fix: Add temp join_token

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.48.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.48.0
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.46.5
+  tag: v1.48.0
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.46.5
+version: v1.48.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.46.5"
+appVersion: "v1.48.0"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.46.5
+  tag: v1.48.0
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/plume/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: diagrid-dashboard
+  repository: file://../diagrid-dashboard
+  version: 0.1.0
+digest: sha256:4fdb3148a2a6439223d7844a3083da2de324dd47e5cb3ac4a5d9c436e6e2c775
+generated: "2026-02-25T16:15:48.608231856+01:00"

charts/plume/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.6.13
+version: v1.7.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.6.13
+appVersion: v1.7.1
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/plume/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/plume/plume
-  tag: v1.6.13
+  tag: v1.7.1
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -90,6 +90,5 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.48.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.48.0
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.46.5
+  tag: v1.48.0
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.4.10
+  version: 9.4.17
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
   namespace: argocd
   chart: argo/argo-rollouts
-  version: 2.40.6
+  version: 2.40.9
   condition: argo.rollouts.enabled
   values:
   - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 0.47.5
+  version: 1.0.7
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests

helmfile.d/catalyst.yaml.gotmpl

@@ -0,0 +1,46 @@
+# yaml-language-server: $schema=https://www.schemastore.org/helmfile.json
+
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: catalyst
+  oci: true
+  url: 'public.ecr.aws/diagrid/catalyst'
+
+commonLabels:
+  tier: system
+
+releases:
+- name: catalyst
+  namespace: cra-agent
+  chart: catalyst/catalyst
+  version: v1.38.0
+  condition: catalyst.enabled
+  values:
+  - ../values/catalyst/values/values.yaml
+  - ../values/catalyst/values/values-{{ .Environment.Name }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/catalyst/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: cra-agent
+  chart: manifests
+  condition: catalyst.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/catalyst/env.yaml.gotmpl
+  - ../values/catalyst/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/catalyst/manifests
+    - manifests

helmfile.d/cert-manager.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: v1.19.4
+  version: v1.20.1
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/dragonfly.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
   namespace: dragonfly
   chart: dragonfly/dragonfly-operator
-  version: v1.4.0
+  version: v1.5.0
   condition: dragonfly.enabled
   values:
   - ../values/dragonfly/values/dragonfly.yaml.gotmpl

helmfile.d/ingress-nginx.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
   namespace: ingress-nginx
   chart: ingress-nginx/ingress-nginx
-  version: 4.14.3
+  version: 4.15.1
   condition: nginx.enabled
   values:
   - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl

helmfile.d/kueue.yaml.gotmpl

@@ -8,7 +8,7 @@ releases:
 - name: kueue
   namespace: kueue-system
   chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.16.2
+  version: 0.16.4
   condition: kueue.enabled
   values:
   - ../values/kueue/values/values.yaml

helmfile.d/loki.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: loki
   namespace: loki
   chart: loki/loki
-  version: 6.53.0
+  version: 6.55.0
   condition: loki.enabled
   values:
   - ../values/loki/values/loki.yaml.gotmpl

helmfile.d/mariadb-operator.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
   namespace: mariadb-operator
   chart: mariadb-operator/mariadb-operator
-  version: 25.10.4
+  version: 26.3.0
   condition: mariadb_operator.enabled
   values:
   - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.56
+  version: 0.2.62
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.146.1
+  version: 0.147.1
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 82.10.3
+  version: 82.15.1
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/slurm-operator.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
   namespace: slinky
   chart: slurm-operator/slurm-operator
-  version: 1.0.2
+  version: 1.0.3
   condition: slurm_operator.enabled
   values:
   - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl

helmfile.d/slurm.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm
   namespace: slurm
   chart: slurm/slurm
-  version: 1.0.2
+  version: 1.0.3
   condition: slurm.enabled
   values:
   - ../values/slurm/values/slurm.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.7.3
+  version: 7.7.11
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/x509-exporter.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: x509-exporter
   namespace: x509-exporter
   chart: x509-exporter/x509-certificate-exporter
-  version: 3.19.1
+  version: 3.20.0
   condition: x509_exporter.enabled
   values:
   - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl

values/argo/manifests/sys-project.yaml

@@ -96,6 +96,10 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: dex
     server: https://kubernetes.default.svc
+  - namespace: cra-agent
+    server: https://kubernetes.default.svc
+  - namespace: catalyst
+    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
@@ -139,7 +143,8 @@ spec:
   - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
   - docker.gitea.com
   - https://operator.mariadb.com/mariadb-enterprise-operator
-  - https://operator.mariadb.com
   - https://ot-container-kit.github.io/helm-charts
+  - https://operator.mariadb.com
   - https://twin.github.io/helm-charts
   - https://charts.dexidp.io
+  - public.ecr.aws/diagrid/catalyst

values/atlantis/kustomize/beta/actor-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: beta-atlantis-actor-config
+data:
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.6"
+  XTRACT_QUEUE: "prod-queue"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.7"
+  PLUME_QUEUE: "prod-queue"

values/atlantis/kustomize/beta/deployment_patch.yaml

@@ -8,3 +8,8 @@
   value:
     secretRef:
       name: prod-atlantis-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: beta-atlantis-actor-config

values/atlantis/kustomize/beta/kustomization.yaml

@@ -14,6 +14,7 @@ patches:
 resources:
   - ../base
   - rbac.yaml
+  - actor-config.yaml
   - tracing.yaml
   - bindings.yaml
   - pubsub.yaml

values/atlantis/kustomize/beta/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - beta-atlantis-appsettings
+  - beta-atlantis-actor-config
   resources:
   - configmaps
   verbs:

values/atlantis/kustomize/prod/actor-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: prod-atlantis-actor-config
+data:
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.6"
+  XTRACT_QUEUE: "prod-queue"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.7"
+  PLUME_QUEUE: "prod-queue"

values/atlantis/kustomize/prod/deployment_patch.yaml

@@ -8,3 +8,8 @@
   value:
     secretRef:
       name: prod-atlantis-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: prod-atlantis-actor-config

values/atlantis/kustomize/prod/kustomization.yaml

@@ -13,6 +13,7 @@ patches:
 resources:
   - ../base
   - secrets.yaml
+  - actor-config.yaml
   - rbac.yaml
   - tracing.yaml
   - bindings.yaml

values/atlantis/kustomize/prod/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - prod-atlantis-appsettings
+  - prod-atlantis-actor-config
   resources:
   - configmaps
   verbs:

values/atlantis/kustomize/staging/actor-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: staging-atlantis-actor-config
+data:
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.6"
+  XTRACT_QUEUE: "dev-queue"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.7"
+  PLUME_QUEUE: "dev-queue"

values/atlantis/kustomize/staging/deployment_patch.yaml

@@ -8,3 +8,8 @@
   value:
     secretRef:
       name: staging-atlantis-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: staging-atlantis-actor-config

values/atlantis/kustomize/staging/kustomization.yaml

@@ -14,6 +14,7 @@ resources:
   - ../base
   - rbac.yaml
   - secrets.yaml
+  - actor-config.yaml
   - tracing.yaml
   - bindings.yaml
   - pubsub.yaml

values/atlantis/kustomize/staging/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - staging-atlantis-appsettings
+  - staging-atlantis-actor-config
   resources:
   - configmaps
   verbs:

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: 23006866-debug
+  tag: 74ed3e11-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/catalyst/env-oceanbox.yaml.gotmpl

@@ -0,0 +1,3 @@
+catalyst:
+  enabled: true
+  autosync: false

values/catalyst/env.yaml.gotmpl

@@ -0,0 +1,3 @@
+catalyst:
+  enabled: false
+  autosync: false

values/catalyst/manifests/catalyst.yaml

@@ -0,0 +1,42 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: catalyst
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: cra-agent
+    server: https://kubernetes.default.svc
+  project: sys
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: {{ .Values.catalyst.env }}
+      - name: HELMFILE_FILE_PATH
+        value: catalyst.yaml.gotmpl
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: aux
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      # - ServerSideApply=true
+    {{- if .Values.catalyst.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+{{- end }}

values/catalyst/manifests/cluster.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: catalyst-db
+  namespace: cra-agent
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:18
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi

values/catalyst/manifests/policy.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-umami
+  namespace: analytics
+spec:
+  description: Allow umami api
+  egress:
+    - toFQDNs:
+        - matchPattern: binaries.prisma.sh
+        - matchPattern: checkpoint.prisma.io
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: umami
+{{- end }}

values/catalyst/values/values.yaml

@@ -0,0 +1,17 @@
+agent:
+  config:
+    project:
+      default_managed_state_store_type: postgresql-shared-external
+      external_postgresql:
+        enabled: true
+        auth_type: connectionString
+        namespace: postgres
+        connection_string_host: catalyst-db.cr-agent.svc.cluster.local
+        connection_string_port: 5432
+        connection_string_username: postgres
+        connection_string_password: postgres
+        connection_string_database: catalyst
+gateway:
+  tls:
+    enabled: true
+join_token: "tset"

values/codex/values/values-staging.yaml

@@ -38,4 +38,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: 38eeb4cc-debug
+  tag: 74ed3e11-debug

values/docs/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "0d279bb9-debug"
+  tag: "64b20667-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/gatus/values/values.yaml

@@ -139,12 +139,3 @@ config:
         environment: staging
       alerts:
         - type: custom
-
-    - name: Plume Dev TOS
-      <<: *https-endpoint
-      group: "Experimental Services"
-      url: https://plume.ekman.oceanbox.io/healthz
-      extra-labels:
-        environment: staging
-      alerts:
-        - type: custom

values/headscale-router/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.28.0
+  tag: v0.27.1
 
 args: [ "serve" ]
 

values/headscale/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.28.0
+  tag: v0.27.1
 
 args: ["serve"]
 
@@ -255,6 +255,7 @@ configMaps:
             { "action": "accept", "src": [ "faith.iha@oceanbox.io" ], "dst": [ "faith.iha@oceanbox.io:*" ] },
             { "action": "accept", "src": [ "elianne.ersdal@oceanbox.io" ], "dst": [  "elianne.ersdal@oceanbox.io:*" ] },
             { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
+            { "action": "accept", "src": [ "erlend.mundal@oceanbox.io" ], "dst": [ "erlend.mundal@oceanbox.io:*" ] },
             // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
           ]
         }
@@ -353,7 +354,7 @@ configMaps:
            { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
            { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "mrtz-diadash.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "mrtz-diadash.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },

values/kueue/manifests/clusterQueue.yaml

@@ -48,12 +48,29 @@ metadata:
 apiVersion: kueue.x-k8s.io/v1beta2
 kind: LocalQueue
 metadata:
-  name: staging-queue
+  name: dev-queue
   namespace: dev-queue
   annotations:
     argocd.argoproj.io/sync-wave: "2"
 spec:
   clusterQueue: cluster-queue
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prod-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: LocalQueue
+metadata:
+  name: prod-queue
+  namespace: prod-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  clusterQueue: cluster-queue
 # ---
 # apiVersion: kueue.x-k8s.io/v1beta2
 # kind: WorkloadPriorityClass

values/kueue/manifests/sorcerer-queue-access.yaml

@@ -0,0 +1,117 @@
+# Cross-namespace RBAC: allow sorcerer ServiceAccounts to manage JobSets in dev-queue
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: beta-sorcerer-prod-queue
+  namespace: prod-queue
+rules:
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: beta-sorcerer-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: beta-sorcerer-prod-queue
+subjects:
+- kind: ServiceAccount
+  name: beta-sorcerer
+  namespace: beta-sorcerer
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: prod-sorcerer-prod-queue
+  namespace: prod-queue
+rules:
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: prod-sorcerer-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prod-sorcerer-prod-queue
+subjects:
+- kind: ServiceAccount
+  name: prod-sorcerer
+  namespace: prod-sorcerer
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: staging-sorcerer-dev-queue
+  namespace: dev-queue
+rules:
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: staging-sorcerer-dev-queue
+  namespace: dev-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: staging-sorcerer-dev-queue
+subjects:
+- kind: ServiceAccount
+  name: staging-sorcerer
+  namespace: staging-sorcerer

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "d5e61949-debug"
+  tag: "da02dd2c-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/plume/values/values-staging.yaml

@@ -1,7 +1,7 @@
-replicaCount: 1
+replicaCount: 0
 image:
   repository: "git.oceanbox.io/oceanbox/plume/plume"
-  tag: v1.6.13
+  tag: 0095aa5a-debug
 podAnnotations:
   dapr.io/enabled: "true"
   dapr.io/app-id: "staging-plume"

values/sorcerer/kustomize/beta-ekman/deployment_patch.yaml

@@ -11,4 +11,9 @@
   value:
     secretRef:
       name: prod-sorcerer-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: beta-sorcerer-kueue-config
 

values/sorcerer/kustomize/beta-ekman/kueue-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: beta-sorcerer-kueue-config
+data:
+  KUEUE_NAMESPACE: "prod-queue"
+  KUEUE_ARCHIVE_PVC: "prod-queue-ceph-archives"

values/sorcerer/kustomize/beta-ekman/kustomization.yaml

@@ -18,6 +18,7 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
+- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/beta-ekman/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - beta-sorcerer-appsettings
+  - beta-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -23,6 +24,24 @@ rules:
   verbs:
   - get
   - watch
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

values/sorcerer/kustomize/prod-ekman/deployment_patch.yaml

@@ -11,4 +11,9 @@
   value:
     secretRef:
       name: prod-sorcerer-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: prod-sorcerer-kueue-config
 

values/sorcerer/kustomize/prod-ekman/kueue-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: prod-sorcerer-kueue-config
+data:
+  KUEUE_NAMESPACE: "prod-queue"
+  KUEUE_ARCHIVE_PVC: "prod-queue-ceph-archives"

values/sorcerer/kustomize/prod-ekman/kustomization.yaml

@@ -18,6 +18,7 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
+- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/prod-ekman/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - prod-sorcerer-appsettings
+  - prod-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -23,6 +24,24 @@ rules:
   verbs:
   - get
   - watch
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

values/sorcerer/kustomize/staging-ekman/deployment_patch.yaml

@@ -11,4 +11,9 @@
   value:
     secretRef:
       name: staging-sorcerer-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: staging-sorcerer-kueue-config
 

values/sorcerer/kustomize/staging-ekman/kueue-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: staging-sorcerer-kueue-config
+data:
+  KUEUE_NAMESPACE: "dev-queue"
+  KUEUE_ARCHIVE_PVC: "dev-queue-ceph-archives"

values/sorcerer/kustomize/staging-ekman/kustomization.yaml

@@ -18,6 +18,7 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
+- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/staging-ekman/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - staging-sorcerer-appsettings
+  - staging-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -23,6 +24,24 @@ rules:
   verbs:
   - get
   - watch
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

values/sorcerer/values/values-staging.yaml

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: 38eeb4cc-debug
+  tag: 74ed3e11-debug
 podAnnotations:
   dapr.io/enabled: "true"
   dapr.io/app-id: "staging-sorcerer"