diff --git a/.github/workflows/enforce-ring-deployment.yaml b/.github/workflows/enforce-ring-deployment.yaml index 369b2ae7129..0cf1ef266b4 100644 --- a/.github/workflows/enforce-ring-deployment.yaml +++ b/.github/workflows/enforce-ring-deployment.yaml @@ -2,7 +2,7 @@ name: Enforce Ring Deployment on: pull_request_target: - types: [opened, synchronize, reopened] + types: [opened, synchronize, reopened, labeled, unlabeled] branches: [main] paths: - 'components/**' @@ -19,35 +19,46 @@ jobs: pull-requests: write issues: write steps: + - name: Check for hotfix label + id: hotfix + if: contains(github.event.pull_request.labels.*.name, 'skip-ring-deployment/hotfix') + run: echo "skip=true" >> "$GITHUB_OUTPUT" + # Check out the BASE branch (trusted code) so we never execute PR code. - uses: actions/checkout@v6 + if: steps.hotfix.outputs.skip != 'true' with: fetch-depth: 0 - uses: actions/setup-go@v5 + if: steps.hotfix.outputs.skip != 'true' with: go-version-file: infra-tools/go.mod cache-dependency-path: infra-tools/go.sum - name: Setup Kustomize + if: steps.hotfix.outputs.skip != 'true' uses: multani/action-setup-kustomize@v1 with: version: 5.6.0 # Build from the trusted base branch before switching to PR code. - name: Build env-detector (from base branch) + if: steps.hotfix.outputs.skip != 'true' working-directory: infra-tools run: go build -o bin/env-detector ./cmd/env-detector # Fetch the GitHub-synthesized merge commit so the tool analyses the # post-merge state, while the binary remains the trusted base build. - name: Checkout PR merge ref + if: steps.hotfix.outputs.skip != 'true' run: | git fetch origin pull/${{ github.event.pull_request.number }}/merge:pr-merge git checkout pr-merge - name: Check ring deployment policy id: ring-check + if: steps.hotfix.outputs.skip != 'true' continue-on-error: true working-directory: infra-tools run: | @@ -59,19 +70,31 @@ jobs: --dry-run - name: Post or update PR comment - if: always() && steps.ring-check.outcome != 'skipped' + if: always() && (steps.ring-check.outcome != 'skipped' || steps.hotfix.outputs.skip == 'true') env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | COMMENT_MARKER="" - # Delete any previous comment from this workflow gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ --paginate --jq ".[] | select(.body | contains(\"${COMMENT_MARKER}\")) | .id" \ | xargs -r -I {} gh api "repos/${{ github.repository }}/issues/comments/{}" -X DELETE - # Post a new comment only if the report file was generated - if [ -s /tmp/ring-report.md ]; then + if [ "${{ steps.hotfix.outputs.skip }}" = "true" ]; then + cat > /tmp/ring-report.md <<'BODY' + ## ✅ Ring Deployment Check — Passed (Hotfix Override) + + This check **passed** because the `skip-ring-deployment/hotfix` label is applied. + The normal ring deployment policy has been bypassed for this PR. + + > **Note:** This override should only be used for emergency hotfixes. + > The label application is tracked in the PR timeline for audit purposes. + BODY + echo "${COMMENT_MARKER}" >> /tmp/ring-report.md + gh pr comment ${{ github.event.pull_request.number }} \ + --repo ${{ github.repository }} \ + --body-file /tmp/ring-report.md + elif [ -s /tmp/ring-report.md ]; then echo "${COMMENT_MARKER}" >> /tmp/ring-report.md gh pr comment ${{ github.event.pull_request.number }} \ --repo ${{ github.repository }} \ @@ -79,5 +102,5 @@ jobs: fi - name: Fail on ring deployment violation - if: always() && steps.ring-check.outcome == 'failure' + if: always() && steps.hotfix.outputs.skip != 'true' && steps.ring-check.outcome == 'failure' run: exit 1 diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000000..c52d7b4ef24 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,37 @@ +# infra-deployments + +GitOps monorepo deploying 50+ Kubernetes components across multiple clusters via Kustomize and ArgoCD ApplicationSets. + +## Quick Commands + +| Action | Command | +|----------------|--------------------------------------------| +| Build overlay | `kustomize build components///` | +| Lint YAML | `yamllint .` | +| K8s lint | `kube-linter lint ` | +| Chainsaw tests | `./hack/chainsaw/chainsaw-prepare.sh` and `chainsaw test ` | +| infra-tools | `cd infra-tools && make build test lint` | + +## Project Layout + +- `components//{base,development,staging,production}/` — per-component Kustomize overlays; staging and production are often further split per-cluster +- `argo-cd-apps/overlays/` — maps to deployment targets (development, staging-downstream, production-downstream, etc.) +- `configs/` — cluster-level configurations (etcd-defrag, kubelet settings) +- `hack/` — deployment and utility scripts +- `infra-tools/` — Go CLI tools (env-detector, render-diff) with their own Makefile + +## Key Conventions + +- Prefer using scripts in `hack/` over manual steps when available +- Promotion order: development/staging → production; changes must be validated in dev/staging before promoting to production +- Production has per-cluster overlay directories; rollouts must be split into rings (subsets of clusters), not applied to all at once +- All changes via PR; CODEOWNERS approval required +- Production PRs must include `## Risk Assessment` (level, description, rollback plan) and `## Validation` (staging evidence if applicable) +- Commits - Jira ID at start (e.g., `KFLUXINFRA-1234 description`). Interactive sessions: Use the -s flag and `Assisted-by:` trailer. Agentic workflow: `Authored-by:` trailer. Include agent name and tool. + +## Gotchas + +- E2E tests are designed to validate in an isolated environment in GitHub Actions CI and should not be run locally +- E2E tests are conditional — they only run on dev/staging PRs when specific files change. Production PRs do not run E2E; rely on prior dev/staging validation +- E2E tests frequently fail due to intermittent infrastructure issues. If the PR looks correct and E2E logs show no relevant errors, comment `/retest` to re-trigger +- When updating component images, also update image references in `hack/new-cluster/templates/` as part of the production ring deployments — new clusters are bootstrapped from these and won't get ArgoCD-synced versions diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 00000000000..43c994c2d36 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +@AGENTS.md diff --git a/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml b/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml index 12db5127640..63b1587d558 100644 --- a/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml +++ b/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml @@ -33,7 +33,7 @@ spec: repoURL: https://github.com/redhat-appstudio/infra-deployments.git targetRevision: main destination: - namespace: group-sync-operator + namespace: authentication server: '{{server}}' syncPolicy: automated: diff --git a/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml new file mode 100644 index 00000000000..ebef1de38ef --- /dev/null +++ b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml @@ -0,0 +1,43 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: k8s-groups +spec: + generators: + - merge: + mergeKeys: + - nameNormalized + generators: + - clusters: + values: + sourceRoot: components/k8s-groups + environment: staging + useCaseDir: rover + - list: + elements: + - nameNormalized: kflux-fedora-01 + values.useCaseDir: fas + template: + metadata: + name: k8s-groups-{{nameNormalized}} + spec: + project: default + source: + path: '{{values.sourceRoot}}/{{values.environment}}/{{values.useCaseDir}}' + repoURL: '' # will be added by kustomization + targetRevision: main + destination: + namespace: k8s-groups + server: '{{server}}' + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: -1 + backoff: + duration: 10s + factor: 2 + maxDuration: 3m diff --git a/components/authentication/helm-charts/metrics/kustomization.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/kustomization.yaml similarity index 79% rename from components/authentication/helm-charts/metrics/kustomization.yaml rename to argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/kustomization.yaml index 8f54b3273e3..79d084451e4 100644 --- a/components/authentication/helm-charts/metrics/kustomization.yaml +++ b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/kustomization.yaml @@ -1,5 +1,4 @@ ---- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- monitor.yaml +- k8s-groups.yaml diff --git a/argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml new file mode 100644 index 00000000000..3836d47406e --- /dev/null +++ b/argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - k8s-groups +components: + - ../../../k-components/inject-internal-infra-deployments-repo-details diff --git a/argo-cd-apps/base/all-clusters/kustomization.yaml b/argo-cd-apps/base/all-clusters/kustomization.yaml index d7360b000f5..d8555820cf2 100644 --- a/argo-cd-apps/base/all-clusters/kustomization.yaml +++ b/argo-cd-apps/base/all-clusters/kustomization.yaml @@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - infra-deployments + - internal-infra-deployments components: - ../../k-components/inject-argocd-namespace - ../../k-components/deploy-to-all-clusters diff --git a/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml b/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml index 4d7e3340561..cba46a05359 100644 --- a/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml +++ b/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml @@ -17,6 +17,8 @@ spec: elements: - nameNormalized: stone-prd-rh01 values.clusterDir: stone-prd-rh01 + - nameNormalized: kflux-fedora-01 + values.clusterDir: kflux-fedora-01 template: metadata: name: image-controller-{{nameNormalized}} diff --git a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml index 789158cf9d2..47942fe9110 100644 --- a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml +++ b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml @@ -17,7 +17,25 @@ spec: environment: staging clusterDir: "" - list: - elements: [] + elements: + - nameNormalized: kflux-ocp-p01 + values.clusterDir: kflux-ocp-p01 + - nameNormalized: kflux-prd-rh02 + values.clusterDir: kflux-prd-rh02 + - nameNormalized: stone-prod-p01 + values.clusterDir: stone-prod-p01 + - nameNormalized: kflux-osp-p01 + values.clusterDir: kflux-osp-p01 + - nameNormalized: kflux-prd-rh03 + values.clusterDir: kflux-prd-rh03 + - nameNormalized: stone-prod-p02 + values.clusterDir: stone-prod-p02 + - nameNormalized: kflux-fedora-01 + values.clusterDir: kflux-fedora-01 + - nameNormalized: kflux-rhel-p01 + values.clusterDir: kflux-rhel-p01 + - nameNormalized: stone-prd-rh01 + values.clusterDir: stone-prd-rh01 template: metadata: name: squid-{{nameNormalized}} diff --git a/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml new file mode 100644 index 00000000000..38a2e467749 --- /dev/null +++ b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: replace + path: /spec/source/repoURL + value: https://github.com/redhat-appstudio/internal-infra-deployments.git +- op: replace + path: /spec/source/targetRevision + value: main diff --git a/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml new file mode 100644 index 00000000000..dd6c502577f --- /dev/null +++ b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: replace + path: /spec/template/spec/source/repoURL + value: https://github.com/redhat-appstudio/internal-infra-deployments.git +- op: replace + path: /spec/template/spec/source/targetRevision + value: main diff --git a/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml new file mode 100644 index 00000000000..ed41289c690 --- /dev/null +++ b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - path: application-set-patch.yaml + target: + group: argoproj.io + version: v1alpha1 + kind: ApplicationSet + labelSelector: noSourceTransform != true + - path: application-patch.yaml + target: + group: argoproj.io + version: v1alpha1 + kind: Application + labelSelector: noSourceTransform != true diff --git a/argo-cd-apps/overlays/development-operator/kustomization.yaml b/argo-cd-apps/overlays/development-operator/kustomization.yaml index a4a463f2b9d..b8024ae421d 100644 --- a/argo-cd-apps/overlays/development-operator/kustomization.yaml +++ b/argo-cd-apps/overlays/development-operator/kustomization.yaml @@ -3,6 +3,8 @@ # policies, pipeline-service, etc.) and deletes only the legacy Konflux # microservice ApplicationSets listed in delete-legacy-konflux-member-appsets.yaml # so those workloads are not deployed alongside the operator-managed stack. +# pipeline-service uses components/pipeline-service/development-operator/ (no +# appstudio-pipelines-scc); the operator build-service component owns that SCC. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: @@ -10,10 +12,15 @@ resources: - ../../base/member/infra-deployments/konflux-operator patchesStrategicMerge: - delete-legacy-konflux-member-appsets.yaml +namespace: openshift-gitops patches: - path: development-operator-generator-patch.yaml target: kind: ApplicationSet version: v1alpha1 name: konflux-operator -namespace: openshift-gitops + - path: pipeline-service-operator-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: pipeline-service diff --git a/argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml b/argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml new file mode 100644 index 00000000000..535b6a9761e --- /dev/null +++ b/argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml @@ -0,0 +1,4 @@ +--- +- op: replace + path: /spec/generators/0/merge/generators/0/clusters/values/environment + value: development-operator diff --git a/argo-cd-apps/overlays/development/delete-applications.yaml b/argo-cd-apps/overlays/development/delete-applications.yaml index 3bf7d66752e..ea6506b27fa 100644 --- a/argo-cd-apps/overlays/development/delete-applications.yaml +++ b/argo-cd-apps/overlays/development/delete-applications.yaml @@ -102,3 +102,9 @@ kind: ApplicationSet metadata: name: monitoring-workload-grafana $patch: delete +--- +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: k8s-groups +$patch: delete diff --git a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml index 030bf274db7..c864fcdda7c 100644 --- a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml +++ b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml @@ -241,7 +241,7 @@ patches: kind: ApplicationSet version: v1alpha1 name: pulp-access-controller - - path: production-overlay-patch.yaml + - path: squid-production-overlay-patch.yaml target: kind: ApplicationSet version: v1alpha1 @@ -281,3 +281,8 @@ patches: kind: ApplicationSet version: v1alpha1 name: perf-team-prometheus-reader + - path: production-overlay-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: k8s-groups diff --git a/argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml b/argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml new file mode 100644 index 00000000000..ee19f8b1808 --- /dev/null +++ b/argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/environment + value: production +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/clusterDir + value: empty-base diff --git a/argo-cd-apps/overlays/production-downstream/kustomization.yaml b/argo-cd-apps/overlays/production-downstream/kustomization.yaml index e713188a5b7..7049247116d 100644 --- a/argo-cd-apps/overlays/production-downstream/kustomization.yaml +++ b/argo-cd-apps/overlays/production-downstream/kustomization.yaml @@ -255,7 +255,7 @@ patches: kind: ApplicationSet version: v1alpha1 name: pulp-access-controller - - path: production-overlay-patch.yaml + - path: squid-production-overlay-patch.yaml target: kind: ApplicationSet version: v1alpha1 @@ -295,3 +295,8 @@ patches: kind: ApplicationSet version: v1alpha1 name: perf-team-prometheus-reader + - path: production-overlay-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: k8s-groups diff --git a/argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml b/argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml new file mode 100644 index 00000000000..ee19f8b1808 --- /dev/null +++ b/argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/environment + value: production +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/clusterDir + value: empty-base diff --git a/components/authentication/README.md b/components/authentication/README.md new file mode 100644 index 00000000000..ccdeedf7772 --- /dev/null +++ b/components/authentication/README.md @@ -0,0 +1,34 @@ +# Authentication + +The Authentication component contains GitOps manifests for Konflux cluster **authentication and authorization**: OpenShift RBAC (**ClusterRoles**, **ClusterRoleBindings**) for Konflux LDAP/Rover groups, baseline view permissions for authenticated users, and the **admin-checker** job that audits cluster admin group membership. + +## What gets deployed + +### RBAC roles and bindings + +| Manifest | Kind | Purpose | +| --- | --- | --- | +| `konflux-admins.yaml` | `ClusterRole` / `ClusterRoleBinding` | Broad cluster permissions **without** `secrets` or `internalrequests` | +| `konflux-admins-pod-admin.yaml` | `ClusterRole` + `RoleBinding` | Pod create/exec/attach in selected namespaces only | +| `konflux-sre.yaml` | `ClusterRole` / `ClusterRoleBinding` | Read-only pod access; delete allowed for cleanup | +| `component-maintainer.yaml` | `ClusterRole` | OLM `installplans`, Tekton Results, limited SA patch | +| `grafana-view-only.yaml` | `ClusterRole` / `RoleBinding` | Read `appstudio-grafana` namespace | +| `test-platform-ci-admins-can-view.yaml` | `ClusterRole` / `ClusterRoleBinding` | View test platform / Crossplane resources | +| `everyone-can-view.yaml` + patch | `ClusterRole` / `ClusterRoleBinding` | Shared view roles for App Studio, monitoring, cluster version, compute | + +`everyone-can-view-patch.yaml` centralizes the list of Konflux Rover groups that receive the “everyone can view” bindings so the same group list is not duplicated across multiple bindings. + +### Admin checker + +Runs in namespace `admin-checker` as CronJob `check-cluster-admins` (Mondays 11:30 UTC). It: + +1. Reads OpenShift `Group` objects `cluster-admins` and `dedicated-admins`. +2. POSTs membership to the workflow URL in secret `rhtap-infra-secrets` (`admin-checker-workflow-url`). + +The service account has read-only access to `user.openshift.io/groups`. Credentials are synced from Vault via External Secrets (`appsre-stonesoup-vault` ClusterSecretStore). + +## Related documentation + +- [Extending the service — Authentication](../../docs/deployment/extending-the-service.md#authentication) +- [k8s-groups component](https://github.com/redhat-appstudio/internal-infra-deployments/tree/main/components/k8s-groups) + diff --git a/components/authentication/base/group-sync-olm/subscription.yaml b/components/authentication/base/group-sync-olm/subscription.yaml deleted file mode 100644 index 20a39f99fbd..00000000000 --- a/components/authentication/base/group-sync-olm/subscription.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: group-sync-operator -spec: - channel: alpha - installPlanApproval: Automatic - name: group-sync-operator - source: community-operators - sourceNamespace: openshift-marketplace ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: group-sync-operator -spec: - targetNamespaces: - - group-sync-operator diff --git a/components/authentication/base/group-sync/group-sync.yaml b/components/authentication/base/group-sync/group-sync.yaml deleted file mode 100644 index c21cfbc02a4..00000000000 --- a/components/authentication/base/group-sync/group-sync.yaml +++ /dev/null @@ -1,12 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: group-sync-operator-maintainers - namespace: group-sync-operator -subjects: - - kind: Group - name: konflux-infra -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: component-maintainer diff --git a/components/authentication/base/group-sync/konflux-rover-groups.yaml b/components/authentication/base/group-sync/konflux-rover-groups.yaml deleted file mode 100644 index 77151f20d36..00000000000 --- a/components/authentication/base/group-sync/konflux-rover-groups.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: redhatcop.redhat.io/v1alpha1 -kind: GroupSync -metadata: - name: konflux-rover-groups - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - providers: - - ldap: - ca: - key: ca.crt - kind: Secret - name: mtls-ca-validators - namespace: group-sync-operator - credentialsSecret: - name: konflux-ldap-sa - namespace: group-sync-operator - insecure: false - prune: true - rfc2307: - usersQuery: - baseDN: 'dc=redhat,dc=com' - derefAliases: never - scope: sub - groupNameAttributes: - - cn - tolerateMemberNotFoundErrors: true - tolerateMemberOutOfScopeErrors: true - groupUIDAttribute: dn - groupMembershipAttributes: - - uniqueMember - userNameAttributes: - - uid - groupsQuery: - baseDN: 'ou=adhoc,ou=managedGroups,dc=redhat,dc=com' - derefAliases: never - filter: (&(objectClass=rhatRoverGroup)(|(cn=konflux-*)(cn=ai-konflux-user-support)(cn=plm-poe))) - scope: sub - userUIDAttribute: dn - url: 'ldaps://ldapfrac.corp.redhat.com' - name: ldap-corp - schedule: '*/15 * * * *' diff --git a/components/authentication/base/group-sync/kustomization.yaml b/components/authentication/base/group-sync/kustomization.yaml deleted file mode 100644 index 7a6e8bdc2b2..00000000000 --- a/components/authentication/base/group-sync/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: group-sync-operator -resources: -- group-sync.yaml -- external-secrets -- konflux-rover-groups.yaml -- test-platform-ci-admins-rover-group.yaml diff --git a/components/authentication/base/group-sync/test-platform-ci-admins-rover-group.yaml b/components/authentication/base/group-sync/test-platform-ci-admins-rover-group.yaml deleted file mode 100644 index cc4d8621b56..00000000000 --- a/components/authentication/base/group-sync/test-platform-ci-admins-rover-group.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: redhatcop.redhat.io/v1alpha1 -kind: GroupSync -metadata: - name: test-platform-ci-rover-groups - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - providers: - - ldap: - ca: - key: ca.crt - kind: Secret - name: mtls-ca-validators - namespace: group-sync-operator - credentialsSecret: - name: konflux-ldap-sa - namespace: group-sync-operator - insecure: false - prune: true - rfc2307: - usersQuery: - baseDN: 'dc=redhat,dc=com' - derefAliases: never - scope: sub - groupNameAttributes: - - cn - tolerateMemberNotFoundErrors: true - tolerateMemberOutOfScopeErrors: true - groupUIDAttribute: dn - groupMembershipAttributes: - - uniqueMember - userNameAttributes: - - uid - groupsQuery: - baseDN: 'ou=adhoc,ou=managedGroups,dc=redhat,dc=com' - derefAliases: never - filter: (&(objectClass=rhatRoverGroup)(cn=test-platform-ci-admins)) - scope: sub - userUIDAttribute: dn - url: 'ldaps://ldapfrac.corp.redhat.com' - name: ldap-corp - schedule: '*/15 * * * *' diff --git a/components/authentication/base/kustomization.yaml b/components/authentication/base/kustomization.yaml index c73f296bbef..da7b65aca5e 100644 --- a/components/authentication/base/kustomization.yaml +++ b/components/authentication/base/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - admin-checker -- group-sync - component-maintainer.yaml - everyone-can-view.yaml - konflux-admins.yaml diff --git a/components/authentication/helm-charts/crd.yaml b/components/authentication/helm-charts/crd.yaml deleted file mode 100644 index 6ad9936c16c..00000000000 --- a/components/authentication/helm-charts/crd.yaml +++ /dev/null @@ -1,919 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null - name: groupsyncs.redhatcop.redhat.io -spec: - group: redhatcop.redhat.io - names: - kind: GroupSync - listKind: GroupSyncList - plural: groupsyncs - singular: groupsync - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: GroupSync is the Schema for the groupsyncs API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: GroupSyncSpec defines the desired state of GroupSync - properties: - excludeInvalidGroupNames: - description: ExcludeInvalidGroupNames excludes Groups with names that are not RFC 1035 compliant. - type: boolean - providers: - description: List of Providers that can be mounted by containers belonging to the pod. - items: - description: Provider represents the container for a single provider - properties: - azure: - description: Azure represents the Azure provider - properties: - authorityHost: - description: AuthorityHost is the location of the Azure Active Directory endpoint - type: string - baseGroups: - description: BaseGroups allows for a set of groups to be specified to start searching from instead of searching all groups in the directory - items: - type: string - type: array - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to Azure - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to Azure Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for communicating to Azure - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - filter: - description: Filter allows for limiting the results from the groups response using the Filter feature of the Azure Graph API - type: string - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to Azure - type: boolean - prune: - description: Prune Whether to prune groups that are no longer in Azure. Default is false - type: boolean - userNameAttributes: - description: UserNameAttributes are the fields to consider on the User object containing the username - items: - type: string - type: array - required: - - credentialsSecret - type: object - github: - description: GitHub represents the GitHub provider - properties: - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to the GitHub server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to the GitHub server Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the GitHub server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to GitHab - type: boolean - mapByScimId: - description: Map users by SCIM Id. This will usually match your IDP id, like UPN when using AAD. - type: boolean - organization: - description: Organization represents the location to source teams to synchronize - type: string - prune: - description: Prune Whether to prune groups that are no longer in GitHub. Default is false - type: boolean - teams: - description: Teams represents a filtered list of teams to synchronize - items: - type: string - type: array - url: - default: https://api.github.com/ - description: URL is the location of the GitHub server - type: string - v4url: - default: https://api.github.com/graphql - description: V4URL is the location of the GitHub server graphql endpoint. - type: string - required: - - credentialsSecret - type: object - gitlab: - description: GitLab represents the GitLab provider - properties: - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to the GitLab server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to the GitLab server Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the GitLab server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to GitLab - type: boolean - prune: - description: Prune Whether to prune groups that are no longer in GitLab. Default is false - type: boolean - scope: - description: Scope represents the depth for which groups will be synchronized - enum: - - one - - sub - type: string - url: - default: https://gitlab.com - description: URL is the location of the GitLab server - type: string - required: - - credentialsSecret - type: object - keycloak: - description: Keycloak represents the Keycloak provider - properties: - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to the Keycloak server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to the Keycloak server Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the Keycloak server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to Keycloak - type: boolean - loginRealm: - description: LoginRealm is the Keycloak realm to authenticate against - type: string - prune: - description: Prune Whether to prune groups that are no longer in Keycloak. Default is false - type: boolean - realm: - description: Realm is the realm containing the groups to synchronize against - type: string - scope: - description: Scope represents the depth for which groups will be synchronized - enum: - - one - - sub - type: string - url: - description: URL is the location of the Keycloak server - type: string - required: - - credentialsSecret - - realm - - url - type: object - ibmsecurityverify: - description: The IBM Security Verify (ISV) provider - properties: - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the ISV server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groups: - description: The ISV groups to synchronize - type: array - items: - type: object - properties: - name: - description: Name of the ISV group - type: string - id: - description: ID of the ISV group - type: string - required: - - id - tenantUrl: - description: URL for the ISV server of the tenant - type: string - required: - - credentialsSecret - - tenantUrl - - groups - type: object - ldap: - description: Ldap represents the LDAP provider - properties: - activeDirectory: - description: ActiveDirectoryConfig represents the configuration for Active Directory - properties: - groupMembershipAttributes: - description: GroupMembershipAttributes defines which attributes on an LDAP user entry will be interpreted as the groups it is a member of - items: - type: string - type: array - userNameAttributes: - description: UserNameAttributes defines which attributes on an LDAP user entry will be interpreted as its OpenShift user name. - items: - type: string - type: array - usersQuery: - description: AllUsersQuery holds the template for an LDAP query that returns user entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - required: - - groupMembershipAttributes - - userNameAttributes - - usersQuery - type: object - augmentedActiveDirectory: - description: ActiveDirectoryConfig represents the configuration for Augmented Active Directory - properties: - groupMembershipAttributes: - description: GroupMembershipAttributes defines which attributes on an LDAP user entry will be interpreted as the groups it is a member of - items: - type: string - type: array - groupNameAttributes: - description: GroupNameAttributes defines which attributes on an LDAP group entry will be interpreted as its name to use for an OpenShift group - items: - type: string - type: array - groupUIDAttribute: - description: GroupUIDAttributes defines which attribute on an LDAP group entry will be interpreted as its unique identifier. (ldapGroupUID) - type: string - groupsQuery: - description: AllGroupsQuery holds the template for an LDAP query that returns group entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - userNameAttributes: - description: UserNameAttributes defines which attributes on an LDAP user entry will be interpreted as its OpenShift user name. - items: - type: string - type: array - usersQuery: - description: AllUsersQuery holds the template for an LDAP query that returns user entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - required: - - groupMembershipAttributes - - groupNameAttributes - - groupUIDAttribute - - groupsQuery - - userNameAttributes - - usersQuery - type: object - blacklist: - description: Blacklist represents a list of groups to not synchronize - items: - type: string - type: array - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to LDAP - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to LDAP Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for communicating to LDAP - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groupUIDNameMapping: - additionalProperties: - type: string - description: / LDAPGroupUIDToOpenShiftGroupNameMapping is an optional direct mapping of LDAP group UIDs to OpenShift group names - type: object - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to LDAP - type: boolean - prune: - description: Prune Whether to prune groups that are no longer in LDAP. Default is false - type: boolean - rfc2307: - description: RFC2307Config represents the configuration for a RFC2307 schema - properties: - groupMembershipAttributes: - description: GroupMembershipAttributes defines which attributes on an LDAP group entry will be interpreted as its members. The values contained in those attributes must be queryable by your UserUIDAttribute - items: - type: string - type: array - groupNameAttributes: - description: GroupNameAttributes defines which attributes on an LDAP group entry will be interpreted as its name to use for an OpenShift group - items: - type: string - type: array - groupUIDAttribute: - description: GroupUIDAttributes defines which attribute on an LDAP group entry will be interpreted as its unique identifier. (ldapGroupUID) - type: string - groupsQuery: - description: AllGroupsQuery holds the template for an LDAP query that returns group entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - tolerateMemberNotFoundErrors: - description: TolerateMemberNotFoundErrors determines the behavior of the LDAP sync job when missing user entries are encountered. If 'true', an LDAP query for users that doesn't find any will be tolerated and an only and error will be logged. If 'false', the LDAP sync job will fail if a query for users doesn't find any. The default value is 'false'. Misconfigured LDAP sync jobs with this flag set to 'true' can cause group membership to be removed, so it is recommended to use this flag with caution. - type: boolean - tolerateMemberOutOfScopeErrors: - description: TolerateMemberOutOfScopeErrors determines the behavior of the LDAP sync job when out-of-scope user entries are encountered. If 'true', an LDAP query for a user that falls outside of the base DN given for the all user query will be tolerated and only an error will be logged. If 'false', the LDAP sync job will fail if a user query would search outside of the base DN specified by the all user query. Misconfigured LDAP sync jobs with this flag set to 'true' can result in groups missing users, so it is recommended to use this flag with caution. - type: boolean - userNameAttributes: - description: UserNameAttributes defines which attributes on an LDAP user entry will be used, in order, as its OpenShift user name. The first attribute with a non-empty value is used. This should match your PreferredUsername setting for your LDAPPasswordIdentityProvider - items: - type: string - type: array - userUIDAttribute: - description: UserUIDAttribute defines which attribute on an LDAP user entry will be interpreted as its unique identifier. It must correspond to values that will be found from the GroupMembershipAttributes - type: string - usersQuery: - description: AllUsersQuery holds the template for an LDAP query that returns user entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - required: - - groupMembershipAttributes - - groupNameAttributes - - groupUIDAttribute - - groupsQuery - - userNameAttributes - - userUIDAttribute - - usersQuery - type: object - url: - description: URL is the location of the LDAP Server - type: string - whitelist: - description: Whitelist represents a list of groups to synchronize - items: - type: string - type: array - required: - - url - type: object - name: - description: Name represents the name of the provider - type: string - okta: - description: Okta represents the Okta provider - properties: - appId: - description: AppId is the id of the application we are syncing groups for - type: string - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the Okta server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - extractLoginUsername: - description: ExtractLoginUsername is true if Okta username's are defaulted to emails and you would like the username only - type: boolean - groupLimit: - description: GroupLimit is the maximum number of groups that are requested from OKTA per request. Multiple requests will be made using pagination if you have more groups than this limit. Default is "1000" - type: integer - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - profileKey: - description: ProfileKey the attribute from Okta you would like to use as the user identifier. Default is "login" - type: string - prune: - description: Prune Whether to prune groups that are no longer in OKTA. Default is false - type: boolean - url: - description: URL is the location of the Okta domain server - type: string - required: - - appId - - credentialsSecret - - url - type: object - required: - - name - type: object - type: array - schedule: - description: Schedule represents a cron based configuration for synchronization - type: string - type: object - status: - description: GroupSyncStatus defines the observed state of GroupSync - properties: - conditions: - items: - description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" - properties: - lastTransitionTime: - description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: message is a human readable message indicating details about the transition. This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - lastSyncSuccessTime: - description: LastSyncSuccessTime represents the time last synchronization completed successfully - format: date-time - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/.helmignore b/components/authentication/helm-charts/group-sync-operator-chart/.helmignore deleted file mode 100644 index 0e8a0eb36f4..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/components/authentication/helm-charts/group-sync-operator-chart/Chart.yaml b/components/authentication/helm-charts/group-sync-operator-chart/Chart.yaml deleted file mode 100644 index 93a99722fb4..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/Chart.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -name: group-sync-operator -version: 0.1.0 -appVersion: latest -description: Helm chart that deploys the group-sync-operator -keywords: - - authorization - - security -sources: - - https://github.com/glevi-rh/group-sync-operator diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/_helpers.tpl b/components/authentication/helm-charts/group-sync-operator-chart/templates/_helpers.tpl deleted file mode 100644 index d417128bb3e..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/_helpers.tpl +++ /dev/null @@ -1,85 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "group-sync-operator.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "group-sync-operator.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "group-sync-operator.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "group-sync-operator.labels" -}} -helm.sh/chart: {{ include "group-sync-operator.chart" . }} -{{ include "group-sync-operator.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.commonLabels }} -{{ toYaml .Values.commonLabels }} -{{- end }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "group-sync-operator.selectorLabels" -}} -app.kubernetes.io/name: {{ include "group-sync-operator.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - - -{{/* -Service Acount Name -*/}} -{{- define "group-sync-operator.serviceAccountName" -}} -{{- printf "%s-%s" (include "group-sync-operator.name" .) "controller-manager" }} -{{- end }} - -{{/* -Create the image path for the passed in image field -*/}} -{{- define "group-sync-operator.image" -}} -{{- if eq (substr 0 7 .version) "sha256:" -}} -{{- printf "%s@%s" .repository .version -}} -{{- else -}} -{{- printf "%s:%s" .repository .version -}} -{{- end -}} -{{- end -}} - -{{/* -Check if WATCH_NAMESPACE environment variable has been provided -*/}} -{{- define "group-sync-operator.checkWatchNamespace" -}} -{{- range .Values.env -}} -{{- if eq .name "WATCH_NAMESPACE" -}} -{{- print "true" -}} -{{- end -}} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_client_clusterrole.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_client_clusterrole.yaml deleted file mode 100644 index bd4af137a9f..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_client_clusterrole.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: metrics-reader -rules: -- nonResourceURLs: ["/metrics"] - verbs: ["get"] diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role.yaml deleted file mode 100644 index 618f5e4177c..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: proxy-role -rules: -- apiGroups: ["authentication.k8s.io"] - resources: - - tokenreviews - verbs: ["create"] -- apiGroups: ["authorization.k8s.io"] - resources: - - subjectaccessreviews - verbs: ["create"] diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role_binding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role_binding.yaml deleted file mode 100644 index 558667b285b..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role_binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: proxy-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: proxy-role -subjects: -- kind: ServiceAccount - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_service.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_service.yaml deleted file mode 100644 index 4030ced8776..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_service.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - control-plane: group-sync-operator - {{- include "group-sync-operator.labels" . | nindent 4 }} - annotations: - service.alpha.openshift.io/serving-cert-secret-name: group-sync-operator-certs - name: controller-manager-metrics-service - namespace: {{ .Release.Namespace }} -spec: - ports: - - name: https - port: 8443 - targetPort: https - selector: - control-plane: group-sync-operator diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_editor_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_editor_role.yaml deleted file mode 100644 index 25b08cd4fb9..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_editor_role.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# permissions for end users to edit groupsyncs. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: groupsync-editor-role -rules: -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs/status - verbs: - - get diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_viewer_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_viewer_role.yaml deleted file mode 100644 index 0e286e366da..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_viewer_role.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# permissions for end users to view groupsyncs. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: groupsync-viewer-role -rules: -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs - verbs: - - get - - list - - watch -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs/status - verbs: - - get diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role.yaml deleted file mode 100644 index 645c961512c..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role.yaml +++ /dev/null @@ -1,38 +0,0 @@ -# permissions to do leader election. -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: leader-election-role - namespace: {{ .Release.Namespace }} -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role_binding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role_binding.yaml deleted file mode 100644 index 5b4f868d813..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role_binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: leader-election-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: leader-election-role -subjects: -- kind: ServiceAccount - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/manager.yaml deleted file mode 100644 index c8b37d06009..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager.yaml +++ /dev/null @@ -1,114 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "group-sync-operator.fullname" . }} - labels: - {{- include "group-sync-operator.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "group-sync-operator.selectorLabels" . | nindent 6 }} - replicas: {{ .Values.replicaCount }} - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "group-sync-operator.selectorLabels" . | nindent 8 }} - control-plane: group-sync-operator - {{- with .Values.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - serviceAccountName: {{ include "group-sync-operator.serviceAccountName" . }} - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --tls-cert-file=/etc/certs/tls/tls.crt - - --tls-private-key-file=/etc/certs/tls/tls.key - image: "{{ template "group-sync-operator.image" .Values.kube_rbac_proxy.image }}" - name: kube-rbac-proxy - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - ports: - - containerPort: 8443 - name: https - volumeMounts: - - mountPath: /etc/certs/tls - name: tls-cert - imagePullPolicy: {{ .Values.kube_rbac_proxy.image.pullPolicy }} - {{- with .Values.env }} - env: - {{- toYaml . | nindent 10 }} - {{- end }} - resources: - {{- toYaml .Values.kube_rbac_proxy.resources | nindent 12 }} - - command: - - /manager - args: - - --health-probe-bind-address=:8081 - - --metrics-addr=127.0.0.1:8080 - - --leader-elect - image: "{{ template "group-sync-operator.image" .Values.image }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - name: {{ .Chart.Name }} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - env: - {{- if eq (include "group-sync-operator.checkWatchNamespace" .) "" }} - - name: WATCH_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- end }} - {{- with .Values.env }} - {{- toYaml . | nindent 12 }} - {{- end }} - volumeMounts: - - mountPath: /tmp - name: tmp-dir - resources: - {{- toYaml .Values.resources | nindent 12 }} - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - volumes: - - name: tls-cert - secret: - defaultMode: 420 - secretName: group-sync-operator-certs - - name: tmp-dir - emptyDir: {} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/manager_role.yaml deleted file mode 100644 index 458a7a50664..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager_role.yaml +++ /dev/null @@ -1,51 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: manager-role -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - get -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs/status - verbs: - - get - - patch - - update -- apiGroups: - - user.openshift.io - resources: - - groups - verbs: - - create - - delete - - get - - list - - patch - - update - - watch diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/monitor.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/monitor.yaml deleted file mode 100644 index 5a9926d85a5..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/monitor.yaml +++ /dev/null @@ -1,25 +0,0 @@ -# Prometheus Monitor Service (Metrics) -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - labels: - control-plane: group-sync-operator - {{- include "group-sync-operator.labels" . | nindent 4 }} - name: controller-manager-metrics-monitor - namespace: {{ .Release.Namespace }} -spec: - endpoints: - - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token - interval: 30s - port: https - scheme: https - tlsConfig: - ca: - secret: - key: 'tls.crt' - name: group-sync-operator-certs - optional: false - serverName: controller-manager-metrics-service.{{ .Release.Namespace }}.svc - selector: - matchLabels: - control-plane: group-sync-operator diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-role.yaml deleted file mode 100644 index 0c8f508749c..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-role.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: prometheus-k8s - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: - - "" - resources: - - endpoints - - pods - - services - verbs: - - get - - list - - watch diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-rolebinding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-rolebinding.yaml deleted file mode 100644 index ec02c18bf86..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-rolebinding.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: prometheus-k8s - namespace: {{ .Release.Namespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prometheus-k8s -subjects: - - kind: ServiceAccount - name: prometheus-k8s - namespace: openshift-monitoring diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/role_binding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/role_binding.yaml deleted file mode 100644 index 70e05a47ec9..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/role_binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: manager-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: manager-role -subjects: -- kind: ServiceAccount - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/service-account.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/service-account.yaml deleted file mode 100644 index 9a29026a5d1..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/service-account.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "group-sync-operator.labels" . | nindent 4 }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/values.yaml b/components/authentication/helm-charts/group-sync-operator-chart/values.yaml deleted file mode 100644 index fed73866424..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/values.yaml +++ /dev/null @@ -1,53 +0,0 @@ -# Default values for group-sync-operator -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - repository: quay.io/konflux-ci/group-sync-operator - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: sha256:4f384c760c7821be60c8f2d9b46152c986af8723f71ad6bfc5cc8372a7c658b8 - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" -podAnnotations: {} - -podLabels: {} - -commonLabels: {} - -resources: - requests: - cpu: 300m - memory: 200Mi - limits: - cpu: 500m - memory: 512Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -env: - # - name: VAR_NAME - # value: var-value - -kube_rbac_proxy: - image: - repository: registry.redhat.io/openshift4/ose-kube-rbac-proxy - pullPolicy: IfNotPresent - version: sha256:c8336efb1269a7f40113aa9767c6dc9affe4fd830a1ca6004206bcef1d0274a3 - resources: - requests: - cpu: 100m - memory: 20Mi - limits: - cpu: 200m - memory: 128Mi - -enableMonitoring: true diff --git a/components/authentication/helm-charts/kustomization.yaml b/components/authentication/helm-charts/kustomization.yaml deleted file mode 100644 index f97463a6ac9..00000000000 --- a/components/authentication/helm-charts/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: group-sync-operator - -resources: - - crd.yaml - -helmGlobals: - chartHome: . - -helmCharts: - - name: group-sync-operator-chart - releaseName: group-sync-operator - namespace: group-sync-operator - valuesFile: group-sync-operator-chart/values.yaml diff --git a/components/authentication/helm-charts/metrics/monitor.yaml b/components/authentication/helm-charts/metrics/monitor.yaml deleted file mode 100644 index 100d71815be..00000000000 --- a/components/authentication/helm-charts/metrics/monitor.yaml +++ /dev/null @@ -1,24 +0,0 @@ ---- -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: group-sync-operator-metrics - namespace: group-sync-operator - labels: - control-plane: group-sync-operator -spec: - endpoints: - - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token - interval: 30s - port: https - scheme: https - tlsConfig: - ca: - secret: - key: tls.crt - name: group-sync-operator-certs - optional: false - serverName: controller-manager-metrics-service.group-sync-operator.svc - selector: - matchLabels: - control-plane: group-sync-operator diff --git a/components/authentication/k-components/ldap-url-patch/kustomization.yaml b/components/authentication/k-components/ldap-url-patch/kustomization.yaml deleted file mode 100644 index 6fa3abd5977..00000000000 --- a/components/authentication/k-components/ldap-url-patch/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component -patches: - - path: ldap-url-patch.yaml - target: - name: konflux-rover-groups - kind: GroupSync - group: redhatcop.redhat.io - version: v1alpha1 - - path: ldap-url-patch.yaml - target: - name: test-platform-ci-rover-groups - kind: GroupSync - group: redhatcop.redhat.io - version: v1alpha1 diff --git a/components/authentication/k-components/ldap-url-patch/ldap-url-patch.yaml b/components/authentication/k-components/ldap-url-patch/ldap-url-patch.yaml deleted file mode 100644 index 20c5dbe69d9..00000000000 --- a/components/authentication/k-components/ldap-url-patch/ldap-url-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/providers/0/ldap/url - value: ldaps://ldap.corp.redhat.com diff --git a/components/authentication/production/base/konflux-ldap-sa-patch.yaml b/components/authentication/production/base/konflux-ldap-sa-patch.yaml deleted file mode 100644 index 0d152974656..00000000000 --- a/components/authentication/production/base/konflux-ldap-sa-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/dataFrom/0/extract/key - value: production/infrastructure/group-sync/konflux-ldap-sa diff --git a/components/authentication/production/base/kustomization.yaml b/components/authentication/production/base/kustomization.yaml index fe127a8ea56..0691bcd59e4 100644 --- a/components/authentication/production/base/kustomization.yaml +++ b/components/authentication/production/base/kustomization.yaml @@ -2,10 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base - - ../../helm-charts -images: - - name: quay.io/konflux-ci/group-sync-operator - digest: sha256:4f384c760c7821be60c8f2d9b46152c986af8723f71ad6bfc5cc8372a7c658b8 patches: - path: rhtap-infra-secrets-patch.yaml target: @@ -13,15 +9,3 @@ patches: kind: ExternalSecret group: external-secrets.io version: v1 - - path: konflux-ldap-sa-patch.yaml - target: - name: konflux-ldap-sa - kind: ExternalSecret - group: external-secrets.io - version: v1 - - path: mtls-ca-validators-patch.yaml - target: - name: mtls-ca-validators - kind: ExternalSecret - group: external-secrets.io - version: v1 diff --git a/components/authentication/production/base/mtls-ca-validators-patch.yaml b/components/authentication/production/base/mtls-ca-validators-patch.yaml deleted file mode 100644 index 1b92a1fb5c8..00000000000 --- a/components/authentication/production/base/mtls-ca-validators-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/dataFrom/0/extract/key - value: production/infrastructure/group-sync/mtls-ca-validators diff --git a/components/authentication/production/kflux-ocp-p01/kustomization.yaml b/components/authentication/production/kflux-ocp-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/kflux-ocp-p01/kustomization.yaml +++ b/components/authentication/production/kflux-ocp-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/kflux-osp-p01/kustomization.yaml b/components/authentication/production/kflux-osp-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/kflux-osp-p01/kustomization.yaml +++ b/components/authentication/production/kflux-osp-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/kflux-rhel-p01/kustomization.yaml b/components/authentication/production/kflux-rhel-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/kflux-rhel-p01/kustomization.yaml +++ b/components/authentication/production/kflux-rhel-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/stone-prod-p01/kustomization.yaml b/components/authentication/production/stone-prod-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/stone-prod-p01/kustomization.yaml +++ b/components/authentication/production/stone-prod-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/stone-prod-p02/kustomization.yaml b/components/authentication/production/stone-prod-p02/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/stone-prod-p02/kustomization.yaml +++ b/components/authentication/production/stone-prod-p02/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/staging/base/kustomization.yaml b/components/authentication/staging/base/kustomization.yaml index a228a024a0b..2333422e2d3 100644 --- a/components/authentication/staging/base/kustomization.yaml +++ b/components/authentication/staging/base/kustomization.yaml @@ -2,7 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base - - ../../helm-charts -images: - - name: quay.io/konflux-ci/group-sync-operator - digest: sha256:4f384c760c7821be60c8f2d9b46152c986af8723f71ad6bfc5cc8372a7c658b8 diff --git a/components/authentication/staging/stone-stage-p01/kustomization.yaml b/components/authentication/staging/stone-stage-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/staging/stone-stage-p01/kustomization.yaml +++ b/components/authentication/staging/stone-stage-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/backup/base/member/schedules/backup-tenants-schedule.yaml b/components/backup/base/member/schedules/backup-tenants-schedule.yaml index d0ca81c6576..df5f296053a 100644 --- a/components/backup/base/member/schedules/backup-tenants-schedule.yaml +++ b/components/backup/base/member/schedules/backup-tenants-schedule.yaml @@ -23,7 +23,6 @@ spec: - dora-metrics - enterprise-contract-service - external-secrets-operator - - group-sync-operator - hac-pact-broker - image-controller - integration-service diff --git a/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml b/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml index 0f228d1bca9..9be2cd1f1b0 100644 --- a/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml +++ b/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml @@ -24,7 +24,6 @@ spec: - dora-metrics - enterprise-contract-service - external-secrets-operator - - group-sync-operator - hac-pact-broker - image-controller - integration-service diff --git a/components/build-service/development/kustomization.yaml b/components/build-service/development/kustomization.yaml index 773bebcfd01..f10c7260a15 100644 --- a/components/build-service/development/kustomization.yaml +++ b/components/build-service/development/kustomization.yaml @@ -2,14 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -- https://github.com/konflux-ci/build-service/config/default?ref=1da4f0fa542a61f212a15c2789f478610db31133 +- https://github.com/konflux-ci/build-service/config/default?ref=04a4744321a7fb747f796da783d51fc322aef598 namespace: build-service images: - name: quay.io/konflux-ci/build-service newName: quay.io/konflux-ci/build-service - newTag: b1d1753245617e47679b3366b2baa0e4ea6b8007 + newTag: 04a4744321a7fb747f796da783d51fc322aef598 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/build-service/production/base/kustomization.yaml b/components/build-service/production/base/kustomization.yaml index c971c55be2e..17374c74ec6 100644 --- a/components/build-service/production/base/kustomization.yaml +++ b/components/build-service/production/base/kustomization.yaml @@ -3,14 +3,14 @@ kind: Kustomization resources: - ../../base - ../../base/external-secrets -- https://github.com/konflux-ci/build-service/config/default?ref=1da4f0fa542a61f212a15c2789f478610db31133 +- https://github.com/konflux-ci/build-service/config/default?ref=04a4744321a7fb747f796da783d51fc322aef598 namespace: build-service images: - name: quay.io/konflux-ci/build-service newName: quay.io/konflux-ci/build-service - newTag: b1d1753245617e47679b3366b2baa0e4ea6b8007 + newTag: 04a4744321a7fb747f796da783d51fc322aef598 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/build-service/staging/base/kustomization.yaml b/components/build-service/staging/base/kustomization.yaml index 0c0d7f89f46..df69b2c888f 100644 --- a/components/build-service/staging/base/kustomization.yaml +++ b/components/build-service/staging/base/kustomization.yaml @@ -3,14 +3,14 @@ kind: Kustomization resources: - ../../base - ../../base/external-secrets -- https://github.com/konflux-ci/build-service/config/default?ref=1da4f0fa542a61f212a15c2789f478610db31133 +- https://github.com/konflux-ci/build-service/config/default?ref=04a4744321a7fb747f796da783d51fc322aef598 namespace: build-service images: - name: quay.io/konflux-ci/build-service newName: quay.io/konflux-ci/build-service - newTag: b1d1753245617e47679b3366b2baa0e4ea6b8007 + newTag: 04a4744321a7fb747f796da783d51fc322aef598 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml b/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml index dae50c1c938..a35247b9d0d 100644 --- a/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml +++ b/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml @@ -32,7 +32,6 @@ spec: - dynatrace - application-service - appstudio-workload-monitoring - - group-sync-operator - build-templates - build-templates-e2e - build-service diff --git a/components/cluster-secret-store/production/kustomization.yaml b/components/cluster-secret-store/production/kustomization.yaml index f25717812c1..fec7cc04514 100644 --- a/components/cluster-secret-store/production/kustomization.yaml +++ b/components/cluster-secret-store/production/kustomization.yaml @@ -9,6 +9,12 @@ patches: kind: ClusterSecretStore group: external-secrets.io version: v1 + - path: perfscale-namespaces-patch.yaml + target: + name: appsre-stonesoup-vault + kind: ClusterSecretStore + group: external-secrets.io + version: v1 - path: approle-id-patch.yaml target: name: appsre-vault diff --git a/components/cluster-secret-store/production/perfscale-namespaces-patch.yaml b/components/cluster-secret-store/production/perfscale-namespaces-patch.yaml new file mode 100644 index 00000000000..e5d8bdc6be7 --- /dev/null +++ b/components/cluster-secret-store/production/perfscale-namespaces-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-2-tenant +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-3-tenant diff --git a/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml b/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml index 3bc966ece22..3bab439ec8d 100644 --- a/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml +++ b/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml @@ -2,3 +2,9 @@ - op: add path: /spec/conditions/0/namespaces/- value: rhtap-promotion-staging +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-2-tenant +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-3-tenant diff --git a/components/dummy-deployment/overlays/development/kustomization.yaml b/components/dummy-deployment/overlays/development/kustomization.yaml index 6bfe0ab1195..28d50f08e9e 100644 --- a/components/dummy-deployment/overlays/development/kustomization.yaml +++ b/components/dummy-deployment/overlays/development/kustomization.yaml @@ -1,20 +1,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization - resources: - - ../../base - - https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=6581c25de3b4979c7d4653fc48c9e01818493d4a - +- ../../base +- https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=dc87f05445031d218b6b66a583513d051ce0ef84 images: - - name: quay.io/redhat-appstudio-qe/dummy-deployment - newName: quay.io/redhat-appstudio-qe/dummy-deployment - newTag: 6581c25de3b4979c7d4653fc48c9e01818493d4a - +- name: quay.io/redhat-appstudio-qe/dummy-deployment + newTag: dc87f05445031d218b6b66a583513d051ce0ef84 patches: - - target: - kind: ConfigMap - name: dummy-deployment-config - patch: | - - op: replace - path: /data/DISPLAY_TEXT - value: "Hello from DEVELOPMENT!" +- target: + kind: ConfigMap + name: dummy-deployment-config + patch: | + - op: replace + path: /data/DISPLAY_TEXT + value: "Hello from DEVELOPMENT!" diff --git a/components/dummy-deployment/overlays/staging/kustomization.yaml b/components/dummy-deployment/overlays/staging/kustomization.yaml index f56b7ccc088..560d56aa155 100644 --- a/components/dummy-deployment/overlays/staging/kustomization.yaml +++ b/components/dummy-deployment/overlays/staging/kustomization.yaml @@ -1,20 +1,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization - resources: - - ../../base - - https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=6581c25de3b4979c7d4653fc48c9e01818493d4a - +- ../../base +- https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=dc87f05445031d218b6b66a583513d051ce0ef84 images: - - name: quay.io/redhat-appstudio-qe/dummy-deployment - newName: quay.io/redhat-appstudio-qe/dummy-deployment - newTag: 6581c25de3b4979c7d4653fc48c9e01818493d4a - +- name: quay.io/redhat-appstudio-qe/dummy-deployment + newTag: dc87f05445031d218b6b66a583513d051ce0ef84 patches: - - target: - kind: ConfigMap - name: dummy-deployment-config - patch: | - - op: replace - path: /data/DISPLAY_TEXT - value: "Hello from STAGE!" +- target: + kind: ConfigMap + name: dummy-deployment-config + patch: | + - op: replace + path: /data/DISPLAY_TEXT + value: "Hello from STAGE!" diff --git a/components/image-controller/production/base/kustomization.yaml b/components/image-controller/production/base/kustomization.yaml index 9824a0fed87..ac6a5adce54 100644 --- a/components/image-controller/production/base/kustomization.yaml +++ b/components/image-controller/production/base/kustomization.yaml @@ -27,3 +27,4 @@ patches: group: external-secrets.io version: v1 - path: ./pruner_cronjob_resources_patch.yaml + - path: ./notification_resetter_cronjob_resources_patch.yaml diff --git a/components/image-controller/production/base/notification_resetter_cronjob_resources_patch.yaml b/components/image-controller/production/base/notification_resetter_cronjob_resources_patch.yaml new file mode 100644 index 00000000000..b4245d7451b --- /dev/null +++ b/components/image-controller/production/base/notification_resetter_cronjob_resources_patch.yaml @@ -0,0 +1,19 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: image-controller-notification-resetter-cronjob + namespace: image-controller-system +spec: + jobTemplate: + spec: + template: + spec: + containers: + - name: notification-resetter + resources: + limits: + cpu: 500m + memory: 1Gi + requests: + cpu: 150m + memory: 1Gi diff --git a/components/image-controller/production/kflux-fedora-01/image-pruner-token.yaml b/components/image-controller/production/kflux-fedora-01/image-pruner-token.yaml new file mode 100644 index 00000000000..568b4c2d690 --- /dev/null +++ b/components/image-controller/production/kflux-fedora-01/image-pruner-token.yaml @@ -0,0 +1,4 @@ +--- +- op: replace + path: /spec/dataFrom/0/extract/key + value: production/build/image-pruner-token-fedora diff --git a/components/image-controller/production/kflux-fedora-01/kustomization.yaml b/components/image-controller/production/kflux-fedora-01/kustomization.yaml new file mode 100644 index 00000000000..e4779e0a820 --- /dev/null +++ b/components/image-controller/production/kflux-fedora-01/kustomization.yaml @@ -0,0 +1,18 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../base + +patches: + - path: quaytoken.yaml + target: + name: quaytoken + kind: ExternalSecret + group: external-secrets.io + version: v1 + - path: image-pruner-token.yaml + target: + name: image-pruner-token + kind: ExternalSecret + group: external-secrets.io + version: v1 diff --git a/components/image-controller/production/kflux-fedora-01/quaytoken.yaml b/components/image-controller/production/kflux-fedora-01/quaytoken.yaml new file mode 100644 index 00000000000..6b1bc830835 --- /dev/null +++ b/components/image-controller/production/kflux-fedora-01/quaytoken.yaml @@ -0,0 +1,4 @@ +--- +- op: replace + path: /spec/dataFrom/0/extract/key + value: production/build/image-controller-fedora diff --git a/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml b/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml index 78dde65baee..eab24ec3f2c 100644 --- a/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml +++ b/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml @@ -4,7 +4,7 @@ metadata: name: image-rbac-proxy namespace: image-rbac-proxy data: - backend-namespace: redhat-user-workloads + backend-namespace: konflux-fedora cluster-url: https://api.kflux-fedora-01.84db.p1.openshiftapps.com:6443 proxy-url: https://image-rbac-proxy.apps.kflux-fedora-01.84db.p1.openshiftapps.com dex-url: https://image-rbac-proxy.apps.kflux-fedora-01.84db.p1.openshiftapps.com/idp diff --git a/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml b/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml +++ b/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-osp-p01/banner-content.yaml b/components/konflux-info/production/kflux-osp-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-osp-p01/banner-content.yaml +++ b/components/konflux-info/production/kflux-osp-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml b/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml +++ b/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml b/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml +++ b/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml b/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml +++ b/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/stone-prd-rh01/banner-content.yaml b/components/konflux-info/production/stone-prd-rh01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/stone-prd-rh01/banner-content.yaml +++ b/components/konflux-info/production/stone-prd-rh01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/stone-prod-p01/banner-content.yaml b/components/konflux-info/production/stone-prod-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/stone-prod-p01/banner-content.yaml +++ b/components/konflux-info/production/stone-prod-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/stone-prod-p02/banner-content.yaml b/components/konflux-info/production/stone-prod-p02/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/stone-prod-p02/banner-content.yaml +++ b/components/konflux-info/production/stone-prod-p02/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-operator/ci/openshift-overlay-e2e/README.md b/components/konflux-operator/ci/openshift-overlay-e2e/README.md new file mode 100644 index 00000000000..88b96eef826 --- /dev/null +++ b/components/konflux-operator/ci/openshift-overlay-e2e/README.md @@ -0,0 +1,10 @@ +# OpenShift CI: `development-operator` overlay E2E + +Placeholder scripts for the optional, on-demand Prow job +`appstudio-operator-overlay-e2e-tests` (openshift/release). + +## Entrypoint + +```bash +./components/konflux-operator/ci/openshift-overlay-e2e/run.sh +``` diff --git a/components/konflux-operator/ci/openshift-overlay-e2e/run.sh b/components/konflux-operator/ci/openshift-overlay-e2e/run.sh new file mode 100755 index 00000000000..36c2eb92709 --- /dev/null +++ b/components/konflux-operator/ci/openshift-overlay-e2e/run.sh @@ -0,0 +1,13 @@ +#!/usr/bin/env bash +# OpenShift CI entrypoint for development-operator overlay E2E (conformance). +# Invoked by openshift/release after cloning infra-deployments at the PR revision. +# +# Phase 1 (current): placeholder — wiring validation only. +# Phase 2: bootstrap (preview --operator-overlay), konflux-ci conformance @ ref from +# invariant/kustomization.yaml, default-tenant namespace (no deploy-test-resources.sh). +set -euo pipefail + +echo "[openshift-operator-overlay-e2e] placeholder: noop (implementation pending)" +echo " Expected later: bootstrap development-operator, konflux-ci conformance only," +echo " E2E_APPLICATIONS_NAMESPACE=default-tenant (KonfluxDefaultTenant), no deploy-test-resources.sh" +exit 0 diff --git a/components/konflux-operator/development/cr/overlay-patches/default-tenant/default-tenant.yaml b/components/konflux-operator/development/cr/overlay-patches/default-tenant/default-tenant.yaml new file mode 100644 index 00000000000..cc8c216bbc2 --- /dev/null +++ b/components/konflux-operator/development/cr/overlay-patches/default-tenant/default-tenant.yaml @@ -0,0 +1,7 @@ +apiVersion: konflux.konflux-ci.dev/v1alpha1 +kind: Konflux +metadata: + name: konflux +spec: + defaultTenant: + enabled: true diff --git a/components/konflux-operator/development/cr/overlay-patches/default-tenant/kustomization.yaml b/components/konflux-operator/development/cr/overlay-patches/default-tenant/kustomization.yaml new file mode 100644 index 00000000000..3789e4bd6c4 --- /dev/null +++ b/components/konflux-operator/development/cr/overlay-patches/default-tenant/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - path: default-tenant.yaml diff --git a/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml b/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml index d453dd0e3c8..3ca388c2fc1 100644 --- a/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml +++ b/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml @@ -4,4 +4,6 @@ metadata: name: konflux spec: imageController: - enabled: true + # patched by hack/preview.sh if IMAGE_CONTROLLER_QUAY_ORG and + # IMAGE_CONTROLLER_QUAY_TOKEN are set + enabled: false diff --git a/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml b/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml index 2d00cbe994f..59c25ef9cd2 100644 --- a/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml +++ b/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml @@ -10,7 +10,7 @@ spec: httpsPort: 30011 proxy: replicas: 1 - nginx: + reverseProxy: resources: requests: cpu: 30m diff --git a/components/konflux-operator/development/invariant/kustomization.yaml b/components/konflux-operator/development/invariant/kustomization.yaml index e4504f5e8ca..4c3881f38ae 100644 --- a/components/konflux-operator/development/invariant/kustomization.yaml +++ b/components/konflux-operator/development/invariant/kustomization.yaml @@ -6,7 +6,7 @@ kind: Kustomization # Parent `../kustomization.yaml` adds per-team overlays from `../cr/overlay-patches/`. resources: # Upstream operator config (konflux-ci builds install.yaml from this layout). - - https://github.com/konflux-ci/konflux-ci/operator/config/default?ref=0bace1e20ff164a00e9d6becfce52e310a921931 + - https://github.com/konflux-ci/konflux-ci/operator/config/default?ref=8618e289d55d2b272cfb8de35ccbcf1c729fe19d - konflux.yaml patches: @@ -15,4 +15,4 @@ patches: images: - name: localhost/konflux-operator newName: quay.io/konflux-ci/konflux-operator - newTag: 0bace1e20ff164a00e9d6becfce52e310a921931 + newTag: 8618e289d55d2b272cfb8de35ccbcf1c729fe19d diff --git a/components/konflux-operator/development/invariant/release-config.yaml b/components/konflux-operator/development/invariant/release-config.yaml index 3b4ab410ce1..bfccd1b44c6 100644 --- a/components/konflux-operator/development/invariant/release-config.yaml +++ b/components/konflux-operator/development/invariant/release-config.yaml @@ -7,6 +7,6 @@ spec: certManager: createClusterIssuer: true internalRegistry: - enabled: true + enabled: false defaultTenant: - enabled: true + enabled: false diff --git a/components/konflux-operator/development/kustomization.yaml b/components/konflux-operator/development/kustomization.yaml index 2b0b4a132f9..2e4ac7edc13 100644 --- a/components/konflux-operator/development/kustomization.yaml +++ b/components/konflux-operator/development/kustomization.yaml @@ -10,6 +10,7 @@ kind: Kustomization resources: - invariant components: + - cr/overlay-patches/default-tenant - cr/overlay-patches/build - cr/overlay-patches/image-controller - cr/overlay-patches/integration diff --git a/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml b/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml index 926d9cf59dc..175a2d27c81 100644 --- a/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml +++ b/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml @@ -159,6 +159,14 @@ rules: resources: - cronjobs - jobs + - verbs: + - get + - list + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles - verbs: - get - list @@ -169,7 +177,6 @@ rules: apiGroups: - rbac.authorization.k8s.io resources: - - roles - rolebindings - verbs: - get diff --git a/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml b/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml index 926d9cf59dc..175a2d27c81 100644 --- a/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml +++ b/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml @@ -159,6 +159,14 @@ rules: resources: - cronjobs - jobs + - verbs: + - get + - list + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles - verbs: - get - list @@ -169,7 +177,6 @@ rules: apiGroups: - rbac.authorization.k8s.io resources: - - roles - rolebindings - verbs: - get diff --git a/components/konflux-ui/production/base/kustomization.yaml b/components/konflux-ui/production/base/kustomization.yaml index 33aa6477e8b..ecf1f2f46a7 100644 --- a/components/konflux-ui/production/base/kustomization.yaml +++ b/components/konflux-ui/production/base/kustomization.yaml @@ -11,7 +11,7 @@ images: digest: sha256:48df30520a766101473e80e7a4abbf59ce06097a5f5919e15075afaa86bd1a2d - name: quay.io/konflux-ci/konflux-ui - newTag: ed23c9b83394454b5822049748939a26a5626093 + newTag: 1e667c457a66dfe556f03a7c8e84087e15262b0c - name: quay.io/oauth2-proxy/oauth2-proxy digest: sha256:3da33b9670c67bd782277f99acadf7026f75b9507bfba2088eb2d497266ef7fc diff --git a/components/konflux-ui/production/base/proxy/kustomization.yaml b/components/konflux-ui/production/base/proxy/kustomization.yaml index 1c632296456..1a669027d27 100644 --- a/components/konflux-ui/production/base/proxy/kustomization.yaml +++ b/components/konflux-ui/production/base/proxy/kustomization.yaml @@ -10,6 +10,13 @@ configMapGenerator: - name: proxy-nginx-templates files: - auth.conf + - name: proxy-nginx-run + files: + - proxy-nginx-run.sh=scripts/proxy-nginx-run.sh + - name: proxy-nginx-generate-loop + files: + - proxy-nginx-generate-loop.sh=scripts/proxy-nginx-generate-loop.sh + - proxy-nginx-generate-loop-probe.sh=scripts/proxy-nginx-generate-loop-probe.sh - name: proxy-nginx-static files: - tekton-results.conf diff --git a/components/konflux-ui/production/base/proxy/proxy.yaml b/components/konflux-ui/production/base/proxy/proxy.yaml index c6648654bd7..80cb6c46d03 100644 --- a/components/konflux-ui/production/base/proxy/proxy.yaml +++ b/components/konflux-ui/production/base/proxy/proxy.yaml @@ -61,18 +61,19 @@ spec: set -e # Generate auth.conf with bearer token replacement - token=$(cat /mnt/api-token/token) + token=$(cat /var/run/secrets/konflux-ci.dev/serviceaccount/token) sed "s/__BEARER_TOKEN__/$token/g" /mnt/nginx-templates/auth.conf > /mnt/nginx-generated-config/auth.conf chmod 640 /mnt/nginx-generated-config/auth.conf volumeMounts: + - mountPath: /var/run/secrets/konflux-ci.dev/serviceaccount + name: kube-api-token + readOnly: true - name: nginx-generated-config mountPath: /mnt/nginx-generated-config - name: nginx-templates mountPath: /mnt/nginx-templates - - name: api-token - mountPath: /mnt/api-token securityContext: readOnlyRootFilesystem: true runAsNonRoot: true @@ -85,14 +86,48 @@ spec: cpu: 10m memory: 64Mi containers: + - name: generate-nginx-configs-loop + image: quay.io/konflux-ci/konflux-ui:68500b32e57278bf33ac18d4ef631ef243abb579 + command: + - bash + args: + - "/var/run/scripts/konflux-ci.dev/proxy-nginx-generate-loop.sh" + livenessProbe: + exec: + command: + - bash + - "/var/run/scripts/konflux-ci.dev/proxy-nginx-generate-loop-probe.sh" + initialDelaySeconds: 30 + periodSeconds: 30 + failureThreshold: 3 + volumeMounts: + - mountPath: /var/run/scripts/konflux-ci.dev/ + name: proxy-generate-loop-script + readOnly: true + - mountPath: /var/run/secrets/konflux-ci.dev/serviceaccount + name: kube-api-token + readOnly: true + - name: nginx-generated-config + mountPath: /mnt/nginx-generated-config + - name: nginx-templates + mountPath: /mnt/nginx-templates + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi - image: registry.access.redhat.com/ubi9/nginx-124@sha256:b924363ff07ee0f8fd4f680497da774ac0721722a119665998ff5b2111098ad1 name: nginx command: - - nginx - - "-g" - - "daemon off;" - - -c - - /etc/nginx/nginx.conf + - bash + args: + - "/var/run/scripts/konflux-ci.dev/proxy-nginx-run.sh" livenessProbe: failureThreshold: 3 httpGet: @@ -128,6 +163,9 @@ spec: cpu: 30m memory: 128Mi volumeMounts: + - mountPath: /var/run/scripts/konflux-ci.dev/ + name: proxy-nginx-run-script + readOnly: true - mountPath: /etc/nginx/nginx.conf subPath: nginx.conf name: proxy @@ -238,6 +276,29 @@ spec: cpu: 50m memory: 128Mi volumes: + - name: proxy-generate-loop-script + configMap: + defaultMode: 0750 + name: proxy-nginx-generate-loop + items: + - key: proxy-nginx-generate-loop.sh + path: proxy-nginx-generate-loop.sh + - key: proxy-nginx-generate-loop-probe.sh + path: proxy-nginx-generate-loop-probe.sh + - name: proxy-nginx-run-script + configMap: + defaultMode: 0750 + name: proxy-nginx-run + items: + - key: proxy-nginx-run.sh + path: proxy-nginx-run.sh + - name: kube-api-token + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + expirationSeconds: 600 + path: token - configMap: defaultMode: 420 name: proxy @@ -264,9 +325,6 @@ spec: secretName: serving-cert - name: nginx-generated-config emptyDir: {} - - name: api-token - secret: - secretName: proxy - name: static-content emptyDir: {} - configMap: @@ -310,14 +368,6 @@ kind: ServiceAccount metadata: name: proxy --- -apiVersion: v1 -kind: Secret -metadata: - name: proxy - annotations: - kubernetes.io/service-account.name: proxy -type: kubernetes.io/service-account-token ---- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop-probe.sh b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop-probe.sh new file mode 100644 index 00000000000..d545b25cab6 --- /dev/null +++ b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop-probe.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +set -euo pipefail + +for cmd in date stat; do + command -v "${cmd}" >/dev/null 2>&1 || { echo "required command not found: ${cmd}"; exit 1; } +done + +AUTH_CONF_FILE=/mnt/nginx-generated-config/auth.conf +AUTH_CONF_NEW_FILE=/mnt/nginx-generated-config/auth.conf.new + +{ [ -f "${AUTH_CONF_NEW_FILE}" ] && [ $(( $(date +%s) - $(stat -c %Y "${AUTH_CONF_NEW_FILE}") )) -lt 60 ]; } || \ + { [ -f "${AUTH_CONF_FILE}" ] && [ $(( $(date +%s) - $(stat -c %Y "${AUTH_CONF_FILE}") )) -lt 60 ]; } diff --git a/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop.sh b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop.sh new file mode 100644 index 00000000000..62bc290de19 --- /dev/null +++ b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop.sh @@ -0,0 +1,40 @@ +#!/bin/bash + +set -euo pipefail + +RETRY_INTERVAL=10 +TOKEN_FILEPATH=/var/run/secrets/konflux-ci.dev/serviceaccount/token +AUTH_CONF_FILE=/mnt/nginx-generated-config/auth.conf.new +AUTH_CONF_TMP_FILE=/mnt/nginx-generated-config/auth.conf.new.tmp +AUTH_CONF_TEMPLATE_FILE=/mnt/nginx-templates/auth.conf + +for cmd in cat sed chmod mv sleep date; do + command -v "${cmd}" >/dev/null 2>&1 || { echo "required command not found: ${cmd}"; exit 1; } +done + +log() { echo "$(date -Iseconds) generate-loop: $*"; } + +log "starting" + +produceToken() ( + # Copy the auth.conf template and replace the bearer token + token=$(cat "${TOKEN_FILEPATH}") + + # Produce a tmp file + sed "s/__BEARER_TOKEN__/${token}/" "${AUTH_CONF_TEMPLATE_FILE}" > "${AUTH_CONF_TMP_FILE}" + chmod 640 "${AUTH_CONF_TMP_FILE}" + + # Rename (atomic) the file to avoid sync issues + mv "${AUTH_CONF_TMP_FILE}" "${AUTH_CONF_FILE}" +) + +produceTokenWithRetry() ( + produceToken || \ + { sleep 3; produceToken; } || \ + { sleep 5; produceToken; } +) + +while produceTokenWithRetry; do sleep "${RETRY_INTERVAL}"; done + +echo "loop broke, crashing" +exit 1 diff --git a/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-run.sh b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-run.sh new file mode 100644 index 00000000000..1de84b7557c --- /dev/null +++ b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-run.sh @@ -0,0 +1,66 @@ +#!/bin/bash + +set -euo pipefail + +NGINX_AUTH_CONF_FILE='/mnt/nginx-generated-config/auth.conf' +NGINX_NEW_AUTH_CONF_FILE='/mnt/nginx-generated-config/auth.conf.new' + +NGINX_CONF_FILE='/etc/nginx/nginx.conf' +RETRY_INTERVAL=10 + +for cmd in nginx cksum mv sleep date; do + command -v "${cmd}" >/dev/null 2>&1 || { echo "required command not found: ${cmd}"; exit 1; } +done + +log() { echo "$(date -Iseconds) proxy-nginx-run: $*"; } + +log "starting" + +# test configuration +nginx -g "daemon off;" -c "${NGINX_CONF_FILE}" -t + +# run the hot-reload loop in background +( + # wait for nginx to start before first reload attempt + while [ ! -f /run/nginx.pid ]; do sleep 1; done + + log "hot-reload loop started" + + # retries hot reloading the nginx configuration multiple + # times with increasing timeouts before returning the error + reloadWithRetry() { + if [ -f "${NGINX_NEW_AUTH_CONF_FILE}" ] && \ + [ "$(cksum < "${NGINX_NEW_AUTH_CONF_FILE}")" != "$(cksum < "${NGINX_AUTH_CONF_FILE}")" ]; then + log "config changed, reloading nginx" + # Move (atomic) the new configuration and reload it in NGINX + mv "${NGINX_NEW_AUTH_CONF_FILE}" "${NGINX_AUTH_CONF_FILE}" && \ + { + nginx -s reload || \ + { sleep 3; nginx -s reload; } || \ + { sleep 5; nginx -s reload; } + } + fi + } + + # hot reload infinite loop + while reloadWithRetry; do sleep "${RETRY_INTERVAL}"; done + + log "loop broke, crashing" + exit 1 +) & +RELOAD_PID=$! + +# run the nginx server in background +( + nginx -g "daemon off;" -c "${NGINX_CONF_FILE}" + log "nginx crashed" + exit 1 +) & +# forward SIGTERM/SIGINT for graceful shutdown +trap 'log "received signal, shutting down"; nginx -s quit 2>/dev/null; kill "${RELOAD_PID}" 2>/dev/null; wait; exit 0' TERM INT + +# wait for any of the background tasks to crash +wait -n +EXIT_CODE=$? +log "child exited with code ${EXIT_CODE}, terminating" +exit "${EXIT_CODE}" diff --git a/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml index b7733c929d0..d4cf4f3c175 100644 --- a/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:2b13f3d1921be90df96ae0c6f8d14ca7936ebb6b@sha256:8c923e6d93d5f4541bc5bc9a19e92c42413f48f57490df595488c27ecdf80f9c + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml index 0e34d2388f4..fa08442b63d 100644 --- a/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml index bdac634b3d5..f1dda42f80c 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..24a649fa76c 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,6 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser + +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml index 2f51cc062d3..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:610e03266bfd0b30e53fc51dbdd56debb33cbe5b@sha256:ecc156d6fb19032ba817a8c4bc41e7453a061db173655f0500afbe8d68dcaf59 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml index 02d4fd44253..b55eec1b85c 100644 --- a/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml index 117aae75f28..4521b614e86 100644 --- a/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml index 7892819994d..870077fe5e0 100644 --- a/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml index 763368e420b..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:832a8c1360cfbb68db63813bd5cfa0c6c2a9b54d@sha256:c06432ceda6fe759c548b19c9784d34c63101909be98d82203be9d04656f6d78 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml index 23a2ea2bbe9..e6b3c55b976 100644 --- a/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml index ee3e70fb1a7..1fc0899edf0 100644 --- a/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..24a649fa76c 100644 --- a/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,6 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser + +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml index ea18a09b25f..22ead7b8458 100644 --- a/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml index b43257e5952..ca931007a83 100644 --- a/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..24a649fa76c 100644 --- a/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,6 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser + +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml index 28886774e95..d3576f461f8 100644 --- a/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml index 28886774e95..d3576f461f8 100644 --- a/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/kubearchive/development/kubearchive.yaml b/components/kubearchive/development/kubearchive.yaml index 4e85291246f..59e250253ba 100644 --- a/components/kubearchive/development/kubearchive.yaml +++ b/components/kubearchive/development/kubearchive.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/component: namespace app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive --- apiVersion: apiextensions.k8s.io/v1 @@ -552,7 +552,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive --- @@ -563,7 +563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-cluster-vacuum namespace: kubearchive --- @@ -574,7 +574,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -585,7 +585,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive --- @@ -596,7 +596,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive rules: @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive rules: @@ -659,7 +659,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server rules: - apiGroups: @@ -677,7 +677,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-edit app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-edit: "true" name: kubearchive-edit rules: @@ -791,7 +791,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-editor app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-editor rules: - apiGroups: @@ -820,7 +820,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-viewer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-viewer rules: - apiGroups: @@ -844,7 +844,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-view app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-view: "true" name: kubearchive-view rules: @@ -868,7 +868,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive roleRef: @@ -887,7 +887,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive roleRef: @@ -906,7 +906,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server roleRef: apiGroup: rbac.authorization.k8s.io @@ -924,7 +924,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -943,7 +943,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-reader app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-reader namespace: kubearchive --- @@ -955,7 +955,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-writer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-writer namespace: kubearchive --- @@ -972,7 +972,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -990,7 +990,7 @@ metadata: app.kubernetes.io/component: database app.kubernetes.io/name: kubearchive-database-credentials app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-database-credentials namespace: kubearchive type: Opaque @@ -1002,7 +1002,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging namespace: kubearchive stringData: @@ -1016,7 +1016,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1035,7 +1035,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-webhooks app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-webhooks namespace: kubearchive spec: @@ -1058,7 +1058,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1076,7 +1076,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1130,7 +1130,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/api:v1.21.4@sha256:b176b1651fe024ecd94207f690e727eb246f57436957115274647c2947494dc8 + image: quay.io/kubearchive/api:v1.22.1@sha256:f8d51f53cca320c04ee90c607dc7ddf4e0dc1060b5fd05349c8cdb9d61bab83e livenessProbe: httpGet: path: /livez @@ -1182,7 +1182,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive spec: @@ -1232,7 +1232,7 @@ spec: valueFrom: resourceFieldRef: resource: limits.cpu - image: quay.io/kubearchive/operator:v1.21.4@sha256:2beeaeb53a17056249b666e8f9bd67a9a237d3394a66a651cb5caca3f8ac4901 + image: quay.io/kubearchive/operator:v1.22.1@sha256:8e50b5bb60058722910a7b073b80c92635683eb50a86191dc5994c4ecea0cbbf livenessProbe: httpGet: path: /healthz @@ -1294,7 +1294,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1346,7 +1346,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/sink:v1.21.4@sha256:3b6603fa0cdd9daf99142573a0cdddce3467cdd8d180fd795e465209584c14b0 + image: quay.io/kubearchive/sink:v1.22.1@sha256:33d01159261fafb309119df22d3b0ba1ca5b39a1476a75e6c1cdff13f890b78d livenessProbe: httpGet: path: /livez @@ -1387,7 +1387,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: cluster-vacuum namespace: kubearchive spec: @@ -1408,7 +1408,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: quay.io/kubearchive/vacuum:v1.21.4@sha256:3ededff190a125e51f2f675ae55d0559295580bda715bb2e3406d1cec7aac339 + image: quay.io/kubearchive/vacuum:v1.22.1@sha256:5dfbbb5c4f66b0573f0a42f40bc1e508dce835881b176fd397455299bfa32bfb name: vacuum restartPolicy: Never serviceAccount: kubearchive-cluster-vacuum @@ -1422,7 +1422,7 @@ metadata: app.kubernetes.io/component: kubearchive app.kubernetes.io/name: kubearchive-schema-migration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-schema-migration namespace: kubearchive spec: @@ -1438,7 +1438,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/postgresql:v1.21.4@sha256:58bcad4798c71746b0c9d11eb482a1075a9b073cbc146187fe2670df16b6d785 + image: quay.io/kubearchive/postgresql:v1.22.1@sha256:806e2c585a998ed51d14a87fac8667bdc27077a5f47d25df1a951a66f1ebacb5 name: migration resources: limits: @@ -1459,7 +1459,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server-certificate namespace: kubearchive spec: @@ -1493,7 +1493,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1515,7 +1515,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-certificate namespace: kubearchive spec: @@ -1534,7 +1534,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive namespace: kubearchive spec: @@ -1548,7 +1548,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1563,7 +1563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-mutating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -1676,7 +1676,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-validating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-validating-webhook-configuration webhooks: - admissionReviewVersions: diff --git a/components/kubearchive/development/kustomization.yaml b/components/kubearchive/development/kustomization.yaml index 7fd698b7d2c..e36fd6af520 100644 --- a/components/kubearchive/development/kustomization.yaml +++ b/components/kubearchive/development/kustomization.yaml @@ -99,7 +99,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.21.4 + image: quay.io/kubearchive/vacuum:v1.22.1 - patch: |- apiVersion: batch/v1 kind: CronJob @@ -112,7 +112,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.21.4 + image: quay.io/kubearchive/vacuum:v1.22.1 - patch: |- apiVersion: batch/v1 kind: CronJob @@ -125,7 +125,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.21.4 + image: quay.io/kubearchive/vacuum:v1.22.1 # Ensure database is ready before schema-migration job runs - patch: |- apiVersion: apps/v1 diff --git a/components/kubearchive/production/kflux-fedora-01/kustomization.yaml b/components/kubearchive/production/kflux-fedora-01/kustomization.yaml index 57ee3474c7e..96834fdbb54 100644 --- a/components/kubearchive/production/kflux-fedora-01/kustomization.yaml +++ b/components/kubearchive/production/kflux-fedora-01/kustomization.yaml @@ -340,3 +340,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml b/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml index 45b27b2be19..06eb77ce9de 100644 --- a/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml +++ b/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml @@ -336,3 +336,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-osp-p01/kustomization.yaml b/components/kubearchive/production/kflux-osp-p01/kustomization.yaml index f541a6feb77..32f5a10f9cb 100644 --- a/components/kubearchive/production/kflux-osp-p01/kustomization.yaml +++ b/components/kubearchive/production/kflux-osp-p01/kustomization.yaml @@ -338,3 +338,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml b/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml index 5249d908a37..14196ed66fc 100644 --- a/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml +++ b/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml @@ -336,3 +336,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml b/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml index d83b9b31b8f..93ee7e7d267 100644 --- a/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml +++ b/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml @@ -340,3 +340,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml b/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml index dd9b8da3b4c..a47559240d0 100644 --- a/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml +++ b/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml @@ -338,3 +338,17 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + diff --git a/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml b/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml index 04132be852a..59e250253ba 100644 --- a/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml +++ b/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/component: namespace app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive --- apiVersion: apiextensions.k8s.io/v1 @@ -552,7 +552,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive --- @@ -563,7 +563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-cluster-vacuum namespace: kubearchive --- @@ -574,7 +574,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -585,7 +585,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive --- @@ -596,7 +596,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive rules: @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive rules: @@ -659,7 +659,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server rules: - apiGroups: @@ -677,7 +677,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-edit app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-edit: "true" name: kubearchive-edit rules: @@ -791,7 +791,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-editor app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-editor rules: - apiGroups: @@ -820,7 +820,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-viewer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-viewer rules: - apiGroups: @@ -844,7 +844,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-view app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-view: "true" name: kubearchive-view rules: @@ -868,7 +868,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive roleRef: @@ -887,7 +887,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive roleRef: @@ -906,7 +906,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server roleRef: apiGroup: rbac.authorization.k8s.io @@ -924,7 +924,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -943,7 +943,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-reader app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-reader namespace: kubearchive --- @@ -955,7 +955,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-writer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-writer namespace: kubearchive --- @@ -972,7 +972,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -980,7 +980,7 @@ apiVersion: v1 data: DATABASE_DB: a3ViZWFyY2hpdmU= DATABASE_KIND: cG9zdGdyZXNxbA== - DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== + DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== # gitleaks:allow DATABASE_PORT: NTQzMg== DATABASE_URL: a3ViZWFyY2hpdmUtcncucG9zdGdyZXNxbC5zdmMuY2x1c3Rlci5sb2NhbA== DATABASE_USER: a3ViZWFyY2hpdmU= @@ -990,7 +990,7 @@ metadata: app.kubernetes.io/component: database app.kubernetes.io/name: kubearchive-database-credentials app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-database-credentials namespace: kubearchive type: Opaque @@ -1002,7 +1002,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging namespace: kubearchive stringData: @@ -1016,7 +1016,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1035,7 +1035,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-webhooks app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-webhooks namespace: kubearchive spec: @@ -1058,7 +1058,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1076,7 +1076,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1130,7 +1130,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/api:v1.20.0@sha256:43938bb7fabcc543cd3b5af0c9074196328f393d6e712f379572cca5ecfaab3c + image: quay.io/kubearchive/api:v1.22.1@sha256:f8d51f53cca320c04ee90c607dc7ddf4e0dc1060b5fd05349c8cdb9d61bab83e livenessProbe: httpGet: path: /livez @@ -1182,7 +1182,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive spec: @@ -1232,7 +1232,7 @@ spec: valueFrom: resourceFieldRef: resource: limits.cpu - image: quay.io/kubearchive/operator:v1.20.0@sha256:eb8b363f5cfddd190011aa1d0e7cdff5c50aefae0bd4207024755146b3840db9 + image: quay.io/kubearchive/operator:v1.22.1@sha256:8e50b5bb60058722910a7b073b80c92635683eb50a86191dc5994c4ecea0cbbf livenessProbe: httpGet: path: /healthz @@ -1294,7 +1294,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1346,7 +1346,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/sink:v1.20.0@sha256:8a13e20ba373f00f7e8889af2a67a61c44d9e8bab74a5c0186f324f2eb0cb120 + image: quay.io/kubearchive/sink:v1.22.1@sha256:33d01159261fafb309119df22d3b0ba1ca5b39a1476a75e6c1cdff13f890b78d livenessProbe: httpGet: path: /livez @@ -1387,7 +1387,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: cluster-vacuum namespace: kubearchive spec: @@ -1408,7 +1408,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: quay.io/kubearchive/vacuum:v1.20.0@sha256:fe373300d999379656f78860906d7a30d77af088d6ba3bfa37a102c422d45480 + image: quay.io/kubearchive/vacuum:v1.22.1@sha256:5dfbbb5c4f66b0573f0a42f40bc1e508dce835881b176fd397455299bfa32bfb name: vacuum restartPolicy: Never serviceAccount: kubearchive-cluster-vacuum @@ -1422,7 +1422,7 @@ metadata: app.kubernetes.io/component: kubearchive app.kubernetes.io/name: kubearchive-schema-migration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-schema-migration namespace: kubearchive spec: @@ -1438,7 +1438,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/postgresql:v1.20.0@sha256:0aae85e8885295c87c3241915b8be86e08d5439f38ec9de9f95b012c67633874 + image: quay.io/kubearchive/postgresql:v1.22.1@sha256:806e2c585a998ed51d14a87fac8667bdc27077a5f47d25df1a951a66f1ebacb5 name: migration resources: limits: @@ -1459,7 +1459,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server-certificate namespace: kubearchive spec: @@ -1493,7 +1493,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1515,7 +1515,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-certificate namespace: kubearchive spec: @@ -1534,7 +1534,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive namespace: kubearchive spec: @@ -1548,7 +1548,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1563,7 +1563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-mutating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -1676,7 +1676,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-validating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-validating-webhook-configuration webhooks: - admissionReviewVersions: diff --git a/components/kubearchive/production/stone-prd-rh01/kustomization.yaml b/components/kubearchive/production/stone-prd-rh01/kustomization.yaml index 06972e7c011..701d1823c82 100644 --- a/components/kubearchive/production/stone-prd-rh01/kustomization.yaml +++ b/components/kubearchive/production/stone-prd-rh01/kustomization.yaml @@ -23,7 +23,10 @@ configMapGenerator: annotations: argocd.argoproj.io/sync-wave: "-2" literals: - - MIGRATION_VERSION=5 + - MIGRATION_VERSION=13 + - name: kubearchive-deployment-schema-version + literals: + - MIGRATION_VERSION=13 - name: kubearchive-logging-writer literals: - | @@ -116,7 +119,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.20.0 + image: quay.io/kubearchive/vacuum:v1.22.1 - patch: |- apiVersion: batch/v1 @@ -125,8 +128,6 @@ patches: name: kubearchive-schema-migration namespace: kubearchive annotations: - # Needed if just the command is changed, otherwise the job needs to be deleted manually - argocd.argoproj.io/sync-options: Force=true,Replace=true argocd.argoproj.io/sync-wave: "-1" ignore-check.kube-linter.io/no-read-only-root-fs: > "This job needs to clone a repository to do its job, so it needs write access to the FS." @@ -142,8 +143,20 @@ patches: configMapKeyRef: name: kubearchive-schema-version key: MIGRATION_VERSION + - name: BATCH_SIZE + value: "10000" securityContext: runAsUser: null + # Add version suffix to Job name so syncs with unchanged version are a no-op + # (immutable Job, same name = nothing to do). On upgrade, new name = new Job + # created, old completed one pruned. Update suffix when changing MIGRATION_VERSION. + - target: + kind: Job + name: kubearchive-schema-migration + patch: |- + - op: replace + path: /metadata/name + value: kubearchive-schema-migration-v13 # We don't need the Secret as it will be created by the ExternalSecrets Operator - patch: |- $patch: delete @@ -225,7 +238,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true @@ -284,7 +297,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true @@ -341,3 +354,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/stone-prod-p01/kustomization.yaml b/components/kubearchive/production/stone-prod-p01/kustomization.yaml index 2dba38a9a35..ba522b67ed8 100644 --- a/components/kubearchive/production/stone-prod-p01/kustomization.yaml +++ b/components/kubearchive/production/stone-prod-p01/kustomization.yaml @@ -336,3 +336,17 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + diff --git a/components/kubearchive/production/stone-prod-p02/kubearchive.yaml b/components/kubearchive/production/stone-prod-p02/kubearchive.yaml index 04132be852a..4e85291246f 100644 --- a/components/kubearchive/production/stone-prod-p02/kubearchive.yaml +++ b/components/kubearchive/production/stone-prod-p02/kubearchive.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/component: namespace app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive --- apiVersion: apiextensions.k8s.io/v1 @@ -552,7 +552,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server namespace: kubearchive --- @@ -563,7 +563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-cluster-vacuum namespace: kubearchive --- @@ -574,7 +574,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator namespace: kubearchive --- @@ -585,7 +585,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-sink namespace: kubearchive --- @@ -596,7 +596,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-leader-election namespace: kubearchive rules: @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-vacuum namespace: kubearchive rules: @@ -659,7 +659,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server rules: - apiGroups: @@ -677,7 +677,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-edit app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 rbac.authorization.k8s.io/aggregate-to-edit: "true" name: kubearchive-edit rules: @@ -791,7 +791,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-editor app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-config-editor rules: - apiGroups: @@ -820,7 +820,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-viewer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-config-viewer rules: - apiGroups: @@ -844,7 +844,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-view app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 rbac.authorization.k8s.io/aggregate-to-view: "true" name: kubearchive-view rules: @@ -868,7 +868,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-leader-election namespace: kubearchive roleRef: @@ -887,7 +887,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-vacuum namespace: kubearchive roleRef: @@ -906,7 +906,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server roleRef: apiGroup: rbac.authorization.k8s.io @@ -924,7 +924,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -943,7 +943,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-reader app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-logging-reader namespace: kubearchive --- @@ -955,7 +955,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-writer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-logging-writer namespace: kubearchive --- @@ -972,7 +972,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator namespace: kubearchive --- @@ -980,7 +980,7 @@ apiVersion: v1 data: DATABASE_DB: a3ViZWFyY2hpdmU= DATABASE_KIND: cG9zdGdyZXNxbA== - DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== + DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== # gitleaks:allow DATABASE_PORT: NTQzMg== DATABASE_URL: a3ViZWFyY2hpdmUtcncucG9zdGdyZXNxbC5zdmMuY2x1c3Rlci5sb2NhbA== DATABASE_USER: a3ViZWFyY2hpdmU= @@ -990,7 +990,7 @@ metadata: app.kubernetes.io/component: database app.kubernetes.io/name: kubearchive-database-credentials app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-database-credentials namespace: kubearchive type: Opaque @@ -1002,7 +1002,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-logging namespace: kubearchive stringData: @@ -1016,7 +1016,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server namespace: kubearchive spec: @@ -1035,7 +1035,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-webhooks app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-webhooks namespace: kubearchive spec: @@ -1058,7 +1058,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-sink namespace: kubearchive spec: @@ -1076,7 +1076,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server namespace: kubearchive spec: @@ -1130,7 +1130,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/api:v1.20.0@sha256:43938bb7fabcc543cd3b5af0c9074196328f393d6e712f379572cca5ecfaab3c + image: quay.io/kubearchive/api:v1.21.4@sha256:b176b1651fe024ecd94207f690e727eb246f57436957115274647c2947494dc8 livenessProbe: httpGet: path: /livez @@ -1182,7 +1182,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator namespace: kubearchive spec: @@ -1232,7 +1232,7 @@ spec: valueFrom: resourceFieldRef: resource: limits.cpu - image: quay.io/kubearchive/operator:v1.20.0@sha256:eb8b363f5cfddd190011aa1d0e7cdff5c50aefae0bd4207024755146b3840db9 + image: quay.io/kubearchive/operator:v1.21.4@sha256:2beeaeb53a17056249b666e8f9bd67a9a237d3394a66a651cb5caca3f8ac4901 livenessProbe: httpGet: path: /healthz @@ -1294,7 +1294,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-sink namespace: kubearchive spec: @@ -1346,7 +1346,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/sink:v1.20.0@sha256:8a13e20ba373f00f7e8889af2a67a61c44d9e8bab74a5c0186f324f2eb0cb120 + image: quay.io/kubearchive/sink:v1.21.4@sha256:3b6603fa0cdd9daf99142573a0cdddce3467cdd8d180fd795e465209584c14b0 livenessProbe: httpGet: path: /livez @@ -1387,7 +1387,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: cluster-vacuum namespace: kubearchive spec: @@ -1408,7 +1408,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: quay.io/kubearchive/vacuum:v1.20.0@sha256:fe373300d999379656f78860906d7a30d77af088d6ba3bfa37a102c422d45480 + image: quay.io/kubearchive/vacuum:v1.21.4@sha256:3ededff190a125e51f2f675ae55d0559295580bda715bb2e3406d1cec7aac339 name: vacuum restartPolicy: Never serviceAccount: kubearchive-cluster-vacuum @@ -1422,7 +1422,7 @@ metadata: app.kubernetes.io/component: kubearchive app.kubernetes.io/name: kubearchive-schema-migration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-schema-migration namespace: kubearchive spec: @@ -1438,7 +1438,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/postgresql:v1.20.0@sha256:0aae85e8885295c87c3241915b8be86e08d5439f38ec9de9f95b012c67633874 + image: quay.io/kubearchive/postgresql:v1.21.4@sha256:58bcad4798c71746b0c9d11eb482a1075a9b073cbc146187fe2670df16b6d785 name: migration resources: limits: @@ -1459,7 +1459,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server-certificate namespace: kubearchive spec: @@ -1493,7 +1493,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-ca namespace: kubearchive spec: @@ -1515,7 +1515,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-certificate namespace: kubearchive spec: @@ -1534,7 +1534,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive namespace: kubearchive spec: @@ -1548,7 +1548,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-ca namespace: kubearchive spec: @@ -1563,7 +1563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-mutating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -1676,7 +1676,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-validating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-validating-webhook-configuration webhooks: - admissionReviewVersions: diff --git a/components/kubearchive/production/stone-prod-p02/kustomization.yaml b/components/kubearchive/production/stone-prod-p02/kustomization.yaml index a5769c26a01..1f1f21ffd60 100644 --- a/components/kubearchive/production/stone-prod-p02/kustomization.yaml +++ b/components/kubearchive/production/stone-prod-p02/kustomization.yaml @@ -23,7 +23,10 @@ configMapGenerator: annotations: argocd.argoproj.io/sync-wave: "-2" literals: - - MIGRATION_VERSION=5 + - MIGRATION_VERSION=13 + - name: kubearchive-deployment-schema-version + literals: + - MIGRATION_VERSION=13 - name: kubearchive-logging-writer literals: - | @@ -111,7 +114,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.20.0 + image: quay.io/kubearchive/vacuum:v1.21.4 - patch: |- apiVersion: batch/v1 @@ -129,13 +132,14 @@ patches: spec: containers: - name: migration - image: quay.io/kubearchive/postgresql:v1.21.3@sha256:2ce1545b19d29bd36c1022de13f451f14847aed04d62ab896a3254d74f7c0d39 env: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: name: kubearchive-schema-version key: MIGRATION_VERSION + - name: BATCH_SIZE + value: "10000" securityContext: runAsUser: null # Add version suffix to Job name so syncs with unchanged version are a no-op @@ -147,7 +151,7 @@ patches: patch: |- - op: replace path: /metadata/name - value: kubearchive-schema-migration-v13 + value: kubearchive-schema-migration-v13b # We don't need the Secret as it will be created by the ExternalSecrets Operator - patch: |- $patch: delete @@ -229,7 +233,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true @@ -288,7 +292,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true @@ -345,3 +349,17 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + diff --git a/components/kubearchive/staging/base/kustomization.yaml b/components/kubearchive/staging/base/kustomization.yaml index aae923b985b..5e32f06dcc5 100644 --- a/components/kubearchive/staging/base/kustomization.yaml +++ b/components/kubearchive/staging/base/kustomization.yaml @@ -46,4 +46,5 @@ patches: spec: containers: - name: otel-collector - image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + image: quay.io/kubearchive/opentelemetry-collector@sha256:74edb825a429b415262e7eb7a99ed77685c9b2b7238ef69fb42a3625df75458f + diff --git a/components/kueue/development/kueue-external-admission/controller-patch.yaml b/components/kueue/development/kueue-external-admission/controller-patch.yaml deleted file mode 100644 index 976aca5d2df..00000000000 --- a/components/kueue/development/kueue-external-admission/controller-patch.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Development: 1 replica so sync does not revert scale-down. -- op: replace - path: /spec/replicas - value: 1 -- op: replace - path: /spec/template/spec/containers/0/resources/requests - value: - cpu: 500m - memory: 512Mi -- op: add - path: /spec/template/spec/containers/0/resources/limits - value: - cpu: 500m - memory: 512Mi diff --git a/components/kueue/development/kueue-external-admission/kustomization.yaml b/components/kueue/development/kueue-external-admission/kustomization.yaml deleted file mode 100644 index 6af4de8239f..00000000000 --- a/components/kueue/development/kueue-external-admission/kustomization.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- https://github.com/konflux-ci/kueue-external-admission/config/default?ref=aa92aa7f658e34577a23b072204de2af5768b3cc -- monitoring.yaml - -images: -- name: example.com/alert-manager-kueue-admission - newName: quay.io/konflux-ci/kueue-external-admission - newTag: aa92aa7f658e34577a23b072204de2af5768b3cc - -namespace: kueue-external-admission - -# ensure that installation starts after the installation of kueue complete -commonAnnotations: - argocd.argoproj.io/sync-wave: "10" - -patches: - - target: - group: "" - version: v1 - kind: ConfigMap - name: config - patch: |- - - op: replace - path: /data/shouldAdmit - value: "true" - - path: controller-patch.yaml - target: - group: apps - kind: Deployment - name: alert-mgr-kueue-admission-controller-manager - version: v1 diff --git a/components/kueue/development/kueue-external-admission/monitoring.yaml b/components/kueue/development/kueue-external-admission/monitoring.yaml deleted file mode 100644 index 25e1f38cd8e..00000000000 --- a/components/kueue/development/kueue-external-admission/monitoring.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: metrics-reader ---- -apiVersion: v1 -kind: Secret -metadata: - name: metrics-reader - annotations: - kubernetes.io/service-account.name: metrics-reader -type: kubernetes.io/service-account-token ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: prometheus-kueue-external-admission-metrics-reader -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: alert-mgr-kueue-admission-metrics-reader -subjects: -- kind: ServiceAccount - name: metrics-reader - namespace: kueue-external-admission ---- -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: kueue-external-admission -spec: - endpoints: - - path: /metrics - interval: 15s - port: https - scheme: https - bearerTokenSecret: - name: "metrics-reader" - key: token - tlsConfig: - insecureSkipVerify: true - selector: - matchLabels: - control-plane: controller-manager diff --git a/components/kueue/development/kustomization.yaml b/components/kueue/development/kustomization.yaml index 13c474eb3a6..553358fa899 100644 --- a/components/kueue/development/kustomization.yaml +++ b/components/kueue/development/kustomization.yaml @@ -4,7 +4,6 @@ resources: - kueue - tekton-kueue - tekton-kueue-monitoring -- kueue-external-admission - queue-config commonAnnotations: diff --git a/components/kueue/development/queue-config/cluster-queue.yaml b/components/kueue/development/queue-config/cluster-queue.yaml index 858f957f9b6..43bc42dfdc0 100644 --- a/components/kueue/development/queue-config/cluster-queue.yaml +++ b/components/kueue/development/queue-config/cluster-queue.yaml @@ -5,20 +5,10 @@ metadata: name: "default-flavor" --- apiVersion: kueue.x-k8s.io/v1beta2 -kind: AdmissionCheck -metadata: - name: static-admission -spec: - controllerName: konflux-ci.dev/kueue-external-admission ---- -apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: - admissionChecksStrategy: - admissionChecks: - - name: static-admission flavorFungibility: whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor @@ -32,6 +22,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns + - konflux-ci-dev-token - cpu - memory - linux-arm64 @@ -45,6 +36,8 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: "500" + - name: konflux-ci-dev-token + nominalQuota: "600" - name: linux-arm64 nominalQuota: "10" - name: linux-amd64 diff --git a/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml b/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml index f4e5920bff8..210ba059594 100644 --- a/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml +++ b/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml @@ -23,11 +23,11 @@ spec: - alert: KueueReplicasNotAvailable expr: | ( - kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"} + kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue"} ) / clamp_min( - kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"}, + kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue"}, 1 ) * 100 < 100 for: 5m @@ -44,12 +44,12 @@ spec: - alert: KueueHighMemoryUtilization expr: | ( - container_memory_working_set_bytes{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator", image!=""} + container_memory_working_set_bytes{namespace=~"tekton-kueue|openshift-kueue-operator", image!=""} * on(container, pod) group_left - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} ) - / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} * 100 > 70 + / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|openshift-kueue-operator"} * 100 > 70 for: 5m labels: severity: warning @@ -64,10 +64,10 @@ spec: - alert: KueueHighCPUUtilization expr: | ( - pod:container_cpu_usage:sum{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + pod:container_cpu_usage:sum{namespace=~"tekton-kueue|openshift-kueue-operator"} * on(pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} - ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}) * 100 > 85 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} + ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|openshift-kueue-operator"}) * 100 > 85 for: 5m labels: severity: warning @@ -94,9 +94,9 @@ spec: - alert: KueueHighContainerRestarts expr: | - increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}[1h]) + increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|openshift-kueue-operator"}[1h]) * on(container, pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} >= 3 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} >= 3 for: 0m labels: severity: warning diff --git a/components/kueue/development/tekton-kueue/config.yaml b/components/kueue/development/tekton-kueue/config.yaml index 70b10d01db0..fab27239245 100644 --- a/components/kueue/development/tekton-kueue/config.yaml +++ b/components/kueue/development/tekton-kueue/config.yaml @@ -92,6 +92,31 @@ cel: - | plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : [] + # The token mechanism allows us to balance admitted PipelineRuns. + # Here we want to state that each PipelineRuns needs one token, but + # Build PipelineRuns are usually heavier, so they need 2. + # + # The total amount of PipelineRuns executing in the system at the same time + # will be decided by the first to saturate between `tekton.dev/pipelineruns` + # and `konflux-ci.dev/token`. This way we can tune the percentage of usually + # heavier PipelineRuns with respect to lighter ones. + # + # As an example, if both `tekton.dev/pipelineruns` and `konflux-ci.dev/token` + # are 600, we could have: + # * 300 Build PipelineRuns + # * 200 Build PipelineRuns + 200 Non-Build PipelineRuns + # * 100 Build PipelineRuns + 400 Non-Build PipelineRuns + # * 600 Non-Build PipelineRuns + - | + pacEventType == 'push' || + pacEventType == 'pull_request' || + pacEventType == "Merge_Request" || + pacEventType == 'test-comment' || + pacEventType == 'retest-comment' || + pacEventType == 'retest-all-comment' || + pacEventType == 'ok-to-test-comment' ? resource('konflux-ci-dev-token', 2) : + resource('konflux-ci-dev-token', 1) + # Set the pipeline priority - | has(pipelineRun.metadata.labels) && diff --git a/components/kueue/production/base/kueue/operator.yaml b/components/kueue/production/base/kueue/operator.yaml index 442bd44fab9..7d2c4134a03 100644 --- a/components/kueue/production/base/kueue/operator.yaml +++ b/components/kueue/production/base/kueue/operator.yaml @@ -40,7 +40,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "-1" spec: - channel: stable-v1.2 + channel: stable-v1.3 installPlanApproval: Automatic name: kueue-operator source: redhat-operators-1-18 diff --git a/components/kueue/production/base/queue-config/workload-priority-class.yaml b/components/kueue/production/base/queue-config/workload-priority-class.yaml index ddea072ce76..8d8c62654ec 100644 --- a/components/kueue/production/base/queue-config/workload-priority-class.yaml +++ b/components/kueue/production/base/queue-config/workload-priority-class.yaml @@ -1,54 +1,54 @@ --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-release value: 1000 description: "Highest priority for release pipelines" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-tenant-release value: 900 description: "High priority for tenant release pipelines" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-post-merge-test value: 800 description: "Priority for post-merge tests" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-post-merge-build value: 700 description: "Priority for post-merge builds" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-pre-merge-test value: 600 description: "Priority for pre-merge tests" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-pre-merge-build value: 500 description: "Priority for pre-merge builds" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-default value: 400 description: "Default priority for konflux pipelines" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-dependency-update diff --git a/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml b/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml index f4e5920bff8..210ba059594 100644 --- a/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml +++ b/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml @@ -23,11 +23,11 @@ spec: - alert: KueueReplicasNotAvailable expr: | ( - kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"} + kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue"} ) / clamp_min( - kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"}, + kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue"}, 1 ) * 100 < 100 for: 5m @@ -44,12 +44,12 @@ spec: - alert: KueueHighMemoryUtilization expr: | ( - container_memory_working_set_bytes{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator", image!=""} + container_memory_working_set_bytes{namespace=~"tekton-kueue|openshift-kueue-operator", image!=""} * on(container, pod) group_left - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} ) - / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} * 100 > 70 + / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|openshift-kueue-operator"} * 100 > 70 for: 5m labels: severity: warning @@ -64,10 +64,10 @@ spec: - alert: KueueHighCPUUtilization expr: | ( - pod:container_cpu_usage:sum{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + pod:container_cpu_usage:sum{namespace=~"tekton-kueue|openshift-kueue-operator"} * on(pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} - ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}) * 100 > 85 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} + ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|openshift-kueue-operator"}) * 100 > 85 for: 5m labels: severity: warning @@ -94,9 +94,9 @@ spec: - alert: KueueHighContainerRestarts expr: | - increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}[1h]) + increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|openshift-kueue-operator"}[1h]) * on(container, pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} >= 3 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} >= 3 for: 0m labels: severity: warning diff --git a/components/kueue/production/base/tekton-kueue/kustomization.yaml b/components/kueue/production/base/tekton-kueue/kustomization.yaml index 83087e5f2de..f3454368085 100644 --- a/components/kueue/production/base/tekton-kueue/kustomization.yaml +++ b/components/kueue/production/base/tekton-kueue/kustomization.yaml @@ -1,12 +1,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- https://github.com/konflux-ci/tekton-kueue/config/default?ref=964790eef15cef723654b6f62b36b8cde867f9f7 +- https://github.com/konflux-ci/tekton-kueue/config/default?ref=cec0b3c8a240a289bb7aff4313ea647b292d96cc images: - name: konflux-ci/tekton-kueue newName: quay.io/konflux-ci/tekton-kueue - newTag: 964790eef15cef723654b6f62b36b8cde867f9f7 + newTag: cec0b3c8a240a289bb7aff4313ea647b292d96cc namespace: tekton-kueue # ensure that installation starts after the installation of kueue complete diff --git a/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml index db6351a3eb0..fc4360dc6c9 100644 --- a/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -157,31 +157,30 @@ spec: - name: linux-s390x nominalQuota: '24' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml index ab7f6242fda..2e2da8df9ea 100644 --- a/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -178,31 +178,30 @@ spec: - name: linux-s390x nominalQuota: '56' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml b/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml index b0c039735e8..7eb604bcbf0 100644 --- a/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml +++ b/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml @@ -1,82 +1,82 @@ --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-prod-release value: 950 description: "High priority for OCP prod release pipelines which should supersede all releases" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-stage-release value: 925 description: "High priority for OCP stage release pipelines which should supersede all other stage auto releases" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-1 value: 410 description: "Priority level 1 (highest)" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-2 value: 409 description: "Priority level 2" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-3 value: 408 description: "Priority level 3" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-4 value: 407 description: "Priority level 4" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-5 value: 406 description: "Priority level 5" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-6 value: 405 description: "Priority level 6" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-7 value: 404 description: "Priority level 7" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-8 value: 403 description: "Priority level 8" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-9 value: 402 description: "Priority level 9" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-10 diff --git a/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml index 76307bfc09f..9ca8732a00e 100644 --- a/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -134,36 +134,35 @@ spec: - name: linux-root-arm64 nominalQuota: '250' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - coveredResources: - localhost flavors: - name: platform-group-3 resources: - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml index e5cc7f41eb6..b50d6f3a0aa 100644 --- a/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -163,31 +163,30 @@ spec: - name: linux-s390x nominalQuota: '64' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml index 0f1fd70864f..e0e00b80ae0 100644 --- a/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -163,31 +163,30 @@ spec: - name: linux-s390x nominalQuota: '56' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml index 2734e4a586e..ec6cd50f779 100644 --- a/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -178,31 +178,30 @@ spec: - name: linux-s390x nominalQuota: '60' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml index d5405dd6b76..2161fc7d10e 100644 --- a/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -169,31 +169,30 @@ spec: - name: linux-test-arm64 nominalQuota: '250' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml index b1f51fd416d..b0b90090dba 100644 --- a/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -151,31 +151,30 @@ spec: - name: linux-root-arm64 nominalQuota: '250' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' - stopPolicy: None + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml index e379e187718..bb19c6ba917 100644 --- a/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml @@ -1,10 +1,10 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -177,35 +177,34 @@ spec: - name: linux-s390x nominalQuota: '72' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k - name: macos-mac2metal-arm64 nominalQuota: '5' - name: windows-4xlarge-amd64 nominalQuota: '5' - stopPolicy: None --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/staging/base/kueue-external-admission/controller-patch.yaml b/components/kueue/staging/base/kueue-external-admission/controller-patch.yaml deleted file mode 100644 index adbb29e0ad2..00000000000 --- a/components/kueue/staging/base/kueue-external-admission/controller-patch.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -- op: replace - path: /spec/replicas - value: 2 - -- op: add - path: /metadata/annotations/ignore-check.kube-linter.io~1no-anti-affinity - value: "Using topologySpreadConstraints" - -- op: add - path: /spec/strategy - value: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 0 - -- op: add - path: /spec/template/spec/topologySpreadConstraints - value: - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/name: tekton-kueue - -- op: add - path: /spec/template/spec/containers/0/resources/requests - value: - cpu: 500m - memory: 4Gi - -- op: add - path: /spec/template/spec/containers/0/resources/limits - value: - cpu: 500m - memory: 4Gi - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-lease-duration=137s" - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-renew-deadline=107s" - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-retry-period=26s" diff --git a/components/kueue/staging/base/kueue-external-admission/kustomization.yaml b/components/kueue/staging/base/kueue-external-admission/kustomization.yaml deleted file mode 100644 index 6af4de8239f..00000000000 --- a/components/kueue/staging/base/kueue-external-admission/kustomization.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- https://github.com/konflux-ci/kueue-external-admission/config/default?ref=aa92aa7f658e34577a23b072204de2af5768b3cc -- monitoring.yaml - -images: -- name: example.com/alert-manager-kueue-admission - newName: quay.io/konflux-ci/kueue-external-admission - newTag: aa92aa7f658e34577a23b072204de2af5768b3cc - -namespace: kueue-external-admission - -# ensure that installation starts after the installation of kueue complete -commonAnnotations: - argocd.argoproj.io/sync-wave: "10" - -patches: - - target: - group: "" - version: v1 - kind: ConfigMap - name: config - patch: |- - - op: replace - path: /data/shouldAdmit - value: "true" - - path: controller-patch.yaml - target: - group: apps - kind: Deployment - name: alert-mgr-kueue-admission-controller-manager - version: v1 diff --git a/components/kueue/staging/base/kueue-external-admission/monitoring.yaml b/components/kueue/staging/base/kueue-external-admission/monitoring.yaml deleted file mode 100644 index 25e1f38cd8e..00000000000 --- a/components/kueue/staging/base/kueue-external-admission/monitoring.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: metrics-reader ---- -apiVersion: v1 -kind: Secret -metadata: - name: metrics-reader - annotations: - kubernetes.io/service-account.name: metrics-reader -type: kubernetes.io/service-account-token ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: prometheus-kueue-external-admission-metrics-reader -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: alert-mgr-kueue-admission-metrics-reader -subjects: -- kind: ServiceAccount - name: metrics-reader - namespace: kueue-external-admission ---- -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: kueue-external-admission -spec: - endpoints: - - path: /metrics - interval: 15s - port: https - scheme: https - bearerTokenSecret: - name: "metrics-reader" - key: token - tlsConfig: - insecureSkipVerify: true - selector: - matchLabels: - control-plane: controller-manager diff --git a/components/kueue/staging/base/kustomization.yaml b/components/kueue/staging/base/kustomization.yaml index 7ea027a28b1..0517a62873f 100644 --- a/components/kueue/staging/base/kustomization.yaml +++ b/components/kueue/staging/base/kustomization.yaml @@ -4,7 +4,6 @@ resources: - kueue - tekton-kueue - tekton-kueue-monitoring -- kueue-external-admission commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml b/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml index f4e5920bff8..210ba059594 100644 --- a/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml +++ b/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml @@ -23,11 +23,11 @@ spec: - alert: KueueReplicasNotAvailable expr: | ( - kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"} + kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue"} ) / clamp_min( - kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"}, + kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue"}, 1 ) * 100 < 100 for: 5m @@ -44,12 +44,12 @@ spec: - alert: KueueHighMemoryUtilization expr: | ( - container_memory_working_set_bytes{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator", image!=""} + container_memory_working_set_bytes{namespace=~"tekton-kueue|openshift-kueue-operator", image!=""} * on(container, pod) group_left - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} ) - / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} * 100 > 70 + / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|openshift-kueue-operator"} * 100 > 70 for: 5m labels: severity: warning @@ -64,10 +64,10 @@ spec: - alert: KueueHighCPUUtilization expr: | ( - pod:container_cpu_usage:sum{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + pod:container_cpu_usage:sum{namespace=~"tekton-kueue|openshift-kueue-operator"} * on(pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} - ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}) * 100 > 85 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} + ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|openshift-kueue-operator"}) * 100 > 85 for: 5m labels: severity: warning @@ -94,9 +94,9 @@ spec: - alert: KueueHighContainerRestarts expr: | - increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}[1h]) + increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|openshift-kueue-operator"}[1h]) * on(container, pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} >= 3 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} >= 3 for: 0m labels: severity: warning diff --git a/components/kueue/staging/base/tekton-kueue/config.yaml b/components/kueue/staging/base/tekton-kueue/config.yaml index 70b10d01db0..fab27239245 100644 --- a/components/kueue/staging/base/tekton-kueue/config.yaml +++ b/components/kueue/staging/base/tekton-kueue/config.yaml @@ -92,6 +92,31 @@ cel: - | plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : [] + # The token mechanism allows us to balance admitted PipelineRuns. + # Here we want to state that each PipelineRuns needs one token, but + # Build PipelineRuns are usually heavier, so they need 2. + # + # The total amount of PipelineRuns executing in the system at the same time + # will be decided by the first to saturate between `tekton.dev/pipelineruns` + # and `konflux-ci.dev/token`. This way we can tune the percentage of usually + # heavier PipelineRuns with respect to lighter ones. + # + # As an example, if both `tekton.dev/pipelineruns` and `konflux-ci.dev/token` + # are 600, we could have: + # * 300 Build PipelineRuns + # * 200 Build PipelineRuns + 200 Non-Build PipelineRuns + # * 100 Build PipelineRuns + 400 Non-Build PipelineRuns + # * 600 Non-Build PipelineRuns + - | + pacEventType == 'push' || + pacEventType == 'pull_request' || + pacEventType == "Merge_Request" || + pacEventType == 'test-comment' || + pacEventType == 'retest-comment' || + pacEventType == 'retest-all-comment' || + pacEventType == 'ok-to-test-comment' ? resource('konflux-ci-dev-token', 2) : + resource('konflux-ci-dev-token', 1) + # Set the pipeline priority - | has(pipelineRun.metadata.labels) && diff --git a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml index fc3b59ee4f2..92876c5a9c8 100644 --- a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml @@ -1,18 +1,8 @@ apiVersion: kueue.x-k8s.io/v1beta2 -kind: AdmissionCheck -metadata: - name: static-admission -spec: - controllerName: konflux-ci.dev/kueue-external-admission ---- -apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: - admissionChecksStrategy: - admissionChecks: - - name: static-admission flavorFungibility: whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor @@ -26,6 +16,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns + - konflux-ci-dev-token - cpu - memory - aws-ip @@ -35,6 +26,8 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: '500' + - name: konflux-ci-dev-token + nominalQuota: '600' - name: cpu nominalQuota: 1k - name: memory diff --git a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml index 4fbedb789fd..c166b3a4a7c 100644 --- a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml @@ -1,18 +1,8 @@ apiVersion: kueue.x-k8s.io/v1beta2 -kind: AdmissionCheck -metadata: - name: static-admission -spec: - controllerName: konflux-ci.dev/kueue-external-admission ---- -apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: - admissionChecksStrategy: - admissionChecks: - - name: static-admission flavorFungibility: whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor @@ -26,6 +16,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns + - konflux-ci-dev-token - cpu - memory - aws-ip @@ -35,6 +26,8 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: '500' + - name: konflux-ci-dev-token + nominalQuota: '600' - name: cpu nominalQuota: 1k - name: memory diff --git a/components/mintmaker/OWNERS b/components/mintmaker/OWNERS index 4ed131acf73..d4f30c7d5aa 100644 --- a/components/mintmaker/OWNERS +++ b/components/mintmaker/OWNERS @@ -3,7 +3,6 @@ approvers: - scoheb - staticf0x -- querti - FernandesMF - HozifaWasfy - KristianTkacik @@ -12,7 +11,6 @@ approvers: reviewers: - scoheb - staticf0x -- querti - FernandesMF - HozifaWasfy - KristianTkacik diff --git a/components/mintmaker/development/kustomization.yaml b/components/mintmaker/development/kustomization.yaml index 79b9eb21c46..e0117bc2a4f 100644 --- a/components/mintmaker/development/kustomization.yaml +++ b/components/mintmaker/development/kustomization.yaml @@ -3,13 +3,13 @@ kind: Kustomization resources: - ../base - plrs-resource-quota.yaml - - https://github.com/konflux-ci/mintmaker/config/default?ref=f630842900c1caf0080e113925b3295b6c008df2 - - https://github.com/konflux-ci/mintmaker/config/renovate?ref=f630842900c1caf0080e113925b3295b6c008df2 + - https://github.com/konflux-ci/mintmaker/config/default?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d + - https://github.com/konflux-ci/mintmaker/config/renovate?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: f630842900c1caf0080e113925b3295b6c008df2 + newTag: c8d93fd9fbbe59b2cb567a319af71a156b1d788d - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image newTag: latest diff --git a/components/mintmaker/production/base/kustomization.yaml b/components/mintmaker/production/base/kustomization.yaml index e4cd752af4f..41cf2ea3389 100644 --- a/components/mintmaker/production/base/kustomization.yaml +++ b/components/mintmaker/production/base/kustomization.yaml @@ -3,18 +3,18 @@ kind: Kustomization resources: - ../../base - ../../base/external-secrets - - https://github.com/konflux-ci/mintmaker/config/default?ref=9916264be87d8750d4e75fa625fd771b9f408dda - - https://github.com/konflux-ci/mintmaker/config/renovate?ref=9916264be87d8750d4e75fa625fd771b9f408dda + - https://github.com/konflux-ci/mintmaker/config/default?ref=70cfa98ddf51f87166807d7f2787677422471d20 + - https://github.com/konflux-ci/mintmaker/config/renovate?ref=70cfa98ddf51f87166807d7f2787677422471d20 namespace: mintmaker images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: 9916264be87d8750d4e75fa625fd771b9f408dda + newTag: 70cfa98ddf51f87166807d7f2787677422471d20 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: d1de4c8ad000d4e27164e3f6e8e077898a741127 + newTag: ea0ea056fc323d2f007e6433d318ea3a64b7bf2d commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index 7fceb0fd368..88563d4f566 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -5,18 +5,18 @@ resources: - ../../base/external-secrets - ../blackbox - plrs-resource-quota.yaml -- https://github.com/konflux-ci/mintmaker/config/default?ref=f630842900c1caf0080e113925b3295b6c008df2 -- https://github.com/konflux-ci/mintmaker/config/renovate?ref=f630842900c1caf0080e113925b3295b6c008df2 +- https://github.com/konflux-ci/mintmaker/config/default?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d +- https://github.com/konflux-ci/mintmaker/config/renovate?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d namespace: mintmaker images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: f630842900c1caf0080e113925b3295b6c008df2 + newTag: c8d93fd9fbbe59b2cb567a319af71a156b1d788d - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: 4e4c7faa421edfe0a02e977a83f2b33d1b5db3b3 + newTag: 5fa9e2f0134e156c6430eac52c16b8010f489539 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml b/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml index b6eb95c4008..d233a253097 100644 --- a/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml +++ b/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/private/stone-stage-p01?ref=724f162701643ed0f59596c882f0beb40b62b045 + - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/private/stone-stage-p01?ref=7280329e718665003f36f8874351ecba3706e422 namespace: appstudio-monitoring diff --git a/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml b/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml index 134c92e9531..15db88bb27b 100644 --- a/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml +++ b/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/public/stone-stg-rh01?ref=5e48bb6dca3eb756f5de24fe2664e14dbf55388f + - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/public/stone-stg-rh01?ref=7280329e718665003f36f8874351ecba3706e422 namespace: appstudio-monitoring diff --git a/components/monitoring/grafana/base/dashboards/kueue/kueue.json b/components/monitoring/grafana/base/dashboards/kueue/kueue.json index 3efe40132cb..f7795611151 100644 --- a/components/monitoring/grafana/base/dashboards/kueue/kueue.json +++ b/components/monitoring/grafana/base/dashboards/kueue/kueue.json @@ -87,7 +87,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -173,7 +173,7 @@ { "editorMode": "code", "exemplar": false, - "expr": "(\n kube_deployment_status_replicas_available{namespace=~\"openshift-kueue-operator|tekton-kueue|kueue-external-admission\"}\n)\n/\nclamp_min(\n kube_deployment_spec_replicas{namespace=~\"openshift-kueue-operator|tekton-kueue|kueue-external-admission\"},\n 1\n) * 100", + "expr": "(\n kube_deployment_status_replicas_available{namespace=~\"openshift-kueue-operator|tekton-kueue\"}\n)\n/\nclamp_min(\n kube_deployment_spec_replicas{namespace=~\"openshift-kueue-operator|tekton-kueue\"},\n 1\n) * 100", "format": "time_series", "instant": false, "legendFormat": "{{deployment}}", @@ -252,7 +252,7 @@ "targets": [ { "editorMode": "code", - "expr": "(\n container_memory_working_set_bytes{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\", image!=\"\"} \n * on(container, pod)\n group_left\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}\n)\n / on (pod) max by (pod) (kube_pod_resource_limit{resource='memory',namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}) * 100", + "expr": "(\n container_memory_working_set_bytes{namespace=~\"tekton-kueue|openshift-kueue-operator\", image!=\"\"} \n * on(container, pod)\n group_left\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|openshift-kueue-operator\"}\n)\n / on (pod) max by (pod) (kube_pod_resource_limit{resource='memory',namespace=~\"tekton-kueue|openshift-kueue-operator\"}) * 100", "legendFormat": "__auto", "range": true, "refId": "A" @@ -399,7 +399,7 @@ "targets": [ { "editorMode": "code", - "expr": "(\n pod:container_cpu_usage:sum{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}\n * on(pod)\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}\n) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}) * 100", + "expr": "(\n pod:container_cpu_usage:sum{namespace=~\"tekton-kueue|openshift-kueue-operator\"}\n * on(pod)\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|openshift-kueue-operator\"}\n) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~\"tekton-kueue|openshift-kueue-operator\"}) * 100", "legendFormat": "{{pod}}", "range": true, "refId": "A" @@ -602,7 +602,7 @@ "targets": [ { "editorMode": "code", - "expr": "increase(kube_pod_container_status_restarts_total{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}[1h])\n* on(container, pod)\nkube_pod_container_status_ready{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}", + "expr": "increase(kube_pod_container_status_restarts_total{namespace=~\"tekton-kueue|openshift-kueue-operator\"}[1h])\n* on(container, pod)\nkube_pod_container_status_ready{namespace=~\"tekton-kueue|openshift-kueue-operator\"}", "legendFormat": "{{pod}}", "range": true, "refId": "A" @@ -1258,7 +1258,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -1331,7 +1331,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -1404,7 +1404,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -1845,7 +1845,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true diff --git a/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml b/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml index 96c55cb02ea..9e6db8db38f 100644 --- a/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml +++ b/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/konflux-ci/perfscale/grafana/?ref=4b4b9640667964558eb974f658d02d0546b65665 + - https://github.com/konflux-ci/perfscale/grafana/?ref=038081278c493c8d8b3185daeccfb9816ca28bb8 diff --git a/components/monitoring/grafana/development/dashboards/release/kustomization.yaml b/components/monitoring/grafana/development/dashboards/release/kustomization.yaml index 3406720c6bf..526b7325c0d 100644 --- a/components/monitoring/grafana/development/dashboards/release/kustomization.yaml +++ b/components/monitoring/grafana/development/dashboards/release/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- https://github.com/konflux-ci/release-service/config/grafana/?ref=98f4196defe6e8cc3addb22af44b07cd6ba6cec1 +- https://github.com/konflux-ci/release-service/config/grafana/?ref=530b605bcfa10e668f821cdc046d35f6b3f476a5 diff --git a/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml b/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml index 96c55cb02ea..9e6db8db38f 100644 --- a/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml +++ b/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/konflux-ci/perfscale/grafana/?ref=4b4b9640667964558eb974f658d02d0546b65665 + - https://github.com/konflux-ci/perfscale/grafana/?ref=038081278c493c8d8b3185daeccfb9816ca28bb8 diff --git a/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml b/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml index 96c55cb02ea..9e6db8db38f 100644 --- a/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml +++ b/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/konflux-ci/perfscale/grafana/?ref=4b4b9640667964558eb974f658d02d0546b65665 + - https://github.com/konflux-ci/perfscale/grafana/?ref=038081278c493c8d8b3185daeccfb9816ca28bb8 diff --git a/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml b/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml index 0529f05a3bf..d2277d2475d 100644 --- a/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml +++ b/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- https://github.com/konflux-ci/release-service/config/grafana/?ref=5f0b67ab53d64072c1fce4d9e18e3297e91da126 +- https://github.com/konflux-ci/release-service/config/grafana/?ref=d02b958bcf790f72dbb38625d5f851f843351f83 diff --git a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml index a115ef8da83..4ad6278715a 100644 --- a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml @@ -113,17 +113,17 @@ # Namespace: tekton-kueue - '{__name__="kube_deployment_status_replicas_ready", namespace="tekton-kueue"}' - '{__name__="kube_deployment_status_replicas_available", namespace="tekton-kueue"}' + - '{__name__="kube_deployment_status_replicas_updated", namespace="tekton-kueue"}' - '{__name__="kube_deployment_spec_replicas", namespace="tekton-kueue"}' - # Namespace: kueue-external-admission - - '{__name__="kube_deployment_status_replicas_ready", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_status_replicas_available", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_spec_replicas", namespace="kueue-external-admission"}' + # Namespace: image-rbac-proxy + - '{__name__="kube_deployment_spec_replicas", namespace="image-rbac-proxy"}' + - '{__name__="kube_deployment_status_replicas_available", namespace="image-rbac-proxy"}' ## Container Metrics - '{__name__="kube_pod_container_status_waiting_reason", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_pod_container_resource_limits", namespace=~"release-service|rhtap-releng-tenant"}' - - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="kube_pod_container_status_terminated_reason", namespace=~".*-tenant", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", namespace="release-service"}' @@ -131,25 +131,25 @@ - '{__name__="container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd"}' - '{__name__="container_memory_usage_bytes", namespace=~"release-service|openshift-etcd|rhtap-releng-tenant"}' - '{__name__="kube_pod_container_status_restarts_total", namespace!~".*-tenant"}' - - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' - - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="node_namespace_pod_container:container_memory_working_set_bytes", pod=~"etcd-ip-.*|kube-apiserver.*"}' - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", pod=~"etcd-ip-.*|kube-apiserver.*"}' - '{__name__="kube_pod_container_info", namespace!~".*-tenant|openshift-.*|kube-.*"}' @@ -163,7 +163,7 @@ - '{__name__="kube_pod_status_unschedulable", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_pod_status_phase", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_running_pods_ready", namespace="konflux-ui"}' - - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' ## Tekton & Pipeline Metrics - '{__name__="pipeline_service_schedule_overhead_percentage_sum"}' diff --git a/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml b/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml index ec5f9c33e24..b0f6e2f524d 100644 --- a/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml +++ b/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml @@ -17,4 +17,4 @@ policy_name|policy_background_mode|rule_type|policy_type|policy_validation_mode|\ resource_request_operation|resource_kind|policy_change_type|event_type|\ name|cluster_queue|quantile|slice|scrape_job|tested_registry|error|queue|\ - priority_class|finalizers" + priority_class|finalizers|severity" diff --git a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml index 81167ca167b..857894d5303 100644 --- a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml @@ -115,6 +115,10 @@ # Namespace: caching - '{__name__="squid_up", namespace="caching"}' + # Namespace: image-rbac-proxy + - '{__name__="kube_deployment_spec_replicas", namespace="image-rbac-proxy"}' + - '{__name__="kube_deployment_status_replicas_available", namespace="image-rbac-proxy"}' + # Namespace: openshift-kueue-operator - '{__name__="kube_deployment_status_replicas_ready", namespace="openshift-kueue-operator"}' - '{__name__="kube_deployment_status_replicas_available", namespace="openshift-kueue-operator"}' @@ -123,17 +127,13 @@ # Namespace: tekton-kueue - '{__name__="kube_deployment_status_replicas_ready", namespace="tekton-kueue"}' - '{__name__="kube_deployment_status_replicas_available", namespace="tekton-kueue"}' + - '{__name__="kube_deployment_status_replicas_updated", namespace="tekton-kueue"}' - '{__name__="kube_deployment_spec_replicas", namespace="tekton-kueue"}' - # Namespace: kueue-external-admission - - '{__name__="kube_deployment_status_replicas_ready", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_status_replicas_available", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_spec_replicas", namespace="kueue-external-admission"}' - ## Container Metrics - '{__name__="kube_pod_container_status_waiting_reason", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_pod_container_resource_limits", namespace=~"release-service|rhtap-releng-tenant"}' - - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="kube_pod_container_status_terminated_reason", namespace=~".*-tenant", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", namespace="release-service"}' @@ -141,25 +141,25 @@ - '{__name__="container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd"}' - '{__name__="container_memory_usage_bytes", namespace=~"release-service|openshift-etcd|rhtap-releng-tenant"}' - '{__name__="kube_pod_container_status_restarts_total", namespace!~".*-tenant"}' - - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|openshift-monitoring|openshift-user-workload-monitoring|appstudio-monitoring"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' - - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|openshift-monitoring|openshift-user-workload-monitoring|appstudio-monitoring"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="node_namespace_pod_container:container_memory_working_set_bytes", pod=~"etcd-ip-.*|kube-apiserver.*"}' - '{__name__="node_namespace_pod_container:container_memory_working_set_bytes", namespace=~"openshift-monitoring|openshift-user-workload-monitoring|appstudio-monitoring"}' - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", pod=~"etcd-ip-.*|kube-apiserver.*"}' @@ -189,7 +189,7 @@ - '{__name__="kube_pod_status_phase", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_running_pods_ready", namespace="konflux-ui"}' - '{__name__="kube_running_pods_ready", namespace="konflux-kite"}' - - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' ## Tekton & Pipeline Metrics - '{__name__="pipeline_service_schedule_overhead_percentage_sum"}' diff --git a/components/multi-platform-controller/staging-downstream/external-secrets.yaml b/components/multi-platform-controller/staging-downstream/external-secrets.yaml index 6838e0fdeb7..cc5d6bc5761 100644 --- a/components/multi-platform-controller/staging-downstream/external-secrets.yaml +++ b/components/multi-platform-controller/staging-downstream/external-secrets.yaml @@ -77,29 +77,6 @@ metadata: annotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true argocd.argoproj.io/sync-wave: "-1" -spec: - dataFrom: - - extract: - key: staging/infrastructure/multi-platform-controller/stone-stage-p01/ibm-ppc64le-ssh-key - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: appsre-stonesoup-vault - target: - creationPolicy: Owner - deletionPolicy: Delete - name: ibm-ppc64le-ssh-key ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: ibm-ppc64le-ssh-key-us-east - namespace: multi-platform-controller - labels: - build.appstudio.redhat.com/multi-platform-secret: "true" - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "-1" spec: dataFrom: - extract: @@ -111,7 +88,7 @@ spec: target: creationPolicy: Owner deletionPolicy: Delete - name: ibm-ppc64le-ssh-key-us-east + name: ibm-ppc64le-ssh-key --- apiVersion: external-secrets.io/v1 kind: ExternalSecret diff --git a/components/multi-platform-controller/staging-downstream/host-values.yaml b/components/multi-platform-controller/staging-downstream/host-values.yaml index 6674e661403..f1b37c57584 100644 --- a/components/multi-platform-controller/staging-downstream/host-values.yaml +++ b/components/multi-platform-controller/staging-downstream/host-values.yaml @@ -205,19 +205,12 @@ dynamicConfigs: # Static hosts configuration staticHosts: ppc64le-static-1: - address: "10.130.103.155" + address: "10.130.72.59" concurrency: "2" platform: "linux/ppc64le" secret: "ibm-ppc64le-ssh-key" user: "root" -# ppc64le-static-2: -# address: "10.130.72.59" -# concurrency: "1" -# platform: "linux/ppc64le" -# secret: "ibm-ppc64le-ssh-key-us-east" -# user: "root" - s390x-static-1: address: "10.130.72.6" concurrency: "2" diff --git a/components/perf-team-prometheus-reader/AGENTS.md b/components/perf-team-prometheus-reader/AGENTS.md new file mode 100644 index 00000000000..1e9644a111e --- /dev/null +++ b/components/perf-team-prometheus-reader/AGENTS.md @@ -0,0 +1,21 @@ +# perf-team-prometheus-reader + +## Validation + +``` +kustomize build components/perf-team-prometheus-reader/development/ +kustomize build components/perf-team-prometheus-reader/staging/base/ +kustomize build components/perf-team-prometheus-reader/production/base/ +``` + +## Production Isolation + +`production/base/` has its own copies of all resource files. It does NOT reference the shared `base/` directory. When making changes: + +- Modifying `base/core/` or `base/tenants-rbac/` only affects development and staging. +- Production requires a separate PR that copies the validated files into `production/base/`. +- Never refactor production to reference `../../base` — the isolation is intentional. + +## General Conventions + +See the [README.md](README.md) for general info about this component and workflow for changes and the repo-level [AGENTS.md](/AGENTS.md) for commit format, PR requirements, and other conventions. diff --git a/components/perf-team-prometheus-reader/README.md b/components/perf-team-prometheus-reader/README.md index dfaed09fd5d..e0167db63b8 100644 --- a/components/perf-team-prometheus-reader/README.md +++ b/components/perf-team-prometheus-reader/README.md @@ -1,8 +1,50 @@ # perf-team-prometheus-reader -Component used by Konflux Perf&Scale team +Monitoring and observability resources for the Konflux Perf&Scale team. Deploys service accounts and RBAC for reading cluster Prometheus metrics, detecting OOMKills/crashloops, and reading events in tenant namespaces. + +## Directory Layout + +- `base/core/` — service accounts, RBAC grants, maintainer bindings (shared by development and staging) +- `base/tenants-rbac/` — event-reader roles for `konflux-perfscale-{1,2,3}-tenant` namespaces (shared by development and staging) +- `development/` — overlay for dev clusters, also defines tenant namespace resources +- `staging/base/` — overlay for staging clusters +- `production/base/` — standalone overlay with its own copies of all resources (does not reference shared `base/`) + +## Promotion Workflow + +Development and staging overlays reference the shared `base/` directory. Production has its own standalone copies of resources and does not inherit from `base/`. + +To roll out a change: + +1. **First PR** — modify files in `base/` (and `development/` or `staging/` if needed). This applies to development and staging clusters. +2. **Soak** — let the change run in staging to validate stability over time. +3. **Second PR** — copy the tested files into `production/base/`. Production PRs should be small, simple copy-pastes of what was already validated in staging to minimize risk of introducing new issues. + +This separation is intentional. Do not refactor production to reference the shared `base/` — the isolation ensures production changes are always explicit and deliberate. ## Service Accounts -- `perf-team-prometheus-reader-cluster-sa`: Used to read monitoring data from cluster Prometheus. -- `perf-team-prometheus-reader-oomcrash-sa`: Used by the [oomkill-and-crashloopbackoff-detector](https://github.com/konflux-ci/perfscale/tree/main/tools/oomkill-and-crashloopbackoff-detector) tool to monitor and detect OOMKills and crashloops across the cluster. +- **`perf-team-prometheus-reader-cluster-sa`** — reads monitoring data from cluster Prometheus. Bound to `cluster-monitoring-view` ClusterRole via `sa-read-permissions-openshift-monitoring` ClusterRoleBinding. + +- **`perf-team-prometheus-reader-oomcrash-sa`** — used by [oomkill-and-crashloopbackoff-detector](https://github.com/konflux-ci/perfscale/tree/main/tools/oomkill-and-crashloopbackoff-detector) to monitor OOMKills and crashloops. Bound to `perf-team-prometheus-reader-oomcrash-role` ClusterRole (list namespaces, get/list events and pods, get pods/log and pods/status). Has a long-lived token Secret. + +- **`konflux-bot-0`** (defined in tenants config, e.g. [here](https://gitlab.cee.redhat.com/releng/konflux-release-data/-/blob/6a23b46f6031be732474324f7da7ed0ae027739e/tenants-config/cluster/stone-prd-rh01/tenants/konflux-perfscale-1-tenant/konflux-bot-0.yaml)) — granted `perf-team-event-reader-role` (get/list/watch events) in each `konflux-perfscale-{1,2,3}-tenant` namespace via `tenants-rbac/`. This SA is used to run [Probe runs](https://docs.google.com/document/d/1lIWwBXeBxlyHkucNJu__NrAsPtRMgoPGjf_0EbHUhcs/edit?tab=t.0#heading=h.lxuqoglzqrgk) in those namespaces. + +Members of the `konflux-performance` group can create tokens for both SAs via the `perf-team-sa-token-creator` Role. To become a member of that group for Red Hat clusters you need to be in [this](https://rover.redhat.com/groups/group/konflux-performance) Rover group, for Fedora cluster add yourself to [this](https://github.com/redhat-appstudio/internal-infra-deployments/blob/6802797bcb8b66968e363d5e8811ac6e1ff348e3/components/k8s-groups/production/fas/groups/konflux-performance.yaml) file. + +## Production PR Template + +Production PRs require `## Risk Assessment` and `## Validation` sections ([full docs](https://konflux-production-approval-tool-982507.pages.redhat.com/#/docs/developer-guide)). Use this template: + +``` +## Risk Assessment +**Risk Level:** Low +**Description:** +**Rollback:** Revert PR + +## Validation +Tested on staging — no regressions observed. +Staging PR: +``` + +Risk levels: Low / Medium / High / Very High. Given purpose of our component, we will be Low or Medium. diff --git a/components/perf-team-prometheus-reader/base/core/kustomization.yaml b/components/perf-team-prometheus-reader/base/core/kustomization.yaml index 156798b85fa..ca031a21b04 100644 --- a/components/perf-team-prometheus-reader/base/core/kustomization.yaml +++ b/components/perf-team-prometheus-reader/base/core/kustomization.yaml @@ -5,3 +5,4 @@ resources: - serviceaccount.yaml - serviceaccount-oomcrash.yaml - perf-team.yaml + - sa-token-rbac.yaml diff --git a/components/perf-team-prometheus-reader/base/core/sa-token-rbac.yaml b/components/perf-team-prometheus-reader/base/core/sa-token-rbac.yaml new file mode 100644 index 00000000000..d5cfb73fba3 --- /dev/null +++ b/components/perf-team-prometheus-reader/base/core/sa-token-rbac.yaml @@ -0,0 +1,29 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +rules: + - verbs: + - create + apiGroups: + - "" + resources: + - serviceaccounts/token + resourceNames: + - perf-team-prometheus-reader-cluster-sa + - perf-team-prometheus-reader-oomcrash-sa +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +subjects: + - kind: Group + apiGroup: rbac.authorization.k8s.io + name: konflux-performance +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-sa-token-creator diff --git a/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml b/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml index 7a6c130935d..95a236d8163 100644 --- a/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml +++ b/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml @@ -1,3 +1,5 @@ +# To generate a token: oc -n perf-team-prometheus-reader create token perf-team-prometheus-reader-cluster-sa --duration "$((24*365))h" +# Store the token in https://vault.devshift.net/ stonesoup /{staging,production}/perfscale/shared/ apiVersion: v1 kind: ServiceAccount metadata: diff --git a/components/perf-team-prometheus-reader/production/base/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/kustomization.yaml index 156798b85fa..f50ab7da0ff 100644 --- a/components/perf-team-prometheus-reader/production/base/kustomization.yaml +++ b/components/perf-team-prometheus-reader/production/base/kustomization.yaml @@ -1,7 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: perf-team-prometheus-reader resources: - serviceaccount.yaml - serviceaccount-oomcrash.yaml - perf-team.yaml + - sa-token-rbac.yaml + - tenants-rbac diff --git a/components/perf-team-prometheus-reader/production/base/sa-token-rbac.yaml b/components/perf-team-prometheus-reader/production/base/sa-token-rbac.yaml new file mode 100644 index 00000000000..d5cfb73fba3 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/sa-token-rbac.yaml @@ -0,0 +1,29 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +rules: + - verbs: + - create + apiGroups: + - "" + resources: + - serviceaccounts/token + resourceNames: + - perf-team-prometheus-reader-cluster-sa + - perf-team-prometheus-reader-oomcrash-sa +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +subjects: + - kind: Group + apiGroup: rbac.authorization.k8s.io + name: konflux-performance +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-sa-token-creator diff --git a/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml b/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml index 7a6c130935d..95a236d8163 100644 --- a/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml +++ b/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml @@ -1,3 +1,5 @@ +# To generate a token: oc -n perf-team-prometheus-reader create token perf-team-prometheus-reader-cluster-sa --duration "$((24*365))h" +# Store the token in https://vault.devshift.net/ stonesoup /{staging,production}/perfscale/shared/ apiVersion: v1 kind: ServiceAccount metadata: diff --git a/components/authentication/base/group-sync-olm/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/kustomization.yaml similarity index 64% rename from components/authentication/base/group-sync-olm/kustomization.yaml rename to components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/kustomization.yaml index 35921ec89ec..4be86f47098 100644 --- a/components/authentication/base/group-sync-olm/kustomization.yaml +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/kustomization.yaml @@ -1,5 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - namespaces.yaml - - subscription.yaml + - tenant-rbac.yaml diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/tenant-rbac.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/tenant-rbac.yaml new file mode 100644 index 00000000000..d4ea9da4f53 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/tenant-rbac.yaml @@ -0,0 +1,24 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-role + namespace: konflux-perfscale-1-tenant +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["get", "list", "watch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-binding + namespace: konflux-perfscale-1-tenant +subjects: +- kind: ServiceAccount + name: konflux-bot-0 + namespace: konflux-perfscale-1-tenant +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-event-reader-role diff --git a/components/authentication/base/group-sync/external-secrets/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/kustomization.yaml similarity index 58% rename from components/authentication/base/group-sync/external-secrets/kustomization.yaml rename to components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/kustomization.yaml index 9e90c5affa8..4be86f47098 100644 --- a/components/authentication/base/group-sync/external-secrets/kustomization.yaml +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/kustomization.yaml @@ -1,5 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - konflux-ldap-sa.yaml - - mtls-ca-validators.yaml + - tenant-rbac.yaml diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/tenant-rbac.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/tenant-rbac.yaml new file mode 100644 index 00000000000..7420a7369f9 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/tenant-rbac.yaml @@ -0,0 +1,24 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-role + namespace: konflux-perfscale-2-tenant +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["get", "list", "watch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-binding + namespace: konflux-perfscale-2-tenant +subjects: +- kind: ServiceAccount + name: konflux-bot-0 + namespace: konflux-perfscale-2-tenant +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-event-reader-role diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/kustomization.yaml new file mode 100644 index 00000000000..4be86f47098 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - tenant-rbac.yaml diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/tenant-rbac.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/tenant-rbac.yaml new file mode 100644 index 00000000000..f8d1d3c8b6b --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/tenant-rbac.yaml @@ -0,0 +1,24 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-role + namespace: konflux-perfscale-3-tenant +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["get", "list", "watch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-binding + namespace: konflux-perfscale-3-tenant +subjects: +- kind: ServiceAccount + name: konflux-bot-0 + namespace: konflux-perfscale-3-tenant +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-event-reader-role diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/kustomization.yaml new file mode 100644 index 00000000000..f21c0ce51d1 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - konflux-perfscale-1-tenant + - konflux-perfscale-2-tenant + - konflux-perfscale-3-tenant diff --git a/components/pipeline-service/development-operator/kustomization.yaml b/components/pipeline-service/development-operator/kustomization.yaml new file mode 100644 index 00000000000..3fea1fa84fb --- /dev/null +++ b/components/pipeline-service/development-operator/kustomization.yaml @@ -0,0 +1,24 @@ +# Used when Konflux is installed via the operator (development-operator Argo overlay). +# Reuses development Tekton/pipeline-service configuration but omits +# appstudio-pipelines-scc so build-service (operator) can own it with ownerReferences. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../development + +# This overlay is applied as live kustomize. Staging/production pipeline-service often +# uses per-cluster deploy.yaml (see components/pipeline-service/README.md); operator +# overlays there require the same SCC omission in whatever path Argo actually syncs. +patches: + - target: + group: security.openshift.io + version: v1 + kind: SecurityContextConstraints + name: appstudio-pipelines-scc + patch: | + apiVersion: security.openshift.io/v1 + kind: SecurityContextConstraints + metadata: + name: appstudio-pipelines-scc + $patch: delete diff --git a/components/pipeline-service/development/main-pipeline-service-configuration.yaml b/components/pipeline-service/development/main-pipeline-service-configuration.yaml index e1b2f6f92d2..3d5e487f332 100644 --- a/components/pipeline-service/development/main-pipeline-service-configuration.yaml +++ b/components/pipeline-service/development/main-pipeline-service-configuration.yaml @@ -2243,7 +2243,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: diff --git a/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml b/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml index aa17334c3c8..b62ce13cc14 100644 --- a/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml +++ b/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml @@ -2073,7 +2073,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: diff --git a/components/pipeline-service/staging/stone-stage-p01/deploy.yaml b/components/pipeline-service/staging/stone-stage-p01/deploy.yaml index 68ef78ac99f..26cfa2c71bb 100644 --- a/components/pipeline-service/staging/stone-stage-p01/deploy.yaml +++ b/components/pipeline-service/staging/stone-stage-p01/deploy.yaml @@ -2649,7 +2649,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: diff --git a/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml b/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml index 442b2c37978..914aac10d83 100644 --- a/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml +++ b/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml @@ -2661,7 +2661,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md index 152c520aa60..c1c11bbfae3 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md @@ -1,7 +1,383 @@ # Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace` Tests that a LocalQueue is created in a namespace labeled with -`konflux-ci.dev/type=tenant`. +`konflux-ci.dev/type=tenant` and no `kueue.konflux-ci.dev/stop-policy` +annotation. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created](#step-when-tenant-labeled-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created` + +Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace-unpaused` + +Tests that a LocalQueue is created in a namespace labeled with +`konflux-ci.dev/type=tenant` and the `kueue.konflux-ci.dev/stop-policy` +annotation set to a value different from `hold`. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled-unpaused" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created](#step-when-tenant-labeled-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created` + +Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-paused-namespace-resumed` + +Tests that a LocalQueue with `stopPolicy` set to `Hold` is created +in a namespace labeled with `konflux-ci.dev/type=tenant` with the +`kueue.konflux-ci.dev/stop-policy` annotation set to `hold`. The +`stopPolicy` is then set to `None` when the annotation is removed +from the namespace. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled-paused-unpaused" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created-paused](#step-when-tenant-labeled-namespace-is-created-paused) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created-paused](#step-then-localqueue-is-created-paused) | 0 | 1 | 0 | 0 | 0 | +| 6 | [when-tenant-labeled-namespace-is-updated-to-unpause](#step-when-tenant-labeled-namespace-is-updated-to-unpause) | 0 | 1 | 0 | 0 | 0 | +| 7 | [then-localqueue-is-unpaused](#step-then-localqueue-is-unpaused) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created-paused` + +update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created-paused` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-updated-to-unpause` + +Update the namespace to unpause it + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `update` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-unpaused` + +Assert the LocalQueue's StopPolicy is None + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace-update-paused` + +Tests that a LocalQueue with `stopPolicy` set to `None` is created +in a namespace labeled with `konflux-ci.dev/type=tenant` with no +`kueue.konflux-ci.dev/stop-policy` annotation set. The `stopPolicy` +is then set to `Hold` when the annotation is added to the namespace. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled-unpaused-paused" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created](#step-when-tenant-labeled-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | +| 6 | [when-tenant-labeled-namespace-is-updated](#step-when-tenant-labeled-namespace-is-updated) | 0 | 1 | 0 | 0 | 0 | +| 7 | [then-localqueue-is-updated](#step-then-localqueue-is-updated) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created` + +Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-updated` + +update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-updated` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace-paused` + +Tests that a LocalQueue is created in a namespace labeled with +`konflux-ci.dev/type=tenant` and with annotation to pause the +LocalQueue. ## Bindings @@ -399,6 +775,81 @@ Apply the ClusterPolicy after the target namespace exists so generateExisting ca Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-kanary-namespace-before-policy` + +Tests that a LocalQueue is created for an existing +`appstudio-kanary-exporter` namespace when the ClusterPolicy is +applied (generateExisting, name-based match). + + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kanary-namespace-exists](#step-given-kanary-namespace-exists) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 4 | [when-cluster-policy-is-ready](#step-when-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kanary-namespace-exists` + +Create the appstudio-kanary-exporter namespace before policy install for name-based generateExisting. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `when-cluster-policy-is-ready` + +Apply the ClusterPolicy after the target namespace exists so generateExisting can backfill the LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + #### Try | # | Operation | Bindings | Outputs | Description | @@ -481,3 +932,77 @@ Assert the expected pipelines-queue LocalQueue exists and matches the fixture (n --- +# Test: `kueue-bootstrap-queue-kanary-by-name` + +Tests that a LocalQueue is created for the `appstudio-kanary-exporter` +namespace without the tenant label (name-based match). + + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-kanary-namespace-is-created](#step-when-kanary-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-kanary-namespace-is-created` + +Create the appstudio-kanary-exporter namespace after the policy is ready to verify name-based generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml index f4e0be4a10f..facb862c205 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml @@ -6,7 +6,8 @@ metadata: spec: description: | Tests that a LocalQueue is created in a namespace labeled with - `konflux-ci.dev/type=tenant`. + `konflux-ci.dev/type=tenant` and no `kueue.konflux-ci.dev/stop-policy` + annotation. concurrent: false namespace: kueue-queue-new bindings: @@ -51,6 +52,241 @@ spec: # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json apiVersion: chainsaw.kyverno.io/v1alpha1 kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-namespace-unpaused +spec: + description: | + Tests that a LocalQueue is created in a namespace labeled with + `konflux-ci.dev/type=tenant` and the `kueue.konflux-ci.dev/stop-policy` + annotation set to a value different from `hold`. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled-unpaused + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created + description: | + Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-unpaused.yaml + template: true + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-paused-namespace-resumed +spec: + description: | + Tests that a LocalQueue with `stopPolicy` set to `Hold` is created + in a namespace labeled with `konflux-ci.dev/type=tenant` with the + `kueue.konflux-ci.dev/stop-policy` annotation set to `hold`. The + `stopPolicy` is then set to `None` when the annotation is removed + from the namespace. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled-paused-unpaused + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created-paused + description: | + update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-paused.yaml + template: true + - name: then-localqueue-is-created-paused + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-paused.yaml + template: true + - name: when-tenant-labeled-namespace-is-updated-to-unpause + description: | + Update the namespace to unpause it + try: + - update: + file: resources/namespace-tenant.yaml + template: true + - name: then-localqueue-is-unpaused + description: | + Assert the LocalQueue's StopPolicy is None + try: + - assert: + file: resources/expected-localqueue.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-namespace-update-paused +spec: + description: | + Tests that a LocalQueue with `stopPolicy` set to `None` is created + in a namespace labeled with `konflux-ci.dev/type=tenant` with no + `kueue.konflux-ci.dev/stop-policy` annotation set. The `stopPolicy` + is then set to `Hold` when the annotation is added to the namespace. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled-unpaused-paused + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created + description: | + Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant.yaml + template: true + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue.yaml + template: true + - name: when-tenant-labeled-namespace-is-updated + description: | + update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-paused.yaml + template: true + - name: then-localqueue-is-updated + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-paused.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-namespace-paused +spec: + description: | + Tests that a LocalQueue is created in a namespace labeled with + `konflux-ci.dev/type=tenant` and with annotation to pause the + LocalQueue. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created + description: | + Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-paused.yaml + template: true + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-paused.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test metadata: name: kueue-bootstrap-queue-unlabeled-namespace-negative spec: @@ -265,6 +501,52 @@ spec: # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json apiVersion: chainsaw.kyverno.io/v1alpha1 kind: Test +metadata: + name: kueue-bootstrap-queue-kanary-namespace-before-policy +spec: + description: | + Tests that a LocalQueue is created for an existing + `appstudio-kanary-exporter` namespace when the ClusterPolicy is + applied (generateExisting, name-based match). + concurrent: false + namespace: kueue-queue-kanary-existing + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kanary-namespace-exists + description: | + Create the appstudio-kanary-exporter namespace before policy install for name-based generateExisting. + try: + - apply: + file: resources/namespace-kanary.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: when-cluster-policy-is-ready + description: | + Apply the ClusterPolicy after the target namespace exists so generateExisting can backfill the LocalQueue. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-kanary.yaml +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test metadata: name: kueue-bootstrap-queue-mintmaker-by-name spec: @@ -310,6 +592,51 @@ spec: # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json apiVersion: chainsaw.kyverno.io/v1alpha1 kind: Test +metadata: + name: kueue-bootstrap-queue-kanary-by-name +spec: + description: | + Tests that a LocalQueue is created for the `appstudio-kanary-exporter` + namespace without the tenant label (name-based match). + concurrent: false + namespace: kueue-queue-kanary-test + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-kanary-namespace-is-created + description: | + Create the appstudio-kanary-exporter namespace after the policy is ready to verify name-based generation. + try: + - apply: + file: resources/namespace-kanary.yaml + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-kanary.yaml +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test metadata: name: ensure-kueue-remains-on-policy-deletion spec: diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-kanary.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-kanary.yaml new file mode 100644 index 00000000000..aafd161743b --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-kanary.yaml @@ -0,0 +1,8 @@ +apiVersion: kueue.x-k8s.io/v1beta1 +kind: LocalQueue +metadata: + name: pipelines-queue + namespace: appstudio-kanary-exporter +spec: + clusterQueue: cluster-pipeline-queue + stopPolicy: None diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml index a21ab0d979c..2e317d53633 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml @@ -5,3 +5,4 @@ metadata: namespace: mintmaker spec: clusterQueue: cluster-pipeline-queue + stopPolicy: None diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-paused.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-paused.yaml new file mode 100644 index 00000000000..90d4bbbe105 --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-paused.yaml @@ -0,0 +1,8 @@ +apiVersion: kueue.x-k8s.io/v1beta1 +kind: LocalQueue +metadata: + name: pipelines-queue + namespace: (join('-', [$namespace, $suffix])) +spec: + clusterQueue: cluster-pipeline-queue + stopPolicy: Hold diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml index 68598a29484..83ba1485b75 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml @@ -5,3 +5,4 @@ metadata: namespace: (join('-', [$namespace, $suffix])) spec: clusterQueue: cluster-pipeline-queue + stopPolicy: None diff --git a/components/authentication/base/group-sync-olm/namespaces.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-kanary.yaml similarity index 54% rename from components/authentication/base/group-sync-olm/namespaces.yaml rename to components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-kanary.yaml index e58b45330ac..07162b806e8 100644 --- a/components/authentication/base/group-sync-olm/namespaces.yaml +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-kanary.yaml @@ -1,4 +1,4 @@ apiVersion: v1 kind: Namespace metadata: - name: group-sync-operator + name: appstudio-kanary-exporter diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-paused.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-paused.yaml new file mode 100644 index 00000000000..82767b7e30c --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-paused.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: (join('-', [$namespace, $suffix])) + annotations: + kueue.konflux-ci.dev/stop-policy: hold + labels: + konflux-ci.dev/type: tenant diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-unpaused.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-unpaused.yaml new file mode 100644 index 00000000000..97896241ca5 --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-unpaused.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: (join('-', [$namespace, $suffix])) + annotations: + kueue.konflux-ci.dev/stop-policy: none + labels: + konflux-ci.dev/type: tenant diff --git a/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml b/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml index 071d372c3c9..a26898f59da 100644 --- a/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml +++ b/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml @@ -20,6 +20,12 @@ spec: - Namespace names: - mintmaker + - appstudio-kanary-exporter + context: + - name: stopPolicy + variable: + jmesPath: >- + (request.object.metadata.annotations."kueue.konflux-ci.dev/stop-policy" || '') == 'hold' && 'Hold' || 'None' generate: generateExisting: true orphanDownstreamOnPolicyDelete: true @@ -31,3 +37,4 @@ spec: data: spec: clusterQueue: cluster-pipeline-queue + stopPolicy: "{{stopPolicy}}" diff --git a/components/release/development/kustomization.yaml b/components/release/development/kustomization.yaml index e4e164ce529..0dbbaf0810d 100644 --- a/components/release/development/kustomization.yaml +++ b/components/release/development/kustomization.yaml @@ -3,13 +3,13 @@ kind: Kustomization resources: - ../base - ../base/monitor/development - - https://github.com/konflux-ci/release-service/config/default?ref=98f4196defe6e8cc3addb22af44b07cd6ba6cec1 + - https://github.com/konflux-ci/release-service/config/default?ref=530b605bcfa10e668f821cdc046d35f6b3f476a5 - release_service_config.yaml images: - name: quay.io/konflux-ci/release-service newName: quay.io/konflux-ci/release-service - newTag: 98f4196defe6e8cc3addb22af44b07cd6ba6cec1 + newTag: 530b605bcfa10e668f821cdc046d35f6b3f476a5 namespace: release-service diff --git a/components/release/staging/kustomization.yaml b/components/release/staging/kustomization.yaml index 86b4daf5a5c..afc15c4d945 100644 --- a/components/release/staging/kustomization.yaml +++ b/components/release/staging/kustomization.yaml @@ -4,7 +4,7 @@ resources: - ../base - ../base/monitor/staging - external-secrets/release-monitor-secret.yaml - - https://github.com/konflux-ci/release-service/config/default?ref=5f0b67ab53d64072c1fce4d9e18e3297e91da126 + - https://github.com/konflux-ci/release-service/config/default?ref=d02b958bcf790f72dbb38625d5f851f843351f83 - release_service_config.yaml - signing_configs.yaml @@ -14,6 +14,6 @@ components: images: - name: quay.io/konflux-ci/release-service newName: quay.io/konflux-ci/release-service - newTag: 5f0b67ab53d64072c1fce4d9e18e3297e91da126 + newTag: d02b958bcf790f72dbb38625d5f851f843351f83 namespace: release-service diff --git a/components/squid/development/squid-helm-generator.yaml b/components/squid/development/squid-helm-generator.yaml index 34a33c6556d..f8fbee40c44 100644 --- a/components/squid/development/squid-helm-generator.yaml +++ b/components/squid/development/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1506+abe1045 +version: 0.1.1521+3e9d8b9 valuesInline: installCertManagerComponents: false mirrord: @@ -16,6 +16,7 @@ valuesInline: enabled: true secretName: artifact-registry-proxy-tls service: + trafficDistribution: PreferClose annotations: service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls upstream: @@ -26,6 +27,7 @@ valuesInline: - ^/.+/@v/.* # /@v/.info|.mod|.zip and /@v/list - ^/sumdb/.* # checksum database (e.g. sum.golang.org) size: 1024 + ttl: 30d test: enabled: false cert-manager: diff --git a/components/squid/production/empty-base/kustomization.yaml b/components/squid/production/empty-base/kustomization.yaml new file mode 100644 index 00000000000..1eff9b93ee1 --- /dev/null +++ b/components/squid/production/empty-base/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: caching +resources: +- ../../base diff --git a/components/squid/production/artifact-registry-credentials.yaml b/components/squid/production/kflux-fedora-01/artifact-registry-credentials.yaml similarity index 100% rename from components/squid/production/artifact-registry-credentials.yaml rename to components/squid/production/kflux-fedora-01/artifact-registry-credentials.yaml diff --git a/components/squid/production/kustomization.yaml b/components/squid/production/kflux-fedora-01/kustomization.yaml similarity index 92% rename from components/squid/production/kustomization.yaml rename to components/squid/production/kflux-fedora-01/kustomization.yaml index 7cde65eb463..6fbdca2f113 100644 --- a/components/squid/production/kustomization.yaml +++ b/components/squid/production/kflux-fedora-01/kustomization.yaml @@ -1,8 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization - resources: -- ../base +- ../../base - artifact-registry-credentials.yaml generators: diff --git a/components/squid/production/squid-helm-generator.yaml b/components/squid/production/kflux-fedora-01/squid-helm-generator.yaml similarity index 100% rename from components/squid/production/squid-helm-generator.yaml rename to components/squid/production/kflux-fedora-01/squid-helm-generator.yaml diff --git a/components/authentication/base/group-sync/external-secrets/mtls-ca-validators.yaml b/components/squid/production/kflux-ocp-p01/artifact-registry-credentials.yaml similarity index 60% rename from components/authentication/base/group-sync/external-secrets/mtls-ca-validators.yaml rename to components/squid/production/kflux-ocp-p01/artifact-registry-credentials.yaml index cca6b0d5a07..5cc5cd38bcf 100644 --- a/components/authentication/base/group-sync/external-secrets/mtls-ca-validators.yaml +++ b/components/squid/production/kflux-ocp-p01/artifact-registry-credentials.yaml @@ -1,16 +1,12 @@ apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: - name: mtls-ca-validators + name: artifact-registry-credentials + namespace: caching annotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true argocd.argoproj.io/sync-wave: "-1" spec: - dataFrom: - - extract: - conversionStrategy: Default - decodingStrategy: None - key: staging/infrastructure/group-sync/mtls-ca-validators refreshInterval: 1h secretStoreRef: kind: ClusterSecretStore @@ -18,4 +14,9 @@ spec: target: creationPolicy: Owner deletionPolicy: Delete - name: mtls-ca-validators + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-ocp-p01/kustomization.yaml b/components/squid/production/kflux-ocp-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-ocp-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml b/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..50f1c13e36f --- /dev/null +++ b/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1521+3e9d8b9 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 1048576 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml b/components/squid/production/kflux-osp-p01/artifact-registry-credentials.yaml similarity index 60% rename from components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml rename to components/squid/production/kflux-osp-p01/artifact-registry-credentials.yaml index f5442dd1113..5cc5cd38bcf 100644 --- a/components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml +++ b/components/squid/production/kflux-osp-p01/artifact-registry-credentials.yaml @@ -1,16 +1,12 @@ apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: - name: konflux-ldap-sa + name: artifact-registry-credentials + namespace: caching annotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true argocd.argoproj.io/sync-wave: "-1" spec: - dataFrom: - - extract: - conversionStrategy: Default - decodingStrategy: None - key: staging/infrastructure/group-sync/konflux-ldap-sa refreshInterval: 1h secretStoreRef: kind: ClusterSecretStore @@ -18,4 +14,9 @@ spec: target: creationPolicy: Owner deletionPolicy: Delete - name: konflux-ldap-sa + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-osp-p01/kustomization.yaml b/components/squid/production/kflux-osp-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-osp-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-osp-p01/squid-helm-generator.yaml b/components/squid/production/kflux-osp-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-osp-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/kflux-prd-rh02/artifact-registry-credentials.yaml b/components/squid/production/kflux-prd-rh02/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-prd-rh02/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-prd-rh02/kustomization.yaml b/components/squid/production/kflux-prd-rh02/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-prd-rh02/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml b/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml new file mode 100644 index 00000000000..50f1c13e36f --- /dev/null +++ b/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1521+3e9d8b9 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 1048576 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/kflux-prd-rh03/artifact-registry-credentials.yaml b/components/squid/production/kflux-prd-rh03/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-prd-rh03/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-prd-rh03/kustomization.yaml b/components/squid/production/kflux-prd-rh03/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-prd-rh03/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-prd-rh03/squid-helm-generator.yaml b/components/squid/production/kflux-prd-rh03/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-prd-rh03/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/kflux-rhel-p01/artifact-registry-credentials.yaml b/components/squid/production/kflux-rhel-p01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-rhel-p01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-rhel-p01/kustomization.yaml b/components/squid/production/kflux-rhel-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-rhel-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-rhel-p01/squid-helm-generator.yaml b/components/squid/production/kflux-rhel-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-rhel-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/stone-prd-rh01/artifact-registry-credentials.yaml b/components/squid/production/stone-prd-rh01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/stone-prd-rh01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/stone-prd-rh01/kustomization.yaml b/components/squid/production/stone-prd-rh01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/stone-prd-rh01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/stone-prd-rh01/squid-helm-generator.yaml b/components/squid/production/stone-prd-rh01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/stone-prd-rh01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/stone-prod-p01/artifact-registry-credentials.yaml b/components/squid/production/stone-prod-p01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/stone-prod-p01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/stone-prod-p01/kustomization.yaml b/components/squid/production/stone-prod-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/stone-prod-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/stone-prod-p01/squid-helm-generator.yaml b/components/squid/production/stone-prod-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..50f1c13e36f --- /dev/null +++ b/components/squid/production/stone-prod-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1521+3e9d8b9 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 1048576 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/stone-prod-p02/artifact-registry-credentials.yaml b/components/squid/production/stone-prod-p02/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/stone-prod-p02/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/stone-prod-p02/kustomization.yaml b/components/squid/production/stone-prod-p02/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/stone-prod-p02/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/stone-prod-p02/squid-helm-generator.yaml b/components/squid/production/stone-prod-p02/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/stone-prod-p02/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/staging/squid-helm-generator.yaml b/components/squid/staging/squid-helm-generator.yaml index 4fc80cde724..b975026c428 100644 --- a/components/squid/staging/squid-helm-generator.yaml +++ b/components/squid/staging/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1506+abe1045 +version: 0.1.1521+3e9d8b9 valuesInline: installCertManagerComponents: false mirrord: @@ -18,6 +18,7 @@ valuesInline: secretName: artifact-registry-proxy-tls service: port: 443 + trafficDistribution: PreferClose annotations: service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls upstream: @@ -29,7 +30,8 @@ valuesInline: allowList: # Cache all traffic to nexus repositories - ^/repository/ - size: 51200 + size: 102400 + ttl: 30d resources: requests: cpu: "2" diff --git a/components/vector-kubearchive-log-collector/development/kustomization.yaml b/components/vector-kubearchive-log-collector/development/kustomization.yaml index 44aa63a1898..94aa9ff5cdd 100644 --- a/components/vector-kubearchive-log-collector/development/kustomization.yaml +++ b/components/vector-kubearchive-log-collector/development/kustomization.yaml @@ -22,6 +22,8 @@ resources: - rbac.yaml - loki-secret.yaml - sa.yaml +- prometheus-rules.yaml +- namespace.yaml patches: - path: scc-patch.yaml @@ -51,6 +53,36 @@ patches: kind: StatefulSet namespace: product-kubearchive-logging labelSelector: app.kubernetes.io/name=loki,app.kubernetes.io/component=ingester + - patch: |- + - op: replace + path: /spec/endpoints/0/scheme + value: http + - op: replace + path: /spec/endpoints/0/port + value: http-metrics + - op: remove + path: /spec/endpoints/0/bearerTokenSecret + - op: remove + path: /spec/endpoints/0/tlsConfig + - op: replace + path: /spec/selector/matchExpressions + value: + - key: app.kubernetes.io/component + operator: In + values: + - querier + - ingester + - distributor + - compactor + - key: app.kubernetes.io/name + operator: In + values: + - loki + target: + group: monitoring.coreos.com + version: v1 + kind: ServiceMonitor + name: product-kubearchive-logging-monitor generators: - vector-helm-generator.yaml diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/namespace.yaml b/components/vector-kubearchive-log-collector/development/namespace.yaml similarity index 72% rename from components/authentication/helm-charts/group-sync-operator-chart/templates/namespace.yaml rename to components/vector-kubearchive-log-collector/development/namespace.yaml index c2c907bd2f3..a51177f0829 100644 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/namespace.yaml +++ b/components/vector-kubearchive-log-collector/development/namespace.yaml @@ -1,6 +1,6 @@ apiVersion: v1 kind: Namespace metadata: - name: {{ .Release.Namespace }} + name: product-kubearchive-logging labels: openshift.io/cluster-monitoring: "true" diff --git a/components/vector-kubearchive-log-collector/development/prometheus-rules.yaml b/components/vector-kubearchive-log-collector/development/prometheus-rules.yaml new file mode 100644 index 00000000000..2c26f0fbbe2 --- /dev/null +++ b/components/vector-kubearchive-log-collector/development/prometheus-rules.yaml @@ -0,0 +1,51 @@ +--- +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: kubearchive-logging-rules + namespace: product-kubearchive-logging + labels: + openshift.io/prometheus-rule-evaluation-scope: leaf-prometheus +spec: + groups: + - name: loki + interval: 30s + rules: + - alert: LokiComponentDown + expr: up{namespace="product-kubearchive-logging",job=~"loki-(ingester|distributor|querier|compactor).*"} == 0 + for: 5m + labels: + severity: critical + annotations: + summary: "Loki component {{ $labels.job }} is down" + description: "{{ $labels.job }} has been down for more than 5 minutes" + - alert: LokiHighRequestLatency + expr: | + histogram_quantile(0.99, + rate(loki_request_duration_seconds_bucket{namespace="product-kubearchive-logging"}[5m]) + ) > 10 + for: 10m + labels: + severity: warning + annotations: + summary: "Loki high request latency" + description: "99th percentile latency is {{ $value }}s" + - alert: LokiIngestionFailure + expr: | + 100 * sum(rate(loki_request_duration_seconds_count{ + namespace="product-kubearchive-logging", + status_code=~"5..", + route=~".*push.*" + }[5m])) by (job) + / + sum(rate(loki_request_duration_seconds_count{ + namespace="product-kubearchive-logging", + route=~".*push.*" + }[5m])) by (job) + > 10 + for: 5m + labels: + severity: warning + annotations: + summary: "Loki ingestion failures detected" + description: "{{ $labels.job }} push error rate is {{ $value | printf \"%.1f\" }}%" diff --git a/components/vector-kubearchive-log-collector/development/rbac.yaml b/components/vector-kubearchive-log-collector/development/rbac.yaml index 66b5d020b8b..6ce79c71db5 100644 --- a/components/vector-kubearchive-log-collector/development/rbac.yaml +++ b/components/vector-kubearchive-log-collector/development/rbac.yaml @@ -17,3 +17,33 @@ subjects: - kind: ServiceAccount name: minio namespace: product-kubearchive-logging +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: prometheus-k8s + namespace: product-kubearchive-logging +rules: +- apiGroups: [""] + resources: + - services + - endpoints + - pods + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: prometheus-k8s + namespace: product-kubearchive-logging +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: prometheus-k8s +subjects: +- kind: ServiceAccount + name: prometheus-k8s + namespace: openshift-monitoring diff --git a/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml b/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml index df2369deddd..f9f65bd28be 100644 --- a/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml +++ b/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml @@ -1,10 +1,11 @@ --- +replicas: 1 resources: requests: - cpu: 200m - memory: 1024Mi - ephemeral-storage: 2Gi # Request ephemeral storage to prevent DiskPressure evictions + cpu: 100m + memory: 512Mi + ephemeral-storage: 1Gi limits: - cpu: 1000m - memory: 2048Mi - ephemeral-storage: 5Gi # Limit ephemeral storage usage to prevent unbounded disk growth + cpu: 500m + memory: 1024Mi + ephemeral-storage: 3Gi diff --git a/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml b/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml index fdb79082f81..c0013eef8b6 100644 --- a/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml +++ b/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml @@ -23,7 +23,6 @@ spec: - dora-metrics - enterprise-contract-service - external-secrets-operator - - group-sync-operator - hac-pact-broker - image-controller - integration-service diff --git a/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml b/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml index 26e0e712985..55d366028e7 100644 --- a/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml +++ b/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml b/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml +++ b/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/hack/new-cluster/templates/private/authentication/kustomization.yaml b/hack/new-cluster/templates/private/authentication/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/hack/new-cluster/templates/private/authentication/kustomization.yaml +++ b/hack/new-cluster/templates/private/authentication/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/hack/preview.sh b/hack/preview.sh index b6701d13dcd..ec44780e0c6 100755 --- a/hack/preview.sh +++ b/hack/preview.sh @@ -270,6 +270,8 @@ print_help() { echo "Environment (optional):" echo " PREVIEW_WAIT_KONFLUX_CR_READY=true When using --operator-overlay, additionally wait for the Konflux" echo " custom resource konflux to exist and report Ready=True (off by default)." + echo " IMAGE_CONTROLLER_QUAY_ORG, IMAGE_CONTROLLER_QUAY_TOKEN With --operator-overlay, both must be set in" + echo " hack/preview.env to enable image-controller on the Konflux CR (off by default)." echo echo "Example: \`$0 preview --obo --grafana --eaas\`" } @@ -378,6 +380,28 @@ configure_kueue_for_ocp_version() { log_success "Kueue disabled for OCP version $ocp_version" } +# Enable Konflux CR image-controller only when Quay credentials are provided (operator overlay). +configure_operator_image_controller() { + [ "$TARGET_PREVIEW_OVERLAY" != "development-operator" ] && return + + local cr_patch="$ROOT/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml" + + log_step "Configuring Konflux operator image-controller (Quay credentials)" + + if [[ -n "${IMAGE_CONTROLLER_QUAY_ORG}" && -n "${IMAGE_CONTROLLER_QUAY_TOKEN}" ]]; then + log_info "IMAGE_CONTROLLER_QUAY_ORG and IMAGE_CONTROLLER_QUAY_TOKEN are set" + log_info " - Quay organization: ${IMAGE_CONTROLLER_QUAY_ORG}" + yq -i '.spec.imageController.enabled = true' "$cr_patch" + log_success "Konflux CR image-controller: enabled (operator will deploy image-controller)" + else + log_info "IMAGE_CONTROLLER_QUAY_ORG and/or IMAGE_CONTROLLER_QUAY_TOKEN are not set" + [ -z "${IMAGE_CONTROLLER_QUAY_ORG}" ] && log_info " - IMAGE_CONTROLLER_QUAY_ORG: not set" + [ -z "${IMAGE_CONTROLLER_QUAY_TOKEN}" ] && log_info " - IMAGE_CONTROLLER_QUAY_TOKEN: not set" + yq -i '.spec.imageController.enabled = false' "$cr_patch" + log_warn "Konflux CR image-controller: disabled (set both Quay variables in hack/preview.env to enable)" + fi +} + # Apply service image overrides from environment variables apply_service_image_overrides() { log_step "Applying service image overrides from environment variables" @@ -1066,6 +1090,7 @@ label_cluster_nodes if [ "$TARGET_PREVIEW_OVERLAY" = "development" ] || [ "$TARGET_PREVIEW_OVERLAY" = "development-operator" ]; then configure_deploy_only configure_kueue_for_ocp_version + configure_operator_image_controller # Configure GitHub org log_step "Configuring GitHub organization" diff --git a/hack/test-tekton-kueue-config.py b/hack/test-tekton-kueue-config.py index b2c67b9d583..eb70786ab11 100755 --- a/hack/test-tekton-kueue-config.py +++ b/hack/test-tekton-kueue-config.py @@ -65,6 +65,7 @@ class ConfigCombination(TypedDict): class TestCombination(TypedDict): pipelinerun_key: str config_key: str + expected: ExpectedResults | None class PipelineRunMetadata(TypedDict, total=False): @@ -204,6 +205,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-arm64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", @@ -252,6 +254,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-arm64": "1", "kueue.konflux-ci.dev/requests-aws-ip": "2" @@ -283,7 +286,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -312,7 +317,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -339,7 +346,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -365,7 +374,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -393,7 +404,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-release" @@ -420,7 +433,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-tenant-release" @@ -444,6 +459,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", }, "labels": { @@ -473,7 +489,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "build.appstudio.openshift.io/type": "nudge", "kueue.x-k8s.io/queue-name": "pipelines-queue", @@ -500,7 +518,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -527,7 +547,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -554,7 +576,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -581,7 +605,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -611,7 +637,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -641,7 +669,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -671,7 +701,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -701,7 +733,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -728,7 +762,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-post-merge-test" @@ -754,7 +790,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test" @@ -777,7 +815,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-default" @@ -803,7 +843,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-release" @@ -837,6 +879,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-arm64": "1", "kueue.konflux-ci.dev/requests-darwin-amd64": "1", "kueue.konflux-ci.dev/requests-windows-amd64": "1", @@ -874,6 +917,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", "kueue.konflux-ci.dev/requests-linux-ppc64le": "1", @@ -914,6 +958,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", "kueue.konflux-ci.dev/requests-linux-ppc64le": "1", @@ -974,6 +1019,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", "kueue.konflux-ci.dev/requests-linux-arm64": "1", @@ -1004,7 +1050,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-prod-release" @@ -1030,14 +1078,15 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-stage-release" } } }, - } # Configuration combinations that can be applied to any PipelineRun @@ -1244,41 +1293,124 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: # Test key PipelineRuns with production config "multiplatform_new_production": { "pipelinerun_key": "multiplatform_new", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "2" + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-post-merge-build" + } + } }, "release_managed_production": { "pipelinerun_key": "release_managed", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-release" + } + } }, "mintmaker_production": { "pipelinerun_key": "mintmaker", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-mintmaker": "1", + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-dependency-update" + } + } }, "internal_pipelinerun_child_production": { "pipelinerun_key": "internal_pipelinerun_child", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-release" + } + } + }, "prefer_new_parameters_production": { "pipelinerun_key": "prefer-new-parameters", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "2", + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", + } + } }, "gitlab_merge_request_production": { "pipelinerun_key": "gitlab_merge_request_build", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", + } + } }, "gitlab_merge_request_test_production": { "pipelinerun_key": "gitlab_merge_request_test", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", + } + } }, "nudging_production": { "pipelinerun_key": "nudge_pipelinerun", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "build.appstudio.openshift.io/type": "nudge", + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-dependency-update" + } + } }, # Test key PipelineRuns with production kflux-ocp-p01 config "multiplatform_new_production-kflux-ocp-p01": { "pipelinerun_key": "multiplatform_new", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "2" + }, + "labels": { + "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "pipelinesascode.tekton.dev/event-type": "push" + } + } }, "release_managed_production-kflux-ocp-p01": { "pipelinerun_key": "release_managed", @@ -1300,31 +1432,69 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: # Example: Test the same PipelineRun with different configs to show reusability "user-specific-priority_and_mixed_platforms_production-kflux-ocp-p01": { "pipelinerun_key": "user-specific-priority", - "config_key": "production-kflux-ocp-p01" - }, - "internal_pipelinerun_child_production-kflux-ocp-p01": { - "pipelinerun_key": "internal_pipelinerun_child", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-linux-ppc64le": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-darwin-amd64": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "3" + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-user-specific" + } + } }, # Test OCP stage/prod priority assignment (only on OCP cluster) "ocp_prod_release_production-kflux-ocp-p01": { "pipelinerun_key": "ocp_prod_release", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-prod-release" + } + } }, "ocp_stage_release_production-kflux-ocp-p01": { "pipelinerun_key": "ocp_stage_release", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-stage-release" + } + } }, "gitlab_merge_request_production-kflux-ocp-p01": { "pipelinerun_key": "gitlab_merge_request_build", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", + } + } }, "gitlab_merge_request_test_production-kflux-ocp-p01": { "pipelinerun_key": "gitlab_merge_request_test", - "config_key": "production-kflux-ocp-p01" - } + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", + } + } + }, } @@ -1347,6 +1517,9 @@ def run_mutation_test(self, test_combination: TestCombination) -> Dict[str, Any] # Get the PipelineRun definition pipelinerun_key = test_combination["pipelinerun_key"] pipelinerun_data = PIPELINERUN_DEFINITIONS[pipelinerun_key] + if "expected" in test_combination and test_combination["expected"] is not None: + pipelinerun_data["expected"] = test_combination["expected"] + pipelinerun = pipelinerun_data["pipelinerun"] with tempfile.TemporaryDirectory() as temp_dir: