Update Helm release cloudnative-pg to v0.29.0

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.24.1
+version: v2.17.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.24.1
+appVersion: v2.17.1
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.24.1
+  tag: v2.17.1
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v2.24.1
+version: v2.17.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v2.24.1"
+appVersion: "v2.17.1"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v2.24.1
+  tag: v2.17.1
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.24.1
+version: v2.17.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.24.1
+appVersion: v2.17.1
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v2.24.1
+  tag: v2.17.1
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 10.2.2
+  version: 9.5.21
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 1.0.19
+  version: 1.0.18
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests

helmfile.d/ingress-haproxy.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: ingress-haproxy
   namespace: ingress-haproxy
   chart: haproxytech/kubernetes-ingress
-  version: 1.52.1
+  version: 1.52.0
   condition: haproxy.enabled
   values:
   - ../values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.3.10
+  version: 0.3.9
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/postgres-operator.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: postgres-operator
   namespace: cnpg
   chart: cloudnative-pg/cloudnative-pg
-  version: 0.28.2
+  version: 0.29.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/postgres-operator.yaml.gotmpl
@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
   namespace: cnpg
   chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.7.0
+  version: 0.6.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 86.3.2
+  version: 86.2.0
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/proteus.yaml.gotmpl

@@ -15,7 +15,6 @@ releases:
   - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
   - ../values/proteus/env.yaml.gotmpl
   - ../values/proteus/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  - ../values/proteus/values/values-staging.yaml
   hooks:
   - events: [ prepare, cleanup ]
     showlogs: true

helmfile.d/spegel.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: spegel
   namespace: spegel
   chart: spegel/spegel
-  version: 0.7.3
+  version: 0.7.1
   condition: spegel.enabled
   values:
   - ../values/spegel/values/spegel.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.10.10
+  version: 7.9.4
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/uptermd.yaml.gotmpl

@@ -1,43 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-repositories:
-- name: upterm
-  url: https://upterm.dev
-
-commonLabels:
-  tier: system
-
-releases:
-- name: uptermd
-  namespace: uptermd
-  chart: upterm/uptermd
-  version: 0.2.0
-  condition: uptermd.enabled
-  values:
-  - ../values/uptermd/values/values.yaml
-  - ../values/uptermd/values/values-{{ .Environment.Name }}.yaml
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/uptermd/kustomize/{{ .Environment.Name }}
-  missingFileHandler: Info
-- name: manifests
-  namespace: uptermd
-  chart: manifests
-  condition: uptermd.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/uptermd/env.yaml.gotmpl
-  - ../values/uptermd/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/uptermd/manifests
-    - manifests

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 12.1.0
+  version: 12.0.3
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

values/argo/env.yaml.gotmpl

@@ -27,6 +27,5 @@ argocd:
     image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
     imagePullSecrets:
       - gitlab-pull-secret
-  webhookSecret: ""
   additional_rbac_settings:
   - g, "eb17a659-4ce6-41bc-9153-d9b117c44479", role:org-admin

values/argo/values/argocd.yaml.gotmpl

@@ -49,8 +49,8 @@ configs:
         name: {{ .name }}
         config:
           issuer: https://login.microsoftonline.com/{{ .tenant }}/v2.0
-          clientID: ${{ .secret_ref.name }}:client_id
+          clientID: ${{ .name | replace "-" "_" }}_client_id
-          clientSecret: ${{ .secret_ref.name }}:client_secret
+          clientSecret: ${{ .name | replace "-" "_" }}_client_secret
           insecureSkipEmailVerified: true
           requestedIDTokenClaims:
             groups:
@@ -62,7 +62,7 @@ configs:
             - email
             - groups
       staticClients:
-      - id: ${{ .secret_ref.name }}:client_id
+      - id: ${{ .name | replace "-" "_" }}_client_id
         name: Kubernetes
         # These are kubectl oidc plugin internal URLs
         redirectURIs:
@@ -99,11 +99,6 @@ configs:
     argo-helm:
       type: helm
       url: https://argoproj.github.io/argo-helm
-  {{- if .Values.argocd.webhookSecret }}
-  secret:
-    extra:
-      webhook.gitea.secret: {{ .Values.argocd.webhookSecret }}
-  {{- end }}
   # UI changes based on env
   styles: |
     /* blue, orange, red depending on env */
@@ -134,11 +129,29 @@ controller:
       cpu: {{ .Values.argocd.resources.controller.cpu  | default "250m" }}
       memory: {{ .Values.argocd.resources.controller.memory  | default "1000Mi" }}
 
+# Mount azure ca as file for SAML auth
 dex:
   metrics:
     enabled: true
     serviceMonitor:
       enabled: true
+  {{- with .Values.clusterConfig.oidc }}
+  env:
+  {{- range . }}
+  {{- if eq .group "devel" }}
+  - name: {{ .name | replace "-" "_" }}_client_secret
+    valueFrom:
+      secretKeyRef:
+        name: {{ .secret_ref.name }}
+        key: client_secret
+  - name: {{ .name | replace "-" "_" }}_client_id
+    valueFrom:
+      secretKeyRef:
+        name: {{ .secret_ref.name }}
+        key: client_id
+  {{- end }}
+  {{- end }}
+  {{- end }}
 
 redis:
   metrics:

values/atlantis/kustomize/staging/actor-config.yaml

@@ -3,6 +3,10 @@ kind: ConfigMap
 metadata:
   name: staging-atlantis-actor-config
 data:
-  TEMPORAL_ADDRESS: "temporal-grpc.ekman.oceanbox.io:443"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.5.1"
-  TEMPORAL_TLS: "true"
+  XTRACT_QUEUE: "dev-queue"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.5.1"
+  PLUME_QUEUE: "dev-queue"
+  TEMPORAL_ADDRESS: "temporal-frontend.temporal:7233"
   TEMPORAL_NAMESPACE: "staging-atlantis"
+  TEMPORAL_TASK_QUEUE: "atlantis"

values/atlantis/manifests/network/allow-temporal.yaml

@@ -1,18 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-temporal
-  namespace: {{ .Release.Namespace }}
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: atlantis
-  egress:
-  - toFQDNs:
-    - matchName: temporal-grpc.ekman.oceanbox.io
-    toPorts:
-    - ports:
-      - port: "443"
-        protocol: TCP
-{{- end }}

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: 506ec0b2-debug
+  tag: 6442206c-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/codex/values/values-staging.yaml

@@ -38,4 +38,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: 7a4a367d-debug
+  tag: 6442206c-debug

values/docs/values/values-staging.yaml

@@ -1,6 +1,6 @@
 fullnameOverride: staging-docs
 image:
-  tag: "511c128c-debug"
+  tag: "72b01c0b-debug"
 ingress:
   enabled: true
   className: "haproxy"

values/gitea/values/values.yaml

@@ -3,7 +3,7 @@ replicaCount: 1
 image:
   registry: "docker.gitea.com"
   repository: gitea
-  tag: "1.26.4"
+  tag: "1.26.2"
 
 resources:
   requests:
@@ -75,11 +75,10 @@ gitea:
       USERNAME: "nickname"
     mailer:
       ENABLED: true
-      FROM: "\"Oceanbox Gitea\" <no-reply@oceanbox.io>"
+      FROM: "gitea@oceanbox.io"
-      PROTOCOL: "smtp+starttls"
+      PROTOCOL: "smtp"
-      SMTP_ADDR: "mx.itpartner.no"
+      SMTP_ADDR: "postfix-mail.postfix.svc.cluster.local"
       SMTP_PORT: 587
-      USER: "no-reply@oceanbox.io"
     database:
       DB_TYPE: postgres
       MAX_OPEN_CONNS: 90
@@ -105,11 +104,6 @@ gitea:
         secretKeyRef:
           name: gitea-s3
           key: secret_key
-    - name: GITEA__mailer__PASSWD
-      valueFrom:
-        secretKeyRef:
-          name: gitea-smtp
-          key: password
     - name: GITEA__DATABASE__PASSWD
       valueFrom:
         secretKeyRef:

values/headscale/values/values.yaml

@@ -118,7 +118,6 @@ configMaps:
               "elianne.ersdal@oceanbox.io",
               "hanskristian.djuve@oceanbox.io",
               "erlend.mundal@oceanbox.io",
-              "hanna.fagrell@oceanbox.io",
             ],
             "group:manager": [
               "svenn.hanssen@oceanbox.io",
@@ -131,6 +130,7 @@ configMaps:
             "group:intern": [
               "haavahak@stud.ntnu.no",
               "haavahak@ntnu.no",
+              "hanna.fagrell@oceanbox.io",
             ],
             "group:ceph": [
               "jonas.juselius@oceanbox.io",

values/ingest/manifests/workerdeployment-py.yaml

@@ -19,7 +19,7 @@ spec:
         runAsGroup: 0
       containers:
         - name: ingest-py
-          image: git.oceanbox.io/oceanbox/churn/ingest-py:v0.1.6
+          image: git.oceanbox.io/oceanbox/churn/ingest-py:v2.3.11
           resources:
             requests:
               memory: 512Mi

values/ingest/manifests/workerdeployment.yaml

@@ -19,7 +19,7 @@ spec:
         runAsGroup: 0
       containers:
         - name: ingest
-          image: git.oceanbox.io/oceanbox/churn/ingest:v0.1.6
+          image: git.oceanbox.io/oceanbox/churn/ingest:v2.3.11
           resources:
             requests:
               memory: 512Mi

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "53080907-debug"
+  tag: "7080a0bd-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/proteus/manifests/network.yaml

@@ -16,6 +16,9 @@ spec:
     - ports:
       - port: "7233"
         protocol: TCP
+  # k8s API server (for batch/v1 Job create/poll/delete)
+  - toEntities:
+    - kube-apiserver
   # DNS
   - toEndpoints:
     - matchLabels:
@@ -27,11 +30,15 @@ spec:
         protocol: UDP
       - port: "53"
         protocol: TCP
-  # OTel collector (tos1 LoadBalancer 10.255.241.12) for Temporal traces, exported cross-cluster
+  # RabbitMQ on oceanbox: NodePorts (30672/31672) or MetalLB IPs on standard port 5672
   - toCIDR:
-    - 10.255.241.12/32
+    - 10.255.241.0/24
     toPorts:
     - ports:
-      - port: "4317"
+      - port: "5672"
+        protocol: TCP
+      - port: "30672"
+        protocol: TCP
+      - port: "31672"
         protocol: TCP
 {{- end }}

values/proteus/manifests/pvc.yaml

@@ -1,37 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-proteus-ceph-archives
-spec:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-proteus-ceph-archives
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: proteus-ceph-archives
-  namespace: proteus
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-proteus-ceph-archives

values/proteus/manifests/rbac.yaml

@@ -0,0 +1,55 @@
+# TODO: the SA the temporal-worker-controller assigns to the pod (assumed `default`).
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-dev-queue
+  namespace: dev-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-dev-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: proteus-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: proteus-prod-queue
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: proteus

values/proteus/manifests/workerdeployment.yaml

@@ -1,10 +1,14 @@
+# TEMPORAL_NAMESPACE  : {env}-atlantis
+# ARCHIVE_PVC                             : the queue's archive PVC (prod+beta -> prod-queue, staging -> dev-queue)
+# Status/inbox/quota now flow via Temporal activities to the Atlantis notify worker; no RabbitMQ.
+# ---
 # apiVersion: temporal.io/v1alpha1
 # kind: WorkerDeployment
 # metadata:
 #   name: proteus-prod
 #   namespace: proteus
 # spec:
-#   replicas: 2
+#   replicas: 1
 #   workerOptions:
 #     temporalNamespace: prod-atlantis
 #     connectionRef:
@@ -17,20 +21,14 @@
 #       securityContext:
 #         runAsUser: 0
 #         runAsGroup: 0
-#       volumes:
-#         - name: archives
-#           persistentVolumeClaim:
-#             claimName: proteus-ceph-archives
 #       containers:
 #         - name: proteus
-#           image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
+#           image: git.oceanbox.io/oceanbox/poseidon/proteus:CHANGEME
 #           resources:
 #             requests:
-#               cpu: "1"
+#               memory: 256Mi
-#               memory: 1Gi
 #             limits:
-#               cpu: "2"
+#               memory: 1Gi
-#               memory: 4Gi
 #           env:
 #             - name: TEMPORAL_TASK_QUEUES
 #               value: plume,xtract
@@ -40,32 +38,6 @@
 #               value: prod
 #             - name: ARCHIVE_PVC
 #               value: prod-queue-ceph-archives
-#             - name: MAX_CONCURRENT_ACTIVITIES
-#               value: "2"
-#             - name: OTEL_EXPORTER_OTLP_ENDPOINT
-#               value: http://10.255.241.12:4317
-#           volumeMounts:
-#             - name: archives
-#               mountPath: /data
-#           ports:
-#             - name: health
-#               containerPort: 8080
-#           livenessProbe:
-#             httpGet:
-#               path: /healthz
-#               port: health
-#             initialDelaySeconds: 20
-#             periodSeconds: 15
-#             timeoutSeconds: 5
-#             failureThreshold: 6
-#           readinessProbe:
-#             httpGet:
-#               path: /readyz
-#               port: health
-#             initialDelaySeconds: 5
-#             periodSeconds: 15
-#             timeoutSeconds: 5
-#             failureThreshold: 3
 # ---
 # apiVersion: temporal.io/v1alpha1
 # kind: WorkerDeployment
@@ -101,9 +73,10 @@
 #               value: beta-atlantis
 #             - name: APP_ENV
 #               value: beta
+#             # beta schedules into prod-queue (same as prod), so the same archive PVC.
 #             - name: ARCHIVE_PVC
 #               value: prod-queue-ceph-archives
----
+# ---
 apiVersion: temporal.io/v1alpha1
 kind: WorkerDeployment
 metadata:
@@ -123,48 +96,20 @@ spec:
       securityContext:
         runAsUser: 0
         runAsGroup: 0
-      volumes:
-        - name: archives
-          persistentVolumeClaim:
-            claimName: proteus-ceph-archives
       containers:
         - name: proteus
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: git.oceanbox.io/oceanbox/poseidon/proteus:v2.17.0
           resources:
             requests:
-              cpu: 500m
+              memory: 256Mi
-              memory: 1Gi
             limits:
-              cpu: "2"
+              memory: 1Gi
-              memory: 4Gi
           env:
             - name: TEMPORAL_TASK_QUEUES
               value: plume,xtract
             - name: TEMPORAL_NAMESPACE
               value: staging-atlantis
-            - name: MAX_CONCURRENT_ACTIVITIES
+            - name: APP_ENV
-              value: "10"
+              value: staging
-            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+            - name: ARCHIVE_PVC
-              value: http://10.255.241.12:4317
+              value: dev-queue-ceph-archives
-          volumeMounts:
-            - name: archives
-              mountPath: /data
-          ports:
-            - name: health
-              containerPort: 8080
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: health
-            initialDelaySeconds: 20
-            periodSeconds: 15
-            timeoutSeconds: 5
-            failureThreshold: 6
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: health
-            initialDelaySeconds: 5
-            periodSeconds: 15
-            timeoutSeconds: 5
-            failureThreshold: 3

values/proteus/values/values-staging.yaml

@@ -1,3 +0,0 @@
-image:
-  repository: git.oceanbox.io/oceanbox/poseidon/proteus
-  tag: 7a4a367d-debug

values/sorcerer/kustomize/staging-ekman/deployment_patch.yaml

@@ -22,4 +22,9 @@
   value:
     secretRef:
       name: staging-sorcerer-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: staging-sorcerer-kueue-config
 

values/sorcerer/kustomize/staging-ekman/kueue-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: staging-sorcerer-kueue-config
+data:
+  KUEUE_NAMESPACE: "dev-queue"
+  KUEUE_ARCHIVE_PVC: "dev-queue-ceph-archives"

values/sorcerer/kustomize/staging-ekman/kustomization.yaml

@@ -19,6 +19,7 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
+- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/staging-ekman/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - staging-sorcerer-appsettings
+  - staging-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -23,6 +24,24 @@ rules:
   verbs:
   - get
   - watch
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

values/sorcerer/values/values-staging.yaml

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: 7a4a367d-debug
+  tag: 6442206c-debug
 podAnnotations:
   dapr.io/enabled: "true"
   dapr.io/app-id: "staging-sorcerer"

values/system/hel1/network/allow-itpartner-mail-egress.yaml

@@ -1,17 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-itpartner-mail-egress
-spec:
-  endpointSelector: {}
-  egress:
-  - toFQDNs:
-    - matchName: mx.itpartner.no
-    toPorts:
-    - ports:
-      - port: "587"
-        protocol: TCP
-      - port: "465"
-        protocol: TCP
-{{- end }}

values/temporal/env-ekman.yaml.gotmpl

@@ -1,6 +1,6 @@
 temporal:
   enabled: true
-  autosync: true
+  autosync: false
   ingress: true
   grpcIngress: true
   workerController: true

values/temporal/manifests/ingress.yaml

@@ -8,8 +8,6 @@ metadata:
     cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "24k"
     oceanbox.io/expose: internal
   labels:
     app.kubernetes.io/name: temporal

values/temporal/manifests/network/temporal-policies.yaml

@@ -60,19 +60,4 @@ spec:
         protocol: UDP
       - port: "53"
         protocol: TCP
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-web-oidc-login
-  namespace: temporal
-spec:
-  description: Allow Temporal Web UI OIDC login to Entra ID
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: web
-  egress:
-  - toFQDNs:
-    - matchName: login.microsoftonline.com
-    - matchPattern: '*.microsoftonline.com'
 {{- end }}

values/temporal/manifests/temporal-db.yaml

@@ -12,20 +12,9 @@ spec:
     initdb:
       database: temporal
       owner: temporal
-  # headroom for ~240 server connections (30/pod x 8 pods) plus CNPG's own
-  postgresql:
-    parameters:
-      max_connections: "300"
-  resources:
-    requests:
-      cpu: 500m
-      memory: 1Gi
-    limits:
-      cpu: "2"
-      memory: 2Gi
   storage:
     resizeInUseVolumes: true
-    size: 20Gi
+    size: 10Gi
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: Database

values/temporal/values/temporal.yaml

@@ -1,11 +1,8 @@
 server:
-  replicaCount: 2
   config:
-    logLevel: "info"
     persistence:
       defaultStore: default
       visibilityStore: visibility
-      # immutable after first deploy
       numHistoryShards: 512
       datastores:
         default:
@@ -23,7 +20,7 @@ server:
             maxConns: 20
             maxIdleConns: 20
             maxConnLifetime: "1h"
-        # NOTE: Postgres 12+ gives advanced visibility; no Elasticsearch needed.
+        # TODO: migrate visibility to Elasticsearch for advanced visibility search.
         visibility:
           sql:
             createDatabase: false
@@ -44,129 +41,8 @@ server:
         timerType: histogram
         listenAddress: "0.0.0.0:9090"
 
-  metrics:
-    serviceMonitor:
-      enabled: true
-      interval: 30s
-
-  resources:
-    requests:
-      cpu: 250m
-      memory: 512Mi
-    limits:
-      cpu: "1"
-      memory: 1Gi
-
-  frontend:
-    podDisruptionBudget:
-      maxUnavailable: 1
-    topologySpreadConstraints:
-    - maxSkew: 1
-      topologyKey: kubernetes.io/hostname
-      whenUnsatisfiable: ScheduleAnyway
-      labelSelector:
-        matchLabels:
-          app.kubernetes.io/name: temporal
-          app.kubernetes.io/instance: temporal
-          app.kubernetes.io/component: frontend
-
-  history:
-    resources:
-      requests:
-        cpu: 250m
-        memory: 768Mi
-      limits:
-        cpu: "1"
-        memory: 1536Mi
-    podDisruptionBudget:
-      maxUnavailable: 1
-    topologySpreadConstraints:
-    - maxSkew: 1
-      topologyKey: kubernetes.io/hostname
-      whenUnsatisfiable: ScheduleAnyway
-      labelSelector:
-        matchLabels:
-          app.kubernetes.io/name: temporal
-          app.kubernetes.io/instance: temporal
-          app.kubernetes.io/component: history
-
-  matching:
-    podDisruptionBudget:
-      maxUnavailable: 1
-    topologySpreadConstraints:
-    - maxSkew: 1
-      topologyKey: kubernetes.io/hostname
-      whenUnsatisfiable: ScheduleAnyway
-      labelSelector:
-        matchLabels:
-          app.kubernetes.io/name: temporal
-          app.kubernetes.io/instance: temporal
-          app.kubernetes.io/component: matching
-
-  worker:
-    podDisruptionBudget:
-      maxUnavailable: 1
-    topologySpreadConstraints:
-    - maxSkew: 1
-      topologyKey: kubernetes.io/hostname
-      whenUnsatisfiable: ScheduleAnyway
-      labelSelector:
-        matchLabels:
-          app.kubernetes.io/name: temporal
-          app.kubernetes.io/instance: temporal
-          app.kubernetes.io/component: worker
-
-# no persistent debug pod; use temporalio/admin-tools on demand
-admintools:
-  enabled: false
-
 web:
   enabled: true
-  replicaCount: 2
-  resources:
-    requests:
-      cpu: 50m
-      memory: 128Mi
-    limits:
-      cpu: 250m
-      memory: 256Mi
-  podDisruptionBudget:
-    maxUnavailable: 1
-  topologySpreadConstraints:
-  - maxSkew: 1
-    topologyKey: kubernetes.io/hostname
-    whenUnsatisfiable: ScheduleAnyway
-    labelSelector:
-      matchLabels:
-        app.kubernetes.io/name: temporal
-        app.kubernetes.io/instance: temporal
-        app.kubernetes.io/component: web
-  # NOTE: native OIDC SSO via Entra ID (same oceanbox-oidc secret as Grafana); gates UI login only
-  additionalEnv:
-    - name: TEMPORAL_AUTH_ENABLED
-      value: "true"
-    - name: TEMPORAL_AUTH_TYPE
-      value: "oidc"
-    - name: TEMPORAL_AUTH_PROVIDER_URL
-      value: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
-    - name: TEMPORAL_AUTH_CLIENT_ID
-      valueFrom:
-        secretKeyRef:
-          name: oceanbox-oidc
-          key: client_id
-    - name: TEMPORAL_AUTH_CLIENT_SECRET
-      valueFrom:
-        secretKeyRef:
-          name: oceanbox-oidc
-          key: client_secret
-    - name: TEMPORAL_AUTH_CALLBACK_URL
-      value: "https://temporal.ekman.oceanbox.io/auth/sso/callback"
-    - name: TEMPORAL_AUTH_SCOPES
-      value: "openid,profile,email,offline_access"
 
 schema:
   useHelmHooks: false
-  # NOTE: run as an ArgoCD sync hook so the controller-mutated Job isn't diffed and stays OutOfSync forever
-  jobAnnotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation

values/uptermd/env-hel1.yaml.gotmpl

@@ -1,2 +0,0 @@
-uptermd:
-  enabled: true

values/uptermd/env.yaml.gotmpl

@@ -1,3 +0,0 @@
-uptermd:
-  enabled: false
-  autosync: false

values/uptermd/kustomize/base/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - _manifest.yaml

values/uptermd/kustomize/default/kustomization.yaml

@@ -1,24 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - target:
-      kind: Ingress
-      name: uptermd
-    patch: |
-      $patch: delete
-      apiVersion: networking.k8s.io/v1
-      kind: Ingress
-      metadata:
-        name: uptermd
-  - target:
-      group: cert-manager.io
-      kind: Issuer
-      name: uptermd-letsencrypt
-    patch: |
-      $patch: delete
-      apiVersion: cert-manager.io/v1
-      kind: Issuer
-      metadata:
-        name: uptermd-letsencrypt

values/uptermd/manifests/ingress.yaml

@@ -1,30 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: uptermd
-  namespace: uptermd
-  labels:
-    app.kubernetes.io/name: uptermd
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    haproxy.org/backend-protocol: h1
-    haproxy.org/timeout-tunnel: "3600s"
-    haproxy.org/timeout-client: "3600s"
-    haproxy.org/timeout-server: "3600s"
-spec:
-  ingressClassName: haproxy
-  rules:
-    - host: upterm.hel1.obx
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: uptermd
-                port:
-                  number: 80
-  tls:
-    - hosts:
-        - upterm.hel1.obx
-      secretName: uptermd-tls

values/uptermd/manifests/uptermd.yaml

@@ -1,37 +0,0 @@
-{{- if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: uptermd
-  namespace: argocd
-spec:
-  destination:
-    namespace: uptermd
-    server: 'https://kubernetes.default.svc'
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-      - name: CLUSTER_NAME
-        value: {{ .Values.clusterConfig.cluster }}
-      - name: HELMFILE_ENVIRONMENT
-        value: default
-      - name: HELMFILE_FILE_PATH
-        value: uptermd.yaml.gotmpl
-  project: sys
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: sys
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      - ServerSideApply=true
-    {{- if .Values.uptermd.autosync }}
-    automated:
-      prune: true
-    {{- end }}
-{{- end }}

values/uptermd/values/values.yaml

@@ -1,20 +0,0 @@
-replicaCount: 1
-
-websocket:
-  enabled: true
-
-service:
-  type: ClusterIP
-
-resources:
-  limits:
-    memory: 512Mi
-  requests:
-    cpu: 100m
-    memory: 512Mi
-
-# No SSH host key is provided, so uptermd generates an ephemeral one on each
-# pod start
-host_keys: {}
-
-authorized_keys: []