devel: Useful kubectl plugins

chore: update npins dependencies

See merge request oceanbox/manifests!67

.envrc

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
 watch_file nix/sources.json
+watch_file nix/checks.nix
 
 # Load .env file if it exists
 dotenv_if_exists

.gitignore

@@ -1,6 +1,7 @@
 *.tgz
 _*/
 .direnv/
+.env
 .pre-commit-config.yaml
 _*.yaml
 backup/

.gitlab-ci.yml

@@ -1,46 +1,54 @@
-image:
+# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
-  name: alpine/helm:latest
+default:
-  entrypoint: [ "/bin/bash", "-c" ]
+  tags:
+    - nix
 
-stages:
+include:
-  - release
+  - project: oceanbox/gitlab-ci
+    ref: v4.5
+    file: template/Base.gitlab-ci.yml
+# stages:
+# - release
 
-release:
+# image:
-  stage: release
+# name: alpine/helm:latest
-  rules:
+# entrypoint: ["/bin/bash", "-c"]
-  - if: '$CI_COMMIT_BRANCH =~ /^main/'
-    when: always
-  - when: never
-  script:
-    - |
-      cd $CI_PROJECT_DIR
-      for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
-        pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-        if [ ! -z $pack ]; then
-          chart=$(basename $pack)
-          curl --request POST \
-               --user gitlab-ci-token:$CI_JOB_TOKEN \
-               --form "chart=@${chart}" \
-               "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-        fi
-      done
 
-rebuild:
+# release:
-  stage: release
+# stage: release
-  rules:
+# rules:
-    - when: manual
+# - if: "$CI_COMMIT_BRANCH =~ /^main/"
-      allow_failure: true
+# when: always
-  script:
+# - when: never
-    - |
+# script:
-      cd $CI_PROJECT_DIR
+# - |
-      for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
+# cd $CI_PROJECT_DIR
-        pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
+# for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
-        if [ ! -z $pack ]; then
+# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-          chart=$(basename $pack)
+# if [ ! -z $pack ]; then
-          curl --request POST \
+# chart=$(basename $pack)
-               --user gitlab-ci-token:$CI_JOB_TOKEN \
+# curl --request POST \
-               --form "chart=@${chart}" \
+# --user gitlab-ci-token:$CI_JOB_TOKEN \
-               "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
+# --form "chart=@${chart}" \
-        fi
+# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-      done
+# fi
+# done
 
+# rebuild:
+# stage: release
+# rules:
+# - when: manual
+# allow_failure: true
+# script:
+# - |
+# cd $CI_PROJECT_DIR
+# for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
+# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
+# if [ ! -z $pack ]; then
+# chart=$(basename $pack)
+# curl --request POST \
+# --user gitlab-ci-token:$CI_JOB_TOKEN \
+# --form "chart=@${chart}" \
+# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
+# fi
+# done

attic/nix/atlantis.nix

@@ -6,39 +6,46 @@ let
   values = lib.apps.appValues {
     inherit env;
     base = ../values/atlantis;
-    extraValues = {};
+    extraValues = { };
   };
 
-  kustomize = r:
+  kustomize =
+    r:
     if r.kind == "Deployment" then
       lib.attrsets.recursiveUpdate r {
-        spec.template.spec.containers =
+        spec.template.spec.containers = builtins.map (
-        builtins.map (x:
+          x:
-        x // {
+          x
+          // {
             livenessProbe.httpGet.path = "/healthz";
             readinessProble.httpGet.path = "/healthz";
-            env = x.env ++ [ { name = "INERNAL_PORT"; value = 8000; } ];
+            env = x.env ++ [
-        }) r.spec.template.spec.containers;
+              {
+                name = "INERNAL_PORT";
+                value = 8000;
+              }
+            ];
+          }
+        ) r.spec.template.spec.containers;
       }
-      else if r.kind == "Service" then
+    else if r.kind == "Service" then
-      {}
+      { }
-    else r;
+    else
+      r;
 in
 {
   options.apps.atlantis = lib.apps.appOptions {
-      revision = lib.mkOption {
+    revision = lib.mkOption {
-        type = lib.types.str;
+      type = lib.types.str;
-        default = "main";
+      default = "main";
-        description = "Revision";
+      description = "Revision";
-      };
+    };
 
-      hostname = lib.mkOption {
+    hostname = lib.mkOption {
-        type = lib.types.str;
+      type = lib.types.str;
-        default = if env == "prod"
+      default = if env == "prod" then "maps.oceanbox.io" else "atlantis.beta.oceanbox.io";
-          then "maps.oceanbox.io"
+      description = "Revision";
-          else "atlantis.beta.oceanbox.io";
+    };
-        description = "Revision";
-      };
   };
 
   config = lib.apps.appConfig cfg "${env}-atlantis" {

attic/nix/openfga.nix

@@ -6,34 +6,32 @@ let
   values = lib.apps.appValues {
     inherit env;
     base = ../values/openfga;
-    extraValues = {};
+    extraValues = { };
   };
 
-  kustomize = r:
+  kustomize =
-    if r.kind == "Job" then
+    r: if r.kind == "Job" then lib.attrsets.recursiveUpdate r { spec.backoffLimit = 2; } else r;
-      lib.attrsets.recursiveUpdate r { spec.backoffLimit = 2; }
-    else r;
 
 in
-  {
+{
-    options.apps.openfga = lib.apps.appOptions {};
+  options.apps.openfga = lib.apps.appOptions { };
 
-    config = lib.apps.appConfig cfg "${env}-openfga" {
+  config = lib.apps.appConfig cfg "${env}-openfga" {
-        helm.releases."${env}-openfga" = {
+    helm.releases."${env}-openfga" = {
-          inherit values;
+      inherit values;
-          chart = lib.helm.downloadHelmChart {
+      chart = lib.helm.downloadHelmChart {
-            repo = "https://openfga.github.io/helm-charts";
+        repo = "https://openfga.github.io/helm-charts";
-            chart = "openfga";
+        chart = "openfga";
-              version = "0.2.12";
+        version = "0.2.12";
-              chartHash = "sha256-7yLcw9/oNPvCePrtTJwKAG88t0Ym5Dl/S83Gz+gQdDU=";
+        chartHash = "sha256-7yLcw9/oNPvCePrtTJwKAG88t0Ym5Dl/S83Gz+gQdDU=";
-          };
-          transformer = rs: builtins.map (x: kustomize x) rs;
-        };
-
-        annotations = {};
-        resources = {
-          services.poop.spec = {
-          };
-        };
       };
-  }
+      transformer = rs: builtins.map (x: kustomize x) rs;
+    };
+
+    annotations = { };
+    resources = {
+      services.poop.spec = {
+      };
+    };
+  };
+}

attic/templates/kyverno.yaml

@@ -46,19 +46,19 @@ spec:
         {{ end }}
         cleanupController:
           resources:
-            limits: 
+            limits:
               memory: {{ .Values.kyverno.resources.cleanupController.memory }}
             requests:
               memory: {{ .Values.kyverno.resources.cleanupController.memory }}
         reportsController:
           resources:
-            limits: 
+            limits:
               memory: {{ .Values.kyverno.resources.reportsController.memory }}
             requests:
               memory: {{ .Values.kyverno.resources.reportsController.memory }}
         backgroundController:
           resources:
-            limits: 
+            limits:
               memory: {{ .Values.kyverno.resources.backgroundController.memory }}
             requests:
               memory: {{ .Values.kyverno.resources.backgroundController.memory }}

attic/templates/linkerd.yaml

@@ -27,17 +27,17 @@ spec:
             scheme: {{ .Values.linkerd.secretScheme }}
             {{- if .Values.linkerd.identityIssuerPEM }}
             tls:
-              crtPEM: {{- .Values.linkerd.identityIssuerPEM | toYaml | indent 14 }} 
+              crtPEM: {{- .Values.linkerd.identityIssuerPEM | toYaml | indent 14 }}
             {{- end }}
         policyValidator:
           externalSecret: true
-          caBundle: {{- .Values.linkerd.webhookPEM | toYaml | indent 9 }}  
+          caBundle: {{- .Values.linkerd.webhookPEM | toYaml | indent 9 }}
         proxyInjector:
           externalSecret: true
-          caBundle: {{- .Values.linkerd.webhookPEM | toYaml | indent 9 }}  
+          caBundle: {{- .Values.linkerd.webhookPEM | toYaml | indent 9 }}
         profileValidator:
           externalSecret: true
-          caBundle: {{- .Values.linkerd.webhookPEM | toYaml | indent 9 }}  
+          caBundle: {{- .Values.linkerd.webhookPEM | toYaml | indent 9 }}
 
   project: sys
   syncPolicy:

attic/templates/metricserver.yaml

@@ -16,7 +16,7 @@ spec:
     helm:
       values: |
         containerPort: 10250
-        resources: 
+        resources:
           requests:
             cpu: 100m
             memory: 200Mi

attic/templates/otel-collector.yaml

@@ -53,7 +53,7 @@ spec:
               endpoint: "tempo.tempo.svc:4317"
               tls:
                 insecure: true
-            ## 
+            ##
             otlphttp/metrics:
               endpoint: http://prom-prometheus.prometheus:9090/api/v1/otlp
               tls:

attic/templates/policies/generate-external-admin-rolebinding.yaml

@@ -12,8 +12,8 @@ metadata:
     policies.kyverno.io/minversion: 1.7.0
     kyverno.io/kubernetes-version: "1.23"
     policies.kyverno.io/description: >-
-      Customers should not have full admin permissions on their own namespaces.  
+      Customers should not have full admin permissions on their own namespaces.
-      This policy will generate a RoleBinding, binding their group_id to 
+      This policy will generate a RoleBinding, binding their group_id to
       the Cluster-Admin clusterrole. This will still only apply to the namespace as
       the resource is a rolebinding, not clusterrolebinding.
       This policy should not trigger on any namespaces with label component=sys

attic/templates/policies/prometheus-add-folder-to-default-dashboards.yaml

@@ -24,7 +24,7 @@ spec:
             grafana_folder: Prometheus-stack
       targets:
       - apiVersion: v1
-        kind: ConfigMap        
+        kind: ConfigMap
         name: "{{`{{ request.object.metadata.name }}`}}"
     name: generate-dashboard-folder-annotation
     skipBackgroundRequests: true

attic/templates/policies/sync-regcred.yaml

@@ -13,7 +13,7 @@ metadata:
       is time consuming and error prone. This policy will copy a
       Secret called `regcred` which exists in the `default` Namespace to
       new Namespaces when they are created. It will also push updates to
-      the copied Secrets should the source Secret be changed.            
+      the copied Secrets should the source Secret be changed.
 spec:
   rules:
   - name: sync-image-pull-secret

attic/templates/policies/whitelist-internal-ingresses.yaml

@@ -9,12 +9,12 @@ metadata:
     policies.kyverno.io/severity: medium
     policies.kyverno.io/subject: Ingress
     policies.kyverno.io/description: >-
-      Ingresses with the label "internal=true" should be whitelisted. 
+      Ingresses with the label "internal=true" should be whitelisted.
-      If no whitelist exists, add the default values, otherwise append 
+      If no whitelist exists, add the default values, otherwise append
       whitelist to the already existing ones
 spec:
   mutateExistingOnPolicyUpdate: false
-  #precondition: has whitelist annotation or 
+  #precondition: has whitelist annotation or
   rules:
   - name: ensure-nginx-whitelist-exists
     match:

attic/templates/resources/dashboards/rabbitmq.yaml

@@ -32,7 +32,7 @@ data:
           }
       ],
       "__elements":{
-          
+
       },
       "__requires":[
           {
@@ -70,7 +70,7 @@ data:
                   "limit":100,
                   "matchAny":false,
                   "tags":[
-                      
+
                   ],
                   "type":"dashboard"
                 },
@@ -83,7 +83,7 @@ data:
       "graphTooltip":0,
       "id":null,
       "links":[
-          
+
       ],
       "liveNow":false,
       "panels":[
@@ -130,7 +130,7 @@ data:
                       }
                   },
                   "mappings":[
-                      
+
                   ],
                   "thresholds":{
                       "mode":"absolute",
@@ -195,7 +195,7 @@ data:
             "options":{
                 "legend":{
                   "calcs":[
-                      
+
                   ],
                   "displayMode":"list",
                   "placement":"bottom",
@@ -255,7 +255,7 @@ data:
                 "multi":false,
                 "name":"DS_PROMETHEUS",
                 "options":[
-                  
+
                 ],
                 "query":"prometheus",
                 "refresh":1,
@@ -266,7 +266,7 @@ data:
             },
             {
                 "current":{
-                  
+
                 },
                 "datasource":{
                   "type":"prometheus",
@@ -279,7 +279,7 @@ data:
                 "multi":false,
                 "name":"namespace",
                 "options":[
-                  
+
                 ],
                 "query":{
                   "query":"label_values(rabbitmq_identity_info, namespace)",
@@ -296,7 +296,7 @@ data:
             },
             {
                 "current":{
-                  
+
                 },
                 "datasource":{
                   "type":"prometheus",
@@ -309,7 +309,7 @@ data:
                 "multi":false,
                 "name":"rabbitmq_cluster",
                 "options":[
-                  
+
                 ],
                 "query":{
                   "query":"label_values(rabbitmq_identity_info{namespace=\"$namespace\"}, rabbitmq_cluster)",
@@ -326,7 +326,7 @@ data:
             },
             {
                 "current":{
-                  
+
                 },
                 "datasource":{
                   "type":"prometheus",
@@ -339,7 +339,7 @@ data:
                 "multi":false,
                 "name":"queue",
                 "options":[
-                  
+
                 ],
                 "query":{
                   "query":"query_result(rabbitmq_detailed_queue_messages{namespace=\"$namespace\"} * on (instance, job) group_left(rabbitmq_cluster) rabbitmq_identity_info{namespace=\"$namespace\", rabbitmq_cluster=\"$rabbitmq_cluster\"})",
@@ -361,7 +361,7 @@ data:
           "to":"now"
       },
       "timepicker":{
-          
+
       },
       "timezone":"",
       "title":"RabbitMQ-Queue",

attic/templates/resources/kube-proxy-rbac.yaml

@@ -37,7 +37,7 @@ rules:
     resources:
       - events
     verbs: ["*"]
-      
+
   - nonResourceURLs: ["*"]
     verbs: ["*"]
   - apiGroups:

attic/templates/resources/pre-cert-manager.yaml

@@ -139,8 +139,8 @@ spec:
         resources: {}
         securityContext:
           allowPrivilegeEscalation: false
-        command: 
+        command:
-        - "/bin/sh" 
+        - "/bin/sh"
         - -c
         - /tmp/renew-certs/renew-certs.sh
         volumeMounts:
@@ -216,7 +216,7 @@ metadata:
   name: default-deny-egress
   namespace: cert-manager
 spec:
-  podSelector: 
+  podSelector:
     matchLabels:
       block-egress: "true"
   policyTypes:

attic/templates/resources/pre-gitlab-runner.yaml

@@ -42,8 +42,8 @@ spec:
         resources: {}
         securityContext:
           allowPrivilegeEscalation: false
-        command: 
+        command:
-        - "/bin/sh" 
+        - "/bin/sh"
         - -c
         - /tmp/renew-certs/renew-certs.sh
         volumeMounts:
@@ -119,7 +119,7 @@ metadata:
   name: default-deny-egress
   namespace: gitlab
 spec:
-  podSelector: 
+  podSelector:
     matchLabels:
       block-egress: "true"
   policyTypes:

attic/values/dex/templates/.vscode/launch.json

@@ -1,7 +1,4 @@
 {
-    // Use IntelliSense to learn about possible attributes.
-    // Hover to view descriptions of existing attributes.
-    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
     "version": "0.2.0",
     "configurations": [
         {

attic/values/dex/templates/README.md

@@ -1,4 +1,4 @@
-# Oceanbox IdP 
+# Oceanbox IdP
 
 ```
 npm install && npm start

attic/values/dex/templates/deploy.sh

@@ -2,16 +2,16 @@
 
 server="root@fs1-0"
 path="/vol/brick0/nfs0/k1/pv-oceanbox-dex"
-dest="$server:$path"
+dest="${server}:${path}"
 
 index=$(basename dist/assets/index-*.js)
 
-ssh $server -- rm $path/static/js/*.js
+ssh "${server}" -- rm "${path}"/static/js/*.js
-scp dist/assets/*.js $dest/static/js/
+scp dist/assets/*.js "${dest}"/static/js/
 
-sed -r "s/@index@/$index/" ./dex/templates/login.html > login.html.$$
+sed -r "s/@index@/${index}/" ./dex/templates/login.html > login.html.$$
-scp ./dex/templates/* $dest/templates/
+scp ./dex/templates/* "${dest}"/templates/
-scp ./dex/static/*.* $dest/static/
+scp ./dex/static/*.* "${dest}"/static/
-scp login.html.$$ $dest/templates/login.html
+scp login.html.$$ "${dest}"/templates/login.html
 rm login.html.$$
 ssh admin@k1-0.itpartner.intern -- kubectl rollout restart -n oceanbox deployment/dex

attic/values/dex/templates/src/App.fs

@@ -66,7 +66,7 @@ let MyApp() =
       if isNullOrUndefined localStorage["user_id"] then
          ""
       else
-         localStorage["user_id"]  
+         localStorage["user_id"]
       // Browser.Dom.document.cookie
       // |> fun s -> s.Split ';'
       // |> Array.filter (fun s -> s.StartsWith "user_id=")
@@ -75,7 +75,7 @@ let MyApp() =
       // |> Option.defaultValue ""
 
     let toggleAmnesia _ = setAmnesia (not amnesia)
-      
+
     html $"""
         <div class="centering">
         <div @keydown={Ev(onEnter)}>

bin/generate.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC2034  # Unused variables left for readability
 
 helmfile () {
 
@@ -10,30 +11,30 @@ bases:
  - ../envs/environments.yaml.gotmpl
 
 commonLabels:
-  tier: $tier
+  tier: ${tier}
 
 releases:
-- name: $name
+- name: ${name}
-  namespace: {{ .Environment.Name }}-$name
+  namespace: {{ .Environment.Name }}-${name}
-  chart: ../charts/$name
+  chart: ../charts/${name}
-  condition: $name.enabled
+  condition: ${name}.enabled
   values:
-  - ../values/$name/values/values.yaml.gotmpl
+  - ../values/${name}/values/values.yaml.gotmpl
-  - ../values/$name/values/values-{{ .Environment.Name }}.yaml
+  - ../values/${name}/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:
-  - ../values/$name/kustomize/{{ .Environment.Name }}
+  - ../values/${name}/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: {{ .Environment.Name }}-$name
+  namespace: {{ .Environment.Name }}-${name}
   chart: manifests
-  condition: $name.enabled
+  condition: ${name}.enabled
   missingFileHandler: Info
   values:
   - ../values/env.yaml
   - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/$name/env.yaml.gotmpl
+  - ../values/${name}/env.yaml.gotmpl
-  - ../values/$name/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/${name}/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   hooks:
   - events: [ prepare, cleanup ]
     showlogs: true
@@ -42,7 +43,7 @@ releases:
     - '{{\`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}\`}}'
     - '{{\`{{ .Release.Chart }}\`}}'
     - '{{\`{{ .Environment.Name }}\`}}'
-    - ../values/$name/manifests
+    - ../values/${name}/manifests
     - manifests
 EOF
 }
@@ -59,10 +60,10 @@ done
 
 name=$1
 tier=$2
-if [ -n "$ns" ]; then
+if [[ -n "${ns}" ]]; then
-    namespace="namespace: {{ .Environment.Name }}-$name"
+    namespace="namespace: {{ .Environment.Name }}-${name}"
 else
-    namespace="namespace: $name"
+    namespace="namespace: ${name}"
 fi
 
-helmfile $1 $2
+helmfile "$1" "$2"

bin/helmify

@@ -4,39 +4,38 @@ set -o pipefail
 
 cmd=$1
 chart=$2
-env=$3
 manifests=${4:-manifests}
 outdir=${5:-_manifests}
 
 build() {
-  mkdir -p $outdir/templates
+  mkdir -p "${outdir}"/templates
-  echo "Creating $outdir/templates"
+  echo "Creating ${outdir}/templates"
 
-  echo "generating $outdir/Chart.yaml" 1>&2
+  echo "generating ${outdir}/Chart.yaml" 1>&2
 
-  cat <<EOF > $outdir/Chart.yaml
+  cat <<EOF > "${outdir}"/Chart.yaml
 apiVersion: v1
 appVersion: "1.0"
 # description: A Helm chart for Kubernetes
-name: $chart
+name: ${chart}
 version: 0.1.0
 EOF
 
-if [ -d $manifests ]; then
+if [[ -d "${manifests}" ]]; then
-    cp -r $manifests/* $outdir/templates
+    cp -r "${manifests}"/* "${outdir}"/templates
-elif [ -f $manifests ]; then
+elif [[ -f "${manifests}" ]]; then
-    cp $manifests $outdir/templates
+    cp "${manifests}" "${outdir}"/templates
 fi
 }
 
 clean() {
-  echo "cleaning $outdir" 1>&2
+  echo "cleaning ${outdir}" 1>&2
-  rm -rf $outdir
+  rm -rf "${outdir}"
 }
 
-case "$cmd" in
+case "${cmd}" in
   "build" ) build ;;
   "clean" ) clean ;;
-  * ) echo "unsupported command: $cmd" 1>&2; exit 1 ;;
+  * ) echo "unsupported command: ${cmd}" 1>&2; exit 1 ;;
 esac
 

bin/kustomizer

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 
-[ $# != 1 ] && exit 1
+[[ $# != 1 ]] && exit 1
 
 dir=$1
-base=$dir/../base
+base=${dir}/../base
 
-if [ -f $base/kustomization.yaml -a -f $dir/kustomization.yaml ]; then
+if [[ -f "${base}"/kustomization.yaml ]] && [[ -f "${dir}"/kustomization.yaml ]]; then
-    cat > $base/_manifest.yaml
+    cat > "${base}"/_manifest.yaml
-    kubectl kustomize $dir
+    kubectl kustomize "${dir}"
 else
     cat
 fi

bootstrap/argocd-cluster-admin.yaml

@@ -3,16 +3,16 @@ kind: ClusterRole
 metadata:
   name: argocd-cluster-admin
 rules:
-- apiGroups:
+  - apiGroups:
-  - '*'
+      - "*"
-  resources:
+    resources:
-  - '*'
+      - "*"
-  verbs:
+    verbs:
-  - '*'
+      - "*"
-- nonResourceURLs:
+  - nonResourceURLs:
-  - '*'
+      - "*"
-  verbs:
+    verbs:
-  - '*'
+      - "*"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -23,9 +23,9 @@ roleRef:
   kind: ClusterRole
   name: argocd-cluster-admin
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: argocd-cluster-admin
+    name: argocd-cluster-admin
-  namespace: kube-system
+    namespace: kube-system
 ---
 apiVersion: v1
 kind: ServiceAccount

bootstrap/cluster-admin-token.yaml

@@ -6,5 +6,3 @@ metadata:
   name: cluster-admin-token
   namespace: kube-system
 type: kubernetes.io/service-account-token
-
-

bootstrap/cluster-ekman.yaml

@@ -10,5 +10,3 @@ metadata:
   name: cluster-ekman
   namespace: argocd
 type: Opaque
-
-

bootstrap/helm-kustomize-cmp/deploy.sh

@@ -3,5 +3,5 @@
 img=registry.gitlab.com/oceanbox/manifests/helm-kustomize-cmp
 tag=${1:-latest}
 
-docker build -t $img:$tag .
+docker build -t "${img}":"${tag}" .
-docker push $img:$tag
+docker push "${img}":"${tag}"

bootstrap/helm-kustomize-cmp/generate.sh

@@ -1,14 +1,15 @@
 #!/bin/sh
+# shellcheck disable=SC2154
 
 export HOME=/plugin
 
-env > /tmp/$ARGOCD_APP_NAME.env
+env > /tmp/"${ARGOCD_APP_NAME}".env
 
-echo "$ARGOCD_APP_PARAMETERS" | jq '.[] | select(.name == "helm-parameters") | .map' | yq -P -oy > parameters.yaml
+echo "${ARGOCD_APP_PARAMETERS}" | jq '.[] | select(.name == "helm-parameters") | .map' | yq -P -oy > parameters.yaml
-cp parameters.yaml /tmp/$ARGOCD_APP_NAME-parameters.yaml
+cp parameters.yaml /tmp/"${ARGOCD_APP_NAME}"-parameters.yaml
 
-if [ -n "$PARAM_CHART" -a "$PARAM_CHART" != "." ]; then
+if [ -n "${PARAM_CHART}" ] && [ "${PARAM_CHART}" != "." ]; then
-    CHART=$PARAM_CHART
+    CHART=${PARAM_CHART}
 elif [ -d chart ]; then
     CHART=chart
 elif [ -f chart ]; then
@@ -18,19 +19,19 @@ else
 fi
 
 [ -f chart/values.yaml ] && VALUES="-f chart/values.yaml"
-[ -f values-chart.yaml ] && VALUES="$VALUES -f values-chart.yaml"
+[ -f values-chart.yaml ] && VALUES="${VALUES} -f values-chart.yaml"
-[ -f values.yaml ] && VALUES="$VALUES -f values.yaml"
+[ -f values.yaml ] && VALUES="${VALUES} -f values.yaml"
-[ -f values-$PARAM_ENV.yaml ] && VALUES="$VALUES -f values-$PARAM_ENV.yaml"
+[ -f values-"${PARAM_ENV}".yaml ] && VALUES="${VALUES} -f values-${PARAM_ENV}.yaml"
-VALUES="$VALUES -f parameters.yaml"
+VALUES="${VALUES} -f parameters.yaml"
 
-helm dependency update $CHART >/tmp/$ARGOCD_APP_NAME-helm-dependency-build.out
+helm dependency update "${CHART}" >/tmp/"${ARGOCD_APP_NAME}"-helm-dependency-build.out
 
 mkdir -p base
-echo "helm template -n $ARGOCD_APP_NAMESPACE $PARAM_FLAGS $VALUES $ARGOCD_APP_NAME $CHART" > /tmp/$ARGOCD_APP_NAME-helm.sh
+echo "helm template -n ${ARGOCD_APP_NAMESPACE} ${PARAM_FLAGS} ${VALUES} ${ARGOCD_APP_NAME} ${CHART}" > /tmp/"${ARGOCD_APP_NAME}"-helm.sh
-helm template -n $ARGOCD_APP_NAMESPACE $PARAM_FLAGS $VALUES $ARGOCD_APP_NAME $CHART > ./base/_manifest.yaml
+helm template -n "${ARGOCD_APP_NAMESPACE}" "${PARAM_FLAGS}" "${VALUES}" "${ARGOCD_APP_NAME}" "${CHART}" > ./base/_manifest.yaml
 
-cp ./base/_manifest.yaml /tmp/$ARGOCD_APP_NAME-manifest.yaml
+cp ./base/_manifest.yaml /tmp/"${ARGOCD_APP_NAME}"-manifest.yaml
 
-[ -d "$PARAM_ENV" ] && kubectl kustomize $PARAM_ENV > /tmp/$ARGOCD_APP_NAME-manifest.yaml
+[ -d "${PARAM_ENV}" ] && kubectl kustomize "${PARAM_ENV}" > /tmp/"${ARGOCD_APP_NAME}"-manifest.yaml
 
-cat /tmp/$ARGOCD_APP_NAME-manifest.yaml
+cat /tmp/"${ARGOCD_APP_NAME}"-manifest.yaml

bootstrap/helm-kustomize-cmp/get-values.sh

@@ -18,7 +18,7 @@ EOF
     exit 0
 fi
 
-yq e -o=p $VALUES | jq --slurp --raw-input '
+yq e -o=p "${VALUES}" | jq --slurp --raw-input '
   [{
     name: "helm-parameters",
     title: "Helm Parameters",

bootstrap/helm-kustomize-cmp/init-helm-repos.sh

@@ -1,8 +1,9 @@
 #!/bin/sh
+# shellcheck disable=SC2154
 
 export HOME=/plugin
 
-helm repo add --username argocd-helm --password "$OCEANBOX_HELM_ACCESS_TOKEN" oceanbox \
+helm repo add --username argocd-helm --password "${OCEANBOX_HELM_ACCESS_TOKEN}" oceanbox \
     https://gitlab.com/api/v4/projects/54396343/packages/helm/stable
 
 helm repo add bitnami https://charts.bitnami.com/bitnami

bootstrap/helm-kustomize-cmp/init.sh

@@ -4,9 +4,9 @@ export HOME=/plugin
 
 helm repo update oceanbox
 
-if [ -n "$PARAM_CHART" -a "$PARAM_CHART" != "." ]; then
+if [ -n "${PARAM_CHART}" ] && [ "${PARAM_CHART}" != "." ]; then
-    helm show values $PARAM_CHART > values-chart.yaml
+    helm show values "${PARAM_CHART}" > values-chart.yaml
 elif [ -f chart ]; then
     CHART=$(cat chart)
-    helm show values $CHART > values-chart.yaml
+    helm show values "${CHART}" > values-chart.yaml
 fi

bootstrap/helm-kustomize-cmp/plugin.yaml

@@ -9,7 +9,7 @@ spec:
   init:
     # Init always happens immediately before generate, but its output is not treated as manifests.
     # This is a good place to, for example, download chart dependencies.
-    command: [ /bin/sh ]
+    command: [/bin/sh]
     args:
       - /plugin/init.sh
   # The generate command runs in the Application source directory each time manifests are generated. Standard output
@@ -17,7 +17,7 @@ spec:
   # To write log messages from the command, write them to stderr, it will always be displayed.
   # Error output will be sent to the UI, so avoid printing sensitive information (such as secrets).
   generate:
-    command: [ /bin/sh ]
+    command: [/bin/sh]
     args:
       - /plugin/generate.sh
 
@@ -27,15 +27,15 @@ spec:
   # Only one of fileName, find.glob, or find.command should be specified. If multiple are specified then only the
   # first (in that order) is evaluated.
   # discover:
-    # fileName is a glob pattern (https://pkg.go.dev/path/filepath#Glob) that is applied to the Application's source
+  # fileName is a glob pattern (https://pkg.go.dev/path/filepath#Glob) that is applied to the Application's source
-    # directory. If there is a match, this plugin may be used for the Application.
+  # directory. If there is a match, this plugin may be used for the Application.
-    # fileName: "./subdir/s*.yaml"
+  # fileName: "./subdir/s*.yaml"
-    # find:
+  # find:
-      # This does the same thing as fileName, but it supports double-start (nested directory) glob patterns.
+  # This does the same thing as fileName, but it supports double-start (nested directory) glob patterns.
-      # glob: "**/Chart.yaml"
+  # glob: "**/Chart.yaml"
-      # The find command runs in the repository's root directory. To match, it must exit with status code 0 _and_
+  # The find command runs in the repository's root directory. To match, it must exit with status code 0 _and_
-      # produce non-empty output to standard out.
+  # produce non-empty output to standard out.
-      # command: [sh, -c, find . -name env.yaml]
+  # command: [sh, -c, find . -name env.yaml]
   # The parameters config describes what parameters the UI should display for an Application. It is up to the user to
   # actually set parameters in the Application manifest (in spec.source.plugin.parameters). The announcements _only_
   # inform the "Parameters" tab in the App Details page of the UI.
@@ -66,22 +66,21 @@ spec:
         itemType: string
         collectionType: string
         string: ""
-      # All the fields above besides "string" apply to both the array and map type parameter announcements.
+        # All the fields above besides 'string' apply to both the array and map type parameter announcements.
-      # - name: array-param
+        # - name: array-param
-      #   # This field communicates the parameter's default value to the UI. Setting this field is optional.
+        #   # This field communicates the parameter's default value to the UI. Setting this field is optional.
-      #   array: [default, items]
+        #   array: [default, items]
-      #   collectionType: array
+        #   collectionType: array
-      # - name: map-param
+        # - name: map-param
-      #   # This field communicates the parameter's default value to the UI. Setting this field is optional.
+        #   # This field communicates the parameter's default value to the UI. Setting this field is optional.
-      #   map:
+        #   map:
-      #     some: value
+        #     some: value
-      #   collectionType: map
+        #   collectionType: map
     # dynamic:
-      # The command is run in an Application's source directory. Standard output must be JSON matching the schema of the
+    # The command is run in an Application's source directory. Standard output must be JSON matching the schema of the
-      # static parameter announcements list.
+    # static parameter announcements list.
-      # command: [ /bin/sh, /plugin/get-values.sh ]
+    # command: [ /bin/sh, /plugin/get-values.sh ]
 
     # If set to `true` then the plugin receives repository files with original file mode. Dangerous since the repository
     # might have executable files. Set to true only if you trust the CMP plugin authors.
     preserveFileMode: false
-

bootstrap/helmfile-cmp/Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/helmfile/helmfile:v1.0.0
+FROM ghcr.io/helmfile/helmfile:v1.1.9
 
 RUN mkdir -p /home/argocd/cmp-server/config/
 COPY plugin.yaml /home/argocd/cmp-server/config/

bootstrap/helmfile-cmp/argo-repo-server-old.yaml

@@ -45,432 +45,432 @@ spec:
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
+            - podAffinityTerm:
-              labelSelector:
+                labelSelector:
-                matchLabels:
+                  matchLabels:
-                  app.kubernetes.io/name: argocd-repo-server
+                    app.kubernetes.io/name: argocd-repo-server
-              topologyKey: kubernetes.io/hostname
+                topologyKey: kubernetes.io/hostname
-            weight: 100
+              weight: 100
       automountServiceAccountToken: true
       containers:
-      - args:
+        - args:
-        - /usr/local/bin/argocd-repo-server
+            - /usr/local/bin/argocd-repo-server
-        - --port=8081
+            - --port=8081
-        - --metrics-port=8084
+            - --metrics-port=8084
-        env:
+          env:
-        - name: ARGOCD_REPO_SERVER_NAME
+            - name: ARGOCD_REPO_SERVER_NAME
-          value: argocd-repo-server
+              value: argocd-repo-server
-        - name: ARGOCD_RECONCILIATION_TIMEOUT
+            - name: ARGOCD_RECONCILIATION_TIMEOUT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: timeout.reconciliation
+                  key: timeout.reconciliation
-              name: argocd-cm
+                  name: argocd-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LOGFORMAT
+            - name: ARGOCD_REPO_SERVER_LOGFORMAT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.log.format
+                  key: reposerver.log.format
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LOGLEVEL
+            - name: ARGOCD_REPO_SERVER_LOGLEVEL
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.log.level
+                  key: reposerver.log.level
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT
+            - name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.parallelism.limit
+                  key: reposerver.parallelism.limit
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LISTEN_ADDRESS
+            - name: ARGOCD_REPO_SERVER_LISTEN_ADDRESS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.listen.address
+                  key: reposerver.listen.address
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LISTEN_METRICS_ADDRESS
+            - name: ARGOCD_REPO_SERVER_LISTEN_METRICS_ADDRESS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.metrics.listen.address
+                  key: reposerver.metrics.listen.address
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_DISABLE_TLS
+            - name: ARGOCD_REPO_SERVER_DISABLE_TLS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.disable.tls
+                  key: reposerver.disable.tls
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_TLS_MIN_VERSION
+            - name: ARGOCD_TLS_MIN_VERSION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.tls.minversion
+                  key: reposerver.tls.minversion
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_TLS_MAX_VERSION
+            - name: ARGOCD_TLS_MAX_VERSION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.tls.maxversion
+                  key: reposerver.tls.maxversion
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_TLS_CIPHERS
+            - name: ARGOCD_TLS_CIPHERS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.tls.ciphers
+                  key: reposerver.tls.ciphers
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_CACHE_EXPIRATION
+            - name: ARGOCD_REPO_CACHE_EXPIRATION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.repo.cache.expiration
+                  key: reposerver.repo.cache.expiration
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDIS_SERVER
+            - name: REDIS_SERVER
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: redis.server
+                  key: redis.server
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDIS_COMPRESSION
+            - name: REDIS_COMPRESSION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: redis.compression
+                  key: redis.compression
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDISDB
+            - name: REDISDB
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: redis.db
+                  key: redis.db
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDIS_USERNAME
+            - name: REDIS_USERNAME
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: redis-username
+                  key: redis-username
-              name: argocd-redis
+                  name: argocd-redis
-              optional: true
+                  optional: true
-        - name: REDIS_PASSWORD
+            - name: REDIS_PASSWORD
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: auth
+                  key: auth
-              name: argocd-redis
+                  name: argocd-redis
-        - name: REDIS_SENTINEL_USERNAME
+            - name: REDIS_SENTINEL_USERNAME
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: redis-sentinel-username
+                  key: redis-sentinel-username
-              name: argocd-redis
+                  name: argocd-redis
-              optional: true
+                  optional: true
-        - name: REDIS_SENTINEL_PASSWORD
+            - name: REDIS_SENTINEL_PASSWORD
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: redis-sentinel-password
+                  key: redis-sentinel-password
-              name: argocd-redis
+                  name: argocd-redis
-              optional: true
+                  optional: true
-        - name: ARGOCD_DEFAULT_CACHE_EXPIRATION
+            - name: ARGOCD_DEFAULT_CACHE_EXPIRATION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.default.cache.expiration
+                  key: reposerver.default.cache.expiration
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_OTLP_ADDRESS
+            - name: ARGOCD_REPO_SERVER_OTLP_ADDRESS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: otlp.address
+                  key: otlp.address
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_OTLP_INSECURE
+            - name: ARGOCD_REPO_SERVER_OTLP_INSECURE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: otlp.insecure
+                  key: otlp.insecure
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_OTLP_HEADERS
+            - name: ARGOCD_REPO_SERVER_OTLP_HEADERS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: otlp.headers
+                  key: otlp.headers
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE
+            - name: ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.max.combined.directory.manifests.size
+                  key: reposerver.max.combined.directory.manifests.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS
+            - name: ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.plugin.tar.exclusions
+                  key: reposerver.plugin.tar.exclusions
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS
+            - name: ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.allow.oob.symlinks
+                  key: reposerver.allow.oob.symlinks
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE
+            - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.streamed.manifest.max.tar.size
+                  key: reposerver.streamed.manifest.max.tar.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE
+            - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.streamed.manifest.max.extracted.size
+                  key: reposerver.streamed.manifest.max.extracted.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE
+            - name: ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.helm.manifest.max.extracted.size
+                  key: reposerver.helm.manifest.max.extracted.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE
+            - name: ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.disable.helm.manifest.max.extracted.size
+                  key: reposerver.disable.helm.manifest.max.extracted.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_GIT_MODULES_ENABLED
+            - name: ARGOCD_GIT_MODULES_ENABLED
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.enable.git.submodule
+                  key: reposerver.enable.git.submodule
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_GIT_LS_REMOTE_PARALLELISM_LIMIT
+            - name: ARGOCD_GIT_LS_REMOTE_PARALLELISM_LIMIT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.git.lsremote.parallelism.limit
+                  key: reposerver.git.lsremote.parallelism.limit
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_GIT_REQUEST_TIMEOUT
+            - name: ARGOCD_GIT_REQUEST_TIMEOUT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.git.request.timeout
+                  key: reposerver.git.request.timeout
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REVISION_CACHE_LOCK_TIMEOUT
+            - name: ARGOCD_REVISION_CACHE_LOCK_TIMEOUT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.revision.cache.lock.timeout
+                  key: reposerver.revision.cache.lock.timeout
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_INCLUDE_HIDDEN_DIRECTORIES
+            - name: ARGOCD_REPO_SERVER_INCLUDE_HIDDEN_DIRECTORIES
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.include.hidden.directories
+                  key: reposerver.include.hidden.directories
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: HELM_CACHE_HOME
+            - name: HELM_CACHE_HOME
-          value: /helm-working-dir
+              value: /helm-working-dir
-        - name: HELM_CONFIG_HOME
+            - name: HELM_CONFIG_HOME
-          value: /helm-working-dir
+              value: /helm-working-dir
-        - name: HELM_DATA_HOME
+            - name: HELM_DATA_HOME
-          value: /helm-working-dir
+              value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v2.12.3
+          image: quay.io/argoproj/argocd:v2.12.3
-        imagePullPolicy: IfNotPresent
+          imagePullPolicy: IfNotPresent
-        livenessProbe:
+          livenessProbe:
-          failureThreshold: 3
+            failureThreshold: 3
-          httpGet:
+            httpGet:
-            path: /healthz?full=true
+              path: /healthz?full=true
-            port: metrics
+              port: metrics
-            scheme: HTTP
+              scheme: HTTP
-          initialDelaySeconds: 10
+            initialDelaySeconds: 10
-          periodSeconds: 10
+            periodSeconds: 10
-          successThreshold: 1
+            successThreshold: 1
-          timeoutSeconds: 1
+            timeoutSeconds: 1
-        name: repo-server
-        ports:
-        - containerPort: 8081
           name: repo-server
-          protocol: TCP
+          ports:
-        - containerPort: 8084
+            - containerPort: 8081
-          name: metrics
+              name: repo-server
-          protocol: TCP
+              protocol: TCP
-        readinessProbe:
+            - containerPort: 8084
-          failureThreshold: 3
+              name: metrics
-          httpGet:
+              protocol: TCP
-            path: /healthz
+          readinessProbe:
-            port: metrics
+            failureThreshold: 3
-            scheme: HTTP
+            httpGet:
-          initialDelaySeconds: 10
+              path: /healthz
-          periodSeconds: 10
+              port: metrics
-          successThreshold: 1
+              scheme: HTTP
-          timeoutSeconds: 1
+            initialDelaySeconds: 10
-        securityContext:
+            periodSeconds: 10
-          allowPrivilegeEscalation: false
+            successThreshold: 1
-          capabilities:
+            timeoutSeconds: 1
-            drop:
+          securityContext:
-            - ALL
+            allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
+            capabilities:
-          runAsNonRoot: true
+              drop:
-          seccompProfile:
+                - ALL
-            type: RuntimeDefault
+            readOnlyRootFilesystem: true
-        terminationMessagePath: /dev/termination-log
+            runAsNonRoot: true
-        terminationMessagePolicy: File
+            seccompProfile:
-        volumeMounts:
+              type: RuntimeDefault
-        - mountPath: /app/config/ssh
+          terminationMessagePath: /dev/termination-log
-          name: ssh-known-hosts
+          terminationMessagePolicy: File
-        - mountPath: /app/config/tls
+          volumeMounts:
-          name: tls-certs
+            - mountPath: /app/config/ssh
-        - mountPath: /app/config/gpg/source
+              name: ssh-known-hosts
-          name: gpg-keys
+            - mountPath: /app/config/tls
-        - mountPath: /app/config/gpg/keys
+              name: tls-certs
-          name: gpg-keyring
+            - mountPath: /app/config/gpg/source
-        - mountPath: /app/config/reposerver/tls
+              name: gpg-keys
-          name: argocd-repo-server-tls
+            - mountPath: /app/config/gpg/keys
-        - mountPath: /helm-working-dir
+              name: gpg-keyring
-          name: helm-working-dir
+            - mountPath: /app/config/reposerver/tls
-        - mountPath: /home/argocd/cmp-server/plugins
+              name: argocd-repo-server-tls
-          name: plugins
+            - mountPath: /helm-working-dir
-        - mountPath: /tmp
+              name: helm-working-dir
-          name: tmp
+            - mountPath: /home/argocd/cmp-server/plugins
-      - command:
+              name: plugins
-        - /var/run/argocd/argocd-cmp-server
+            - mountPath: /tmp
-        image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
+              name: tmp
-        imagePullPolicy: Always
+        - command:
-        name: kustomize-helm-with-rewrite
+            - /var/run/argocd/argocd-cmp-server
-        securityContext:
+          image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
-          runAsNonRoot: true
+          imagePullPolicy: Always
-          runAsUser: 999
+          name: kustomize-helm-with-rewrite
-        terminationMessagePath: /dev/termination-log
+          securityContext:
-        terminationMessagePolicy: File
+            runAsNonRoot: true
-        volumeMounts:
+            runAsUser: 999
-        - mountPath: /var/run/argocd
+          terminationMessagePath: /dev/termination-log
-          name: var-files
+          terminationMessagePolicy: File
-        - mountPath: /home/argocd/cmp-server/plugins
+          volumeMounts:
-          name: plugins
+            - mountPath: /var/run/argocd
-        - mountPath: /tmp
+              name: var-files
-          name: cmp-tmp
+            - mountPath: /home/argocd/cmp-server/plugins
-        - mountPath: /helm-working-dir
+              name: plugins
-          name: helm-working-dir
+            - mountPath: /tmp
-      - command:
+              name: cmp-tmp
-        - /var/run/argocd/argocd-cmp-server
+            - mountPath: /helm-working-dir
-        image: registry.gitlab.com/oceanbox/manifests/helm-kustomize-cmp:latest
+              name: helm-working-dir
-        imagePullPolicy: Always
+        - command:
-        name: helm-kustomize-cmp
+            - /var/run/argocd/argocd-cmp-server
-        securityContext:
+          image: registry.gitlab.com/oceanbox/manifests/helm-kustomize-cmp:latest
-          runAsNonRoot: true
+          imagePullPolicy: Always
-          runAsUser: 999
+          name: helm-kustomize-cmp
-        terminationMessagePath: /dev/termination-log
+          securityContext:
-        terminationMessagePolicy: File
+            runAsNonRoot: true
-        volumeMounts:
+            runAsUser: 999
-        - mountPath: /var/run/argocd
+          terminationMessagePath: /dev/termination-log
-          name: var-files
+          terminationMessagePolicy: File
-        - mountPath: /home/argocd/cmp-server/plugins
+          volumeMounts:
-          name: plugins
+            - mountPath: /var/run/argocd
-        - mountPath: /tmp
+              name: var-files
-          name: cmp-tmp
+            - mountPath: /home/argocd/cmp-server/plugins
-        - mountPath: /helm-working-dir
+              name: plugins
-          name: helm-working-dir
+            - mountPath: /tmp
-      - command:
+              name: cmp-tmp
-        - /var/run/argocd/argocd-cmp-server
+            - mountPath: /helm-working-dir
-        image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
+              name: helm-working-dir
-        imagePullPolicy: Always
+        - command:
-        name: helmfile-cmp
+            - /var/run/argocd/argocd-cmp-server
-        securityContext:
+          image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
-          runAsNonRoot: true
+          imagePullPolicy: Always
-          runAsUser: 999
+          name: helmfile-cmp
-        terminationMessagePath: /dev/termination-log
+          securityContext:
-        terminationMessagePolicy: File
+            runAsNonRoot: true
-        volumeMounts:
+            runAsUser: 999
-        - mountPath: /var/run/argocd
+          terminationMessagePath: /dev/termination-log
-          name: var-files
+          terminationMessagePolicy: File
-        - mountPath: /home/argocd/cmp-server/plugins
+          volumeMounts:
-          name: plugins
+            - mountPath: /var/run/argocd
-        - mountPath: /tmp
+              name: var-files
-          name: cmp-tmp
+            - mountPath: /home/argocd/cmp-server/plugins
-        - mountPath: /helm-working-dir
+              name: plugins
-          name: helm-working-dir
+            - mountPath: /tmp
+              name: cmp-tmp
+            - mountPath: /helm-working-dir
+              name: helm-working-dir
       dnsPolicy: ClusterFirst
       imagePullSecrets:
-      - name: gitlab-pull-secret
+        - name: gitlab-pull-secret
       initContainers:
-      - command:
+        - command:
-        - /bin/cp
+            - /bin/cp
-        - -n
+            - -n
-        - /usr/local/bin/argocd
+            - /usr/local/bin/argocd
-        - /var/run/argocd/argocd-cmp-server
+            - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:v2.12.3
+          image: quay.io/argoproj/argocd:v2.12.3
-        imagePullPolicy: IfNotPresent
+          imagePullPolicy: IfNotPresent
-        name: copyutil
+          name: copyutil
-        securityContext:
+          securityContext:
-          allowPrivilegeEscalation: false
+            allowPrivilegeEscalation: false
-          capabilities:
+            capabilities:
-            drop:
+              drop:
-            - ALL
+                - ALL
-          readOnlyRootFilesystem: true
+            readOnlyRootFilesystem: true
-          runAsNonRoot: true
+            runAsNonRoot: true
-          seccompProfile:
+            seccompProfile:
-            type: RuntimeDefault
+              type: RuntimeDefault
-        terminationMessagePath: /dev/termination-log
+          terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
+          terminationMessagePolicy: File
-        volumeMounts:
+          volumeMounts:
-        - mountPath: /var/run/argocd
+            - mountPath: /var/run/argocd
-          name: var-files
+              name: var-files
-      - command:
+        - command:
-        - /bin/sh
+            - /bin/sh
-        - /plugin/init-helm-repos.sh
+            - /plugin/init-helm-repos.sh
-        env:
+          env:
-        - name: OCEANBOX_HELM_ACCESS_TOKEN
+            - name: OCEANBOX_HELM_ACCESS_TOKEN
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: token
+                  key: token
-              name: oceanbox-helm
+                  name: oceanbox-helm
-              optional: false
+                  optional: false
-        image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
+          image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
-        imagePullPolicy: Always
+          imagePullPolicy: Always
-        name: init-helm-repos
+          name: init-helm-repos
-        securityContext:
+          securityContext:
-          allowPrivilegeEscalation: false
+            allowPrivilegeEscalation: false
-          capabilities:
+            capabilities:
-            drop:
+              drop:
-            - ALL
+                - ALL
-          readOnlyRootFilesystem: true
+            readOnlyRootFilesystem: true
-          runAsNonRoot: true
+            runAsNonRoot: true
-          runAsUser: 999
+            runAsUser: 999
-          seccompProfile:
+            seccompProfile:
-            type: RuntimeDefault
+              type: RuntimeDefault
-        terminationMessagePath: /dev/termination-log
+          terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
+          terminationMessagePolicy: File
-        volumeMounts:
+          volumeMounts:
-        - mountPath: /helm-working-dir
+            - mountPath: /helm-working-dir
-          name: helm-working-dir
+              name: helm-working-dir
       restartPolicy: Always
       schedulerName: default-scheduler
       serviceAccount: argocd-repo-server
       serviceAccountName: argocd-repo-server
       terminationGracePeriodSeconds: 30
       volumes:
-      - name: cmp-tmp
+        - name: cmp-tmp
-      - name: helm-working-dir
+        - name: helm-working-dir
-      - name: plugins
+        - name: plugins
-      - name: var-files
+        - name: var-files
-      - name: tmp
+        - name: tmp
-      - configMap:
+        - configMap:
-          defaultMode: 420
+            defaultMode: 420
-          name: argocd-ssh-known-hosts-cm
+            name: argocd-ssh-known-hosts-cm
-        name: ssh-known-hosts
+          name: ssh-known-hosts
-      - configMap:
+        - configMap:
-          defaultMode: 420
+            defaultMode: 420
-          name: argocd-tls-certs-cm
+            name: argocd-tls-certs-cm
-        name: tls-certs
+          name: tls-certs
-      - configMap:
+        - configMap:
-          defaultMode: 420
+            defaultMode: 420
-          name: argocd-gpg-keys-cm
+            name: argocd-gpg-keys-cm
-        name: gpg-keys
+          name: gpg-keys
-      - name: gpg-keyring
+        - name: gpg-keyring
-      - name: argocd-repo-server-tls
+        - name: argocd-repo-server-tls
-        secret:
+          secret:
-          defaultMode: 420
+            defaultMode: 420
-          items:
+            items:
-          - key: tls.crt
+              - key: tls.crt
-            path: tls.crt
+                path: tls.crt
-          - key: tls.key
+              - key: tls.key
-            path: tls.key
+                path: tls.key
-          - key: ca.crt
+              - key: ca.crt
-            path: ca.crt
+                path: ca.crt
-          optional: true
+            optional: true
-          secretName: argocd-repo-server-tls
+            secretName: argocd-repo-server-tls

bootstrap/helmfile-cmp/argo-repo-server-patch.yaml

@@ -4,24 +4,24 @@ spec:
   template:
     spec:
       imagePullSecrets:
-      - name: gitlab-pull-secret
+        - name: gitlab-pull-secret
       containers:
-      - command:
+        - command:
-        - /var/run/argocd/argocd-cmp-server
+            - /var/run/argocd/argocd-cmp-server
-        image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
+          image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
-        imagePullPolicy: Always
+          imagePullPolicy: Always
-        name: helmfile-cmp
+          name: helmfile-cmp
-        securityContext:
+          securityContext:
-          runAsNonRoot: true
+            runAsNonRoot: true
-          runAsUser: 999
+            runAsUser: 999
-        terminationMessagePath: /dev/termination-log
+          terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
+          terminationMessagePolicy: File
-        volumeMounts:
+          volumeMounts:
-        - mountPath: /var/run/argocd
+            - mountPath: /var/run/argocd
-          name: var-files
+              name: var-files
-        - mountPath: /home/argocd/cmp-server/plugins
+            - mountPath: /home/argocd/cmp-server/plugins
-          name: plugins
+              name: plugins
-        - mountPath: /tmp
+            - mountPath: /tmp
-          name: tmp
+              name: tmp
-        - mountPath: /helm-working-dir
+            - mountPath: /helm-working-dir
-          name: helm-working-dir
+              name: helm-working-dir

bootstrap/helmfile-cmp/deploy.sh

@@ -3,5 +3,5 @@
 img=registry.gitlab.com/oceanbox/manifests/helmfile-cmp
 tag=${1:-latest}
 
-docker build -t $img:$tag .
+docker build -t "${img}":"${tag}" .
-docker push $img:$tag
+docker push "${img}":"${tag}"

bootstrap/helmfile-cmp/generate.sh

@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2154
 
 # NOTE: Ensure errors are part of exitcode
 # set -o pipefail
@@ -10,7 +11,7 @@ export HELM_CONFIG_HOME=/tmp/helm/config
 export HELMFILE_CACHE_HOME=/tmp/helmfile/cache
 export HELMFILE_TEMPDIR=/tmp/helmfile/tmp
 
-test -n ARGOCD_ENV_HELMFILE_ENVIRONMENT && export HELMFILE_ENVIRONMENT=$ARGOCD_ENV_HELMFILE_ENVIRONMENT
+test -n ARGOCD_ENV_HELMFILE_ENVIRONMENT && export HELMFILE_ENVIRONMENT="${ARGOCD_ENV_HELMFILE_ENVIRONMENT}"
-test -n ARGOCD_ENV_HELMFILE_FILE_PATH && export HELMFILE_FILE_PATH=$ARGOCD_ENV_HELMFILE_FILE_PATH
+test -n ARGOCD_ENV_HELMFILE_FILE_PATH && export HELMFILE_FILE_PATH="${ARGOCD_ENV_HELMFILE_FILE_PATH}"
 
-helmfile -n "$ARGOCD_APP_NAMESPACE" $ARGS template --include-crds -q
+helmfile -n "${ARGOCD_APP_NAMESPACE}" "${ARGS}" template -q --include-crds

bootstrap/helmfile-cmp/plugin.yaml

@@ -4,7 +4,7 @@ metadata:
   name: helmfile-cmp
 spec:
   generate:
-    command: [ "/bin/sh" ]
+    command: ["/bin/sh"]
     args:
       - /plugin/generate.sh
   lockRepo: false

bootstrap/kustomize-helm-with-rewrite/argo-repo-server.yaml

@@ -44,341 +44,341 @@ spec:
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
+            - podAffinityTerm:
-              labelSelector:
+                labelSelector:
-                matchLabels:
+                  matchLabels:
-                  app.kubernetes.io/name: argocd-repo-server
+                    app.kubernetes.io/name: argocd-repo-server
-              topologyKey: kubernetes.io/hostname
+                topologyKey: kubernetes.io/hostname
-            weight: 100
+              weight: 100
       containers:
-      - args:
+        - args:
-        - /usr/local/bin/argocd-repo-server
+            - /usr/local/bin/argocd-repo-server
-        - --port=8081
+            - --port=8081
-        - --metrics-port=8084
+            - --metrics-port=8084
-        env:
+          env:
-        - name: ARGOCD_REPO_SERVER_NAME
+            - name: ARGOCD_REPO_SERVER_NAME
-          value: argocd-repo-server
+              value: argocd-repo-server
-        - name: ARGOCD_RECONCILIATION_TIMEOUT
+            - name: ARGOCD_RECONCILIATION_TIMEOUT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: timeout.reconciliation
+                  key: timeout.reconciliation
-              name: argocd-cm
+                  name: argocd-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LOGFORMAT
+            - name: ARGOCD_REPO_SERVER_LOGFORMAT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.log.format
+                  key: reposerver.log.format
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LOGLEVEL
+            - name: ARGOCD_REPO_SERVER_LOGLEVEL
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.log.level
+                  key: reposerver.log.level
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT
+            - name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.parallelism.limit
+                  key: reposerver.parallelism.limit
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LISTEN_ADDRESS
+            - name: ARGOCD_REPO_SERVER_LISTEN_ADDRESS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.listen.address
+                  key: reposerver.listen.address
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_LISTEN_METRICS_ADDRESS
+            - name: ARGOCD_REPO_SERVER_LISTEN_METRICS_ADDRESS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.metrics.listen.address
+                  key: reposerver.metrics.listen.address
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_DISABLE_TLS
+            - name: ARGOCD_REPO_SERVER_DISABLE_TLS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.disable.tls
+                  key: reposerver.disable.tls
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_TLS_MIN_VERSION
+            - name: ARGOCD_TLS_MIN_VERSION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.tls.minversion
+                  key: reposerver.tls.minversion
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_TLS_MAX_VERSION
+            - name: ARGOCD_TLS_MAX_VERSION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.tls.maxversion
+                  key: reposerver.tls.maxversion
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_TLS_CIPHERS
+            - name: ARGOCD_TLS_CIPHERS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.tls.ciphers
+                  key: reposerver.tls.ciphers
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_CACHE_EXPIRATION
+            - name: ARGOCD_REPO_CACHE_EXPIRATION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.repo.cache.expiration
+                  key: reposerver.repo.cache.expiration
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDIS_SERVER
+            - name: REDIS_SERVER
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: redis.server
+                  key: redis.server
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDIS_COMPRESSION
+            - name: REDIS_COMPRESSION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: redis.compression
+                  key: redis.compression
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDISDB
+            - name: REDISDB
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: redis.db
+                  key: redis.db
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: REDIS_USERNAME
+            - name: REDIS_USERNAME
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: redis-username
+                  key: redis-username
-              name: argocd-redis
+                  name: argocd-redis
-              optional: true
+                  optional: true
-        - name: REDIS_PASSWORD
+            - name: REDIS_PASSWORD
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: redis-password
+                  key: redis-password
-              name: argocd-redis
+                  name: argocd-redis
-              optional: true
+                  optional: true
-        - name: ARGOCD_DEFAULT_CACHE_EXPIRATION
+            - name: ARGOCD_DEFAULT_CACHE_EXPIRATION
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.default.cache.expiration
+                  key: reposerver.default.cache.expiration
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_OTLP_ADDRESS
+            - name: ARGOCD_REPO_SERVER_OTLP_ADDRESS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: otlp.address
+                  key: otlp.address
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_OTLP_INSECURE
+            - name: ARGOCD_REPO_SERVER_OTLP_INSECURE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: otlp.insecure
+                  key: otlp.insecure
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_OTLP_HEADERS
+            - name: ARGOCD_REPO_SERVER_OTLP_HEADERS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: otlp.headers
+                  key: otlp.headers
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE
+            - name: ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.max.combined.directory.manifests.size
+                  key: reposerver.max.combined.directory.manifests.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS
+            - name: ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.plugin.tar.exclusions
+                  key: reposerver.plugin.tar.exclusions
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS
+            - name: ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.allow.oob.symlinks
+                  key: reposerver.allow.oob.symlinks
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE
+            - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.streamed.manifest.max.tar.size
+                  key: reposerver.streamed.manifest.max.tar.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE
+            - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.streamed.manifest.max.extracted.size
+                  key: reposerver.streamed.manifest.max.extracted.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE
+            - name: ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.helm.manifest.max.extracted.size
+                  key: reposerver.helm.manifest.max.extracted.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE
+            - name: ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.disable.helm.manifest.max.extracted.size
+                  key: reposerver.disable.helm.manifest.max.extracted.size
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_GIT_MODULES_ENABLED
+            - name: ARGOCD_GIT_MODULES_ENABLED
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.enable.git.submodule
+                  key: reposerver.enable.git.submodule
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_GIT_LS_REMOTE_PARALLELISM_LIMIT
+            - name: ARGOCD_GIT_LS_REMOTE_PARALLELISM_LIMIT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.git.lsremote.parallelism.limit
+                  key: reposerver.git.lsremote.parallelism.limit
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: ARGOCD_GIT_REQUEST_TIMEOUT
+            - name: ARGOCD_GIT_REQUEST_TIMEOUT
-          valueFrom:
+              valueFrom:
-            configMapKeyRef:
+                configMapKeyRef:
-              key: reposerver.git.request.timeout
+                  key: reposerver.git.request.timeout
-              name: argocd-cmd-params-cm
+                  name: argocd-cmd-params-cm
-              optional: true
+                  optional: true
-        - name: HELM_CACHE_HOME
+            - name: HELM_CACHE_HOME
-          value: /helm-working-dir
+              value: /helm-working-dir
-        - name: HELM_CONFIG_HOME
+            - name: HELM_CONFIG_HOME
-          value: /helm-working-dir
+              value: /helm-working-dir
-        - name: HELM_DATA_HOME
+            - name: HELM_DATA_HOME
-          value: /helm-working-dir
+              value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v2.10.4
+          image: quay.io/argoproj/argocd:v2.10.4
-        imagePullPolicy: IfNotPresent
+          imagePullPolicy: IfNotPresent
-        livenessProbe:
+          livenessProbe:
-          failureThreshold: 3
+            failureThreshold: 3
-          httpGet:
+            httpGet:
-            path: /healthz?full=true
+              path: /healthz?full=true
-            port: metrics
+              port: metrics
-            scheme: HTTP
+              scheme: HTTP
-          initialDelaySeconds: 10
+            initialDelaySeconds: 10
-          periodSeconds: 10
+            periodSeconds: 10
-          successThreshold: 1
+            successThreshold: 1
-          timeoutSeconds: 1
+            timeoutSeconds: 1
-        name: repo-server
-        ports:
-        - containerPort: 8081
           name: repo-server
-          protocol: TCP
+          ports:
-        - containerPort: 8084
+            - containerPort: 8081
-          name: metrics
+              name: repo-server
-          protocol: TCP
+              protocol: TCP
-        readinessProbe:
+            - containerPort: 8084
-          failureThreshold: 3
+              name: metrics
-          httpGet:
+              protocol: TCP
-            path: /healthz
+          readinessProbe:
-            port: metrics
+            failureThreshold: 3
-            scheme: HTTP
+            httpGet:
-          initialDelaySeconds: 10
+              path: /healthz
-          periodSeconds: 10
+              port: metrics
-          successThreshold: 1
+              scheme: HTTP
-          timeoutSeconds: 1
+            initialDelaySeconds: 10
-        resources: {}
+            periodSeconds: 10
-        securityContext:
+            successThreshold: 1
-          allowPrivilegeEscalation: false
+            timeoutSeconds: 1
-          capabilities:
+          resources: {}
-            drop:
+          securityContext:
-            - ALL
+            allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
+            capabilities:
-          runAsNonRoot: true
+              drop:
-          seccompProfile:
+                - ALL
-            type: RuntimeDefault
+            readOnlyRootFilesystem: true
-        terminationMessagePath: /dev/termination-log
+            runAsNonRoot: true
-        terminationMessagePolicy: File
+            seccompProfile:
-        volumeMounts:
+              type: RuntimeDefault
-        - mountPath: /app/config/ssh
+          terminationMessagePath: /dev/termination-log
-          name: ssh-known-hosts
+          terminationMessagePolicy: File
-        - mountPath: /app/config/tls
+          volumeMounts:
-          name: tls-certs
+            - mountPath: /app/config/ssh
-        - mountPath: /app/config/gpg/source
+              name: ssh-known-hosts
-          name: gpg-keys
+            - mountPath: /app/config/tls
-        - mountPath: /app/config/gpg/keys
+              name: tls-certs
-          name: gpg-keyring
+            - mountPath: /app/config/gpg/source
-        - mountPath: /app/config/reposerver/tls
+              name: gpg-keys
-          name: argocd-repo-server-tls
+            - mountPath: /app/config/gpg/keys
-        - mountPath: /helm-working-dir
+              name: gpg-keyring
-          name: helm-working-dir
+            - mountPath: /app/config/reposerver/tls
-        - mountPath: /home/argocd/cmp-server/plugins
+              name: argocd-repo-server-tls
-          name: plugins
+            - mountPath: /helm-working-dir
-        - mountPath: /tmp
+              name: helm-working-dir
-          name: tmp
+            - mountPath: /home/argocd/cmp-server/plugins
-      - command:
+              name: plugins
-        - /var/run/argocd/argocd-cmp-server
+            - mountPath: /tmp
-        image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
+              name: tmp
-        imagePullPolicy: Always
+        - command:
-        name: kustomize-helm-with-rewrite
+            - /var/run/argocd/argocd-cmp-server
-        resources: {}
+          image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
-        securityContext:
+          imagePullPolicy: Always
-          runAsNonRoot: true
+          name: kustomize-helm-with-rewrite
-          runAsUser: 999
+          resources: {}
-        terminationMessagePath: /dev/termination-log
+          securityContext:
-        terminationMessagePolicy: File
+            runAsNonRoot: true
-        volumeMounts:
+            runAsUser: 999
-        - mountPath: /var/run/argocd
+          terminationMessagePath: /dev/termination-log
-          name: var-files
+          terminationMessagePolicy: File
-        - mountPath: /home/argocd/cmp-server/plugins
+          volumeMounts:
-          name: plugins
+            - mountPath: /var/run/argocd
-        - mountPath: /tmp
+              name: var-files
-          name: cmp-tmp
+            - mountPath: /home/argocd/cmp-server/plugins
-        - mountPath: /helm-working-dir
+              name: plugins
-          name: helm-working-dir
+            - mountPath: /tmp
+              name: cmp-tmp
+            - mountPath: /helm-working-dir
+              name: helm-working-dir
       dnsPolicy: ClusterFirst
       imagePullSecrets:
-      - name: gitlab-pull-secret
+        - name: gitlab-pull-secret
       initContainers:
-      - command:
+        - command:
-        - /bin/cp
+            - /bin/cp
-        - -n
+            - -n
-        - /usr/local/bin/argocd
+            - /usr/local/bin/argocd
-        - /var/run/argocd/argocd-cmp-server
+            - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:v2.10.4
+          image: quay.io/argoproj/argocd:v2.10.4
-        imagePullPolicy: IfNotPresent
+          imagePullPolicy: IfNotPresent
-        name: copyutil
+          name: copyutil
-        resources: {}
+          resources: {}
-        securityContext:
+          securityContext:
-          allowPrivilegeEscalation: false
+            allowPrivilegeEscalation: false
-          capabilities:
+            capabilities:
-            drop:
+              drop:
-            - ALL
+                - ALL
-          readOnlyRootFilesystem: true
+            readOnlyRootFilesystem: true
-          runAsNonRoot: true
+            runAsNonRoot: true
-          seccompProfile:
+            seccompProfile:
-            type: RuntimeDefault
+              type: RuntimeDefault
-        terminationMessagePath: /dev/termination-log
+          terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
+          terminationMessagePolicy: File
-        volumeMounts:
+          volumeMounts:
-        - mountPath: /var/run/argocd
+            - mountPath: /var/run/argocd
-          name: var-files
+              name: var-files
-      - command:
+        - command:
-        - /bin/sh
+            - /bin/sh
-        - /plugin/init-helm-repos.sh
+            - /plugin/init-helm-repos.sh
-        image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
+          image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
-        imagePullPolicy: Always
+          imagePullPolicy: Always
-        name: init-helm-repos
+          name: init-helm-repos
-        resources: {}
+          resources: {}
-        securityContext:
+          securityContext:
-          allowPrivilegeEscalation: false
+            allowPrivilegeEscalation: false
-          capabilities:
+            capabilities:
-            drop:
+              drop:
-            - ALL
+                - ALL
-          readOnlyRootFilesystem: true
+            readOnlyRootFilesystem: true
-          runAsUser: 999
+            runAsUser: 999
-          runAsNonRoot: true
+            runAsNonRoot: true
-          seccompProfile:
+            seccompProfile:
-            type: RuntimeDefault
+              type: RuntimeDefault
-        terminationMessagePath: /dev/termination-log
+          terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
+          terminationMessagePolicy: File
-        env:
+          env:
-        - name: OCEANBOX_HELM_ACCESS_TOKEN
+            - name: OCEANBOX_HELM_ACCESS_TOKEN
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              key: token
+                  key: token
-              name: oceanbox-helm
+                  name: oceanbox-helm
-              optional: false
+                  optional: false
-        volumeMounts:
+          volumeMounts:
-        - mountPath: /helm-working-dir
+            - mountPath: /helm-working-dir
-          name: helm-working-dir
+              name: helm-working-dir
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
@@ -386,40 +386,39 @@ spec:
       serviceAccountName: argocd-repo-server
       terminationGracePeriodSeconds: 30
       volumes:
-      - emptyDir: {}
+        - emptyDir: {}
-        name: cmp-tmp
+          name: cmp-tmp
-      - emptyDir: {}
+        - emptyDir: {}
-        name: helm-working-dir
+          name: helm-working-dir
-      - emptyDir: {}
+        - emptyDir: {}
-        name: plugins
+          name: plugins
-      - emptyDir: {}
+        - emptyDir: {}
-        name: var-files
+          name: var-files
-      - emptyDir: {}
+        - emptyDir: {}
-        name: tmp
+          name: tmp
-      - configMap:
+        - configMap:
-          defaultMode: 420
+            defaultMode: 420
-          name: argocd-ssh-known-hosts-cm
+            name: argocd-ssh-known-hosts-cm
-        name: ssh-known-hosts
+          name: ssh-known-hosts
-      - configMap:
+        - configMap:
-          defaultMode: 420
+            defaultMode: 420
-          name: argocd-tls-certs-cm
+            name: argocd-tls-certs-cm
-        name: tls-certs
+          name: tls-certs
-      - configMap:
+        - configMap:
-          defaultMode: 420
+            defaultMode: 420
-          name: argocd-gpg-keys-cm
+            name: argocd-gpg-keys-cm
-        name: gpg-keys
+          name: gpg-keys
-      - emptyDir: {}
+        - emptyDir: {}
-        name: gpg-keyring
+          name: gpg-keyring
-      - name: argocd-repo-server-tls
+        - name: argocd-repo-server-tls
-        secret:
+          secret:
-          defaultMode: 420
+            defaultMode: 420
-          items:
+            items:
-          - key: tls.crt
+              - key: tls.crt
-            path: tls.crt
+                path: tls.crt
-          - key: tls.key
+              - key: tls.key
-            path: tls.key
+                path: tls.key
-          - key: ca.crt
+              - key: ca.crt
-            path: ca.crt
+                path: ca.crt
-          optional: true
+            optional: true
-          secretName: argocd-repo-server-tls
+            secretName: argocd-repo-server-tls
-

bootstrap/reset-ekman-cluster.sh

@@ -13,7 +13,7 @@ kubectl --context ekman apply -f cluster-admin-token.yaml
 # kubectl --context oceanbox apply -f _cluster-ekman.yaml
 
 token=$(kubectl --context ekman get secret -n kube-system argocd-manager-token -o yaml | grep ' token:' | cut -d' ' -f4 | base64 -d)
-sed "s/@token@/$token/" cluster-ekman.yaml > _cluster-ekman.yaml
+sed "s/@token@/${token}/" cluster-ekman.yaml > _cluster-ekman.yaml
 echo "configure argocd ekman-cluster..."
 cat _cluster-ekman.yaml
 kubectl --context oceanbox apply -f _cluster-ekman.yaml

bootstrap/staging-vcluster.yaml

@@ -13,4 +13,3 @@ stringData:
   name: staging-vcluster
   server: https://staging-vcluster.staging-vcluster
 type: Opaque
-

bootstrap/values.yaml

@@ -19,12 +19,12 @@ applications:
         plugin:
           name: helmfile-cmp
           env:
-          - name: CLUSTER_NAME
+            - name: CLUSTER_NAME
-            value: replaceme
+              value: replaceme
-          - name: HELMFILE_ENVIRONMENT
+            - name: HELMFILE_ENVIRONMENT
-            value: default
+              value: default
-          - name: HELMFILE_FILE_PATH
+            - name: HELMFILE_FILE_PATH
-            value: system.yaml.gotmpl
+              value: system.yaml.gotmpl
 projects:
   sys:
     namespace: argocd
@@ -32,12 +32,12 @@ projects:
     additionalAnnotations: {}
     description: sys components project
     sourceRepos:
-    - '*'
+      - "*"
     destinations:
-    - namespace: '*'
+      - namespace: "*"
-      server: https://kubernetes.default.svc
+        server: https://kubernetes.default.svc
     clusterResourceWhitelist:
-    - group: '*'
+      - group: "*"
-      kind: '*'
+        kind: "*"
     orphanedResources:
       warn: false

charts/atlantis/Chart.yaml

@@ -8,3 +8,8 @@ version: v1.35.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
 appVersion: v1.35.2
+dependencies:
+  - name: diagrid-dashboard
+    version: "0.1.0"
+    repository: "file://../diagrid-dashboard"
+    condition: diagrid-dashboard.enabled

charts/atlantis/values.yaml

@@ -116,3 +116,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
+diagrid-dashboard:
+  enabled: false

charts/diagrid-dashboard/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/diagrid-dashboard/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: diagrid-dashboard
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

charts/diagrid-dashboard/templates/NOTES.txt

@@ -0,0 +1,35 @@
+1. Get the application URL by running these commands:
+{{- if .Values.httpRoute.enabled }}
+{{- if .Values.httpRoute.hostnames }}
+    export APP_HOSTNAME={{ .Values.httpRoute.hostnames | first }}
+{{- else }}
+    export APP_HOSTNAME=$(kubectl get --namespace {{(first .Values.httpRoute.parentRefs).namespace | default .Release.Namespace }} gateway/{{ (first .Values.httpRoute.parentRefs).name }} -o jsonpath="{.spec.listeners[0].hostname}")
+  {{- end }}
+{{- if and .Values.httpRoute.rules (first .Values.httpRoute.rules).matches (first (first .Values.httpRoute.rules).matches).path.value }}
+    echo "Visit http://$APP_HOSTNAME{{ (first (first .Values.httpRoute.rules).matches).path.value }} to use your application"
+
+    NOTE: Your HTTPRoute depends on the listener configuration of your gateway and your HTTPRoute rules.
+    The rules can be set for path, method, header and query parameters.
+    You can check the gateway configuration with 'kubectl get --namespace {{(first .Values.httpRoute.parentRefs).namespace | default .Release.Namespace }} gateway/{{ (first .Values.httpRoute.parentRefs).name }} -o yaml'
+{{- end }}
+{{- else if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "diagrid-dashboard.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "diagrid-dashboard.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "diagrid-dashboard.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "diagrid-dashboard.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

charts/diagrid-dashboard/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "diagrid-dashboard.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "diagrid-dashboard.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "diagrid-dashboard.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "diagrid-dashboard.labels" -}}
+helm.sh/chart: {{ include "diagrid-dashboard.chart" . }}
+{{ include "diagrid-dashboard.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "diagrid-dashboard.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "diagrid-dashboard.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "diagrid-dashboard.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "diagrid-dashboard.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/diagrid-dashboard/templates/deployment.yaml

@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "diagrid-dashboard.fullname" . }}
+  labels:
+    {{- include "diagrid-dashboard.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "diagrid-dashboard.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "diagrid-dashboard.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "diagrid-dashboard.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: COMPONENT_FILE
+              value: /app/components/statestore.yaml
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: statestore
+              mountPath: /app/components/statestore.yaml
+              subPath: statestore.yaml
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: statestore
+          configMap:
+            name: {{ include "diagrid-dashboard.fullname" . }}-statestore
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/diagrid-dashboard/templates/hpa.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "diagrid-dashboard.fullname" . }}
+  labels:
+    {{- include "diagrid-dashboard.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "diagrid-dashboard.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

charts/diagrid-dashboard/templates/httproute.yaml

@@ -0,0 +1,38 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "diagrid-dashboard.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "diagrid-dashboard.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs:
+    {{- with .Values.httpRoute.parentRefs }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.httpRoute.rules }}
+    {{- with .matches }}
+    - matches:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .filters }}
+      filters:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+          weight: 1
+    {{- end }}
+{{- end }}

charts/diagrid-dashboard/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "diagrid-dashboard.fullname" . }}
+  labels:
+    {{- include "diagrid-dashboard.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- with .pathType }}
+            pathType: {{ . }}
+            {{- end }}
+            backend:
+              service:
+                name: {{ include "diagrid-dashboard.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/diagrid-dashboard/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "diagrid-dashboard.fullname" . }}
+  labels:
+    {{- include "diagrid-dashboard.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "diagrid-dashboard.selectorLabels" . | nindent 4 }}

charts/diagrid-dashboard/templates/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "diagrid-dashboard.serviceAccountName" . }}
+  labels:
+    {{- include "diagrid-dashboard.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}

charts/diagrid-dashboard/templates/statestore.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "diagrid-dashboard.fullname" . }}-statestore
+data:
+  statestore.yaml: |
+    apiVersion: dapr.io/v1alpha1
+    kind: Component
+    metadata:
+      name: statestore
+    scopes:
+      - {{ .Values.statestore.scope }}
+    spec:
+      metadata:
+        - name: redisHost
+          value: {{ .Values.statestore.redis }}:6379
+        - name: redisUsername
+          value: default
+        - name: redisPassword
+          value: secret
+        - name: actorStateStore
+          value: "true"
+        - name: redisDB
+          value: "1"
+      type: state.redis
+      version: v1

charts/diagrid-dashboard/templates/tests/test-connection.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "diagrid-dashboard.fullname" . }}-test-connection"
+  labels:
+    {{- include "diagrid-dashboard.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "diagrid-dashboard.fullname" . }}:{{ .Values.service.port }}']
+  restartPolicy: Never

charts/diagrid-dashboard/values.yaml

@@ -0,0 +1,160 @@
+# Default values for diagrid-dashboard.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+statestore:
+  scope: my-scope
+  redis: my-redis
+
+# This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
+replicaCount: 1
+
+# This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
+image:
+  repository: ghcr.io/diagridio/diagrid-dashboard
+  # This sets the pull policy for images.
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: "latest"
+
+# This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+imagePullSecrets: []
+# This is to override the chart name.
+nameOverride: ""
+fullnameOverride: ""
+
+# This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Automatically mount a ServiceAccount's API credentials?
+  automount: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+# This is for setting Kubernetes Annotations to a Pod.
+# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+podAnnotations: {}
+# This is for setting Kubernetes Labels to a Pod.
+# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+podLabels: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+# This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
+service:
+  # This sets the service type more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
+  type: ClusterIP
+  # This sets the ports more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#field-spec-ports
+  port: 8080
+
+# This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
+ingress:
+  enabled: true
+  className: "nginx"
+  annotations:
+    cert-manager.io/cluster-issuer: ca-issuer
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    oceanbox.io/expose: internal
+  hosts:
+    - host: diadash.dev.vtn.obx
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - secretName: diadash-tls
+      hosts:
+        - diadash.dev.vtn.obx
+
+# -- Expose the service via gateway-api HTTPRoute
+# Requires Gateway API resources and suitable controller installed within the cluster
+# (see: https://gateway-api.sigs.k8s.io/guides/)
+httpRoute:
+  # HTTPRoute enabled.
+  enabled: false
+  # HTTPRoute annotations.
+  annotations: {}
+  # Which Gateways this Route is attached to.
+  parentRefs:
+    - name: gateway
+      sectionName: http
+      # namespace: default
+  # Hostnames matching HTTP header.
+  hostnames:
+    - chart-example.local
+  # List of rules and filters applied.
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /headers
+  #   filters:
+  #   - type: RequestHeaderModifier
+  #     requestHeaderModifier:
+  #       set:
+  #       - name: My-Overwrite-Header
+  #         value: this-is-the-only-value
+  #       remove:
+  #       - User-Agent
+  # - matches:
+  #   - path:
+  #       type: PathPrefix
+  #       value: /echo
+  #     headers:
+  #     - name: version
+  #       value: v2
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+# This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+livenessProbe:
+  httpGet:
+    path: /
+    port: http
+readinessProbe:
+  httpGet:
+    path: /
+    port: http
+
+# This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+
+# Additional volumes on the output Deployment definition.
+volumes: {}
+
+# Additional volumeMounts on the output Deployment definition.
+volumeMounts: {}
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}

charts/fornix/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/fornix/Chart.yaml

@@ -0,0 +1,21 @@
+apiVersion: v2
+name: fornix
+description: A Helm chart for Kubernetes
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: v1.6.0
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "v1.6.0"

charts/fornix/templates/NOTES.txt

@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "fornix.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "fornix.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "fornix.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "fornix.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

charts/fornix/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "fornix.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "fornix.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "fornix.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "fornix.labels" -}}
+helm.sh/chart: {{ include "fornix.chart" . }}
+{{ include "fornix.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "fornix.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "fornix.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "fornix.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "fornix.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/fornix/templates/deployment.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "fornix.fullname" . }}
+  labels:
+    {{- include "fornix.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fornix.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "fornix.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "fornix.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          env:
+          - name: DRUPAL_URL
+            value: {{ .Values.drupalUrl }}
+          - name: BASE_URL
+            value: {{ .Values.baseUrl }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/fornix/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "fornix.fullname" . }}
+  labels:
+    {{- include "fornix.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- with .pathType }}
+            pathType: {{ . }}
+            {{- end }}
+            backend:
+              service:
+                name: {{ include "fornix.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/fornix/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "fornix.fullname" . }}
+  labels:
+    {{- include "fornix.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "fornix.selectorLabels" . | nindent 4 }}

charts/fornix/templates/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "fornix.serviceAccountName" . }}
+  labels:
+    {{- include "fornix.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}

charts/fornix/templates/tests/test-connection.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "fornix.fullname" . }}-test-connection"
+  labels:
+    {{- include "fornix.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "fornix.fullname" . }}:{{ .Values.service.port }}']
+  restartPolicy: Never

charts/fornix/values.yaml

@@ -0,0 +1,100 @@
+# Default values for fornix.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+drupalUrl: http://drupal
+baseUrl: https://oceanbox.io
+# This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
+replicaCount: 1
+# This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
+image:
+  repository: registry.gitlab.com/oceanbox/fornix
+  # This sets the pull policy for images.
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: v1.6.0
+# This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+imagePullSecrets:
+  - name: gitlab-pull-secret
+# This is to override the chart name.
+nameOverride: ""
+fullnameOverride: ""
+# This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Automatically mount a ServiceAccount's API credentials?
+  automount: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+# This is for setting Kubernetes Annotations to a Pod.
+# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+podAnnotations: {}
+# This is for setting Kubernetes Labels to a Pod.
+# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+podLabels: {}
+podSecurityContext:
+  fsGroup: 2000
+securityContext:
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: false
+  runAsNonRoot: true
+  runAsUser: 1000
+# This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
+service:
+  # This sets the service type more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
+  type: ClusterIP
+  # This sets the ports more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#field-spec-ports
+  port: 8085
+# This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
+ingress:
+  enabled: false
+resources: {}
+# We usually recommend not to specify default resources and to leave this as a conscious
+# choice for the user. This also increases chances charts run on environments with little
+# resources, such as Minikube. If you do want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
+
+# This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+livenessProbe:
+  httpGet:
+    path: /
+    port: http
+readinessProbe:
+  httpGet:
+    path: /
+    port: http
+# This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+# Additional volumes on the output Deployment definition.
+volumes: []
+# - name: foo
+#   secret:
+#     secretName: mysecret
+#     optional: false
+
+# Additional volumeMounts on the output Deployment definition.
+volumeMounts: []
+# - name: foo
+#   mountPath: "/etc/foo"
+#   readOnly: true
+
+nodeSelector: {}
+tolerations: []
+affinity: {}

charts/makai/values.yaml

@@ -3,7 +3,7 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/makai/makai
+  repository: registry.gitlab.com/oceanbox/makai
   tag: v0.1.0
   pullPolicy: IfNotPresent
 init:

charts/plume/templates/redis.yaml

@@ -45,6 +45,7 @@ spec:
     persistentVolumeClaimSpec:
       accessModes:
       - ReadWriteOnce
+      storageClass: {{ .Values.redis.storageClass | default "managed-nfs-storage" }}
       resources:
         requests:
           storage: {{ .Values.redis.size | default "1Gi" }}

charts/plume/values.yaml

@@ -3,7 +3,7 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/plume/plume
+  repository: registry.gitlab.com/oceanbox/plume
   tag: v1.6.7
   pullPolicy: IfNotPresent
 init:

charts/sorcerer/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: diagrid-dashboard
+  repository: file://../diagrid-dashboard
+  version: 0.1.0
+digest: sha256:4fdb3148a2a6439223d7844a3083da2de324dd47e5cb3ac4a5d9c436e6e2c775
+generated: "2025-12-16T19:38:21.939708629+01:00"

charts/sorcerer/Chart.yaml

@@ -8,3 +8,8 @@ version: v1.35.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
 appVersion: v1.35.2
+dependencies:
+  - name: diagrid-dashboard
+    version: "0.1.0"
+    repository: "file://../diagrid-dashboard"
+    condition: diagrid-dashboard.enabled

charts/sorcerer/values.yaml

@@ -108,3 +108,9 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
+diagrid-dashboard:
+  enabled: false
+  statestore:
+    scope: sorcerer
+    redis: sorcerer-redis

charts/yolo-registry/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: registry
-  tag: 2
+  tag: 3
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -27,7 +27,7 @@ releases:
 - name: argocd-apps
   namespace: argocd
   chart: argo/argocd-apps
-  version: 0.0.9
+  version: 2.0.3
   condition: argo.apps.enabled
   values:
   - ../values/argo/values/apps.yaml.gotmpl

helmfile.d/cert-manager.yaml.gotmpl

@@ -3,7 +3,8 @@ bases:
 
 repositories:
   - name: cert-manager
-    url: 'https://charts.jetstack.io'
+    oci: true
+    url: 'quay.io/jetstack/charts'
 
 commonLabels:
   tier: system
@@ -12,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: 1.12.13
+  version: v1.19.2
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/forgejo.yaml.gotmpl

@@ -0,0 +1,44 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: forgejo
+  oci: true
+  url: code.forgejo.org/forgejo-helm
+
+commonLabels:
+  tier: system
+
+releases:
+- name: forgejo
+  namespace: forgejo
+  chart: forgejo/forgejo
+  version: 16.0.0
+  condition: forgejo.enabled
+  values:
+  - ../values/forgejo/values/values.yaml
+  - ../values/forgejo/values/values-{{ .Environment.Name }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/forgejo/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: forgejo
+  chart: manifests
+  condition: forgejo.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/forgejo/env.yaml.gotmpl
+  - ../values/forgejo/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/forgejo/manifests
+    - manifests

helmfile.d/fornix.yaml.gotmpl

@@ -0,0 +1,37 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: oceanbox
+
+releases:
+- name: fornix
+  namespace: fornix
+  chart: ../charts/fornix
+  condition: fornix.enabled
+  values:
+  - ../values/fornix/values/values.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/fornix/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: fornix
+  chart: manifests
+  condition: fornix.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/fornix/env.yaml.gotmpl
+  - ../values/fornix/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/fornix/manifests
+    - manifests

helmfile.d/ingress-nginx.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
   namespace: ingress-nginx
   chart: ingress-nginx/ingress-nginx
-  version: 4.8.3
+  version: 4.14.1
   condition: nginx.enabled
   values:
   - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl

helmfile.d/kueue.yaml.gotmpl

@@ -0,0 +1,40 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: system
+
+releases:
+- name: kueue
+  namespace: kueue-system
+  chart: oci://registry.k8s.io/kueue/charts/kueue
+  version: 0.15.0
+  condition: kueue.enabled
+  values:
+  - ../values/kueue/values/values.yaml
+  - ../values/kueue/values/values-{{ .Environment.Name }}.yaml
+  - ../values/kueue/values/values-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/kueue/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: kueue-system
+  chart: manifests
+  condition: kueue.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/kueue/env.yaml.gotmpl
+  - ../values/kueue/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/kueue/manifests
+    - manifests

helmfile.d/kyverno.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: kyverno
   namespace: kyverno
   chart: kyverno/kyverno
-  version: 3.5.1
+  version: 3.6.1
   condition: kyverno.enabled
   values:
   - ../values/kyverno/values/kyverno.yaml.gotmpl

helmfile.d/mariadb-operator.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
   namespace: mariadb-operator
   chart: mariadb-operator/mariadb-operator
-  version: 25.8.4
+  version: 25.10.3
   condition: mariadb_operator.enabled
   values:
   - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.45
+  version: 0.2.50
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.134.1
+  version: 0.142.1
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/postgres-operator.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: postgres-operator
   namespace: cnpg
   chart: cloudnative-pg/cloudnative-pg
-  version: 0.26.1
+  version: 0.27.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/postgres-operator.yaml.gotmpl

helmfile.d/rabbitmq.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: {{ .Environment.Name }}-rabbitmq
   namespace: rabbitmq
   chart: bitnami/rabbitmq
-  version: 12.9.0
+  version: 13.0.3
   condition: rabbitmq.enabled
   values:
   - ../values/rabbitmq/values/values.yaml

helmfile.d/slurm-operator.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
   namespace: slinky
   chart: slurm-operator/slurm-operator
-  version: 0.4.0
+  version: 0.4.1
   condition: slurm_operator.enabled
   values:
   - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl

helmfile.d/spegel.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: spegel
   namespace: spegel
   chart: spegel/spegel
-  version: 0.5.1
+  version: 0.6.0
   condition: spegel.enabled
   values:
   - ../values/spegel/values/spegel.yaml.gotmpl

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 11.1.1
+  version: 11.3.2
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

nix/checks.nix

@@ -0,0 +1,70 @@
+let
+  sources = import ./default.nix;
+  pkgs = import sources.nixpkgs { };
+  pre-commit = import sources.git-hooks;
+
+  globalExcludes = [
+    "nix/default.nix"
+    "attic"
+    "vcluster"
+    ".*vendor"
+    ".*chart/.*"
+    ".*schema.json"
+  ];
+
+in
+pre-commit.run {
+  src = pkgs.nix-gitignore.gitignoreSource [ ] ../.;
+  # Do not run at pre-commit time
+  default_stages = [
+    "pre-push"
+  ];
+  # TODO(mrtz): Remove when default
+  package = pkgs.prek;
+  # Linters From https://github.com/cachix/pre-commit-hooks.nix
+  hooks = {
+    nixfmt-rfc-style = {
+      enable = true;
+      excludes = globalExcludes;
+    };
+
+    trim-trailing-whitespace.enable = true;
+
+    shellcheck = {
+      enable = true;
+      excludes = [
+        "vcluster/"
+        "attic/"
+      ];
+      args = [
+        "-x"
+        "-o"
+        "all"
+      ];
+    };
+
+    yamllint = {
+      enable = true;
+      excludes = [
+        "attic/"
+        "charts/templates/"
+        "charts/"
+        "values/"
+        "vcluster/"
+      ];
+      settings = {
+        strict = true;
+        configData = ''{ extends: default, rules: { document-start: disable, line-length: {max: 300} } }'';
+      };
+    };
+
+    check-json.enable = true;
+
+    renovate-config-validator = {
+      enable = true;
+      files = "renovate.json$";
+      entry = "renovate-config-validator";
+    };
+
+  };
+}

nix/default.nix

@@ -9,8 +9,15 @@
 */
 # Generated by npins. Do not modify; will be overwritten regularly
 let
-  data = builtins.fromJSON (builtins.readFile ./sources.json);
+  # Backwards-compatibly make something that previously didn't take any arguments take some
-  version = data.version;
+  # The function must return an attrset, and will unfortunately be eagerly evaluated
+  # Same thing, but it catches eval errors on the default argument so that one may still call it with other arguments
+  mkFunctor =
+    fn:
+    let
+      e = builtins.tryEval (fn { });
+    in
+    (if e.success then e.value else { error = fn { }; }) // { __functor = _self: fn; };
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
   range =
@@ -21,7 +28,6 @@ let
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
   stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
-  concatMapStrings = f: list: concatStrings (map f list);
   concatStrings = builtins.concatStringsSep "";
 
   # If the environment variable NPINS_OVERRIDE_${name} is set, then use
@@ -48,41 +54,87 @@ let
 
   mkSource =
     name: spec:
+    {
+      pkgs ? null,
+    }:
     assert spec ? type;
     let
+      # Unify across builtin and pkgs fetchers.
+      # `fetchGit` requires a wrapper because of slight API differences.
+      fetchers =
+        if pkgs == null then
+          {
+            inherit (builtins) fetchTarball fetchurl;
+            # For some fucking reason, fetchGit has a different signature than the other builtin fetchers …
+            fetchGit = args: (builtins.fetchGit args).outPath;
+          }
+        else
+          {
+            fetchTarball =
+              {
+                url,
+                sha256,
+              }:
+              pkgs.fetchzip {
+                inherit url sha256;
+                extension = "tar";
+              };
+            inherit (pkgs) fetchurl;
+            fetchGit =
+              {
+                url,
+                submodules,
+                rev,
+                name,
+                narHash,
+              }:
+              pkgs.fetchgit {
+                inherit url rev name;
+                fetchSubmodules = submodules;
+                hash = narHash;
+              };
+          };
+
+      # Dispatch to the correct code path based on the type
       path =
         if spec.type == "Git" then
-          mkGitSource spec
+          mkGitSource fetchers spec
         else if spec.type == "GitRelease" then
-          mkGitSource spec
+          mkGitSource fetchers spec
         else if spec.type == "PyPi" then
-          mkPyPiSource spec
+          mkPyPiSource fetchers spec
         else if spec.type == "Channel" then
-          mkChannelSource spec
+          mkChannelSource fetchers spec
         else if spec.type == "Tarball" then
-          mkTarballSource spec
+          mkTarballSource fetchers spec
+        else if spec.type == "Container" then
+          mkContainerSource pkgs spec
         else
           builtins.throw "Unknown source type ${spec.type}";
     in
     spec // { outPath = mayOverride name path; };
 
   mkGitSource =
+    {
+      fetchTarball,
+      fetchGit,
+      ...
+    }:
     {
       repository,
       revision,
       url ? null,
       submodules,
       hash,
-      branch ? null,
       ...
     }:
     assert repository ? type;
     # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
     # In the latter case, there we will always be an url to the tarball
     if url != null && !submodules then
-      builtins.fetchTarball {
+      fetchTarball {
         inherit url;
-        sha256 = hash; # FIXME: check nix version & use SRI hashes
+        sha256 = hash;
       }
     else
       let
@@ -93,6 +145,8 @@ let
             "https://github.com/${repository.owner}/${repository.repo}.git"
           else if repository.type == "GitLab" then
             "${repository.server}/${repository.repo_path}.git"
+          else if repository.type == "Forgejo" then
+            "${repository.server}/${repository.owner}/${repository.repo}.git"
           else
             throw "Unrecognized repository type ${repository.type}";
         urlToName =
@@ -107,40 +161,89 @@ let
           "${if matched == null then "source" else builtins.head matched}${appendShort}";
         name = urlToName url revision;
       in
-      builtins.fetchGit {
+      fetchGit {
         rev = revision;
-        inherit name;
+        narHash = hash;
-        # hash = hash;
+
-        inherit url submodules;
+        inherit name submodules url;
       };
 
   mkPyPiSource =
-    { url, hash, ... }:
+    { fetchurl, ... }:
-    builtins.fetchurl {
+    {
+      url,
+      hash,
+      ...
+    }:
+    fetchurl {
       inherit url;
       sha256 = hash;
     };
 
   mkChannelSource =
-    { url, hash, ... }:
+    { fetchTarball, ... }:
-    builtins.fetchTarball {
+    {
+      url,
+      hash,
+      ...
+    }:
+    fetchTarball {
       inherit url;
       sha256 = hash;
     };
 
   mkTarballSource =
+    { fetchTarball, ... }:
     {
       url,
       locked_url ? url,
       hash,
       ...
     }:
-    builtins.fetchTarball {
+    fetchTarball {
       url = locked_url;
       sha256 = hash;
     };
+
+  mkContainerSource =
+    pkgs:
+    {
+      image_name,
+      image_tag,
+      image_digest,
+      ...
+    }:
+    if pkgs == null then
+      builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
+    else
+      pkgs.dockerTools.pullImage {
+        imageName = image_name;
+        imageDigest = image_digest;
+        finalImageTag = image_tag;
+      };
 in
-if version == 5 then
+mkFunctor (
-  builtins.mapAttrs mkSource data.pins
+  {
-else
+    input ? ./sources.json,
-  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
+  }:
+  let
+    data =
+      if builtins.isPath input then
+        # while `readFile` will throw an error anyways if the path doesn't exist,
+        # we still need to check beforehand because *our* error can be caught but not the one from the builtin
+        # *piegames sighs*
+        if builtins.pathExists input then
+          builtins.fromJSON (builtins.readFile input)
+        else
+          throw "Input path ${toString input} does not exist"
+      else if builtins.isAttrs input then
+        input
+      else
+        throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
+    version = data.version;
+  in
+  if version == 7 then
+    builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
+  else
+    throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
+)

nix/sources.json

@@ -1,11 +1,24 @@
 {
   "pins": {
+    "git-hooks": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "cachix",
+        "repo": "git-hooks.nix"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
+      "url": "https://github.com/cachix/git-hooks.nix/archive/f0927703b7b1c8d97511c4116eb9b4ec6645a0fa.tar.gz",
+      "hash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE="
+    },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre903996.59b6c96beacc/nixexprs.tar.xz",
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre927565.13868c071cc7/nixexprs.tar.xz",
-      "hash": "0b0yr9d1xyfwgpaj68bimsbjjbj7yis4whjvkrfdycfnasdf0gf0"
+      "hash": "sha256-wufp5c0nWh/87f9eK7xy1eZXms5zd4yl6S4SR+LfA08="
     }
   },
-  "version": 5
+  "version": 7
 }

raw/tos/oceanbox/database/upload-img.sh

@@ -3,7 +3,7 @@
 # Simple script for uploading a base64 encoded image into our database. For
 # grafana business image panels.
 
-if [ $# -ne 2 ]
+if [[ $# -ne 2 ]]
 then
 	echo "Usage: $0 <image-name> <file>.png"
 	exit 1
@@ -12,9 +12,9 @@ fi
 filename=$1
 file=$2
 
-if [ ! -e $file ]
+if [[ ! -e "${file}" ]]
 then
-	echo "file $file does not exist"
+	echo "file ${file} does not exist"
 	exit 1
 fi
 
@@ -22,9 +22,9 @@ function create_image() {
 	local filename=$1
 	local data=$2
 cat << EOF
-INSERT INTO images VALUES('$filename', '$data');
+INSERT INTO images VALUES('${filename}', '${data}');
 EOF
 }
 
-data=$(cat $file | base64 -w0)
+data=$(base64 -w0 < "${file}")
-create_image $filename $data
+create_image "${filename}" "${data}"

renovate.json

@@ -1,4 +1,3 @@
-// -*- mode: jsonc -*-
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [

rules/etcd.yaml

@@ -1,183 +1,204 @@
 groups:
-- name: etcd
+  - name: etcd
-  rules:
+    rules:
-  - alert: etcdMembersDown
+      - alert: etcdMembersDown
-    annotations:
+        annotations:
-      description: 'etcd cluster "{{ $labels.job }}": members are down ({{ $value
+          description:
-        }}).'
+            'etcd cluster "{{ $labels.job }}": members are down ({{ $value
-      summary: etcd cluster members are down.
+            }}).'
-    expr: |-
+          summary: etcd cluster members are down.
-      max without (endpoint) (
+        expr: |-
-        sum without (instance) (up{job=~".*etcd.*"} == bool 0)
+          max without (endpoint) (
-      or
+            sum without (instance) (up{job=~".*etcd.*"} == bool 0)
-        count without (To) (
+          or
-          sum without (instance) (rate(etcd_network_peer_sent_failures_total{job=~".*etcd.*"}[120s])) > 0.01
+            count without (To) (
-        )
+              sum without (instance) (rate(etcd_network_peer_sent_failures_total{job=~".*etcd.*"}[120s])) > 0.01
-      )
+            )
-      > 0
+          )
-    for: 10m
+          > 0
-    labels:
+        for: 10m
-      severity: critical
+        labels:
-  - alert: etcdInsufficientMembers
+          severity: critical
-    annotations:
+      - alert: etcdInsufficientMembers
-      description: 'etcd cluster "{{ $labels.job }}": insufficient members ({{ $value
+        annotations:
-        }}).'
+          description:
-      summary: etcd cluster has insufficient number of members.
+            'etcd cluster "{{ $labels.job }}": insufficient members ({{ $value
-    expr: sum(up{job=~".*etcd.*"} == bool 1) without (instance) < ((count(up{job=~".*etcd.*"})
+            }}).'
-      without (instance) + 1) / 2)
+          summary: etcd cluster has insufficient number of members.
-    for: 3m
+        expr:
-    labels:
+          sum(up{job=~".*etcd.*"} == bool 1) without (instance) < ((count(up{job=~".*etcd.*"})
-      severity: critical
+          without (instance) + 1) / 2)
-  - alert: etcdNoLeader
+        for: 3m
-    annotations:
+        labels:
-      description: 'etcd cluster "{{ $labels.job }}": member {{ $labels.instance }}
+          severity: critical
-        has no leader.'
+      - alert: etcdNoLeader
-      summary: etcd cluster has no leader.
+        annotations:
-    expr: etcd_server_has_leader{job=~".*etcd.*"} == 0
+          description:
-    for: 1m
+            'etcd cluster "{{ $labels.job }}": member {{ $labels.instance }}
-    labels:
+            has no leader.'
-      severity: critical
+          summary: etcd cluster has no leader.
-  - alert: etcdHighNumberOfLeaderChanges
+        expr: etcd_server_has_leader{job=~".*etcd.*"} == 0
-    annotations:
+        for: 1m
-      description: 'etcd cluster "{{ $labels.job }}": {{ $value }} leader changes
+        labels:
-        within the last 15 minutes. Frequent elections may be a sign of insufficient
+          severity: critical
-        resources, high network latency, or disruptions by other components and should
+      - alert: etcdHighNumberOfLeaderChanges
-        be investigated.'
+        annotations:
-      summary: etcd cluster has high number of leader changes.
+          description:
-    expr: increase((max without (instance) (etcd_server_leader_changes_seen_total{job=~".*etcd.*"})
+            'etcd cluster "{{ $labels.job }}": {{ $value }} leader changes
-      or 0*absent(etcd_server_leader_changes_seen_total{job=~".*etcd.*"}))[15m:1m])
+            within the last 15 minutes. Frequent elections may be a sign of insufficient
-      >= 4
+            resources, high network latency, or disruptions by other components and should
-    for: 5m
+            be investigated.'
-    labels:
+          summary: etcd cluster has high number of leader changes.
-      severity: warning
+        expr:
-  - alert: etcdHighNumberOfFailedGRPCRequests
+          increase((max without (instance) (etcd_server_leader_changes_seen_total{job=~".*etcd.*"})
-    annotations:
+          or 0*absent(etcd_server_leader_changes_seen_total{job=~".*etcd.*"}))[15m:1m])
-      description: 'etcd cluster "{{ $labels.job }}": {{ $value }}% of requests for
+          >= 4
-        {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}.'
+        for: 5m
-      summary: etcd cluster has high number of failed grpc requests.
+        labels:
-    expr: |-
+          severity: warning
-      100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code)
+      - alert: etcdHighNumberOfFailedGRPCRequests
-        /
+        annotations:
-      sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code)
+          description:
-        > 1
+            'etcd cluster "{{ $labels.job }}": {{ $value }}% of requests for
-    for: 10m
+            {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}.'
-    labels:
+          summary: etcd cluster has high number of failed grpc requests.
-      severity: warning
+        expr: |-
-  - alert: etcdHighNumberOfFailedGRPCRequests
+          100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code)
-    annotations:
+            /
-      description: 'etcd cluster "{{ $labels.job }}": {{ $value }}% of requests for
+          sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code)
-        {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}.'
+            > 1
-      summary: etcd cluster has high number of failed grpc requests.
+        for: 10m
-    expr: |-
+        labels:
-      100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code)
+          severity: warning
-        /
+      - alert: etcdHighNumberOfFailedGRPCRequests
-      sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code)
+        annotations:
-        > 5
+          description:
-    for: 5m
+            'etcd cluster "{{ $labels.job }}": {{ $value }}% of requests for
-    labels:
+            {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}.'
-      severity: critical
+          summary: etcd cluster has high number of failed grpc requests.
-  - alert: etcdGRPCRequestsSlow
+        expr: |-
-    annotations:
+          100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code)
-      description: 'etcd cluster "{{ $labels.job }}": 99th percentile of gRPC requests
+            /
-        is {{ $value }}s on etcd instance {{ $labels.instance }} for {{ $labels.grpc_method
+          sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code)
-        }} method.'
+            > 5
-      summary: etcd grpc requests are slow
+        for: 5m
-    expr: |-
+        labels:
-      histogram_quantile(0.99, sum(rate(grpc_server_handling_seconds_bucket{job=~".*etcd.*", grpc_method!="Defragment", grpc_type="unary"}[5m])) without(grpc_type))
+          severity: critical
-      > 0.15
+      - alert: etcdGRPCRequestsSlow
-    for: 10m
+        annotations:
-    labels:
+          description:
-      severity: critical
+            'etcd cluster "{{ $labels.job }}": 99th percentile of gRPC requests
-  - alert: etcdMemberCommunicationSlow
+            is {{ $value }}s on etcd instance {{ $labels.instance }} for {{ $labels.grpc_method
-    annotations:
+            }} method.'
-      description: 'etcd cluster "{{ $labels.job }}": member communication with {{
+          summary: etcd grpc requests are slow
-        $labels.To }} is taking {{ $value }}s on etcd instance {{ $labels.instance
+        expr: |-
-        }}.'
+          histogram_quantile(0.99, sum(rate(grpc_server_handling_seconds_bucket{job=~".*etcd.*", grpc_method!="Defragment", grpc_type="unary"}[5m])) without(grpc_type))
-      summary: etcd cluster member communication is slow.
+          > 0.15
-    expr: |-
+        for: 10m
-      histogram_quantile(0.99, rate(etcd_network_peer_round_trip_time_seconds_bucket{job=~".*etcd.*"}[5m]))
+        labels:
-      > 0.15
+          severity: critical
-    for: 10m
+      - alert: etcdMemberCommunicationSlow
-    labels:
+        annotations:
-      severity: warning
+          description:
-  - alert: etcdHighNumberOfFailedProposals
+            'etcd cluster "{{ $labels.job }}": member communication with {{
-    annotations:
+            $labels.To }} is taking {{ $value }}s on etcd instance {{ $labels.instance
-      description: 'etcd cluster "{{ $labels.job }}": {{ $value }} proposal failures
+            }}.'
-        within the last 30 minutes on etcd instance {{ $labels.instance }}.'
+          summary: etcd cluster member communication is slow.
-      summary: etcd cluster has high number of proposal failures.
+        expr: |-
-    expr: rate(etcd_server_proposals_failed_total{job=~".*etcd.*"}[15m]) > 5
+          histogram_quantile(0.99, rate(etcd_network_peer_round_trip_time_seconds_bucket{job=~".*etcd.*"}[5m]))
-    for: 15m
+          > 0.15
-    labels:
+        for: 10m
-      severity: warning
+        labels:
-  - alert: etcdHighFsyncDurations
+          severity: warning
-    annotations:
+      - alert: etcdHighNumberOfFailedProposals
-      description: 'etcd cluster "{{ $labels.job }}": 99th percentile fsync durations
+        annotations:
-        are {{ $value }}s on etcd instance {{ $labels.instance }}.'
+          description:
-      summary: etcd cluster 99th percentile fsync durations are too high.
+            'etcd cluster "{{ $labels.job }}": {{ $value }} proposal failures
-    expr: |-
+            within the last 30 minutes on etcd instance {{ $labels.instance }}.'
-      histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
+          summary: etcd cluster has high number of proposal failures.
-      > 0.5
+        expr: rate(etcd_server_proposals_failed_total{job=~".*etcd.*"}[15m]) > 5
-    for: 10m
+        for: 15m
-    labels:
+        labels:
-      severity: warning
+          severity: warning
-  - alert: etcdHighFsyncDurations
+      - alert: etcdHighFsyncDurations
-    annotations:
+        annotations:
-      description: 'etcd cluster "{{ $labels.job }}": 99th percentile fsync durations
+          description:
-        are {{ $value }}s on etcd instance {{ $labels.instance }}.'
+            'etcd cluster "{{ $labels.job }}": 99th percentile fsync durations
-      summary: etcd cluster 99th percentile fsync durations are too high.
+            are {{ $value }}s on etcd instance {{ $labels.instance }}.'
-    expr: |-
+          summary: etcd cluster 99th percentile fsync durations are too high.
-      histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
+        expr: |-
-      > 1
+          histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
-    for: 10m
+          > 0.5
-    labels:
+        for: 10m
-      severity: critical
+        labels:
-  - alert: etcdHighCommitDurations
+          severity: warning
-    annotations:
+      - alert: etcdHighFsyncDurations
-      description: 'etcd cluster "{{ $labels.job }}": 99th percentile commit durations
+        annotations:
-        {{ $value }}s on etcd instance {{ $labels.instance }}.'
+          description:
-      summary: etcd cluster 99th percentile commit durations are too high.
+            'etcd cluster "{{ $labels.job }}": 99th percentile fsync durations
-    expr: |-
+            are {{ $value }}s on etcd instance {{ $labels.instance }}.'
-      histogram_quantile(0.99, rate(etcd_disk_backend_commit_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
+          summary: etcd cluster 99th percentile fsync durations are too high.
-      > 0.25
+        expr: |-
-    for: 10m
+          histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
-    labels:
+          > 1
-      severity: warning
+        for: 10m
-  - alert: etcdDatabaseQuotaLowSpace
+        labels:
-    annotations:
+          severity: critical
-      description: 'etcd cluster "{{ $labels.job }}": database size exceeds the defined
+      - alert: etcdHighCommitDurations
-        quota on etcd instance {{ $labels.instance }}, please defrag or increase the
+        annotations:
-        quota as the writes to etcd will be disabled when it is full.'
+          description:
-      summary: etcd cluster database is running full.
+            'etcd cluster "{{ $labels.job }}": 99th percentile commit durations
-    expr: (last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~".*etcd.*"}[5m]) /
+            {{ $value }}s on etcd instance {{ $labels.instance }}.'
-      last_over_time(etcd_server_quota_backend_bytes{job=~".*etcd.*"}[5m]))*100 >
+          summary: etcd cluster 99th percentile commit durations are too high.
-      95
+        expr: |-
-    for: 10m
+          histogram_quantile(0.99, rate(etcd_disk_backend_commit_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
-    labels:
+          > 0.25
-      severity: critical
+        for: 10m
-  - alert: etcdExcessiveDatabaseGrowth
+        labels:
-    annotations:
+          severity: warning
-      description: 'etcd cluster "{{ $labels.job }}": Predicting running out of disk
+      - alert: etcdDatabaseQuotaLowSpace
-        space in the next four hours, based on write observations within the past
+        annotations:
-        four hours on etcd instance {{ $labels.instance }}, please check as it might
+          description:
-        be disruptive.'
+            'etcd cluster "{{ $labels.job }}": database size exceeds the defined
-      summary: etcd cluster database growing very fast.
+            quota on etcd instance {{ $labels.instance }}, please defrag or increase the
-    expr: predict_linear(etcd_mvcc_db_total_size_in_bytes{job=~".*etcd.*"}[4h], 4*60*60)
+            quota as the writes to etcd will be disabled when it is full.'
-      > etcd_server_quota_backend_bytes{job=~".*etcd.*"}
+          summary: etcd cluster database is running full.
-    for: 10m
+        expr:
-    labels:
+          (last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~".*etcd.*"}[5m]) /
-      severity: warning
+          last_over_time(etcd_server_quota_backend_bytes{job=~".*etcd.*"}[5m]))*100 >
-  - alert: etcdDatabaseHighFragmentationRatio
+          95
-    annotations:
+        for: 10m
-      description: 'etcd cluster "{{ $labels.job }}": database size in use on instance
+        labels:
-        {{ $labels.instance }} is {{ $value | humanizePercentage }} of the actual
+          severity: critical
-        allocated disk space, please run defragmentation (e.g. etcdctl defrag) to
+      - alert: etcdExcessiveDatabaseGrowth
-        retrieve the unused fragmented disk space.'
+        annotations:
-      runbook_url: https://etcd.io/docs/v3.5/op-guide/maintenance/#defragmentation
+          description:
-      summary: etcd database size in use is less than 50% of the actual allocated
+            'etcd cluster "{{ $labels.job }}": Predicting running out of disk
-        storage.
+            space in the next four hours, based on write observations within the past
-    expr: (last_over_time(etcd_mvcc_db_total_size_in_use_in_bytes{job=~".*etcd.*"}[5m])
+            four hours on etcd instance {{ $labels.instance }}, please check as it might
-      / last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~".*etcd.*"}[5m])) < 0.5
+            be disruptive.'
-      and etcd_mvcc_db_total_size_in_use_in_bytes{job=~".*etcd.*"} > 104857600
+          summary: etcd cluster database growing very fast.
-    for: 10m
+        expr:
-    labels:
+          predict_linear(etcd_mvcc_db_total_size_in_bytes{job=~".*etcd.*"}[4h], 4*60*60)
-      severity: warning
+          > etcd_server_quota_backend_bytes{job=~".*etcd.*"}
+        for: 10m
+        labels:
+          severity: warning
+      - alert: etcdDatabaseHighFragmentationRatio
+        annotations:
+          description:
+            'etcd cluster "{{ $labels.job }}": database size in use on instance
+            {{ $labels.instance }} is {{ $value | humanizePercentage }} of the actual
+            allocated disk space, please run defragmentation (e.g. etcdctl defrag) to
+            retrieve the unused fragmented disk space.'
+          runbook_url: https://etcd.io/docs/v3.5/op-guide/maintenance/#defragmentation
+          summary:
+            etcd database size in use is less than 50% of the actual allocated
+            storage.
+        expr:
+          (last_over_time(etcd_mvcc_db_total_size_in_use_in_bytes{job=~".*etcd.*"}[5m])
+          / last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~".*etcd.*"}[5m])) < 0.5
+          and etcd_mvcc_db_total_size_in_use_in_bytes{job=~".*etcd.*"} > 104857600
+        for: 10m
+        labels:
+          severity: warning

rules/general.yaml

@@ -1,43 +1,47 @@
 groups:
-- name: general.rules
+  - name: general.rules
-  rules:
+    rules:
-  - alert: TargetDown
+      - alert: TargetDown
-    annotations:
+        annotations:
-      description: '{{ printf "%.4g" $value }}% of the {{ $labels.job }}/{{ $labels.service
+          description:
-        }} targets in {{ $labels.namespace }} namespace are down.'
+            '{{ printf "%.4g" $value }}% of the {{ $labels.job }}/{{ $labels.service
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/general/targetdown
+            }} targets in {{ $labels.namespace }} namespace are down.'
-      summary: One or more targets are unreachable.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/general/targetdown
-    expr: 100 * (count(up == 0) BY (cluster, job, namespace, service) / count(up)
+          summary: One or more targets are unreachable.
-      BY (cluster, job, namespace, service)) > 10
+        expr:
-    for: 10m
+          100 * (count(up == 0) BY (cluster, job, namespace, service) / count(up)
-    labels:
+          BY (cluster, job, namespace, service)) > 10
-      severity: warning
+        for: 10m
-  - alert: Watchdog
+        labels:
-    annotations:
+          severity: warning
-      description: |
+      - alert: Watchdog
-        This is an alert meant to ensure that the entire alerting pipeline is functional.
+        annotations:
-        This alert is always firing, therefore it should always be firing in Alertmanager
+          description: |
-        and always fire against a receiver. There are integrations with various notification
+            This is an alert meant to ensure that the entire alerting pipeline is functional.
-        mechanisms that send a notification when this alert is not firing. For example the
+            This alert is always firing, therefore it should always be firing in Alertmanager
-        "DeadMansSnitch" integration in PagerDuty.
+            and always fire against a receiver. There are integrations with various notification
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/general/watchdog
+            mechanisms that send a notification when this alert is not firing. For example the
-      summary: An alert that should always be firing to certify that Alertmanager
+            "DeadMansSnitch" integration in PagerDuty.
-        is working properly.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/general/watchdog
-    expr: vector(1)
+          summary:
-    labels:
+            An alert that should always be firing to certify that Alertmanager
-      severity: none
+            is working properly.
-  - alert: InfoInhibitor
+        expr: vector(1)
-    annotations:
+        labels:
-      description: |
+          severity: none
-        This is an alert that is used to inhibit info alerts.
+      - alert: InfoInhibitor
-        By themselves, the info-level alerts are sometimes very noisy, but they are relevant when combined with
+        annotations:
-        other alerts.
+          description: |
-        This alert fires whenever there's a severity="info" alert, and stops firing when another alert with a
+            This is an alert that is used to inhibit info alerts.
-        severity of 'warning' or 'critical' starts firing on the same namespace.
+            By themselves, the info-level alerts are sometimes very noisy, but they are relevant when combined with
-        This alert should be routed to a null receiver and configured to inhibit alerts with severity="info".
+            other alerts.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/general/infoinhibitor
+            This alert fires whenever there's a severity="info" alert, and stops firing when another alert with a
-      summary: Info-level alert inhibition.
+            severity of 'warning' or 'critical' starts firing on the same namespace.
-    expr: ALERTS{severity = "info"} == 1 unless on (namespace) ALERTS{alertname !=
+            This alert should be routed to a null receiver and configured to inhibit alerts with severity="info".
-      "InfoInhibitor", severity =~ "warning|critical", alertstate="firing"} == 1
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/general/infoinhibitor
-    labels:
+          summary: Info-level alert inhibition.
-      severity: none
+        expr:
+          ALERTS{severity = "info"} == 1 unless on (namespace) ALERTS{alertname !=
+          "InfoInhibitor", severity =~ "warning|critical", alertstate="firing"} == 1
+        labels:
+          severity: none

rules/kubernetes-apps.yaml

@@ -1,262 +1,281 @@
 groups:
-- name: kubernetes-apps
+  - name: kubernetes-apps
-  rules:
+    rules:
-  - alert: KubePodCrashLooping
+      - alert: KubePodCrashLooping
-    annotations:
+        annotations:
-      description: 'Pod {{ $labels.namespace }}/{{ $labels.pod }} ({{ $labels.container
+          description:
-        }}) is in waiting state (reason: "CrashLoopBackOff").'
+            'Pod {{ $labels.namespace }}/{{ $labels.pod }} ({{ $labels.container
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodcrashlooping
+            }}) is in waiting state (reason: "CrashLoopBackOff").'
-      summary: Pod is crash looping.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodcrashlooping
-    expr: max_over_time(kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff",
+          summary: Pod is crash looping.
-      job="kube-state-metrics", namespace=~".*"}[5m]) >= 1
+        expr:
-    for: 15m
+          max_over_time(kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff",
-    labels:
+          job="kube-state-metrics", namespace=~".*"}[5m]) >= 1
-      severity: warning
+        for: 15m
-  - alert: KubePodNotReady
+        labels:
-    annotations:
+          severity: warning
-      description: Pod {{ $labels.namespace }}/{{ $labels.pod }} has been in a non-ready
+      - alert: KubePodNotReady
-        state for longer than 15 minutes.
+        annotations:
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodnotready
+          description:
-      summary: Pod has been in a non-ready state for more than 15 minutes.
+            Pod {{ $labels.namespace }}/{{ $labels.pod }} has been in a non-ready
-    expr: |-
+            state for longer than 15 minutes.
-      sum by (namespace, pod, cluster) (
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodnotready
-        max by (namespace, pod, cluster) (
+          summary: Pod has been in a non-ready state for more than 15 minutes.
-          kube_pod_status_phase{job="kube-state-metrics", namespace=~".*", phase=~"Pending|Unknown|Failed"}
+        expr: |-
-        ) * on (namespace, pod, cluster) group_left(owner_kind) topk by (namespace, pod, cluster) (
+          sum by (namespace, pod, cluster) (
-          1, max by (namespace, pod, owner_kind, cluster) (kube_pod_owner{owner_kind!="Job"})
+            max by (namespace, pod, cluster) (
-        )
+              kube_pod_status_phase{job="kube-state-metrics", namespace=~".*", phase=~"Pending|Unknown|Failed"}
-      ) > 0
+            ) * on (namespace, pod, cluster) group_left(owner_kind) topk by (namespace, pod, cluster) (
-    for: 15m
+              1, max by (namespace, pod, owner_kind, cluster) (kube_pod_owner{owner_kind!="Job"})
-    labels:
+            )
-      severity: warning
+          ) > 0
-  - alert: KubeDeploymentGenerationMismatch
+        for: 15m
-    annotations:
+        labels:
-      description: Deployment generation for {{ $labels.namespace }}/{{ $labels.deployment
+          severity: warning
-        }} does not match, this indicates that the Deployment has failed but has not
+      - alert: KubeDeploymentGenerationMismatch
-        been rolled back.
+        annotations:
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentgenerationmismatch
+          description:
-      summary: Deployment generation mismatch due to possible roll-back
+            Deployment generation for {{ $labels.namespace }}/{{ $labels.deployment
-    expr: |-
+            }} does not match, this indicates that the Deployment has failed but has not
-      kube_deployment_status_observed_generation{job="kube-state-metrics", namespace=~".*"}
+            been rolled back.
-        !=
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentgenerationmismatch
-      kube_deployment_metadata_generation{job="kube-state-metrics", namespace=~".*"}
+          summary: Deployment generation mismatch due to possible roll-back
-    for: 15m
+        expr: |-
-    labels:
+          kube_deployment_status_observed_generation{job="kube-state-metrics", namespace=~".*"}
-      severity: warning
-  - alert: KubeDeploymentReplicasMismatch
-    annotations:
-      description: Deployment {{ $labels.namespace }}/{{ $labels.deployment }} has
-        not matched the expected number of replicas for longer than 15 minutes.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentreplicasmismatch
-      summary: Deployment has not matched the expected number of replicas.
-    expr: |-
-      (
-        kube_deployment_spec_replicas{job="kube-state-metrics", namespace=~".*"}
-          >
-        kube_deployment_status_replicas_available{job="kube-state-metrics", namespace=~".*"}
-      ) and (
-        changes(kube_deployment_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m])
-          ==
-        0
-      )
-    for: 15m
-    labels:
-      severity: warning
-  - alert: KubeDeploymentRolloutStuck
-    annotations:
-      description: Rollout of deployment {{ $labels.namespace }}/{{ $labels.deployment
-        }} is not progressing for longer than 15 minutes.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentrolloutstuck
-      summary: Deployment rollout is not progressing.
-    expr: |-
-      kube_deployment_status_condition{condition="Progressing", status="false",job="kube-state-metrics", namespace=~".*"}
-      != 0
-    for: 15m
-    labels:
-      severity: warning
-  - alert: KubeStatefulSetReplicasMismatch
-    annotations:
-      description: StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} has
-        not matched the expected number of replicas for longer than 15 minutes.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetreplicasmismatch
-      summary: StatefulSet has not matched the expected number of replicas.
-    expr: |-
-      (
-        kube_statefulset_status_replicas_ready{job="kube-state-metrics", namespace=~".*"}
-          !=
-        kube_statefulset_status_replicas{job="kube-state-metrics", namespace=~".*"}
-      ) and (
-        changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m])
-          ==
-        0
-      )
-    for: 15m
-    labels:
-      severity: warning
-  - alert: KubeStatefulSetGenerationMismatch
-    annotations:
-      description: StatefulSet generation for {{ $labels.namespace }}/{{ $labels.statefulset
-        }} does not match, this indicates that the StatefulSet has failed but has
-        not been rolled back.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetgenerationmismatch
-      summary: StatefulSet generation mismatch due to possible roll-back
-    expr: |-
-      kube_statefulset_status_observed_generation{job="kube-state-metrics", namespace=~".*"}
-        !=
-      kube_statefulset_metadata_generation{job="kube-state-metrics", namespace=~".*"}
-    for: 15m
-    labels:
-      severity: warning
-  - alert: KubeStatefulSetUpdateNotRolledOut
-    annotations:
-      description: StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} update
-        has not been rolled out.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetupdatenotrolledout
-      summary: StatefulSet update has not been rolled out.
-    expr: |-
-      (
-        max by (namespace, statefulset) (
-          kube_statefulset_status_current_revision{job="kube-state-metrics", namespace=~".*"}
-            unless
-          kube_statefulset_status_update_revision{job="kube-state-metrics", namespace=~".*"}
-        )
-          *
-        (
-          kube_statefulset_replicas{job="kube-state-metrics", namespace=~".*"}
             !=
-          kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}
+          kube_deployment_metadata_generation{job="kube-state-metrics", namespace=~".*"}
-        )
+        for: 15m
-      )  and (
+        labels:
-        changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[5m])
+          severity: warning
-          ==
+      - alert: KubeDeploymentReplicasMismatch
-        0
+        annotations:
-      )
+          description:
-    for: 15m
+            Deployment {{ $labels.namespace }}/{{ $labels.deployment }} has
-    labels:
+            not matched the expected number of replicas for longer than 15 minutes.
-      severity: warning
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentreplicasmismatch
-  - alert: KubeDaemonSetRolloutStuck
+          summary: Deployment has not matched the expected number of replicas.
-    annotations:
+        expr: |-
-      description: DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} has not
+          (
-        finished or progressed for at least 15 minutes.
+            kube_deployment_spec_replicas{job="kube-state-metrics", namespace=~".*"}
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetrolloutstuck
+              >
-      summary: DaemonSet rollout is stuck.
+            kube_deployment_status_replicas_available{job="kube-state-metrics", namespace=~".*"}
-    expr: |-
+          ) and (
-      (
+            changes(kube_deployment_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m])
-        (
+              ==
-          kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+            0
-           !=
+          )
+        for: 15m
+        labels:
+          severity: warning
+      - alert: KubeDeploymentRolloutStuck
+        annotations:
+          description:
+            Rollout of deployment {{ $labels.namespace }}/{{ $labels.deployment
+            }} is not progressing for longer than 15 minutes.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentrolloutstuck
+          summary: Deployment rollout is not progressing.
+        expr: |-
+          kube_deployment_status_condition{condition="Progressing", status="false",job="kube-state-metrics", namespace=~".*"}
+          != 0
+        for: 15m
+        labels:
+          severity: warning
+      - alert: KubeStatefulSetReplicasMismatch
+        annotations:
+          description:
+            StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} has
+            not matched the expected number of replicas for longer than 15 minutes.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetreplicasmismatch
+          summary: StatefulSet has not matched the expected number of replicas.
+        expr: |-
+          (
+            kube_statefulset_status_replicas_ready{job="kube-state-metrics", namespace=~".*"}
+              !=
+            kube_statefulset_status_replicas{job="kube-state-metrics", namespace=~".*"}
+          ) and (
+            changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m])
+              ==
+            0
+          )
+        for: 15m
+        labels:
+          severity: warning
+      - alert: KubeStatefulSetGenerationMismatch
+        annotations:
+          description:
+            StatefulSet generation for {{ $labels.namespace }}/{{ $labels.statefulset
+            }} does not match, this indicates that the StatefulSet has failed but has
+            not been rolled back.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetgenerationmismatch
+          summary: StatefulSet generation mismatch due to possible roll-back
+        expr: |-
+          kube_statefulset_status_observed_generation{job="kube-state-metrics", namespace=~".*"}
+            !=
+          kube_statefulset_metadata_generation{job="kube-state-metrics", namespace=~".*"}
+        for: 15m
+        labels:
+          severity: warning
+      - alert: KubeStatefulSetUpdateNotRolledOut
+        annotations:
+          description:
+            StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} update
+            has not been rolled out.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetupdatenotrolledout
+          summary: StatefulSet update has not been rolled out.
+        expr: |-
+          (
+            max by (namespace, statefulset) (
+              kube_statefulset_status_current_revision{job="kube-state-metrics", namespace=~".*"}
+                unless
+              kube_statefulset_status_update_revision{job="kube-state-metrics", namespace=~".*"}
+            )
+              *
+            (
+              kube_statefulset_replicas{job="kube-state-metrics", namespace=~".*"}
+                !=
+              kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}
+            )
+          )  and (
+            changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[5m])
+              ==
+            0
+          )
+        for: 15m
+        labels:
+          severity: warning
+      - alert: KubeDaemonSetRolloutStuck
+        annotations:
+          description:
+            DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} has not
+            finished or progressed for at least 15 minutes.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetrolloutstuck
+          summary: DaemonSet rollout is stuck.
+        expr: |-
+          (
+            (
+              kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+               !=
+              kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+            ) or (
+              kube_daemonset_status_number_misscheduled{job="kube-state-metrics", namespace=~".*"}
+               !=
+              0
+            ) or (
+              kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+               !=
+              kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+            ) or (
+              kube_daemonset_status_number_available{job="kube-state-metrics", namespace=~".*"}
+               !=
+              kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+            )
+          ) and (
+            changes(kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"}[5m])
+              ==
+            0
+          )
+        for: 15m
+        labels:
+          severity: warning
+      - alert: KubeContainerWaiting
+        annotations:
+          description:
+            pod/{{ $labels.pod }} in namespace {{ $labels.namespace }} on container
+            {{ $labels.container}} has been in waiting state for longer than 1 hour.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontainerwaiting
+          summary: Pod container waiting longer than 1 hour
+        expr:
+          sum by (namespace, pod, container, cluster) (kube_pod_container_status_waiting_reason{job="kube-state-metrics",
+          namespace=~".*"}) > 0
+        for: 1h
+        labels:
+          severity: warning
+      - alert: KubeDaemonSetNotScheduled
+        annotations:
+          description:
+            "{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset
+            }} are not scheduled."
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetnotscheduled
+          summary: DaemonSet pods are not scheduled.
+        expr: |-
           kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
-        ) or (
+            -
+          kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"} > 0
+        for: 10m
+        labels:
+          severity: warning
+      - alert: KubeDaemonSetMisScheduled
+        annotations:
+          description:
+            "{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset
+            }} are running where they are not supposed to run."
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetmisscheduled
+          summary: DaemonSet pods are misscheduled.
+        expr:
           kube_daemonset_status_number_misscheduled{job="kube-state-metrics", namespace=~".*"}
-           !=
+          > 0
-          0
+        for: 15m
-        ) or (
+        labels:
-          kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+          severity: warning
-           !=
+      - alert: KubeJobNotCompleted
-          kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+        annotations:
-        ) or (
+          description:
-          kube_daemonset_status_number_available{job="kube-state-metrics", namespace=~".*"}
+            Job {{ $labels.namespace }}/{{ $labels.job_name }} is taking more
-           !=
+            than {{ "43200" | humanizeDuration }} to complete.
-          kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobnotcompleted
-        )
+          summary: Job did not complete in time
-      ) and (
+        expr: |-
-        changes(kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"}[5m])
+          time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
-          ==
+            and
-        0
+          kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
-      )
+        labels:
-    for: 15m
+          severity: warning
-    labels:
+      - alert: KubeJobFailed
-      severity: warning
+        annotations:
-  - alert: KubeContainerWaiting
+          description:
-    annotations:
+            Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to complete.
-      description: pod/{{ $labels.pod }} in namespace {{ $labels.namespace }} on container
+            Removing failed job after investigation should clear this alert.
-        {{ $labels.container}} has been in waiting state for longer than 1 hour.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobfailed
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontainerwaiting
+          summary: Job failed to complete.
-      summary: Pod container waiting longer than 1 hour
+        expr: kube_job_failed{job="kube-state-metrics", namespace=~".*"}  > 0
-    expr: sum by (namespace, pod, container, cluster) (kube_pod_container_status_waiting_reason{job="kube-state-metrics",
+        for: 15m
-      namespace=~".*"}) > 0
+        labels:
-    for: 1h
+          severity: warning
-    labels:
+      - alert: KubeHpaReplicasMismatch
-      severity: warning
+        annotations:
-  - alert: KubeDaemonSetNotScheduled
+          description:
-    annotations:
+            HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler  }}
-      description: '{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset
+            has not matched the desired number of replicas for longer than 15 minutes.
-        }} are not scheduled.'
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpareplicasmismatch
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetnotscheduled
+          summary: HPA has not matched desired number of replicas.
-      summary: DaemonSet pods are not scheduled.
+        expr: |-
-    expr: |-
+          (kube_horizontalpodautoscaler_status_desired_replicas{job="kube-state-metrics", namespace=~".*"}
-      kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
+            !=
-        -
+          kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"})
-      kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"} > 0
+            and
-    for: 10m
+          (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
-    labels:
+            >
-      severity: warning
+          kube_horizontalpodautoscaler_spec_min_replicas{job="kube-state-metrics", namespace=~".*"})
-  - alert: KubeDaemonSetMisScheduled
+            and
-    annotations:
+          (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
-      description: '{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset
+            <
-        }} are running where they are not supposed to run.'
+          kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"})
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetmisscheduled
+            and
-      summary: DaemonSet pods are misscheduled.
+          changes(kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}[15m]) == 0
-    expr: kube_daemonset_status_number_misscheduled{job="kube-state-metrics", namespace=~".*"}
+        for: 15m
-      > 0
+        labels:
-    for: 15m
+          severity: warning
-    labels:
+      - alert: KubeHpaMaxedOut
-      severity: warning
+        annotations:
-  - alert: KubeJobNotCompleted
+          description:
-    annotations:
+            HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler  }}
-      description: Job {{ $labels.namespace }}/{{ $labels.job_name }} is taking more
+            has been running at max replicas for longer than 15 minutes.
-        than {{ "43200" | humanizeDuration }} to complete.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpamaxedout
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobnotcompleted
+          summary: HPA is running at max replicas
-      summary: Job did not complete in time
+        expr: |-
-    expr: |-
+          kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
-      time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
+            ==
-        and
+          kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"}
-      kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
+        for: 15m
-    labels:
+        labels:
-      severity: warning
+          severity: warning
-  - alert: KubeJobFailed
-    annotations:
-      description: Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to complete.
-        Removing failed job after investigation should clear this alert.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobfailed
-      summary: Job failed to complete.
-    expr: kube_job_failed{job="kube-state-metrics", namespace=~".*"}  > 0
-    for: 15m
-    labels:
-      severity: warning
-  - alert: KubeHpaReplicasMismatch
-    annotations:
-      description: HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler  }}
-        has not matched the desired number of replicas for longer than 15 minutes.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpareplicasmismatch
-      summary: HPA has not matched desired number of replicas.
-    expr: |-
-      (kube_horizontalpodautoscaler_status_desired_replicas{job="kube-state-metrics", namespace=~".*"}
-        !=
-      kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"})
-        and
-      (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
-        >
-      kube_horizontalpodautoscaler_spec_min_replicas{job="kube-state-metrics", namespace=~".*"})
-        and
-      (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
-        <
-      kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"})
-        and
-      changes(kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}[15m]) == 0
-    for: 15m
-    labels:
-      severity: warning
-  - alert: KubeHpaMaxedOut
-    annotations:
-      description: HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler  }}
-        has been running at max replicas for longer than 15 minutes.
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpamaxedout
-      summary: HPA is running at max replicas
-    expr: |-
-      kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
-        ==
-      kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"}
-    for: 15m
-    labels:
-      severity: warning

rules/kubernetes-resources.yaml

@@ -1,115 +1,123 @@
 groups:
-- name: kubernetes-resources
+  - name: kubernetes-resources
-  rules:
+    rules:
-  - alert: KubeCPUOvercommit
+      - alert: KubeCPUOvercommit
-    annotations:
+        annotations:
-      description: Cluster {{ $labels.cluster }} has overcommitted CPU resource requests
+          description:
-        for Pods by {{ $value }} CPU shares and cannot tolerate node failure.
+            Cluster {{ $labels.cluster }} has overcommitted CPU resource requests
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuovercommit
+            for Pods by {{ $value }} CPU shares and cannot tolerate node failure.
-      summary: Cluster has overcommitted CPU resource requests.
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuovercommit
-    expr: |-
+          summary: Cluster has overcommitted CPU resource requests.
-      sum(namespace_cpu:kube_pod_container_resource_requests:sum{}) by (cluster) - (sum(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster) - max(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster)) > 0
+        expr: |-
-      and
+          sum(namespace_cpu:kube_pod_container_resource_requests:sum{}) by (cluster) - (sum(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster) - max(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster)) > 0
-      (sum(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster) - max(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster)) > 0
+          and
-    for: 10m
+          (sum(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster) - max(kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) by (cluster)) > 0
-    labels:
+        for: 10m
-      severity: warning
+        labels:
-  - alert: KubeMemoryOvercommit
+          severity: warning
-    annotations:
+      - alert: KubeMemoryOvercommit
-      description: Cluster {{ $labels.cluster }} has overcommitted memory resource
+        annotations:
-        requests for Pods by {{ $value | humanize }} bytes and cannot tolerate node
+          description:
-        failure.
+            Cluster {{ $labels.cluster }} has overcommitted memory resource
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryovercommit
+            requests for Pods by {{ $value | humanize }} bytes and cannot tolerate node
-      summary: Cluster has overcommitted memory resource requests.
+            failure.
-    expr: |-
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryovercommit
-      sum(namespace_memory:kube_pod_container_resource_requests:sum{}) by (cluster) - (sum(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster) - max(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster)) > 0
+          summary: Cluster has overcommitted memory resource requests.
-      and
+        expr: |-
-      (sum(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster) - max(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster)) > 0
+          sum(namespace_memory:kube_pod_container_resource_requests:sum{}) by (cluster) - (sum(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster) - max(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster)) > 0
-    for: 10m
+          and
-    labels:
+          (sum(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster) - max(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster)) > 0
-      severity: warning
+        for: 10m
-  - alert: KubeCPUQuotaOvercommit
+        labels:
-    annotations:
+          severity: warning
-      description: Cluster {{ $labels.cluster }}  has overcommitted CPU resource requests
+      - alert: KubeCPUQuotaOvercommit
-        for Namespaces.
+        annotations:
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuquotaovercommit
+          description:
-      summary: Cluster has overcommitted CPU resource requests.
+            Cluster {{ $labels.cluster }}  has overcommitted CPU resource requests
-    expr: |-
+            for Namespaces.
-      sum(min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(cpu|requests.cpu)"})) by (cluster)
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuquotaovercommit
-        /
+          summary: Cluster has overcommitted CPU resource requests.
-      sum(kube_node_status_allocatable{resource="cpu", job="kube-state-metrics"}) by (cluster)
+        expr: |-
-        > 1.5
+          sum(min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(cpu|requests.cpu)"})) by (cluster)
-    for: 5m
+            /
-    labels:
+          sum(kube_node_status_allocatable{resource="cpu", job="kube-state-metrics"}) by (cluster)
-      severity: warning
+            > 1.5
-  - alert: KubeMemoryQuotaOvercommit
+        for: 5m
-    annotations:
+        labels:
-      description: Cluster {{ $labels.cluster }}  has overcommitted memory resource
+          severity: warning
-        requests for Namespaces.
+      - alert: KubeMemoryQuotaOvercommit
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryquotaovercommit
+        annotations:
-      summary: Cluster has overcommitted memory resource requests.
+          description:
-    expr: |-
+            Cluster {{ $labels.cluster }}  has overcommitted memory resource
-      sum(min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(memory|requests.memory)"})) by (cluster)
+            requests for Namespaces.
-        /
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryquotaovercommit
-      sum(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster)
+          summary: Cluster has overcommitted memory resource requests.
-        > 1.5
+        expr: |-
-    for: 5m
+          sum(min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(memory|requests.memory)"})) by (cluster)
-    labels:
+            /
-      severity: warning
+          sum(kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}) by (cluster)
-  - alert: KubeQuotaAlmostFull
+            > 1.5
-    annotations:
+        for: 5m
-      description: Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage
+        labels:
-        }} of its {{ $labels.resource }} quota.
+          severity: warning
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaalmostfull
+      - alert: KubeQuotaAlmostFull
-      summary: Namespace quota is going to be full.
+        annotations:
-    expr: |-
+          description:
-      kube_resourcequota{job="kube-state-metrics", type="used"}
+            Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage
-        / ignoring(instance, job, type)
+            }} of its {{ $labels.resource }} quota.
-      (kube_resourcequota{job="kube-state-metrics", type="hard"} > 0)
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaalmostfull
-        > 0.9 < 1
+          summary: Namespace quota is going to be full.
-    for: 15m
+        expr: |-
-    labels:
+          kube_resourcequota{job="kube-state-metrics", type="used"}
-      severity: info
+            / ignoring(instance, job, type)
-  - alert: KubeQuotaFullyUsed
+          (kube_resourcequota{job="kube-state-metrics", type="hard"} > 0)
-    annotations:
+            > 0.9 < 1
-      description: Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage
+        for: 15m
-        }} of its {{ $labels.resource }} quota.
+        labels:
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotafullyused
+          severity: info
-      summary: Namespace quota is fully used.
+      - alert: KubeQuotaFullyUsed
-    expr: |-
+        annotations:
-      kube_resourcequota{job="kube-state-metrics", type="used"}
+          description:
-        / ignoring(instance, job, type)
+            Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage
-      (kube_resourcequota{job="kube-state-metrics", type="hard"} > 0)
+            }} of its {{ $labels.resource }} quota.
-        == 1
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotafullyused
-    for: 15m
+          summary: Namespace quota is fully used.
-    labels:
+        expr: |-
-      severity: info
+          kube_resourcequota{job="kube-state-metrics", type="used"}
-  - alert: KubeQuotaExceeded
+            / ignoring(instance, job, type)
-    annotations:
+          (kube_resourcequota{job="kube-state-metrics", type="hard"} > 0)
-      description: Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage
+            == 1
-        }} of its {{ $labels.resource }} quota.
+        for: 15m
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaexceeded
+        labels:
-      summary: Namespace quota has exceeded the limits.
+          severity: info
-    expr: |-
+      - alert: KubeQuotaExceeded
-      kube_resourcequota{job="kube-state-metrics", type="used"}
+        annotations:
-        / ignoring(instance, job, type)
+          description:
-      (kube_resourcequota{job="kube-state-metrics", type="hard"} > 0)
+            Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage
-        > 1
+            }} of its {{ $labels.resource }} quota.
-    for: 15m
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaexceeded
-    labels:
+          summary: Namespace quota has exceeded the limits.
-      severity: warning
+        expr: |-
-  - alert: CPUThrottlingHigh
+          kube_resourcequota{job="kube-state-metrics", type="used"}
-    annotations:
+            / ignoring(instance, job, type)
-      description: '{{ $value | humanizePercentage }} throttling of CPU in namespace
+          (kube_resourcequota{job="kube-state-metrics", type="hard"} > 0)
-        {{ $labels.namespace }} for container {{ $labels.container }} in pod {{ $labels.pod
+            > 1
-        }}.'
+        for: 15m
-      runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/cputhrottlinghigh
+        labels:
-      summary: Processes experience elevated CPU throttling.
+          severity: warning
-    expr: |-
+      - alert: CPUThrottlingHigh
-      sum(increase(container_cpu_cfs_throttled_periods_total{container!="", }[5m])) by (cluster, container, pod, namespace)
+        annotations:
-        /
+          description:
-      sum(increase(container_cpu_cfs_periods_total{}[5m])) by (cluster, container, pod, namespace)
+            "{{ $value | humanizePercentage }} throttling of CPU in namespace
-        > ( 25 / 100 )
+            {{ $labels.namespace }} for container {{ $labels.container }} in pod {{ $labels.pod
-    for: 15m
+            }}."
-    labels:
+          runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/cputhrottlinghigh
-      severity: info
+          summary: Processes experience elevated CPU throttling.
+        expr: |-
+          sum(increase(container_cpu_cfs_throttled_periods_total{container!="", }[5m])) by (cluster, container, pod, namespace)
+            /
+          sum(increase(container_cpu_cfs_periods_total{}[5m])) by (cluster, container, pod, namespace)
+            > ( 25 / 100 )
+        for: 15m
+        labels:
+          severity: info