "2.95.1",
+    "otelCollector": "http://opentelemetry-collector.otel.svc:4317",
+    "pubsubName": "pubsub",
+    "pubsubTopic": "hipster-atlantis",
+    "slurm": {
+        "baseUrl": "https://slurmrestd.ekman.oceanbox.io/",
+        "slurmApi": "slurm/v0.0.42/",
+        "dbdApi": "slurmdbd/v0.0.42/",
+        "accessToken": ""
+    },
+    "amqp": {
+        "auth": "user:hunny-bunny",
+        "host": "10.255.241.201:30673"
+    },
+    "fenceRadius": 1250.0
+}

values/atlantis/kustomize/beta/bindings.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: slurm-events
+spec:
+  type: bindings.rabbitmq
+  version: v1
+  metadata:
+  - name: host
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  connString
+  - name: queueName
+    value: beta-slurm-job-events
+  - name: durable
+    value: true
+  - name: contentType
+    value: "application/json"
+  - name: route
+    value: /events/slurm
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/configurations.yaml

@@ -0,0 +1,20 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: configstore
+spec:
+  type: configuration.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: beta-atlantis-redis:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: beta-atlantis-redis
+      key:  redis-password
+  - name: redisDB
+    value: "1"
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/default.env

@@ -0,0 +1 @@
+OIDC_CLIENT_SECRET=KOJ6bDHzE5vdyfSrzgwLjtM5PzA809Zm

values/atlantis/kustomize/beta/deployment_patch.yaml

@@ -0,0 +1,10 @@
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: azure-keyvault
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: prod-atlantis-env

values/atlantis/kustomize/beta/keyvault.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: azure-keyvault
+spec:
+  type: secretstores.azure.keyvault
+  version: v1
+  metadata:
+  - name: vaultName
+    value: atlantisvault
+  - name: azureTenantId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_TENANT_ID
+  - name: azureClientId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_ID
+  - name: azureClientSecret
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_SECRET

values/atlantis/kustomize/beta/kustomization.yaml

@@ -0,0 +1,24 @@
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: beta-atlantis-appsettings
+  files:
+    - appsettings.json
+patches:
+  - target:
+      group: apps
+      version: v1
+      kind: Deployment
+    path: deployment_patch.yaml
+
+resources:
+  - ../base
+  - rbac.yaml
+  - tracing.yaml
+  - bindings.yaml
+  - pubsub.yaml
+  - statestore.yaml
+  - subscriptions.yaml
+  - configurations.yaml
+  - secretstore.yaml
+  - keyvault.yaml

values/atlantis/kustomize/beta/pubsub.yaml

@@ -0,0 +1,52 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: pubsub
+spec:
+  version: v1
+  type: pubsub.rabbitmq
+  metadata:
+  - name: hostname
+    value: prod-rabbitmq.rabbitmq
+  - name: username
+    value: user
+  - name: password
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  rabbitmq-password
+  - name: protocol
+    value: amqp
+  - name: durable
+    value: true
+  - name: deletedWhenUnused
+    value: false
+  - name: autoAck
+    value: false
+  - name: deliveryMode
+    value: 1
+  - name: requeueInFailure
+    value: false
+  - name: prefetchCount
+    value: 0
+  - name: reconnectWait
+    value: 0
+  - name: concurrencyMode
+    value: parallel
+  - name: publisherConfirm
+    value: false
+  - name: backOffPolicy
+    value: exponential
+  - name: backOffInitialInterval
+    value: 100
+  - name: backOffMaxRetries
+    value: 16
+  - name: enableDeadLetter # Optional enable dead Letter or not
+    value: true
+  - name: maxLen # Optional max message count in a queue
+    value: 3000
+  - name: maxLenBytes # Optional maximum length in bytes of a queue.
+    value: 10485760
+  - name: exchangeKind
+    value: fanout
+  - name: clientName
+    value: "{appID}"

values/atlantis/kustomize/beta/rbac.yaml

@@ -0,0 +1,40 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: beta-atlantis
+  namespace: beta-atlantis
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - beta-atlantis-appsettings
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - watch
+- apiGroups:
+  - ""
+  resourceNames:
+  - azure-keyvault
+  - beta-atlantis-redis
+  - slurm-access-token
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: beta-atlantis
+  namespace: beta-atlantis
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: beta-atlantis
+subjects:
+- kind: ServiceAccount
+  name: beta-atlantis
+  namespace: beta-atlantis

values/atlantis/kustomize/beta/secretstore.yaml

@@ -0,0 +1,10 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: secretstore
+spec:
+  type: secretstores.kubernetes
+  version: v1
+  metadata:
+   - name: defaultNamespace
+     value: beta-atlantis

values/atlantis/kustomize/beta/statestore.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: statestore
+spec:
+  type: state.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: beta-atlantis-redis:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: beta-atlantis-redis
+      key:  redis-password
+  - name: actorStateStore
+    value: "true"
+  - name: redisDB
+    value: "0"
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/subscriptions.yaml

@@ -0,0 +1,27 @@
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: hipster-events
+spec:
+  topic: hipster
+  routes:
+    default: /events/hipster
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- beta-atlantis
+---
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: inbox-events
+spec:
+  topic: inbox
+  routes:
+    default: /events/inbox
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- beta-atlantis

values/atlantis/kustomize/beta/tracing.yaml

@@ -0,0 +1,11 @@
+apiVersion: dapr.io/v1alpha1
+kind: Configuration
+metadata:
+  name: tracing
+spec:
+  tracing:
+    samplingRate: "1"
+    otel:
+      endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
+      protocol: grpc
+      isSecure: false

values/atlantis/kustomize/prod/appsettings.json

@@ -73,7 +73,8 @@
     "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
     "sorcerer" : "https://sorcerer.data.oceanbox.io",
     "allowedOrigins": [
-        "https://maps.oceanbox.io"
+        "https://maps.oceanbox.io",
+        "https://codex.adm.oceanbox.io"
     ],
     "appName": "atlantis",
     "appEnv": "prod",

values/atlantis/kustomize/staging/appsettings.json

@@ -26,7 +26,7 @@
         "cookieDomain": ".oceanbox.io",
         "cookieName": ".obx.staging",
         "ttl": 12.0,
-        "signedOutRedirectUri": "https://atlantis.beta.oceanbox.io",
+        "signedOutRedirectUri": "https://maps.dev.oceanbox.io",
         "realm": "atlantis",
         "environment": "staging",
         "keyStore": {
@@ -76,7 +76,8 @@
         "https://atlantis.beta.oceanbox.io",
         "https://atlantis.dev.oceanbox.io",
         "https://atlantis.local.oceanbox.io:8080",
-        "https://maps.dev.oceanbox.io"
+        "https://maps.dev.oceanbox.io",
+        "https://codex.dev.oceanbox.io"
     ],
     "appName": "atlantis",
     "appEnv": "staging",

values/atlantis/manifests/atlantis.yaml

@@ -27,16 +27,24 @@ spec:
         value: {{ .Values.atlantis.env }}
       - name: HELMFILE_FILE_PATH
         value: atlantis.yaml.gotmpl
+  {{- if ne .Values.atlantis.env "beta" }}
   - repoURL: https://charts.bitnami.com/bitnami
     targetRevision: 20.1.7
     chart: redis
     helm:
       valueFiles:
       - $values/values/atlantis/values/redis-{{ .Values.atlantis.env }}.yaml
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+  {{- end }}
+  - repoURL: https://git.oceanbox.io/platform/manifests.git
     targetRevision: main
     ref: values
   ignoreDifferences:
+    - kind: Secret
+      name: beta-atlantis-db-superuser
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
     - kind: Secret
       name: azure-keyvault
       jqPathExpressions:
@@ -67,6 +75,12 @@ spec:
         - '.data'
         - '.metadata.labels'
         - '.metadata.annotations'
+    - kind: Secret
+      name: slurm-access-token
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
   syncPolicy:
     syncOptions:
       - CreateNamespace=true

values/atlantis/values/redis-prod.yaml

@@ -2,6 +2,14 @@ architecture: replication
 
 replica:
   replicaCount: 2
+  resources:
+    limits:
+      ephemeral-storage: 1024Mi
+      memory: 192Mi
+    requests:
+      cpu: 150m
+      ephemeral-storage: 50Mi
+      memory: 128Mi
 
 auth:
   enabled: true
@@ -20,4 +28,3 @@ master:
       cpu: 150m
       ephemeral-storage: 50Mi
       memory: 128Mi
-

values/atlantis/values/sec.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  redis-password: N2drUGlEN0ZMNA==
+kind: Secret
+metadata:
+  name: beta-sorcerer-redis
+  namespace: beta-sorcerer
+type: Opaque

values/atlantis/values/values-beta.yaml.gotmpl

@@ -0,0 +1,103 @@
+replicaCount: 1
+
+image:
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: v1.46.2
+
+podAnnotations:
+  dapr.io/app-id: "beta-atlantis"
+
+env:
+  - name: APP_NAMESPACE
+    value: beta-atlantis
+  - name: APP_VERSION
+    value: "2.97.4-beta"
+  - name: LOG_LEVEL
+    value: "1"
+  - name: ANALYTICS_WEB_ID
+    value: "16e7d807-4db5-45fd-92a9-27393445a153"
+  - name: REDIS_USER
+    value: default
+  - name: REDIS_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: beta-atlantis-redis
+        key: redis-password
+  # Share production database
+  - name: DB_HOST
+    value: prod-atlantis-db-rw.prod-atlantis
+  - name: DB_PORT
+    value: "5432"
+  - name: DB_USER
+    valueFrom:
+      secretKeyRef:
+        name: prod-atlantis-db-superuser
+        key: username
+  - name: DB_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: prod-atlantis-db-superuser
+        key: password
+  - name: DAPR_API_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: dapr-api-token
+        key: token
+
+ingress:
+  enabled: true
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+  hosts:
+    - host: maps.beta.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+       - maps.beta.oceanbox.io
+      secretName: beta-atlantis-tls
+
+cluster:
+  enabled: false
+  bootstrap: false
+
+redis:
+  enabled: true
+  size: 2Gi
+  secret:
+    name: beta-atlantis-redis
+    key: redis-password
+  backup:
+    enabled: true
+  resources:
+    cpu: 150m
+    memory: 256Mi
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 250m
+    memory: 512Mi
+
+diagrid-dashboard:
+  enabled: false
+  statestore:
+    scope: beta-atlantis
+    redis: beta-atlantis-redis

values/atlantis/values/values-prod.yaml.gotmpl

@@ -73,9 +73,6 @@ cluster:
     enabled: false
 
 resources:
-  limits:
-    cpu: 1
-    memory: 1Gi
   requests:
     cpu: 500m
     memory: 1Gi

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,6 +1,7 @@
 replicaCount: 1
 image:
-  tag: 8e824d4a-debug
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: 23006866-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:
@@ -49,23 +50,6 @@ ingress:
     # nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"
     # oceanbox.io/expose: internal
   hosts:
-    - host: atlantis.beta.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-      internal:
-        - path: /internal
-          pathType: ImplementationSpecific
-        - path: /dapr
-          pathType: ImplementationSpecific
-        - path: /actors
-          pathType: ImplementationSpecific
-        - path: /job
-          pathType: ImplementationSpecific
-        - path: /events
-          pathType: ImplementationSpecific
-        - path: /metrics
-          pathType: ImplementationSpecific
     - host: maps.dev.oceanbox.io
       paths:
         - path: /
@@ -83,27 +67,8 @@ ingress:
           pathType: ImplementationSpecific
         - path: /metrics
           pathType: ImplementationSpecific
-    - host: atlas.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-      internal:
-        - path: /internal
-          pathType: ImplementationSpecific
-        - path: /dapr
-          pathType: ImplementationSpecific
-        - path: /actors
-          pathType: ImplementationSpecific
-        - path: /job
-          pathType: ImplementationSpecific
-        - path: /events
-          pathType: ImplementationSpecific
-        - path: /metrics
-          pathType: ImplementationSpecific
   tls:
     - hosts:
-        - atlantis.beta.oceanbox.io
-        - atlas.oceanbox.io
         - maps.dev.oceanbox.io
       secretName: staging-atlantis-tls
 cluster:

values/attic/env-oceanbox.yaml.gotmpl

@@ -1,2 +1,2 @@
 attic:
-  enabled: true
+  enabled: false

values/attic/manifests/attic.yaml

@@ -4,15 +4,15 @@ metadata:
   name: attic
   namespace: argocd
   finalizers:
-  - resources-finalizer.argocd.argoproj.io
+    - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
     namespace: attic
-    server: 'https://kubernetes.default.svc'
+    server: "https://kubernetes.default.svc"
   sources:
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    - repoURL: https://git.oceanbox.io/oceanbox/manifests.git
-    targetRevision: HEAD
+      targetRevision: HEAD
-    path: values/attic/manifests
+      path: values/attic/manifests
   project: aux
   syncPolicy:
     managedNamespaceMetadata:

values/cert-manager/env-hel1.yaml.gotmpl

@@ -0,0 +1,5 @@
+cert_manager:
+ enabled: true
+ autosync: true
+ gatewayApi:
+  enabled: true

values/cert-manager/env.yaml.gotmpl

@@ -1,3 +1,5 @@
 cert_manager:
  enabled: true
  autosync: true
+ gatewayApi:
+  enabled: false

values/cert-manager/values/cert-manager.yaml.gotmpl

@@ -3,3 +3,9 @@ enableCertificateOwnerRef: true
 startupapicheck:
   podAnnotations:
     linkerd.io/inject: disabled
+{{- if .Values.cert_manager.gatewayApi.enabled }}
+config:
+  apiVersion: controller.config.cert-manager.io/v1alpha1
+  enableGatewayAPI: true
+  kind: ControllerConfiguration
+{{- end }}

values/cilium/cilium-manifests/gateway.yaml

@@ -0,0 +1,122 @@
+{{- if eq .Values.cilium.cluster "hel1" }}
+# TODO: Move to ListernerSets when those get Promoted to GA
+# Resources:
+# - https://gateway-api.sigs.k8s.io/geps/gep-1713/
+# - https://github.com/kubernetes-sigs/gateway-api/issues/1713
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: shared-gateway
+  namespace: kube-system
+spec:
+  infrastructure:
+    annotations:
+      load-balancer.hetzner.cloud/location: hel1
+      load-balancer.hetzner.cloud/type: lb11
+      load-balancer.hetzner.cloud/name: load-balancer-1
+      load-balancer.hetzner.cloud/use-private-ip: "true"
+      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
+      load-balancer.hetzner.cloud/http-redirect-https: "false"
+  gatewayClassName: cilium
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: https
+      protocol: HTTPS
+      port: 443
+      tls:
+        certificateRefs:
+          - group: ''
+            kind: Secret
+            name: wildcard-oceanbox-io
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: https-hel1
+      protocol: HTTPS
+      port: 443
+      hostname: "*.hel1.oceanbox.io"
+      tls:
+        certificateRefs:
+          - group: ''
+            kind: Secret
+            name: wildcard-hel1-oceanbox-io
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: https-internal
+      protocol: HTTPS
+      port: 443
+      hostname: "*.adm.hel1.obx"
+      tls:
+        certificateRefs:
+          - group: ''
+            kind: Secret
+            name: wildcard-adm-hel1-obx
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: ssh
+      protocol: TCP
+      port: 22
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-oceanbox-io
+spec:
+  secretName: wildcard-oceanbox-io
+  commonName: oceanbox.io
+  dnsNames:
+    - oceanbox.io
+    - "*.oceanbox.io"
+  issuerRef:
+    name: letsencrypt-prod-dns01
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-hel1-oceanbox-io
+spec:
+  secretName: wildcard-hel1-oceanbox-io
+  dnsNames:
+    - "*.hel1.oceanbox.io"
+  issuerRef:
+    name: letsencrypt-prod-dns01
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-adm-hel1-obx
+spec:
+  secretName: wildcard-adm-hel1-obx
+  dnsNames:
+    - "*.adm.hel1.obx"
+  issuerRef:
+    name: ca-issuer
+    kind: ClusterIssuer
+{{- end}}

values/cilium/cilium-manifests/policies/allow-ingress-to-cluster.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: "cilium.io/v2"
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ingress-to-cluster
+  namespace: default
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: reserved:ingress
+        operator: Exists
+  egress:
+    - toEntities:
+        - cluster
+  ingress:
+    - fromEntities:
+        - world
+        - cluster
+{{- end }}

values/cilium/env-ekman.yaml.gotmpl

@@ -0,0 +1,19 @@
+cilium:
+  enabled: true
+  # WireGuard cannot be used during migration -- Flannel nodes have no WireGuard
+  # keys so encrypted traffic is unreadable by them.
+  # TODO: re-enable after migration
+  encryption:
+    enabled: false
+  envoy:
+    enabled: true
+  # kube-proxy stays running during migration; disable replacement until done.
+  # TODO: set to true after migration
+  kubeProxyReplacement: false
+  # Direct apiserver connection -- do not rely on the kubernetes service IP
+  # during migration since we are touching the CNI layer.
+  # TODO: remove k8sServiceHost / k8sServicePort (or keep pointing at apiserver localhost)
+  k8sServiceHost: 10.255.241.99
+  k8sServicePort: 6443
+  policyAuditMode: true
+  upgradeCompatability: 1.18

values/cilium/env-hel1.yaml.gotmpl

@@ -0,0 +1,14 @@
+cilium:
+  enabled: true
+  envoy:
+    enabled: true
+  nodePort:
+    enabled: true
+  l2announcement:
+    enabled: true
+  gatewayAPI:
+    enabled: true
+  gatewayTest:
+    enabled: true
+  policyAuditMode: true
+  upgradeCompatability: 1.18

values/cilium/env-rossby.yaml.gotmpl

@@ -0,0 +1,10 @@
+cilium:
+  enabled: true
+  nodePort:
+    enabled: true
+  l2announcement:
+    enabled: true
+  loadbalancerPool:
+    enabled: false
+    cidr:
+     - 10.255.241.11/32

values/cilium/env.yaml.gotmpl

@@ -30,3 +30,4 @@ cilium:
   loadbalancerPool:
     enabled: false
     cidr: []
+  cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}

values/cilium/values/cilium-ekman.yaml.gotmpl

@@ -0,0 +1,33 @@
+# Installs Cilium without writing the CNI config file.
+# Flannel keeps serving pods on unmigrated nodes.
+# TODO: Remove after migration
+#cni:
+  #customConf: false
+
+# Routes cross-CNI traffic via the host network stack so Flannel pods
+# and Cilium pods can reach each other during the transition.
+# TODO: Remove after migration
+#bpf:
+  #hostLegacyRouting: false
+
+# NOTE: Use Geneve so Cilium's overlay is distinct from Flannel's VXLAN.
+# This is required for cross-CNI pod connectivity during migration.
+routingMode: tunnel
+tunnelProtocol: geneve
+
+# New pod CIDR exclusively for Cilium (must not overlap):
+# Flannel pod CIDR: 10.100.0.0/16  (clusterCidr in k8s config)
+# Service CIDR:     10.0.0.0/22
+# Node networks:    10.255.241.0/24, 10.255.242.0/24, 10.255.243.0/24, 10.255.244.0/24
+# TODO: after migration switch ipam.mode to kubernetes
+ipam:
+  mode: cluster-pool
+  operator:
+    clusterPoolIPv4PodCIDRList:
+      - "10.100.0.0/16"
+    clusterPoolIPv4MaskSize: 24
+
+# NOTE: Rate limit Cilium's k8s API client ekman has ~30 nodes.
+k8sClientRateLimit:
+  qps: 5
+  burst: 10