From 6e2a484be9fd3b958d6c90650320d117c9a7534e Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Thu, 14 May 2026 10:32:02 +0000 Subject: [PATCH 01/83] update components/mintmaker/staging/base/kustomization.yaml (#11798) Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/staging/base/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index 7fceb0fd368..273216bea1c 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -16,7 +16,7 @@ images: newTag: f630842900c1caf0080e113925b3295b6c008df2 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: 4e4c7faa421edfe0a02e977a83f2b33d1b5db3b3 + newTag: 94810e0758480e3632374ab49eb03f1e27b59157 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From 7516ee8c766f0be480e21fff8109f2f94c30f962 Mon Sep 17 00:00:00 2001 From: Andy Sadler Date: Thu, 14 May 2026 07:14:07 -0500 Subject: [PATCH 02/83] policies: rollout queue-config policy to prod (#11787) It's been baking in staging for a few weeks, and no issues have been identified. Synchronize the production policy with the staging policy. One small change to the policy is required, however: production has not upgraded to the latest version of kueue, so the v1beta1 version of kueue's resources is required by this policy. Fixes: KFLUXINFRA-3646 Signed-off-by: Andy Sadler --- .../queue-config/.chainsaw-test/README.md | 527 +++++++++++++++++- .../.chainsaw-test/chainsaw-test.yaml | 329 ++++++++++- .../resources/expected-localqueue-kanary.yaml | 8 + .../expected-localqueue-mintmaker.yaml | 1 + .../resources/expected-localqueue-paused.yaml | 8 + .../resources/expected-localqueue.yaml | 1 + .../resources/namespace-kanary.yaml | 4 + .../resources/namespace-tenant-paused.yaml | 8 + .../resources/namespace-tenant-unpaused.yaml | 8 + .../kueue/queue-config/cluster-policy.yaml | 7 + 10 files changed, 899 insertions(+), 2 deletions(-) create mode 100644 components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-kanary.yaml create mode 100644 components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-paused.yaml create mode 100644 components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-kanary.yaml create mode 100644 components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-paused.yaml create mode 100644 components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-unpaused.yaml diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md index 152c520aa60..c1c11bbfae3 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/README.md @@ -1,7 +1,383 @@ # Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace` Tests that a LocalQueue is created in a namespace labeled with -`konflux-ci.dev/type=tenant`. +`konflux-ci.dev/type=tenant` and no `kueue.konflux-ci.dev/stop-policy` +annotation. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created](#step-when-tenant-labeled-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created` + +Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace-unpaused` + +Tests that a LocalQueue is created in a namespace labeled with +`konflux-ci.dev/type=tenant` and the `kueue.konflux-ci.dev/stop-policy` +annotation set to a value different from `hold`. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled-unpaused" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created](#step-when-tenant-labeled-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created` + +Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-paused-namespace-resumed` + +Tests that a LocalQueue with `stopPolicy` set to `Hold` is created +in a namespace labeled with `konflux-ci.dev/type=tenant` with the +`kueue.konflux-ci.dev/stop-policy` annotation set to `hold`. The +`stopPolicy` is then set to `None` when the annotation is removed +from the namespace. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled-paused-unpaused" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created-paused](#step-when-tenant-labeled-namespace-is-created-paused) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created-paused](#step-then-localqueue-is-created-paused) | 0 | 1 | 0 | 0 | 0 | +| 6 | [when-tenant-labeled-namespace-is-updated-to-unpause](#step-when-tenant-labeled-namespace-is-updated-to-unpause) | 0 | 1 | 0 | 0 | 0 | +| 7 | [then-localqueue-is-unpaused](#step-then-localqueue-is-unpaused) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created-paused` + +update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created-paused` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-updated-to-unpause` + +Update the namespace to unpause it + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `update` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-unpaused` + +Assert the LocalQueue's StopPolicy is None + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace-update-paused` + +Tests that a LocalQueue with `stopPolicy` set to `None` is created +in a namespace labeled with `konflux-ci.dev/type=tenant` with no +`kueue.konflux-ci.dev/stop-policy` annotation set. The `stopPolicy` +is then set to `Hold` when the annotation is added to the namespace. + + +## Bindings + +| # | Name | Value | +|:-:|---|---| +| 1 | `suffix` | "labeled-unpaused-paused" | + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-tenant-labeled-namespace-is-created](#step-when-tenant-labeled-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | +| 6 | [when-tenant-labeled-namespace-is-updated](#step-when-tenant-labeled-namespace-is-updated) | 0 | 1 | 0 | 0 | 0 | +| 7 | [then-localqueue-is-updated](#step-then-localqueue-is-updated) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-created` + +Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +### Step: `when-tenant-labeled-namespace-is-updated` + +update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-updated` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-new-tenant-labeled-namespace-paused` + +Tests that a LocalQueue is created in a namespace labeled with +`konflux-ci.dev/type=tenant` and with annotation to pause the +LocalQueue. ## Bindings @@ -399,6 +775,81 @@ Apply the ClusterPolicy after the target namespace exists so generateExisting ca Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + +# Test: `kueue-bootstrap-queue-kanary-namespace-before-policy` + +Tests that a LocalQueue is created for an existing +`appstudio-kanary-exporter` namespace when the ClusterPolicy is +applied (generateExisting, name-based match). + + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kanary-namespace-exists](#step-given-kanary-namespace-exists) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 4 | [when-cluster-policy-is-ready](#step-when-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kanary-namespace-exists` + +Create the appstudio-kanary-exporter namespace before policy install for name-based generateExisting. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `when-cluster-policy-is-ready` + +Apply the ClusterPolicy after the target namespace exists so generateExisting can backfill the LocalQueue. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + #### Try | # | Operation | Bindings | Outputs | Description | @@ -481,3 +932,77 @@ Assert the expected pipelines-queue LocalQueue exists and matches the fixture (n --- +# Test: `kueue-bootstrap-queue-kanary-by-name` + +Tests that a LocalQueue is created for the `appstudio-kanary-exporter` +namespace without the tenant label (name-based match). + + +## Steps + +| # | Name | Bindings | Try | Catch | Finally | Cleanup | +|:-:|---|:-:|:-:|:-:|:-:|:-:| +| 1 | [given-localqueue-crd-exists](#step-given-localqueue-crd-exists) | 0 | 1 | 0 | 0 | 0 | +| 2 | [given-kyverno-has-permission-on-resources](#step-given-kyverno-has-permission-on-resources) | 0 | 1 | 0 | 0 | 0 | +| 3 | [given-cluster-policy-is-ready](#step-given-cluster-policy-is-ready) | 0 | 2 | 0 | 0 | 0 | +| 4 | [when-kanary-namespace-is-created](#step-when-kanary-namespace-is-created) | 0 | 1 | 0 | 0 | 0 | +| 5 | [then-localqueue-is-created](#step-then-localqueue-is-created) | 0 | 1 | 0 | 0 | 0 | + +### Step: `given-localqueue-crd-exists` + +Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-kyverno-has-permission-on-resources` + +Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `given-cluster-policy-is-ready` + +Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | +| 2 | `assert` | 0 | 0 | *No description* | + +### Step: `when-kanary-namespace-is-created` + +Create the appstudio-kanary-exporter namespace after the policy is ready to verify name-based generation. + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `apply` | 0 | 0 | *No description* | + +### Step: `then-localqueue-is-created` + +Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + + +#### Try + +| # | Operation | Bindings | Outputs | Description | +|:-:|---|:-:|:-:|---| +| 1 | `assert` | 0 | 0 | *No description* | + +--- + diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml index f4e0be4a10f..facb862c205 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/chainsaw-test.yaml @@ -6,7 +6,8 @@ metadata: spec: description: | Tests that a LocalQueue is created in a namespace labeled with - `konflux-ci.dev/type=tenant`. + `konflux-ci.dev/type=tenant` and no `kueue.konflux-ci.dev/stop-policy` + annotation. concurrent: false namespace: kueue-queue-new bindings: @@ -51,6 +52,241 @@ spec: # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json apiVersion: chainsaw.kyverno.io/v1alpha1 kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-namespace-unpaused +spec: + description: | + Tests that a LocalQueue is created in a namespace labeled with + `konflux-ci.dev/type=tenant` and the `kueue.konflux-ci.dev/stop-policy` + annotation set to a value different from `hold`. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled-unpaused + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created + description: | + Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-unpaused.yaml + template: true + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-paused-namespace-resumed +spec: + description: | + Tests that a LocalQueue with `stopPolicy` set to `Hold` is created + in a namespace labeled with `konflux-ci.dev/type=tenant` with the + `kueue.konflux-ci.dev/stop-policy` annotation set to `hold`. The + `stopPolicy` is then set to `None` when the annotation is removed + from the namespace. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled-paused-unpaused + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created-paused + description: | + update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-paused.yaml + template: true + - name: then-localqueue-is-created-paused + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-paused.yaml + template: true + - name: when-tenant-labeled-namespace-is-updated-to-unpause + description: | + Update the namespace to unpause it + try: + - update: + file: resources/namespace-tenant.yaml + template: true + - name: then-localqueue-is-unpaused + description: | + Assert the LocalQueue's StopPolicy is None + try: + - assert: + file: resources/expected-localqueue.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-namespace-update-paused +spec: + description: | + Tests that a LocalQueue with `stopPolicy` set to `None` is created + in a namespace labeled with `konflux-ci.dev/type=tenant` with no + `kueue.konflux-ci.dev/stop-policy` annotation set. The `stopPolicy` + is then set to `Hold` when the annotation is added to the namespace. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled-unpaused-paused + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created + description: | + Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant.yaml + template: true + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue.yaml + template: true + - name: when-tenant-labeled-namespace-is-updated + description: | + update a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-paused.yaml + template: true + - name: then-localqueue-is-updated + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-paused.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: kueue-bootstrap-queue-new-tenant-labeled-namespace-paused +spec: + description: | + Tests that a LocalQueue is created in a namespace labeled with + `konflux-ci.dev/type=tenant` and with annotation to pause the + LocalQueue. + concurrent: false + namespace: kueue-queue-new + bindings: + - name: suffix + value: labeled + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-tenant-labeled-namespace-is-created + description: | + Create a namespace labeled konflux-ci.dev/type=tenant so the policy should generate a LocalQueue. + try: + - apply: + file: resources/namespace-tenant-paused.yaml + template: true + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-paused.yaml + template: true +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test metadata: name: kueue-bootstrap-queue-unlabeled-namespace-negative spec: @@ -265,6 +501,52 @@ spec: # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json apiVersion: chainsaw.kyverno.io/v1alpha1 kind: Test +metadata: + name: kueue-bootstrap-queue-kanary-namespace-before-policy +spec: + description: | + Tests that a LocalQueue is created for an existing + `appstudio-kanary-exporter` namespace when the ClusterPolicy is + applied (generateExisting, name-based match). + concurrent: false + namespace: kueue-queue-kanary-existing + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kanary-namespace-exists + description: | + Create the appstudio-kanary-exporter namespace before policy install for name-based generateExisting. + try: + - apply: + file: resources/namespace-kanary.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: when-cluster-policy-is-ready + description: | + Apply the ClusterPolicy after the target namespace exists so generateExisting can backfill the LocalQueue. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-kanary.yaml +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test metadata: name: kueue-bootstrap-queue-mintmaker-by-name spec: @@ -310,6 +592,51 @@ spec: # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json apiVersion: chainsaw.kyverno.io/v1alpha1 kind: Test +metadata: + name: kueue-bootstrap-queue-kanary-by-name +spec: + description: | + Tests that a LocalQueue is created for the `appstudio-kanary-exporter` + namespace without the tenant label (name-based match). + concurrent: false + namespace: kueue-queue-kanary-test + steps: + - name: given-localqueue-crd-exists + description: | + Install the Kueue LocalQueue CRD so the API server accepts LocalQueue objects in the test cluster. + try: + - apply: + file: ./resources/localqueue-crd.yaml + - name: given-kyverno-has-permission-on-resources + description: | + Apply Kyverno RBAC so the policy engine can generate and reconcile LocalQueue resources. + try: + - apply: + file: ../kyverno-rbac.yaml + - name: given-cluster-policy-is-ready + description: | + Apply the queue bootstrap ClusterPolicy and assert Kyverno reports the policy as ready before exercising generation. + try: + - apply: + file: ../cluster-policy.yaml + - assert: + file: chainsaw-assert-clusterpolicy.yaml + - name: when-kanary-namespace-is-created + description: | + Create the appstudio-kanary-exporter namespace after the policy is ready to verify name-based generation. + try: + - apply: + file: resources/namespace-kanary.yaml + - name: then-localqueue-is-created + description: | + Assert the expected pipelines-queue LocalQueue exists and matches the fixture (name and spec). + try: + - assert: + file: resources/expected-localqueue-kanary.yaml +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test metadata: name: ensure-kueue-remains-on-policy-deletion spec: diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-kanary.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-kanary.yaml new file mode 100644 index 00000000000..aafd161743b --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-kanary.yaml @@ -0,0 +1,8 @@ +apiVersion: kueue.x-k8s.io/v1beta1 +kind: LocalQueue +metadata: + name: pipelines-queue + namespace: appstudio-kanary-exporter +spec: + clusterQueue: cluster-pipeline-queue + stopPolicy: None diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml index a21ab0d979c..2e317d53633 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-mintmaker.yaml @@ -5,3 +5,4 @@ metadata: namespace: mintmaker spec: clusterQueue: cluster-pipeline-queue + stopPolicy: None diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-paused.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-paused.yaml new file mode 100644 index 00000000000..90d4bbbe105 --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue-paused.yaml @@ -0,0 +1,8 @@ +apiVersion: kueue.x-k8s.io/v1beta1 +kind: LocalQueue +metadata: + name: pipelines-queue + namespace: (join('-', [$namespace, $suffix])) +spec: + clusterQueue: cluster-pipeline-queue + stopPolicy: Hold diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml index 68598a29484..83ba1485b75 100644 --- a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/expected-localqueue.yaml @@ -5,3 +5,4 @@ metadata: namespace: (join('-', [$namespace, $suffix])) spec: clusterQueue: cluster-pipeline-queue + stopPolicy: None diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-kanary.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-kanary.yaml new file mode 100644 index 00000000000..07162b806e8 --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-kanary.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: appstudio-kanary-exporter diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-paused.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-paused.yaml new file mode 100644 index 00000000000..82767b7e30c --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-paused.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: (join('-', [$namespace, $suffix])) + annotations: + kueue.konflux-ci.dev/stop-policy: hold + labels: + konflux-ci.dev/type: tenant diff --git a/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-unpaused.yaml b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-unpaused.yaml new file mode 100644 index 00000000000..97896241ca5 --- /dev/null +++ b/components/policies/production/policies/kueue/queue-config/.chainsaw-test/resources/namespace-tenant-unpaused.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: (join('-', [$namespace, $suffix])) + annotations: + kueue.konflux-ci.dev/stop-policy: none + labels: + konflux-ci.dev/type: tenant diff --git a/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml b/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml index 071d372c3c9..a26898f59da 100644 --- a/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml +++ b/components/policies/production/policies/kueue/queue-config/cluster-policy.yaml @@ -20,6 +20,12 @@ spec: - Namespace names: - mintmaker + - appstudio-kanary-exporter + context: + - name: stopPolicy + variable: + jmesPath: >- + (request.object.metadata.annotations."kueue.konflux-ci.dev/stop-policy" || '') == 'hold' && 'Hold' || 'None' generate: generateExisting: true orphanDownstreamOnPolicyDelete: true @@ -31,3 +37,4 @@ spec: data: spec: clusterQueue: cluster-pipeline-queue + stopPolicy: "{{stopPolicy}}" From 7f71f2ffbcb76aabd8a4b4b56a41d846972b7eae Mon Sep 17 00:00:00 2001 From: Andy Sadler Date: Thu, 14 May 2026 08:21:54 -0500 Subject: [PATCH 03/83] info: announce maintenance on Friday, May 15th (#11792) Some further maintenance items were identified following last week's maintenance, and some follow-up maintenance is required. All production clusters except for the fedora cluster will be impacted by this maintenance. Inform users that this maintenance will be occurring and that their pipelineruns may be held for a short time. Signed-off-by: Andy Sadler --- .../konflux-info/production/kflux-ocp-p01/banner-content.yaml | 3 ++- .../konflux-info/production/kflux-osp-p01/banner-content.yaml | 3 ++- .../konflux-info/production/kflux-prd-rh02/banner-content.yaml | 3 ++- .../konflux-info/production/kflux-prd-rh03/banner-content.yaml | 3 ++- .../konflux-info/production/kflux-rhel-p01/banner-content.yaml | 3 ++- .../konflux-info/production/stone-prd-rh01/banner-content.yaml | 3 ++- .../konflux-info/production/stone-prod-p01/banner-content.yaml | 3 ++- .../konflux-info/production/stone-prod-p02/banner-content.yaml | 3 ++- 8 files changed, 16 insertions(+), 8 deletions(-) diff --git a/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml b/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml +++ b/components/konflux-info/production/kflux-ocp-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-osp-p01/banner-content.yaml b/components/konflux-info/production/kflux-osp-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-osp-p01/banner-content.yaml +++ b/components/konflux-info/production/kflux-osp-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml b/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml +++ b/components/konflux-info/production/kflux-prd-rh02/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml b/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml +++ b/components/konflux-info/production/kflux-prd-rh03/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml b/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml +++ b/components/konflux-info/production/kflux-rhel-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/stone-prd-rh01/banner-content.yaml b/components/konflux-info/production/stone-prd-rh01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/stone-prd-rh01/banner-content.yaml +++ b/components/konflux-info/production/stone-prd-rh01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/stone-prod-p01/banner-content.yaml b/components/konflux-info/production/stone-prod-p01/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/stone-prod-p01/banner-content.yaml +++ b/components/konflux-info/production/stone-prod-p01/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info diff --git a/components/konflux-info/production/stone-prod-p02/banner-content.yaml b/components/konflux-info/production/stone-prod-p02/banner-content.yaml index cead8cfce2d..7aab85b5a76 100644 --- a/components/konflux-info/production/stone-prod-p02/banner-content.yaml +++ b/components/konflux-info/production/stone-prod-p02/banner-content.yaml @@ -1,2 +1,3 @@ # Only the first banner will be displayed. Put the one to display at the top and remove any which are no longer relevant -[] +- summary: This cluster will see maintenance on May 15th, 2026, during which pipelineruns may be held from executing for a short time. + type: info From ea766a8d2d78c87239a0cfa9ebad458f597ed97f Mon Sep 17 00:00:00 2001 From: Oleg Betsun Date: Thu, 14 May 2026 16:50:08 +0300 Subject: [PATCH 04/83] update opentelemetry-collector for KubeArchive prod config (#11776) * update opentelemetry-collector for KubeArchive stage config KONFLUX-12789 KONFLUX-12711 KONFLUX-12789 KONFLUX-12711 Signed-off-by: obetsun * fix linter errors Signed-off-by: obetsun * refactor otel-collector patch Signed-off-by: obetsun * fix kustomization files Signed-off-by: obetsun * fix linter errors Signed-off-by: obetsun --------- Signed-off-by: obetsun --- .../production/kflux-fedora-01/kustomization.yaml | 13 +++++++++++++ .../production/kflux-ocp-p01/kustomization.yaml | 13 +++++++++++++ .../production/kflux-osp-p01/kustomization.yaml | 13 +++++++++++++ .../production/kflux-prd-rh02/kustomization.yaml | 13 +++++++++++++ .../production/kflux-prd-rh03/kustomization.yaml | 13 +++++++++++++ .../production/kflux-rhel-p01/kustomization.yaml | 14 ++++++++++++++ .../production/stone-prd-rh01/kustomization.yaml | 13 +++++++++++++ .../production/stone-prod-p01/kustomization.yaml | 14 ++++++++++++++ .../production/stone-prod-p02/kustomization.yaml | 14 ++++++++++++++ 9 files changed, 120 insertions(+) diff --git a/components/kubearchive/production/kflux-fedora-01/kustomization.yaml b/components/kubearchive/production/kflux-fedora-01/kustomization.yaml index 57ee3474c7e..96834fdbb54 100644 --- a/components/kubearchive/production/kflux-fedora-01/kustomization.yaml +++ b/components/kubearchive/production/kflux-fedora-01/kustomization.yaml @@ -340,3 +340,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml b/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml index 45b27b2be19..06eb77ce9de 100644 --- a/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml +++ b/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml @@ -336,3 +336,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-osp-p01/kustomization.yaml b/components/kubearchive/production/kflux-osp-p01/kustomization.yaml index f541a6feb77..32f5a10f9cb 100644 --- a/components/kubearchive/production/kflux-osp-p01/kustomization.yaml +++ b/components/kubearchive/production/kflux-osp-p01/kustomization.yaml @@ -338,3 +338,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml b/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml index 5249d908a37..14196ed66fc 100644 --- a/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml +++ b/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml @@ -336,3 +336,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml b/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml index d83b9b31b8f..93ee7e7d267 100644 --- a/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml +++ b/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml @@ -340,3 +340,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml b/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml index dd9b8da3b4c..a47559240d0 100644 --- a/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml +++ b/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml @@ -338,3 +338,17 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + diff --git a/components/kubearchive/production/stone-prd-rh01/kustomization.yaml b/components/kubearchive/production/stone-prd-rh01/kustomization.yaml index 06972e7c011..242947e19a6 100644 --- a/components/kubearchive/production/stone-prd-rh01/kustomization.yaml +++ b/components/kubearchive/production/stone-prd-rh01/kustomization.yaml @@ -341,3 +341,16 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 diff --git a/components/kubearchive/production/stone-prod-p01/kustomization.yaml b/components/kubearchive/production/stone-prod-p01/kustomization.yaml index 2dba38a9a35..ba522b67ed8 100644 --- a/components/kubearchive/production/stone-prod-p01/kustomization.yaml +++ b/components/kubearchive/production/stone-prod-p01/kustomization.yaml @@ -336,3 +336,17 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + diff --git a/components/kubearchive/production/stone-prod-p02/kustomization.yaml b/components/kubearchive/production/stone-prod-p02/kustomization.yaml index a5769c26a01..b51aaf454a5 100644 --- a/components/kubearchive/production/stone-prod-p02/kustomization.yaml +++ b/components/kubearchive/production/stone-prod-p02/kustomization.yaml @@ -345,3 +345,17 @@ patches: metadata: name: "kubearchive-operator-certificate" namespace: kubearchive + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: otel-collector + labels: + app: otel-collector + spec: + template: + spec: + containers: + - name: otel-collector + image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + From 75f41ae93941de34945b1b53927ef31c9ba2e47e Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Thu, 14 May 2026 13:55:38 +0000 Subject: [PATCH 05/83] update components/mintmaker/production/base/kustomization.yaml (#11802) Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/production/base/kustomization.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/components/mintmaker/production/base/kustomization.yaml b/components/mintmaker/production/base/kustomization.yaml index e4cd752af4f..4173eb7f4c4 100644 --- a/components/mintmaker/production/base/kustomization.yaml +++ b/components/mintmaker/production/base/kustomization.yaml @@ -3,18 +3,18 @@ kind: Kustomization resources: - ../../base - ../../base/external-secrets - - https://github.com/konflux-ci/mintmaker/config/default?ref=9916264be87d8750d4e75fa625fd771b9f408dda - - https://github.com/konflux-ci/mintmaker/config/renovate?ref=9916264be87d8750d4e75fa625fd771b9f408dda + - https://github.com/konflux-ci/mintmaker/config/default?ref=f630842900c1caf0080e113925b3295b6c008df2 + - https://github.com/konflux-ci/mintmaker/config/renovate?ref=f630842900c1caf0080e113925b3295b6c008df2 namespace: mintmaker images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: 9916264be87d8750d4e75fa625fd771b9f408dda + newTag: f630842900c1caf0080e113925b3295b6c008df2 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: d1de4c8ad000d4e27164e3f6e8e077898a741127 + newTag: 94810e0758480e3632374ab49eb03f1e27b59157 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From 679275df15460236905f27b7070087e472daef8f Mon Sep 17 00:00:00 2001 From: Emily Keefe Date: Thu, 14 May 2026 10:20:58 -0400 Subject: [PATCH 06/83] Add k8s groups component (#11786) Add a new component to deploy the k8s groups located in the internal-infra-deployments repository to the tenant Konflux clusters. KFLUXINFRA-3596 --- argo-cd-apps/base/k8s-groups/k8s-groups.yaml | 41 +++++++++++++++++++ .../base/k8s-groups/kustomization.yaml | 4 ++ .../konflux-public-staging/kustomization.yaml | 1 + .../delete-applications.yaml | 7 ++++ 4 files changed, 53 insertions(+) create mode 100644 argo-cd-apps/base/k8s-groups/k8s-groups.yaml create mode 100644 argo-cd-apps/base/k8s-groups/kustomization.yaml diff --git a/argo-cd-apps/base/k8s-groups/k8s-groups.yaml b/argo-cd-apps/base/k8s-groups/k8s-groups.yaml new file mode 100644 index 00000000000..2b1ab2c3b57 --- /dev/null +++ b/argo-cd-apps/base/k8s-groups/k8s-groups.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: k8s-groups +spec: + generators: + - merge: + mergeKeys: + - nameNormalized + generators: + - clusters: + values: + sourceRoot: components/k8s-groups + environment: staging + useCaseDir: rover + - list: + elements: [] + template: + metadata: + name: k8s-groups-{{nameNormalized}} + spec: + project: default + source: + path: '{{values.sourceRoot}}/{{values.environment}}/{{values.useCaseDir}}' + repoURL: https://github.com/redhat-appstudio/internal-infra-deployments.git + targetRevision: main + destination: + namespace: k8s-groups + server: '{{server}}' + syncPolicy: + automated: + prune: true + selfHeal: false + syncOptions: + - CreateNamespace=true + retry: + limit: -1 + backoff: + duration: 10s + factor: 2 + maxDuration: 3m diff --git a/argo-cd-apps/base/k8s-groups/kustomization.yaml b/argo-cd-apps/base/k8s-groups/kustomization.yaml new file mode 100644 index 00000000000..79d084451e4 --- /dev/null +++ b/argo-cd-apps/base/k8s-groups/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- k8s-groups.yaml diff --git a/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml b/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml index 9e3cf839d92..10492a3dd67 100644 --- a/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml +++ b/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml @@ -9,6 +9,7 @@ resources: - ../../base/eaas - ../../base/monitoring-blackbox - ../../base/monitoring-workload-kanary + - ../../base/k8s-groups namespace: konflux-public-staging patchesStrategicMerge: diff --git a/argo-cd-apps/overlays/production-downstream/delete-applications.yaml b/argo-cd-apps/overlays/production-downstream/delete-applications.yaml index 2b65d88c8f2..499f52e4251 100644 --- a/argo-cd-apps/overlays/production-downstream/delete-applications.yaml +++ b/argo-cd-apps/overlays/production-downstream/delete-applications.yaml @@ -29,3 +29,10 @@ kind: ApplicationSet metadata: name: dummy-deployment $patch: delete +# k8s-groups is being tested on staging clusters for now +--- +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: k8s-groups +$patch: delete From 37f798359b16e9f3025f97a233e90b57c498ab3e Mon Sep 17 00:00:00 2001 From: Hugo Ares Date: Thu, 14 May 2026 11:17:28 -0400 Subject: [PATCH 07/83] Fix k8s-groups to not deploy in cluster (#11809) In order to fix this, we need to apply the patch from k-components/deploy-to-all-clusters. This is already done in argo-cd-apps/base/all-clusters/kustomization.yaml so fix this by moving k8s-groups within that folder. Since this is first component deploy from another repo than infra-deployments, create all the basic patches for this new repo. KFLUXINFRA-3596 Signed-off-by: Hugo Ares --- .../k8s-groups/k8s-groups.yaml | 2 +- .../k8s-groups/kustomization.yaml | 0 .../kustomization.yaml | 6 ++++++ .../base/all-clusters/kustomization.yaml | 1 + .../application-patch.yaml | 7 +++++++ .../application-set-patch.yaml | 7 +++++++ .../kustomization.yaml | 16 ++++++++++++++++ .../development/delete-applications.yaml | 6 ++++++ .../delete-applications.yaml | 7 +++++++ .../konflux-public-staging/kustomization.yaml | 1 - 10 files changed, 51 insertions(+), 2 deletions(-) rename argo-cd-apps/base/{ => all-clusters/internal-infra-deployments}/k8s-groups/k8s-groups.yaml (92%) rename argo-cd-apps/base/{ => all-clusters/internal-infra-deployments}/k8s-groups/kustomization.yaml (100%) create mode 100644 argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml create mode 100644 argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml create mode 100644 argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml create mode 100644 argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml diff --git a/argo-cd-apps/base/k8s-groups/k8s-groups.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml similarity index 92% rename from argo-cd-apps/base/k8s-groups/k8s-groups.yaml rename to argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml index 2b1ab2c3b57..c97c2163850 100644 --- a/argo-cd-apps/base/k8s-groups/k8s-groups.yaml +++ b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml @@ -22,7 +22,7 @@ spec: project: default source: path: '{{values.sourceRoot}}/{{values.environment}}/{{values.useCaseDir}}' - repoURL: https://github.com/redhat-appstudio/internal-infra-deployments.git + repoURL: '' # will be added by kustomization targetRevision: main destination: namespace: k8s-groups diff --git a/argo-cd-apps/base/k8s-groups/kustomization.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/kustomization.yaml similarity index 100% rename from argo-cd-apps/base/k8s-groups/kustomization.yaml rename to argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/kustomization.yaml diff --git a/argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml new file mode 100644 index 00000000000..3836d47406e --- /dev/null +++ b/argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - k8s-groups +components: + - ../../../k-components/inject-internal-infra-deployments-repo-details diff --git a/argo-cd-apps/base/all-clusters/kustomization.yaml b/argo-cd-apps/base/all-clusters/kustomization.yaml index d7360b000f5..d8555820cf2 100644 --- a/argo-cd-apps/base/all-clusters/kustomization.yaml +++ b/argo-cd-apps/base/all-clusters/kustomization.yaml @@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - infra-deployments + - internal-infra-deployments components: - ../../k-components/inject-argocd-namespace - ../../k-components/deploy-to-all-clusters diff --git a/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml new file mode 100644 index 00000000000..38a2e467749 --- /dev/null +++ b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: replace + path: /spec/source/repoURL + value: https://github.com/redhat-appstudio/internal-infra-deployments.git +- op: replace + path: /spec/source/targetRevision + value: main diff --git a/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml new file mode 100644 index 00000000000..dd6c502577f --- /dev/null +++ b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: replace + path: /spec/template/spec/source/repoURL + value: https://github.com/redhat-appstudio/internal-infra-deployments.git +- op: replace + path: /spec/template/spec/source/targetRevision + value: main diff --git a/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml new file mode 100644 index 00000000000..ed41289c690 --- /dev/null +++ b/argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - path: application-set-patch.yaml + target: + group: argoproj.io + version: v1alpha1 + kind: ApplicationSet + labelSelector: noSourceTransform != true + - path: application-patch.yaml + target: + group: argoproj.io + version: v1alpha1 + kind: Application + labelSelector: noSourceTransform != true diff --git a/argo-cd-apps/overlays/development/delete-applications.yaml b/argo-cd-apps/overlays/development/delete-applications.yaml index 3bf7d66752e..ea6506b27fa 100644 --- a/argo-cd-apps/overlays/development/delete-applications.yaml +++ b/argo-cd-apps/overlays/development/delete-applications.yaml @@ -102,3 +102,9 @@ kind: ApplicationSet metadata: name: monitoring-workload-grafana $patch: delete +--- +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: k8s-groups +$patch: delete diff --git a/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml b/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml index 0746a5a779f..0f3b6388672 100644 --- a/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml +++ b/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml @@ -29,3 +29,10 @@ kind: ApplicationSet metadata: name: dummy-deployment $patch: delete +# k8s-groups is being tested on staging clusters for now +--- +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: k8s-groups +$patch: delete diff --git a/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml b/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml index 10492a3dd67..9e3cf839d92 100644 --- a/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml +++ b/argo-cd-apps/overlays/konflux-public-staging/kustomization.yaml @@ -9,7 +9,6 @@ resources: - ../../base/eaas - ../../base/monitoring-blackbox - ../../base/monitoring-workload-kanary - - ../../base/k8s-groups namespace: konflux-public-staging patchesStrategicMerge: From 0d52da011e1c22c59f209c7cb8793ff33fdebc14 Mon Sep 17 00:00:00 2001 From: rcerven Date: Thu, 14 May 2026 19:37:00 +0200 Subject: [PATCH 08/83] bump build-service (#11810) Signed-off-by: Robert Cerven --- components/build-service/development/kustomization.yaml | 4 ++-- components/build-service/staging/base/kustomization.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/components/build-service/development/kustomization.yaml b/components/build-service/development/kustomization.yaml index 773bebcfd01..f10c7260a15 100644 --- a/components/build-service/development/kustomization.yaml +++ b/components/build-service/development/kustomization.yaml @@ -2,14 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -- https://github.com/konflux-ci/build-service/config/default?ref=1da4f0fa542a61f212a15c2789f478610db31133 +- https://github.com/konflux-ci/build-service/config/default?ref=04a4744321a7fb747f796da783d51fc322aef598 namespace: build-service images: - name: quay.io/konflux-ci/build-service newName: quay.io/konflux-ci/build-service - newTag: b1d1753245617e47679b3366b2baa0e4ea6b8007 + newTag: 04a4744321a7fb747f796da783d51fc322aef598 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/build-service/staging/base/kustomization.yaml b/components/build-service/staging/base/kustomization.yaml index 0c0d7f89f46..df69b2c888f 100644 --- a/components/build-service/staging/base/kustomization.yaml +++ b/components/build-service/staging/base/kustomization.yaml @@ -3,14 +3,14 @@ kind: Kustomization resources: - ../../base - ../../base/external-secrets -- https://github.com/konflux-ci/build-service/config/default?ref=1da4f0fa542a61f212a15c2789f478610db31133 +- https://github.com/konflux-ci/build-service/config/default?ref=04a4744321a7fb747f796da783d51fc322aef598 namespace: build-service images: - name: quay.io/konflux-ci/build-service newName: quay.io/konflux-ci/build-service - newTag: b1d1753245617e47679b3366b2baa0e4ea6b8007 + newTag: 04a4744321a7fb747f796da783d51fc322aef598 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From 6eee61db96a0f7f4afe7a19500c6fef588f4eae5 Mon Sep 17 00:00:00 2001 From: rcerven Date: Thu, 14 May 2026 20:17:06 +0200 Subject: [PATCH 09/83] Promoting component build-service from stage to prod (#11815) Signed-off-by: Robert Cerven --- components/build-service/production/base/kustomization.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/build-service/production/base/kustomization.yaml b/components/build-service/production/base/kustomization.yaml index c971c55be2e..17374c74ec6 100644 --- a/components/build-service/production/base/kustomization.yaml +++ b/components/build-service/production/base/kustomization.yaml @@ -3,14 +3,14 @@ kind: Kustomization resources: - ../../base - ../../base/external-secrets -- https://github.com/konflux-ci/build-service/config/default?ref=1da4f0fa542a61f212a15c2789f478610db31133 +- https://github.com/konflux-ci/build-service/config/default?ref=04a4744321a7fb747f796da783d51fc322aef598 namespace: build-service images: - name: quay.io/konflux-ci/build-service newName: quay.io/konflux-ci/build-service - newTag: b1d1753245617e47679b3366b2baa0e4ea6b8007 + newTag: 04a4744321a7fb747f796da783d51fc322aef598 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From 21caa25383f386fc7e6663eb1e4a9c14c37455b5 Mon Sep 17 00:00:00 2001 From: Emily Keefe Date: Thu, 14 May 2026 15:28:17 -0400 Subject: [PATCH 10/83] Add self-healing to k8s-groups apps (#11822) KFLUXINFRA-3596 --- .../internal-infra-deployments/k8s-groups/k8s-groups.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml index c97c2163850..e1e46474456 100644 --- a/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml +++ b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml @@ -30,7 +30,7 @@ spec: syncPolicy: automated: prune: true - selfHeal: false + selfHeal: true syncOptions: - CreateNamespace=true retry: From 3f92379daf1f57f63fc567f618ed5f5bf915cb1f Mon Sep 17 00:00:00 2001 From: Emily Keefe Date: Thu, 14 May 2026 15:32:49 -0400 Subject: [PATCH 11/83] Delete group-sync-operator from staging (#11816) KFLUXINFRA-3827 --- .../authentication/authentication.yaml | 2 +- .../group-sync-namespace-patch.yaml | 4 ++ .../kustomization.yaml | 5 +++ .../group-sync-namespace-patch.yaml | 4 ++ .../production-downstream/kustomization.yaml | 6 +++ .../admin-checker/admin-checker-sa.yaml | 0 .../admin-checker/cronjob.yaml | 0 .../external-secrets/kustomization.yaml | 0 .../external-secrets/rhtap-infra-secrets.yaml | 0 .../admin-checker/kustomization.yaml | 0 .../admin-checker/namespace.yaml | 0 .../component-maintainer.yaml | 0 .../everyone-can-view-patch.yaml | 0 .../everyone-can-view.yaml | 0 .../grafana-view-only.yaml | 0 .../konflux-admins-pod-admin.yaml | 0 .../{ => authentication}/konflux-admins.yaml | 0 .../{ => authentication}/konflux-sre.yaml | 0 .../base/authentication/kustomization.yaml | 43 +++++++++++++++++++ .../test-platform-ci-admins-can-view.yaml | 0 .../authentication/base/kustomization.yaml | 43 +------------------ .../staging/base/kustomization.yaml | 6 +-- .../stone-stage-p01/kustomization.yaml | 2 - 23 files changed, 66 insertions(+), 49 deletions(-) create mode 100644 argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml create mode 100644 argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml rename components/authentication/base/{ => authentication}/admin-checker/admin-checker-sa.yaml (100%) rename components/authentication/base/{ => authentication}/admin-checker/cronjob.yaml (100%) rename components/authentication/base/{ => authentication}/admin-checker/external-secrets/kustomization.yaml (100%) rename components/authentication/base/{ => authentication}/admin-checker/external-secrets/rhtap-infra-secrets.yaml (100%) rename components/authentication/base/{ => authentication}/admin-checker/kustomization.yaml (100%) rename components/authentication/base/{ => authentication}/admin-checker/namespace.yaml (100%) rename components/authentication/base/{ => authentication}/component-maintainer.yaml (100%) rename components/authentication/base/{ => authentication}/everyone-can-view-patch.yaml (100%) rename components/authentication/base/{ => authentication}/everyone-can-view.yaml (100%) rename components/authentication/base/{ => authentication}/grafana-view-only.yaml (100%) rename components/authentication/base/{ => authentication}/konflux-admins-pod-admin.yaml (100%) rename components/authentication/base/{ => authentication}/konflux-admins.yaml (100%) rename components/authentication/base/{ => authentication}/konflux-sre.yaml (100%) create mode 100644 components/authentication/base/authentication/kustomization.yaml rename components/authentication/base/{ => authentication}/test-platform-ci-admins-can-view.yaml (100%) diff --git a/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml b/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml index 12db5127640..63b1587d558 100644 --- a/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml +++ b/argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml @@ -33,7 +33,7 @@ spec: repoURL: https://github.com/redhat-appstudio/infra-deployments.git targetRevision: main destination: - namespace: group-sync-operator + namespace: authentication server: '{{server}}' syncPolicy: automated: diff --git a/argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml b/argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml new file mode 100644 index 00000000000..0b4986efd8c --- /dev/null +++ b/argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml @@ -0,0 +1,4 @@ +--- +- op: add + path: /spec/template/spec/destination/namespace + value: group-sync-operator diff --git a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml index 030bf274db7..2de08cb21b1 100644 --- a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml +++ b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml @@ -46,6 +46,11 @@ patches: kind: ApplicationSet version: v1alpha1 name: authentication + - path: group-sync-namespace-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: authentication - path: production-overlay-patch.yaml target: kind: ApplicationSet diff --git a/argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml b/argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml new file mode 100644 index 00000000000..0b4986efd8c --- /dev/null +++ b/argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml @@ -0,0 +1,4 @@ +--- +- op: add + path: /spec/template/spec/destination/namespace + value: group-sync-operator diff --git a/argo-cd-apps/overlays/production-downstream/kustomization.yaml b/argo-cd-apps/overlays/production-downstream/kustomization.yaml index e713188a5b7..80c1e973909 100644 --- a/argo-cd-apps/overlays/production-downstream/kustomization.yaml +++ b/argo-cd-apps/overlays/production-downstream/kustomization.yaml @@ -45,6 +45,11 @@ patches: kind: ApplicationSet version: v1alpha1 name: authentication + - path: group-sync-namespace-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: authentication - path: production-overlay-patch.yaml target: kind: ApplicationSet @@ -295,3 +300,4 @@ patches: kind: ApplicationSet version: v1alpha1 name: perf-team-prometheus-reader + diff --git a/components/authentication/base/admin-checker/admin-checker-sa.yaml b/components/authentication/base/authentication/admin-checker/admin-checker-sa.yaml similarity index 100% rename from components/authentication/base/admin-checker/admin-checker-sa.yaml rename to components/authentication/base/authentication/admin-checker/admin-checker-sa.yaml diff --git a/components/authentication/base/admin-checker/cronjob.yaml b/components/authentication/base/authentication/admin-checker/cronjob.yaml similarity index 100% rename from components/authentication/base/admin-checker/cronjob.yaml rename to components/authentication/base/authentication/admin-checker/cronjob.yaml diff --git a/components/authentication/base/admin-checker/external-secrets/kustomization.yaml b/components/authentication/base/authentication/admin-checker/external-secrets/kustomization.yaml similarity index 100% rename from components/authentication/base/admin-checker/external-secrets/kustomization.yaml rename to components/authentication/base/authentication/admin-checker/external-secrets/kustomization.yaml diff --git a/components/authentication/base/admin-checker/external-secrets/rhtap-infra-secrets.yaml b/components/authentication/base/authentication/admin-checker/external-secrets/rhtap-infra-secrets.yaml similarity index 100% rename from components/authentication/base/admin-checker/external-secrets/rhtap-infra-secrets.yaml rename to components/authentication/base/authentication/admin-checker/external-secrets/rhtap-infra-secrets.yaml diff --git a/components/authentication/base/admin-checker/kustomization.yaml b/components/authentication/base/authentication/admin-checker/kustomization.yaml similarity index 100% rename from components/authentication/base/admin-checker/kustomization.yaml rename to components/authentication/base/authentication/admin-checker/kustomization.yaml diff --git a/components/authentication/base/admin-checker/namespace.yaml b/components/authentication/base/authentication/admin-checker/namespace.yaml similarity index 100% rename from components/authentication/base/admin-checker/namespace.yaml rename to components/authentication/base/authentication/admin-checker/namespace.yaml diff --git a/components/authentication/base/component-maintainer.yaml b/components/authentication/base/authentication/component-maintainer.yaml similarity index 100% rename from components/authentication/base/component-maintainer.yaml rename to components/authentication/base/authentication/component-maintainer.yaml diff --git a/components/authentication/base/everyone-can-view-patch.yaml b/components/authentication/base/authentication/everyone-can-view-patch.yaml similarity index 100% rename from components/authentication/base/everyone-can-view-patch.yaml rename to components/authentication/base/authentication/everyone-can-view-patch.yaml diff --git a/components/authentication/base/everyone-can-view.yaml b/components/authentication/base/authentication/everyone-can-view.yaml similarity index 100% rename from components/authentication/base/everyone-can-view.yaml rename to components/authentication/base/authentication/everyone-can-view.yaml diff --git a/components/authentication/base/grafana-view-only.yaml b/components/authentication/base/authentication/grafana-view-only.yaml similarity index 100% rename from components/authentication/base/grafana-view-only.yaml rename to components/authentication/base/authentication/grafana-view-only.yaml diff --git a/components/authentication/base/konflux-admins-pod-admin.yaml b/components/authentication/base/authentication/konflux-admins-pod-admin.yaml similarity index 100% rename from components/authentication/base/konflux-admins-pod-admin.yaml rename to components/authentication/base/authentication/konflux-admins-pod-admin.yaml diff --git a/components/authentication/base/konflux-admins.yaml b/components/authentication/base/authentication/konflux-admins.yaml similarity index 100% rename from components/authentication/base/konflux-admins.yaml rename to components/authentication/base/authentication/konflux-admins.yaml diff --git a/components/authentication/base/konflux-sre.yaml b/components/authentication/base/authentication/konflux-sre.yaml similarity index 100% rename from components/authentication/base/konflux-sre.yaml rename to components/authentication/base/authentication/konflux-sre.yaml diff --git a/components/authentication/base/authentication/kustomization.yaml b/components/authentication/base/authentication/kustomization.yaml new file mode 100644 index 00000000000..da7b65aca5e --- /dev/null +++ b/components/authentication/base/authentication/kustomization.yaml @@ -0,0 +1,43 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- admin-checker +- component-maintainer.yaml +- everyone-can-view.yaml +- konflux-admins.yaml +- konflux-admins-pod-admin.yaml +- grafana-view-only.yaml +- test-platform-ci-admins-can-view.yaml +- konflux-sre.yaml + +patches: + - path: everyone-can-view-patch.yaml + target: + name: everyone-view + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-appstudio + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-cluster-version + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-cluster-monitoring + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-compute + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 diff --git a/components/authentication/base/test-platform-ci-admins-can-view.yaml b/components/authentication/base/authentication/test-platform-ci-admins-can-view.yaml similarity index 100% rename from components/authentication/base/test-platform-ci-admins-can-view.yaml rename to components/authentication/base/authentication/test-platform-ci-admins-can-view.yaml diff --git a/components/authentication/base/kustomization.yaml b/components/authentication/base/kustomization.yaml index c73f296bbef..20cb6f47927 100644 --- a/components/authentication/base/kustomization.yaml +++ b/components/authentication/base/kustomization.yaml @@ -1,44 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- admin-checker -- group-sync -- component-maintainer.yaml -- everyone-can-view.yaml -- konflux-admins.yaml -- konflux-admins-pod-admin.yaml -- grafana-view-only.yaml -- test-platform-ci-admins-can-view.yaml -- konflux-sre.yaml - -patches: - - path: everyone-can-view-patch.yaml - target: - name: everyone-view - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-appstudio - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-cluster-version - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-cluster-monitoring - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-compute - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 + - group-sync + - authentication diff --git a/components/authentication/staging/base/kustomization.yaml b/components/authentication/staging/base/kustomization.yaml index a228a024a0b..8cece4d8a41 100644 --- a/components/authentication/staging/base/kustomization.yaml +++ b/components/authentication/staging/base/kustomization.yaml @@ -1,8 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../../base - - ../../helm-charts -images: - - name: quay.io/konflux-ci/group-sync-operator - digest: sha256:4f384c760c7821be60c8f2d9b46152c986af8723f71ad6bfc5cc8372a7c658b8 + - ../../base/authentication diff --git a/components/authentication/staging/stone-stage-p01/kustomization.yaml b/components/authentication/staging/stone-stage-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/staging/stone-stage-p01/kustomization.yaml +++ b/components/authentication/staging/stone-stage-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch From b774a534247438a505de4c4a2142fbbd39567e36 Mon Sep 17 00:00:00 2001 From: Emily Keefe Date: Thu, 14 May 2026 16:56:17 -0400 Subject: [PATCH 12/83] Deploy k8s-groups to production clusters (#11824) KFLUXINFRA-3596 --- .../konflux-public-production/delete-applications.yaml | 7 ------- .../overlays/konflux-public-production/kustomization.yaml | 5 +++++ .../production-downstream/delete-applications.yaml | 7 ------- .../overlays/production-downstream/kustomization.yaml | 6 +++++- 4 files changed, 10 insertions(+), 15 deletions(-) diff --git a/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml b/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml index 0f3b6388672..0746a5a779f 100644 --- a/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml +++ b/argo-cd-apps/overlays/konflux-public-production/delete-applications.yaml @@ -29,10 +29,3 @@ kind: ApplicationSet metadata: name: dummy-deployment $patch: delete -# k8s-groups is being tested on staging clusters for now ---- -apiVersion: argoproj.io/v1alpha1 -kind: ApplicationSet -metadata: - name: k8s-groups -$patch: delete diff --git a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml index 2de08cb21b1..4de6a0e7d8e 100644 --- a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml +++ b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml @@ -286,3 +286,8 @@ patches: kind: ApplicationSet version: v1alpha1 name: perf-team-prometheus-reader + - path: production-overlay-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: k8s-groups diff --git a/argo-cd-apps/overlays/production-downstream/delete-applications.yaml b/argo-cd-apps/overlays/production-downstream/delete-applications.yaml index 499f52e4251..2b65d88c8f2 100644 --- a/argo-cd-apps/overlays/production-downstream/delete-applications.yaml +++ b/argo-cd-apps/overlays/production-downstream/delete-applications.yaml @@ -29,10 +29,3 @@ kind: ApplicationSet metadata: name: dummy-deployment $patch: delete -# k8s-groups is being tested on staging clusters for now ---- -apiVersion: argoproj.io/v1alpha1 -kind: ApplicationSet -metadata: - name: k8s-groups -$patch: delete diff --git a/argo-cd-apps/overlays/production-downstream/kustomization.yaml b/argo-cd-apps/overlays/production-downstream/kustomization.yaml index 80c1e973909..8ed2540a1e8 100644 --- a/argo-cd-apps/overlays/production-downstream/kustomization.yaml +++ b/argo-cd-apps/overlays/production-downstream/kustomization.yaml @@ -300,4 +300,8 @@ patches: kind: ApplicationSet version: v1alpha1 name: perf-team-prometheus-reader - + - path: production-overlay-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: k8s-groups From 1f5d9c9c003d1fef617c720ddfe436fb9a5a649c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Fri, 15 May 2026 13:02:56 +0200 Subject: [PATCH 13/83] feat(KONFLUX-13961): Update perf in-cluster dashboards (#11758) --- .../grafana/development/dashboards/perfscale/kustomization.yaml | 2 +- .../grafana/staging/dashboards/perfscale/kustomization.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml b/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml index 96c55cb02ea..9e6db8db38f 100644 --- a/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml +++ b/components/monitoring/grafana/development/dashboards/perfscale/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/konflux-ci/perfscale/grafana/?ref=4b4b9640667964558eb974f658d02d0546b65665 + - https://github.com/konflux-ci/perfscale/grafana/?ref=038081278c493c8d8b3185daeccfb9816ca28bb8 diff --git a/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml b/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml index 96c55cb02ea..9e6db8db38f 100644 --- a/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml +++ b/components/monitoring/grafana/staging/dashboards/perfscale/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/konflux-ci/perfscale/grafana/?ref=4b4b9640667964558eb974f658d02d0546b65665 + - https://github.com/konflux-ci/perfscale/grafana/?ref=038081278c493c8d8b3185daeccfb9816ca28bb8 From cb4df72e53708bbf808ddf5a25bd8325a0d625b9 Mon Sep 17 00:00:00 2001 From: Francesco Ilario Date: Fri, 15 May 2026 16:19:27 +0200 Subject: [PATCH 14/83] add tokens in tekton-kueue (#10850) * add tokens in tekton-kueue This proposal adds the new ephemeral resource `konflux-ci.dev/token` in tekton-kueue. This is to weight PipelineRuns with respect to known patterns in tekton-kueue and to better balance them. As an example, we noticed that Build PipelineRuns are usually heavier than Non-Build PipelineRuns, so we can identify Build PipelineRuns and mark them to require 2 tokens. The other PipelineRuns will only take 1 instead. Assuming both `tekton.dev/pipelineruns` and `konflux-ci.dev/token` are 600, we could have in execution: * 300 Build PipelineRuns * 200 Build PipelineRuns + 200 Non-Build PipelineRuns * 100 Build PipelineRuns + 400 Non-Build PipelineRuns * 600 Non-Build PipelineRuns Signed-off-by: Francesco Ilario * fix linters Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED * update tests Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED * fix tests Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED * fix tests Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED * remove duplicate test Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED --------- Signed-off-by: Francesco Ilario --- .../queue-config/cluster-queue.yaml | 3 + .../development/tekton-kueue/config.yaml | 25 ++ .../staging/base/tekton-kueue/config.yaml | 25 ++ .../queue-config/cluster-queue.yaml | 3 + .../queue-config/cluster-queue.yaml | 3 + hack/test-tekton-kueue-config.py | 255 +++++++++++++++--- 6 files changed, 273 insertions(+), 41 deletions(-) diff --git a/components/kueue/development/queue-config/cluster-queue.yaml b/components/kueue/development/queue-config/cluster-queue.yaml index 858f957f9b6..f0e185a48a0 100644 --- a/components/kueue/development/queue-config/cluster-queue.yaml +++ b/components/kueue/development/queue-config/cluster-queue.yaml @@ -32,6 +32,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns + - konflux-ci.dev/token - cpu - memory - linux-arm64 @@ -45,6 +46,8 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: "500" + - name: konflux-ci.dev/token + nominalQuota: "600" - name: linux-arm64 nominalQuota: "10" - name: linux-amd64 diff --git a/components/kueue/development/tekton-kueue/config.yaml b/components/kueue/development/tekton-kueue/config.yaml index 70b10d01db0..fab27239245 100644 --- a/components/kueue/development/tekton-kueue/config.yaml +++ b/components/kueue/development/tekton-kueue/config.yaml @@ -92,6 +92,31 @@ cel: - | plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : [] + # The token mechanism allows us to balance admitted PipelineRuns. + # Here we want to state that each PipelineRuns needs one token, but + # Build PipelineRuns are usually heavier, so they need 2. + # + # The total amount of PipelineRuns executing in the system at the same time + # will be decided by the first to saturate between `tekton.dev/pipelineruns` + # and `konflux-ci.dev/token`. This way we can tune the percentage of usually + # heavier PipelineRuns with respect to lighter ones. + # + # As an example, if both `tekton.dev/pipelineruns` and `konflux-ci.dev/token` + # are 600, we could have: + # * 300 Build PipelineRuns + # * 200 Build PipelineRuns + 200 Non-Build PipelineRuns + # * 100 Build PipelineRuns + 400 Non-Build PipelineRuns + # * 600 Non-Build PipelineRuns + - | + pacEventType == 'push' || + pacEventType == 'pull_request' || + pacEventType == "Merge_Request" || + pacEventType == 'test-comment' || + pacEventType == 'retest-comment' || + pacEventType == 'retest-all-comment' || + pacEventType == 'ok-to-test-comment' ? resource('konflux-ci-dev-token', 2) : + resource('konflux-ci-dev-token', 1) + # Set the pipeline priority - | has(pipelineRun.metadata.labels) && diff --git a/components/kueue/staging/base/tekton-kueue/config.yaml b/components/kueue/staging/base/tekton-kueue/config.yaml index 70b10d01db0..fab27239245 100644 --- a/components/kueue/staging/base/tekton-kueue/config.yaml +++ b/components/kueue/staging/base/tekton-kueue/config.yaml @@ -92,6 +92,31 @@ cel: - | plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : [] + # The token mechanism allows us to balance admitted PipelineRuns. + # Here we want to state that each PipelineRuns needs one token, but + # Build PipelineRuns are usually heavier, so they need 2. + # + # The total amount of PipelineRuns executing in the system at the same time + # will be decided by the first to saturate between `tekton.dev/pipelineruns` + # and `konflux-ci.dev/token`. This way we can tune the percentage of usually + # heavier PipelineRuns with respect to lighter ones. + # + # As an example, if both `tekton.dev/pipelineruns` and `konflux-ci.dev/token` + # are 600, we could have: + # * 300 Build PipelineRuns + # * 200 Build PipelineRuns + 200 Non-Build PipelineRuns + # * 100 Build PipelineRuns + 400 Non-Build PipelineRuns + # * 600 Non-Build PipelineRuns + - | + pacEventType == 'push' || + pacEventType == 'pull_request' || + pacEventType == "Merge_Request" || + pacEventType == 'test-comment' || + pacEventType == 'retest-comment' || + pacEventType == 'retest-all-comment' || + pacEventType == 'ok-to-test-comment' ? resource('konflux-ci-dev-token', 2) : + resource('konflux-ci-dev-token', 1) + # Set the pipeline priority - | has(pipelineRun.metadata.labels) && diff --git a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml index fc3b59ee4f2..f546dc6ce90 100644 --- a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml @@ -26,6 +26,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns + - konflux-ci.dev/token - cpu - memory - aws-ip @@ -35,6 +36,8 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: '500' + - name: konflux-ci.dev/token + nominalQuota: '600' - name: cpu nominalQuota: 1k - name: memory diff --git a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml index 4fbedb789fd..8f2d69ea76f 100644 --- a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml @@ -26,6 +26,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns + - konflux-ci.dev/token - cpu - memory - aws-ip @@ -35,6 +36,8 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: '500' + - name: konflux-ci.dev/token + nominalQuota: '600' - name: cpu nominalQuota: 1k - name: memory diff --git a/hack/test-tekton-kueue-config.py b/hack/test-tekton-kueue-config.py index b2c67b9d583..eb70786ab11 100755 --- a/hack/test-tekton-kueue-config.py +++ b/hack/test-tekton-kueue-config.py @@ -65,6 +65,7 @@ class ConfigCombination(TypedDict): class TestCombination(TypedDict): pipelinerun_key: str config_key: str + expected: ExpectedResults | None class PipelineRunMetadata(TypedDict, total=False): @@ -204,6 +205,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-arm64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", @@ -252,6 +254,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-arm64": "1", "kueue.konflux-ci.dev/requests-aws-ip": "2" @@ -283,7 +286,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -312,7 +317,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -339,7 +346,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -365,7 +374,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -393,7 +404,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-release" @@ -420,7 +433,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-tenant-release" @@ -444,6 +459,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", }, "labels": { @@ -473,7 +489,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "build.appstudio.openshift.io/type": "nudge", "kueue.x-k8s.io/queue-name": "pipelines-queue", @@ -500,7 +518,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -527,7 +547,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -554,7 +576,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -581,7 +605,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", @@ -611,7 +637,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -641,7 +669,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -671,7 +701,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -701,7 +733,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", @@ -728,7 +762,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-post-merge-test" @@ -754,7 +790,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test" @@ -777,7 +815,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-default" @@ -803,7 +843,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-release" @@ -837,6 +879,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-arm64": "1", "kueue.konflux-ci.dev/requests-darwin-amd64": "1", "kueue.konflux-ci.dev/requests-windows-amd64": "1", @@ -874,6 +917,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", "kueue.konflux-ci.dev/requests-linux-ppc64le": "1", @@ -914,6 +958,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", "kueue.konflux-ci.dev/requests-linux-ppc64le": "1", @@ -974,6 +1019,7 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: }, "expected": { "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "kueue.konflux-ci.dev/requests-linux-amd64": "1", "kueue.konflux-ci.dev/requests-linux-s390x": "1", "kueue.konflux-ci.dev/requests-linux-arm64": "1", @@ -1004,7 +1050,9 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-prod-release" @@ -1030,14 +1078,15 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: } }, "expected": { - "annotations": {}, + "annotations": { + "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", + }, "labels": { "kueue.x-k8s.io/queue-name": "pipelines-queue", "kueue.x-k8s.io/priority-class": "konflux-stage-release" } } }, - } # Configuration combinations that can be applied to any PipelineRun @@ -1244,41 +1293,124 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: # Test key PipelineRuns with production config "multiplatform_new_production": { "pipelinerun_key": "multiplatform_new", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "2" + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-post-merge-build" + } + } }, "release_managed_production": { "pipelinerun_key": "release_managed", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-release" + } + } }, "mintmaker_production": { "pipelinerun_key": "mintmaker", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-mintmaker": "1", + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-dependency-update" + } + } }, "internal_pipelinerun_child_production": { "pipelinerun_key": "internal_pipelinerun_child", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-release" + } + } + }, "prefer_new_parameters_production": { "pipelinerun_key": "prefer-new-parameters", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "2", + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", + } + } }, "gitlab_merge_request_production": { "pipelinerun_key": "gitlab_merge_request_build", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", + } + } }, "gitlab_merge_request_test_production": { "pipelinerun_key": "gitlab_merge_request_test", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", + } + } }, "nudging_production": { "pipelinerun_key": "nudge_pipelinerun", - "config_key": "production" + "config_key": "production", + "expected": { + "annotations": {}, + "labels": { + "build.appstudio.openshift.io/type": "nudge", + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-dependency-update" + } + } }, # Test key PipelineRuns with production kflux-ocp-p01 config "multiplatform_new_production-kflux-ocp-p01": { "pipelinerun_key": "multiplatform_new", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "2" + }, + "labels": { + "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "pipelinesascode.tekton.dev/event-type": "push" + } + } }, "release_managed_production-kflux-ocp-p01": { "pipelinerun_key": "release_managed", @@ -1300,31 +1432,69 @@ def check_prerequisites(should_print: bool = True) -> Dict[str, TestConfig]: # Example: Test the same PipelineRun with different configs to show reusability "user-specific-priority_and_mixed_platforms_production-kflux-ocp-p01": { "pipelinerun_key": "user-specific-priority", - "config_key": "production-kflux-ocp-p01" - }, - "internal_pipelinerun_child_production-kflux-ocp-p01": { - "pipelinerun_key": "internal_pipelinerun_child", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": { + "kueue.konflux-ci.dev/requests-linux-amd64": "1", + "kueue.konflux-ci.dev/requests-linux-s390x": "1", + "kueue.konflux-ci.dev/requests-linux-ppc64le": "1", + "kueue.konflux-ci.dev/requests-linux-arm64": "1", + "kueue.konflux-ci.dev/requests-darwin-amd64": "1", + "kueue.konflux-ci.dev/requests-aws-ip": "3" + }, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-user-specific" + } + } }, # Test OCP stage/prod priority assignment (only on OCP cluster) "ocp_prod_release_production-kflux-ocp-p01": { "pipelinerun_key": "ocp_prod_release", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-prod-release" + } + } }, "ocp_stage_release_production-kflux-ocp-p01": { "pipelinerun_key": "ocp_stage_release", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-stage-release" + } + } }, "gitlab_merge_request_production-kflux-ocp-p01": { "pipelinerun_key": "gitlab_merge_request_build", - "config_key": "production-kflux-ocp-p01" + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", + } + } }, "gitlab_merge_request_test_production-kflux-ocp-p01": { "pipelinerun_key": "gitlab_merge_request_test", - "config_key": "production-kflux-ocp-p01" - } + "config_key": "production-kflux-ocp-p01", + "expected": { + "annotations": {}, + "labels": { + "kueue.x-k8s.io/queue-name": "pipelines-queue", + "kueue.x-k8s.io/priority-class": "konflux-pre-merge-test", + } + } + }, } @@ -1347,6 +1517,9 @@ def run_mutation_test(self, test_combination: TestCombination) -> Dict[str, Any] # Get the PipelineRun definition pipelinerun_key = test_combination["pipelinerun_key"] pipelinerun_data = PIPELINERUN_DEFINITIONS[pipelinerun_key] + if "expected" in test_combination and test_combination["expected"] is not None: + pipelinerun_data["expected"] = test_combination["expected"] + pipelinerun = pipelinerun_data["pipelinerun"] with tempfile.TemporaryDirectory() as temp_dir: From 0b360fb1ad4e4a17764a347cad185755a5047e35 Mon Sep 17 00:00:00 2001 From: Hugo Ares Date: Fri, 15 May 2026 13:34:28 -0400 Subject: [PATCH 15/83] Change Fedora k8s-group to use FAS folder (#11833) Fedora should not use rover groups, use FAS ones. Signed-off-by: Hugo Ares --- .../internal-infra-deployments/k8s-groups/k8s-groups.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml index e1e46474456..ebef1de38ef 100644 --- a/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml +++ b/argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml @@ -14,7 +14,9 @@ spec: environment: staging useCaseDir: rover - list: - elements: [] + elements: + - nameNormalized: kflux-fedora-01 + values.useCaseDir: fas template: metadata: name: k8s-groups-{{nameNormalized}} From afce8d09345dbaec57c895f3d374fa6f1a2a0d2a Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Sun, 17 May 2026 11:10:16 +0300 Subject: [PATCH 16/83] KONFLUX-13356: upgrade kueue operator and tekton-kueue for prod ring 1 (#11803) * KONFLUX-13356: add ring 1 tekton-kueue base pinned to cec0b3c8 Copy of production base tekton-kueue with resources ref and image tag updated to cec0b3c8. This temporary directory will be removed when ring 2 upgrades and the shared base is updated. Assisted-by: Claude Code Signed-off-by: Gal Levi * KONFLUX-13356: upgrade kueue operator and tekton-kueue for prod ring 1 Upgrade kueue operator from stable-v1.2 to stable-v1.3 and tekton-kueue to cec0b3c8 for ring 1 production clusters: stone-prod-p01, kflux-ocp-p01, kflux-prd-rh02. - Ring 1 clusters reference base components individually, using base-ring1-tekton-kueue instead of the shared base tekton-kueue. - Per-cluster kustomize patch overrides the Subscription channel from stable-v1.2 to stable-v1.3. - ClusterQueue specs updated: whenCanBorrow Borrow to MayStopSearch, removed stopPolicy None to prevent ArgoCD drift from the v1beta2 conversion webhook. Assisted-by: Claude Code Signed-off-by: Gal Levi --------- Signed-off-by: Gal Levi --- .../base-ring1-tekton-kueue/config.yaml | 137 ++++++++++++++++++ .../controller-patch.yaml | 49 +++++++ .../kustomization.yaml | 45 ++++++ .../webhook-patch.yaml | 41 ++++++ .../kflux-ocp-p01/kustomization.yaml | 14 +- .../queue-config/cluster-queue.yaml | 3 +- .../kflux-prd-rh02/kustomization.yaml | 14 +- .../queue-config/cluster-queue.yaml | 3 +- .../stone-prod-p01/kustomization.yaml | 14 +- .../queue-config/cluster-queue.yaml | 3 +- 10 files changed, 314 insertions(+), 9 deletions(-) create mode 100644 components/kueue/production/base-ring1-tekton-kueue/config.yaml create mode 100644 components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml create mode 100644 components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml create mode 100644 components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml diff --git a/components/kueue/production/base-ring1-tekton-kueue/config.yaml b/components/kueue/production/base-ring1-tekton-kueue/config.yaml new file mode 100644 index 00000000000..70b10d01db0 --- /dev/null +++ b/components/kueue/production/base-ring1-tekton-kueue/config.yaml @@ -0,0 +1,137 @@ +queueName: pipelines-queue +cel: + expressions: + # Set resource requests for multi platform pipelines + - | + has(pipelineRun.spec.params) && + pipelineRun.spec.params.exists(p, p.name == 'build-platforms') ? + pipelineRun.spec.params.filter( + p, + p.name == 'build-platforms')[0] + .value.map( + p, + resource(replace(replace(p, "/", "-"), "_", "-"), 1) + ) : [] + + # Request AWS IP for AWS-based platforms + - | + has(pipelineRun.spec.params) && + pipelineRun.spec.params.exists(p, p.name == 'build-platforms') ? + pipelineRun.spec.params.filter( + p, + p.name == 'build-platforms')[0] + .value.filter( + p, + !( + p in [ + 'linux/ppc64le', + 'linux/s390x', + 'linux/x86_64', + 'local', + 'localhost', + ] + ) + ).map( + p, + resource('aws-ip', 1) + ) : [] + + # Set resource requests for multi platform pipelines which doesn't use the build-platforms parameter (old style) + - | + !( + has(pipelineRun.spec.params) && + pipelineRun.spec.params.exists(p, p.name == 'build-platforms') + ) && + has(pipelineRun.spec.pipelineSpec) && + has(pipelineRun.spec.pipelineSpec.tasks) && + pipelineRun.spec.pipelineSpec.tasks.size() > 0 ? + pipelineRun.spec.pipelineSpec.tasks.map( + task, + has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : [] + ) + .filter(p, p.size() > 0) + .map( + p, + resource(replace(replace(p[0].value, "/", "-"), "_", "-"), 1) + ) : [] + + # Request AWS IP for AWS-based platforms which doesn't use the build-platforms parameter (old style) + - | + !( + has(pipelineRun.spec.params) && + pipelineRun.spec.params.exists(p, p.name == 'build-platforms') + ) && + has(pipelineRun.spec.pipelineSpec) && + has(pipelineRun.spec.pipelineSpec.tasks) && + pipelineRun.spec.pipelineSpec.tasks.size() > 0 ? + pipelineRun.spec.pipelineSpec.tasks.map( + task, + has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : [] + ) + .filter(p, p.size() > 0) + .filter( + p, + !( + p[0].value in [ + 'linux/ppc64le', + 'linux/s390x', + 'linux/x86_64', + 'local', + 'localhost', + ] + ) + ) + .map( + p, + resource('aws-ip', 1) + ) : [] + + # Set mintmaker resource requests. + # Necessary since mintmaker refreshes can overload clusters without a + # bottleneck on the number of pipelineruns running. + - | + plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : [] + + # Set the pipeline priority + - | + has(pipelineRun.metadata.labels) && + 'build.appstudio.openshift.io/type' in pipelineRun.metadata.labels && + pipelineRun.metadata.labels['build.appstudio.openshift.io/type'] == 'nudge' ? + priority('konflux-dependency-update') : + + pacEventType == 'push' ? priority('konflux-post-merge-build') : + pacEventType == 'pull_request' || + pacEventType == "Merge_Request" || + pacEventType == 'test-comment' || + pacEventType == 'retest-comment' || + pacEventType == 'retest-all-comment' || + pacEventType == 'ok-to-test-comment' ? priority('konflux-pre-merge-build') : + pacTestEventType == 'push' ? priority('konflux-post-merge-test') : + pacTestEventType == 'pull_request' || + pacTestEventType == "Merge_Request" || + pacTestEventType == 'test-comment' || + pacTestEventType == 'retest-comment' || + pacTestEventType == 'retest-all-comment' || + pacTestEventType == 'ok-to-test-comment' ? priority('konflux-pre-merge-test') : + + has(pipelineRun.metadata.labels) && + 'appstudio.openshift.io/service' in pipelineRun.metadata.labels && + pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' && + 'pipelines.appstudio.openshift.io/type' in pipelineRun.metadata.labels && + pipelineRun.metadata.labels['pipelines.appstudio.openshift.io/type'] == 'managed' ? + priority('konflux-release') : + + has(pipelineRun.metadata.labels) && + 'appstudio.openshift.io/service' in pipelineRun.metadata.labels && + pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' && + 'release.appstudio.openshift.io/namespace' in pipelineRun.metadata.labels && + pipelineRun.metadata.labels['release.appstudio.openshift.io/namespace'] == plrNamespace ? + priority('konflux-tenant-release') : + + plrNamespace == 'mintmaker' ? priority('konflux-dependency-update') : + + has(pipelineRun.metadata.labels) && + 'internal-services.appstudio.openshift.io/pipelinerun-uid' in pipelineRun.metadata.labels ? + priority('konflux-release') : + + priority('konflux-default') diff --git a/components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml b/components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml new file mode 100644 index 00000000000..2004b89d0e0 --- /dev/null +++ b/components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml @@ -0,0 +1,49 @@ +--- +- op: replace + path: /spec/replicas + value: 2 + +- op: add + path: /metadata/annotations/ignore-check.kube-linter.io~1no-anti-affinity + value: "Using topologySpreadConstraints" + +- op: add + path: /spec/strategy + value: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 0 + +- op: add + path: /spec/template/spec/topologySpreadConstraints + value: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/name: tekton-kueue + +- op: add + path: /spec/template/spec/containers/0/resources/requests + value: + cpu: 500m + memory: 2Gi + +- op: add + path: /spec/template/spec/containers/0/resources/limits + value: + cpu: 500m + memory: 2Gi + +- op: add + path: /spec/template/spec/containers/0/args/- + value: "--leader-elect-lease-duration=137s" + +- op: add + path: /spec/template/spec/containers/0/args/- + value: "--leader-elect-renew-deadline=107s" + +- op: add + path: /spec/template/spec/containers/0/args/- + value: "--leader-elect-retry-period=26s" diff --git a/components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml b/components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml new file mode 100644 index 00000000000..f3454368085 --- /dev/null +++ b/components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml @@ -0,0 +1,45 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- https://github.com/konflux-ci/tekton-kueue/config/default?ref=cec0b3c8a240a289bb7aff4313ea647b292d96cc + +images: +- name: konflux-ci/tekton-kueue + newName: quay.io/konflux-ci/tekton-kueue + newTag: cec0b3c8a240a289bb7aff4313ea647b292d96cc + +namespace: tekton-kueue +# ensure that installation starts after the installation of kueue complete +commonAnnotations: + argocd.argoproj.io/sync-wave: "10" + +configMapGenerator: + - name: tekton-kueue-config + namespace: tekton-kueue + behavior: replace + files: + - config.yaml + +generatorOptions: + disableNameSuffixHash: true + +patches: +- path: webhook-patch.yaml + target: + group: apps + kind: Deployment + name: tekton-kueue-webhook + version: v1 +- path: controller-patch.yaml + target: + group: apps + kind: Deployment + name: tekton-kueue-controller-manager + version: v1 +- target: + kind: Namespace + name: tekton-kueue + patch: |- + - op: add + path: /metadata/labels/openshift.io~1cluster-monitoring + value: "true" diff --git a/components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml b/components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml new file mode 100644 index 00000000000..39e53690c53 --- /dev/null +++ b/components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml @@ -0,0 +1,41 @@ +--- +- op: replace + path: /spec/replicas + value: 3 + +- op: add + path: /metadata/annotations/ignore-check.kube-linter.io~1no-anti-affinity + value: "Using topologySpreadConstraints" + +- op: add + path: /spec/strategy + value: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 0 + +- op: add + path: /spec/template/spec/topologySpreadConstraints + value: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/name: tekton-kueue-webhook + +- op: add + path: /spec/template/spec/containers/0/resources/requests + value: + cpu: 200m + memory: 256Mi + +- op: add + path: /spec/template/spec/containers/0/resources/limits + value: + cpu: 200m + memory: 256Mi + +- op: add + path: /spec/template/spec/containers/0/args/- + value: --zap-log-level=5 diff --git a/components/kueue/production/kflux-ocp-p01/kustomization.yaml b/components/kueue/production/kflux-ocp-p01/kustomization.yaml index 08061c36c7f..f8bccc0de40 100644 --- a/components/kueue/production/kflux-ocp-p01/kustomization.yaml +++ b/components/kueue/production/kflux-ocp-p01/kustomization.yaml @@ -1,7 +1,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base +- ../base/kueue +- ../base-ring1-tekton-kueue +- ../base/tekton-kueue-monitoring - queue-config commonAnnotations: @@ -13,3 +15,13 @@ configMapGenerator: behavior: replace files: - config.yaml + +patches: +- target: + kind: Subscription + name: openshift-kueue-operator + namespace: openshift-kueue-operator + patch: |- + - op: replace + path: /spec/channel + value: stable-v1.3 diff --git a/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml index ab7f6242fda..8b07aa4feaa 100644 --- a/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -183,7 +183,6 @@ spec: nominalQuota: '1000' - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor diff --git a/components/kueue/production/kflux-prd-rh02/kustomization.yaml b/components/kueue/production/kflux-prd-rh02/kustomization.yaml index 24145d9cf86..b51ca37688b 100644 --- a/components/kueue/production/kflux-prd-rh02/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh02/kustomization.yaml @@ -1,8 +1,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base +- ../base/kueue +- ../base-ring1-tekton-kueue +- ../base/tekton-kueue-monitoring - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +patches: +- target: + kind: Subscription + name: openshift-kueue-operator + namespace: openshift-kueue-operator + patch: |- + - op: replace + path: /spec/channel + value: stable-v1.3 diff --git a/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml index e5cc7f41eb6..4d340e0f2f7 100644 --- a/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -168,7 +168,6 @@ spec: nominalQuota: '1000' - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor diff --git a/components/kueue/production/stone-prod-p01/kustomization.yaml b/components/kueue/production/stone-prod-p01/kustomization.yaml index 24145d9cf86..b51ca37688b 100644 --- a/components/kueue/production/stone-prod-p01/kustomization.yaml +++ b/components/kueue/production/stone-prod-p01/kustomization.yaml @@ -1,8 +1,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base +- ../base/kueue +- ../base-ring1-tekton-kueue +- ../base/tekton-kueue-monitoring - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +patches: +- target: + kind: Subscription + name: openshift-kueue-operator + namespace: openshift-kueue-operator + patch: |- + - op: replace + path: /spec/channel + value: stable-v1.3 diff --git a/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml index b1f51fd416d..61982f1468e 100644 --- a/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -156,7 +156,6 @@ spec: nominalQuota: '1000' - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor From c3c14bf844f1c3ca44944a9add0d7a055e17d7c6 Mon Sep 17 00:00:00 2001 From: Francesco Ilario Date: Mon, 18 May 2026 21:00:53 +0200 Subject: [PATCH 17/83] fix: token resource sanitized name (#11854) Tekton-Kueue sanitizes and normalizes the resource names as it needs to use them in an annotation's key. The normalized name needs to be used in the ClusterQueue. Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED --- components/kueue/development/queue-config/cluster-queue.yaml | 4 ++-- .../staging/stone-stage-p01/queue-config/cluster-queue.yaml | 4 ++-- .../staging/stone-stg-rh01/queue-config/cluster-queue.yaml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/components/kueue/development/queue-config/cluster-queue.yaml b/components/kueue/development/queue-config/cluster-queue.yaml index f0e185a48a0..04259bc07de 100644 --- a/components/kueue/development/queue-config/cluster-queue.yaml +++ b/components/kueue/development/queue-config/cluster-queue.yaml @@ -32,7 +32,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns - - konflux-ci.dev/token + - konflux-ci-dev-token - cpu - memory - linux-arm64 @@ -46,7 +46,7 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: "500" - - name: konflux-ci.dev/token + - name: konflux-ci-dev-token nominalQuota: "600" - name: linux-arm64 nominalQuota: "10" diff --git a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml index f546dc6ce90..90f1c3c15b2 100644 --- a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml @@ -26,7 +26,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns - - konflux-ci.dev/token + - konflux-ci-dev-token - cpu - memory - aws-ip @@ -36,7 +36,7 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: '500' - - name: konflux-ci.dev/token + - name: konflux-ci-dev-token nominalQuota: '600' - name: cpu nominalQuota: 1k diff --git a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml index 8f2d69ea76f..5f214bc0a3c 100644 --- a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml @@ -26,7 +26,7 @@ spec: resourceGroups: - coveredResources: - tekton.dev/pipelineruns - - konflux-ci.dev/token + - konflux-ci-dev-token - cpu - memory - aws-ip @@ -36,7 +36,7 @@ spec: resources: - name: tekton.dev/pipelineruns nominalQuota: '500' - - name: konflux-ci.dev/token + - name: konflux-ci-dev-token nominalQuota: '600' - name: cpu nominalQuota: 1k From fce7eee9277de692d0efbe395568357116354f76 Mon Sep 17 00:00:00 2001 From: Manish Kumar <30774250+manish-jangra@users.noreply.github.com> Date: Tue, 19 May 2026 12:26:59 +0530 Subject: [PATCH 18/83] KFLUXINFRA-3786: revoke Role write permissions from tenant admins (staging) (#11782) * KFLUXINFRA-3786: revoke Role write permissions from tenant admins (staging) Split the combined roles+rolebindings RBAC rule in konflux-admin-user-actions so that roles is read-only (get/list) while rolebindings retains full CRUD. Co-authored-by: Cursor * KFLUXINFRA-3786: revoke Role write permissions from tenant admins (production) Split the combined roles+rolebindings RBAC rule in konflux-admin-user-actions so that roles is read-only (get/list) while rolebindings retains full CRUD. Co-authored-by: Cursor * KFLUXINFRA-3786: add watch verb for roles read-only rule Co-authored-by: Cursor * KFLUXINFRA-3786: revert production change, staging only for now Co-authored-by: Cursor --------- Co-authored-by: Cursor --- .../staging/base/konflux-admin-user-actions.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml b/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml index 926d9cf59dc..175a2d27c81 100644 --- a/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml +++ b/components/konflux-rbac/staging/base/konflux-admin-user-actions.yaml @@ -159,6 +159,14 @@ rules: resources: - cronjobs - jobs + - verbs: + - get + - list + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles - verbs: - get - list @@ -169,7 +177,6 @@ rules: apiGroups: - rbac.authorization.k8s.io resources: - - roles - rolebindings - verbs: - get From 80cc5a0ed4b47e7028ef57dbc62628de07b7c8d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Tue, 19 May 2026 10:44:09 +0200 Subject: [PATCH 19/83] feat(KONFLUX-14043): Enable appsre-stonesoup-vault for perfscale-2 and perfscale-3 tenants in staging (#11875) Add konflux-perfscale-2-tenant and konflux-perfscale-3-tenant namespaces to the appsre-stonesoup-vault ClusterSecretStore in staging only. Production will follow in a separate PR. Generated-by: Claude --- .../staging/rhtap-promotion-staging-patch.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml b/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml index 3bc966ece22..3bab439ec8d 100644 --- a/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml +++ b/components/cluster-secret-store/staging/rhtap-promotion-staging-patch.yaml @@ -2,3 +2,9 @@ - op: add path: /spec/conditions/0/namespaces/- value: rhtap-promotion-staging +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-2-tenant +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-3-tenant From 0976a8a0f58d32165c20e37133747421f90547f2 Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Tue, 19 May 2026 14:12:41 +0300 Subject: [PATCH 20/83] KONFLUX-13356: migrate kueue CRs to v1beta2 for prod ring 1 (#11842) Migrate all kueue custom resources from v1beta1 to v1beta2 for ring 1 production clusters: stone-prod-p01, kflux-ocp-p01, kflux-prd-rh02. - ClusterQueue, ResourceFlavor apiVersion v1beta1 to v1beta2 - Add base-ring1-queue-config with v1beta2 WorkloadPriorityClasses, ring 1 clusters reference this instead of base/queue-config - OCP-specific WorkloadPriorityClasses v1beta1 to v1beta2 - nominalQuota 1000 to 1k (canonical resource.Quantity form) Assisted-by: Claude Code Signed-off-by: Gal Levi --- .../kustomization.yaml | 8 +++ .../workload-priority-class.yaml | 56 +++++++++++++++++++ .../queue-config/cluster-queue.yaml | 16 +++--- .../queue-config/kustomization.yaml | 2 +- .../ocp-build-workload-priority-class.yaml | 24 ++++---- .../queue-config/cluster-queue.yaml | 16 +++--- .../queue-config/kustomization.yaml | 2 +- .../queue-config/cluster-queue.yaml | 16 +++--- .../queue-config/kustomization.yaml | 2 +- 9 files changed, 103 insertions(+), 39 deletions(-) create mode 100644 components/kueue/production/base-ring1-queue-config/kustomization.yaml create mode 100644 components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml diff --git a/components/kueue/production/base-ring1-queue-config/kustomization.yaml b/components/kueue/production/base-ring1-queue-config/kustomization.yaml new file mode 100644 index 00000000000..f717b27bc45 --- /dev/null +++ b/components/kueue/production/base-ring1-queue-config/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- workload-priority-class.yaml + +# ensure that installation starts after the installation of kueue complete +commonAnnotations: + argocd.argoproj.io/sync-wave: "10" diff --git a/components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml b/components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml new file mode 100644 index 00000000000..8d8c62654ec --- /dev/null +++ b/components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml @@ -0,0 +1,56 @@ +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-release +value: 1000 +description: "Highest priority for release pipelines" +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-tenant-release +value: 900 +description: "High priority for tenant release pipelines" +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-post-merge-test +value: 800 +description: "Priority for post-merge tests" +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-post-merge-build +value: 700 +description: "Priority for post-merge builds" +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-pre-merge-test +value: 600 +description: "Priority for pre-merge tests" +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-pre-merge-build +value: 500 +description: "Priority for pre-merge builds" +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-default +value: 400 +description: "Default priority for konflux pipelines" +--- +apiVersion: kueue.x-k8s.io/v1beta2 +kind: WorkloadPriorityClass +metadata: + name: konflux-dependency-update +value: 300 +description: "Lower priority for dependency updates" diff --git a/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml index 8b07aa4feaa..2e2da8df9ea 100644 --- a/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-ocp-p01/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -178,30 +178,30 @@ spec: - name: linux-s390x nominalQuota: '56' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml b/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml index 99ae9c2c9f5..dd7b8e25f17 100644 --- a/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base/queue-config +- ../../base-ring1-queue-config - ocp-build-workload-priority-class.yaml # ensure that installation starts after the installation of kueue complete diff --git a/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml b/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml index b0c039735e8..7eb604bcbf0 100644 --- a/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml +++ b/components/kueue/production/kflux-ocp-p01/queue-config/ocp-build-workload-priority-class.yaml @@ -1,82 +1,82 @@ --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-prod-release value: 950 description: "High priority for OCP prod release pipelines which should supersede all releases" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-stage-release value: 925 description: "High priority for OCP stage release pipelines which should supersede all other stage auto releases" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-1 value: 410 description: "Priority level 1 (highest)" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-2 value: 409 description: "Priority level 2" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-3 value: 408 description: "Priority level 3" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-4 value: 407 description: "Priority level 4" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-5 value: 406 description: "Priority level 5" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-6 value: 405 description: "Priority level 6" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-7 value: 404 description: "Priority level 7" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-8 value: 403 description: "Priority level 8" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-9 value: 402 description: "Priority level 9" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: build-priority-10 diff --git a/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml index 4d340e0f2f7..b50d6f3a0aa 100644 --- a/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-prd-rh02/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -163,30 +163,30 @@ spec: - name: linux-s390x nominalQuota: '64' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml b/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml index f9fd4ed82c8..3c0e1b51f71 100644 --- a/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base/queue-config +- ../../base-ring1-queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: diff --git a/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml index 61982f1468e..b0b90090dba 100644 --- a/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prod-p01/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -151,30 +151,30 @@ spec: - name: linux-root-arm64 nominalQuota: '250' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml b/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml index f9fd4ed82c8..3c0e1b51f71 100644 --- a/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml +++ b/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base/queue-config +- ../../base-ring1-queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: From 8c65afddc9e7eaff611de502c7e2da5b192b4219 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Tue, 19 May 2026 13:24:43 +0200 Subject: [PATCH 21/83] feat(KONFLUX-14043): Enable appsre-stonesoup-vault for perfscale-2 and perfscale-3 tenants in prod (#11883) Add konflux-perfscale-2-tenant and konflux-perfscale-3-tenant namespaces to the appsre-stonesoup-vault ClusterSecretStore in production via overlay patch, matching the existing staging configuration. Generated-by: Claude --- .../cluster-secret-store/production/kustomization.yaml | 6 ++++++ .../production/perfscale-namespaces-patch.yaml | 7 +++++++ 2 files changed, 13 insertions(+) create mode 100644 components/cluster-secret-store/production/perfscale-namespaces-patch.yaml diff --git a/components/cluster-secret-store/production/kustomization.yaml b/components/cluster-secret-store/production/kustomization.yaml index f25717812c1..fec7cc04514 100644 --- a/components/cluster-secret-store/production/kustomization.yaml +++ b/components/cluster-secret-store/production/kustomization.yaml @@ -9,6 +9,12 @@ patches: kind: ClusterSecretStore group: external-secrets.io version: v1 + - path: perfscale-namespaces-patch.yaml + target: + name: appsre-stonesoup-vault + kind: ClusterSecretStore + group: external-secrets.io + version: v1 - path: approle-id-patch.yaml target: name: appsre-vault diff --git a/components/cluster-secret-store/production/perfscale-namespaces-patch.yaml b/components/cluster-secret-store/production/perfscale-namespaces-patch.yaml new file mode 100644 index 00000000000..e5d8bdc6be7 --- /dev/null +++ b/components/cluster-secret-store/production/perfscale-namespaces-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-2-tenant +- op: add + path: /spec/conditions/0/namespaces/- + value: konflux-perfscale-3-tenant From afca9214c98787fd92211592119d268384c8e279 Mon Sep 17 00:00:00 2001 From: Emily Keefe Date: Tue, 19 May 2026 09:42:37 -0400 Subject: [PATCH 22/83] Remove group-sync from production environments (#11835) KFLUXINFRA-3827 --- .../group-sync-namespace-patch.yaml | 4 ---- .../kustomization.yaml | 5 ----- .../group-sync-namespace-patch.yaml | 4 ---- .../production-downstream/kustomization.yaml | 5 ----- .../production/base/kustomization.yaml | 18 +----------------- .../kflux-ocp-p01/kustomization.yaml | 2 -- .../kflux-osp-p01/kustomization.yaml | 2 -- .../kflux-rhel-p01/kustomization.yaml | 2 -- .../stone-prod-p01/kustomization.yaml | 2 -- .../stone-prod-p02/kustomization.yaml | 2 -- 10 files changed, 1 insertion(+), 45 deletions(-) delete mode 100644 argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml delete mode 100644 argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml diff --git a/argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml b/argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml deleted file mode 100644 index 0b4986efd8c..00000000000 --- a/argo-cd-apps/overlays/konflux-public-production/group-sync-namespace-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/template/spec/destination/namespace - value: group-sync-operator diff --git a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml index 4de6a0e7d8e..3cf7e915101 100644 --- a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml +++ b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml @@ -46,11 +46,6 @@ patches: kind: ApplicationSet version: v1alpha1 name: authentication - - path: group-sync-namespace-patch.yaml - target: - kind: ApplicationSet - version: v1alpha1 - name: authentication - path: production-overlay-patch.yaml target: kind: ApplicationSet diff --git a/argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml b/argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml deleted file mode 100644 index 0b4986efd8c..00000000000 --- a/argo-cd-apps/overlays/production-downstream/group-sync-namespace-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/template/spec/destination/namespace - value: group-sync-operator diff --git a/argo-cd-apps/overlays/production-downstream/kustomization.yaml b/argo-cd-apps/overlays/production-downstream/kustomization.yaml index 8ed2540a1e8..45376a7bf4b 100644 --- a/argo-cd-apps/overlays/production-downstream/kustomization.yaml +++ b/argo-cd-apps/overlays/production-downstream/kustomization.yaml @@ -45,11 +45,6 @@ patches: kind: ApplicationSet version: v1alpha1 name: authentication - - path: group-sync-namespace-patch.yaml - target: - kind: ApplicationSet - version: v1alpha1 - name: authentication - path: production-overlay-patch.yaml target: kind: ApplicationSet diff --git a/components/authentication/production/base/kustomization.yaml b/components/authentication/production/base/kustomization.yaml index fe127a8ea56..2f47aec25dc 100644 --- a/components/authentication/production/base/kustomization.yaml +++ b/components/authentication/production/base/kustomization.yaml @@ -1,11 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../../base - - ../../helm-charts -images: - - name: quay.io/konflux-ci/group-sync-operator - digest: sha256:4f384c760c7821be60c8f2d9b46152c986af8723f71ad6bfc5cc8372a7c658b8 + - ../../base/authentication patches: - path: rhtap-infra-secrets-patch.yaml target: @@ -13,15 +9,3 @@ patches: kind: ExternalSecret group: external-secrets.io version: v1 - - path: konflux-ldap-sa-patch.yaml - target: - name: konflux-ldap-sa - kind: ExternalSecret - group: external-secrets.io - version: v1 - - path: mtls-ca-validators-patch.yaml - target: - name: mtls-ca-validators - kind: ExternalSecret - group: external-secrets.io - version: v1 diff --git a/components/authentication/production/kflux-ocp-p01/kustomization.yaml b/components/authentication/production/kflux-ocp-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/kflux-ocp-p01/kustomization.yaml +++ b/components/authentication/production/kflux-ocp-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/kflux-osp-p01/kustomization.yaml b/components/authentication/production/kflux-osp-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/kflux-osp-p01/kustomization.yaml +++ b/components/authentication/production/kflux-osp-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/kflux-rhel-p01/kustomization.yaml b/components/authentication/production/kflux-rhel-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/kflux-rhel-p01/kustomization.yaml +++ b/components/authentication/production/kflux-rhel-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/stone-prod-p01/kustomization.yaml b/components/authentication/production/stone-prod-p01/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/stone-prod-p01/kustomization.yaml +++ b/components/authentication/production/stone-prod-p01/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch diff --git a/components/authentication/production/stone-prod-p02/kustomization.yaml b/components/authentication/production/stone-prod-p02/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/components/authentication/production/stone-prod-p02/kustomization.yaml +++ b/components/authentication/production/stone-prod-p02/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch From 9f2749f3eda7f420f05b7f16927bbe280efddd2b Mon Sep 17 00:00:00 2001 From: Sahil Budhwar Date: Tue, 19 May 2026 20:30:14 +0530 Subject: [PATCH 23/83] chore: bump konflux-ui (production) ed23c9b83394 => 1e667c457a66 (#11846) Co-authored-by: github-actions[bot] --- components/konflux-ui/production/base/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/konflux-ui/production/base/kustomization.yaml b/components/konflux-ui/production/base/kustomization.yaml index 33aa6477e8b..ecf1f2f46a7 100644 --- a/components/konflux-ui/production/base/kustomization.yaml +++ b/components/konflux-ui/production/base/kustomization.yaml @@ -11,7 +11,7 @@ images: digest: sha256:48df30520a766101473e80e7a4abbf59ce06097a5f5919e15075afaa86bd1a2d - name: quay.io/konflux-ci/konflux-ui - newTag: ed23c9b83394454b5822049748939a26a5626093 + newTag: 1e667c457a66dfe556f03a7c8e84087e15262b0c - name: quay.io/oauth2-proxy/oauth2-proxy digest: sha256:3da33b9670c67bd782277f99acadf7026f75b9507bfba2088eb2d497266ef7fc From 7d40a9592582580dced907ba4ebe1940fcd519f0 Mon Sep 17 00:00:00 2001 From: Jen Cullinan <113446385+jencull@users.noreply.github.com> Date: Tue, 19 May 2026 16:18:20 +0100 Subject: [PATCH 24/83] chore(STONEINTG-1594): add endpoint params for image_rbac_proxy (#11888) Signed-off-by: jcullina --- .../staging/base/monitoringstack/endpoints-params.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml index 81167ca167b..6fd2369c092 100644 --- a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml @@ -115,6 +115,10 @@ # Namespace: caching - '{__name__="squid_up", namespace="caching"}' + # Namespace: image-rbac-proxy + - '{__name__="kube_deployment_spec_replicas", namespace="image-rbac-proxy"}' + - '{__name__="kube_deployment_status_replicas_available", namespace="image-rbac-proxy"}' + # Namespace: openshift-kueue-operator - '{__name__="kube_deployment_status_replicas_ready", namespace="openshift-kueue-operator"}' - '{__name__="kube_deployment_status_replicas_available", namespace="openshift-kueue-operator"}' From c9929cd83ebc16106b929cedede4eaeca2f46d08 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Wed, 20 May 2026 05:55:39 +0000 Subject: [PATCH 25/83] update components/konflux-operator/development/invariant/kustomization.yaml (#11893) Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- .../konflux-operator/development/invariant/kustomization.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/konflux-operator/development/invariant/kustomization.yaml b/components/konflux-operator/development/invariant/kustomization.yaml index e4504f5e8ca..4c3881f38ae 100644 --- a/components/konflux-operator/development/invariant/kustomization.yaml +++ b/components/konflux-operator/development/invariant/kustomization.yaml @@ -6,7 +6,7 @@ kind: Kustomization # Parent `../kustomization.yaml` adds per-team overlays from `../cr/overlay-patches/`. resources: # Upstream operator config (konflux-ci builds install.yaml from this layout). - - https://github.com/konflux-ci/konflux-ci/operator/config/default?ref=0bace1e20ff164a00e9d6becfce52e310a921931 + - https://github.com/konflux-ci/konflux-ci/operator/config/default?ref=8618e289d55d2b272cfb8de35ccbcf1c729fe19d - konflux.yaml patches: @@ -15,4 +15,4 @@ patches: images: - name: localhost/konflux-operator newName: quay.io/konflux-ci/konflux-operator - newTag: 0bace1e20ff164a00e9d6becfce52e310a921931 + newTag: 8618e289d55d2b272cfb8de35ccbcf1c729fe19d From 2eb48fe7375bd97ba04b9b4a5c7e30992a340bcf Mon Sep 17 00:00:00 2001 From: Yftach Herzog Date: Wed, 20 May 2026 10:38:28 +0300 Subject: [PATCH 26/83] test(KFLUXVNGD-924): placeholder for openshift CI operator tests (#11887) Adding a placeholder entrypoint that will used by OpenShift CI to trigger e2e tests the Konflux Operator. Assisted-by: Cursor Signed-off-by: Yftach Herzog --- .../ci/openshift-overlay-e2e/README.md | 10 ++++++++++ .../ci/openshift-overlay-e2e/run.sh | 13 +++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 components/konflux-operator/ci/openshift-overlay-e2e/README.md create mode 100755 components/konflux-operator/ci/openshift-overlay-e2e/run.sh diff --git a/components/konflux-operator/ci/openshift-overlay-e2e/README.md b/components/konflux-operator/ci/openshift-overlay-e2e/README.md new file mode 100644 index 00000000000..88b96eef826 --- /dev/null +++ b/components/konflux-operator/ci/openshift-overlay-e2e/README.md @@ -0,0 +1,10 @@ +# OpenShift CI: `development-operator` overlay E2E + +Placeholder scripts for the optional, on-demand Prow job +`appstudio-operator-overlay-e2e-tests` (openshift/release). + +## Entrypoint + +```bash +./components/konflux-operator/ci/openshift-overlay-e2e/run.sh +``` diff --git a/components/konflux-operator/ci/openshift-overlay-e2e/run.sh b/components/konflux-operator/ci/openshift-overlay-e2e/run.sh new file mode 100755 index 00000000000..36c2eb92709 --- /dev/null +++ b/components/konflux-operator/ci/openshift-overlay-e2e/run.sh @@ -0,0 +1,13 @@ +#!/usr/bin/env bash +# OpenShift CI entrypoint for development-operator overlay E2E (conformance). +# Invoked by openshift/release after cloning infra-deployments at the PR revision. +# +# Phase 1 (current): placeholder — wiring validation only. +# Phase 2: bootstrap (preview --operator-overlay), konflux-ci conformance @ ref from +# invariant/kustomization.yaml, default-tenant namespace (no deploy-test-resources.sh). +set -euo pipefail + +echo "[openshift-operator-overlay-e2e] placeholder: noop (implementation pending)" +echo " Expected later: bootstrap development-operator, konflux-ci conformance only," +echo " E2E_APPLICATIONS_NAMESPACE=default-tenant (KonfluxDefaultTenant), no deploy-test-resources.sh" +exit 0 From b8899ab87301c94201cf2b565454dd490a2d670a Mon Sep 17 00:00:00 2001 From: Asaf Aviv <72219135+asafaviv-devops@users.noreply.github.com> Date: Wed, 20 May 2026 11:08:57 +0300 Subject: [PATCH 27/83] SPRE-5349: add kube_deployment_status_replicas_updated metric for tekton-kueue (#11901) Required by the TektonKueueRolloutStuck alert to detect stuck rollouts where updated replicas are fewer than desired. Co-authored-by: Asaf Aviv --- .../staging/base/monitoringstack/endpoints-params.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml index 6fd2369c092..e160f81698a 100644 --- a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml @@ -127,6 +127,7 @@ # Namespace: tekton-kueue - '{__name__="kube_deployment_status_replicas_ready", namespace="tekton-kueue"}' - '{__name__="kube_deployment_status_replicas_available", namespace="tekton-kueue"}' + - '{__name__="kube_deployment_status_replicas_updated", namespace="tekton-kueue"}' - '{__name__="kube_deployment_spec_replicas", namespace="tekton-kueue"}' # Namespace: kueue-external-admission From 8d4af6b857633163183c9b009d52740e6b1da7d8 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Wed, 20 May 2026 09:17:19 +0000 Subject: [PATCH 28/83] update components/mintmaker/staging/base/kustomization.yaml (#11908) Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/staging/base/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index 273216bea1c..0a90e98f4c9 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -16,7 +16,7 @@ images: newTag: f630842900c1caf0080e113925b3295b6c008df2 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: 94810e0758480e3632374ab49eb03f1e27b59157 + newTag: 8e655fcf49dc462caf48424d40aecbfd5313391a commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From 231af8a63ec14d822d55227096417bad16a2c510 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marta=20A=C3=B1=C3=B3n=20Ruiz?= Date: Wed, 20 May 2026 11:43:03 +0200 Subject: [PATCH 29/83] Upgrade kubearchive to v1.21.4 in stone-prod-p02 (#11895) Split MIGRATION_VERSION into two configmaps following the staging pattern: kubearchive-schema-version (for the migration Job) and kubearchive-deployment-schema-version (for deployments). This ensures deployments pick up the new schema version only after the migration Job completes via ArgoCD sync waves. Signed-off-by: Marta Anon Co-authored-by: Claude Opus 4.6 --- .../stone-prod-p02/kubearchive.yaml | 84 +++++++++---------- .../stone-prod-p02/kustomization.yaml | 16 ++-- 2 files changed, 52 insertions(+), 48 deletions(-) diff --git a/components/kubearchive/production/stone-prod-p02/kubearchive.yaml b/components/kubearchive/production/stone-prod-p02/kubearchive.yaml index 04132be852a..4e85291246f 100644 --- a/components/kubearchive/production/stone-prod-p02/kubearchive.yaml +++ b/components/kubearchive/production/stone-prod-p02/kubearchive.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/component: namespace app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive --- apiVersion: apiextensions.k8s.io/v1 @@ -552,7 +552,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server namespace: kubearchive --- @@ -563,7 +563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-cluster-vacuum namespace: kubearchive --- @@ -574,7 +574,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator namespace: kubearchive --- @@ -585,7 +585,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-sink namespace: kubearchive --- @@ -596,7 +596,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-leader-election namespace: kubearchive rules: @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-vacuum namespace: kubearchive rules: @@ -659,7 +659,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server rules: - apiGroups: @@ -677,7 +677,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-edit app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 rbac.authorization.k8s.io/aggregate-to-edit: "true" name: kubearchive-edit rules: @@ -791,7 +791,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-editor app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-config-editor rules: - apiGroups: @@ -820,7 +820,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-viewer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-config-viewer rules: - apiGroups: @@ -844,7 +844,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-view app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 rbac.authorization.k8s.io/aggregate-to-view: "true" name: kubearchive-view rules: @@ -868,7 +868,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-leader-election namespace: kubearchive roleRef: @@ -887,7 +887,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-vacuum namespace: kubearchive roleRef: @@ -906,7 +906,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server roleRef: apiGroup: rbac.authorization.k8s.io @@ -924,7 +924,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -943,7 +943,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-reader app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-logging-reader namespace: kubearchive --- @@ -955,7 +955,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-writer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-logging-writer namespace: kubearchive --- @@ -972,7 +972,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator namespace: kubearchive --- @@ -980,7 +980,7 @@ apiVersion: v1 data: DATABASE_DB: a3ViZWFyY2hpdmU= DATABASE_KIND: cG9zdGdyZXNxbA== - DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== + DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== # gitleaks:allow DATABASE_PORT: NTQzMg== DATABASE_URL: a3ViZWFyY2hpdmUtcncucG9zdGdyZXNxbC5zdmMuY2x1c3Rlci5sb2NhbA== DATABASE_USER: a3ViZWFyY2hpdmU= @@ -990,7 +990,7 @@ metadata: app.kubernetes.io/component: database app.kubernetes.io/name: kubearchive-database-credentials app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-database-credentials namespace: kubearchive type: Opaque @@ -1002,7 +1002,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-logging namespace: kubearchive stringData: @@ -1016,7 +1016,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server namespace: kubearchive spec: @@ -1035,7 +1035,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-webhooks app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-webhooks namespace: kubearchive spec: @@ -1058,7 +1058,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-sink namespace: kubearchive spec: @@ -1076,7 +1076,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server namespace: kubearchive spec: @@ -1130,7 +1130,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/api:v1.20.0@sha256:43938bb7fabcc543cd3b5af0c9074196328f393d6e712f379572cca5ecfaab3c + image: quay.io/kubearchive/api:v1.21.4@sha256:b176b1651fe024ecd94207f690e727eb246f57436957115274647c2947494dc8 livenessProbe: httpGet: path: /livez @@ -1182,7 +1182,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator namespace: kubearchive spec: @@ -1232,7 +1232,7 @@ spec: valueFrom: resourceFieldRef: resource: limits.cpu - image: quay.io/kubearchive/operator:v1.20.0@sha256:eb8b363f5cfddd190011aa1d0e7cdff5c50aefae0bd4207024755146b3840db9 + image: quay.io/kubearchive/operator:v1.21.4@sha256:2beeaeb53a17056249b666e8f9bd67a9a237d3394a66a651cb5caca3f8ac4901 livenessProbe: httpGet: path: /healthz @@ -1294,7 +1294,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-sink namespace: kubearchive spec: @@ -1346,7 +1346,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/sink:v1.20.0@sha256:8a13e20ba373f00f7e8889af2a67a61c44d9e8bab74a5c0186f324f2eb0cb120 + image: quay.io/kubearchive/sink:v1.21.4@sha256:3b6603fa0cdd9daf99142573a0cdddce3467cdd8d180fd795e465209584c14b0 livenessProbe: httpGet: path: /livez @@ -1387,7 +1387,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: cluster-vacuum namespace: kubearchive spec: @@ -1408,7 +1408,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: quay.io/kubearchive/vacuum:v1.20.0@sha256:fe373300d999379656f78860906d7a30d77af088d6ba3bfa37a102c422d45480 + image: quay.io/kubearchive/vacuum:v1.21.4@sha256:3ededff190a125e51f2f675ae55d0559295580bda715bb2e3406d1cec7aac339 name: vacuum restartPolicy: Never serviceAccount: kubearchive-cluster-vacuum @@ -1422,7 +1422,7 @@ metadata: app.kubernetes.io/component: kubearchive app.kubernetes.io/name: kubearchive-schema-migration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-schema-migration namespace: kubearchive spec: @@ -1438,7 +1438,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/postgresql:v1.20.0@sha256:0aae85e8885295c87c3241915b8be86e08d5439f38ec9de9f95b012c67633874 + image: quay.io/kubearchive/postgresql:v1.21.4@sha256:58bcad4798c71746b0c9d11eb482a1075a9b073cbc146187fe2670df16b6d785 name: migration resources: limits: @@ -1459,7 +1459,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-api-server-certificate namespace: kubearchive spec: @@ -1493,7 +1493,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-ca namespace: kubearchive spec: @@ -1515,7 +1515,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-operator-certificate namespace: kubearchive spec: @@ -1534,7 +1534,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive namespace: kubearchive spec: @@ -1548,7 +1548,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-ca namespace: kubearchive spec: @@ -1563,7 +1563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-mutating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -1676,7 +1676,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-validating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.21.4 name: kubearchive-validating-webhook-configuration webhooks: - admissionReviewVersions: diff --git a/components/kubearchive/production/stone-prod-p02/kustomization.yaml b/components/kubearchive/production/stone-prod-p02/kustomization.yaml index b51aaf454a5..1f1f21ffd60 100644 --- a/components/kubearchive/production/stone-prod-p02/kustomization.yaml +++ b/components/kubearchive/production/stone-prod-p02/kustomization.yaml @@ -23,7 +23,10 @@ configMapGenerator: annotations: argocd.argoproj.io/sync-wave: "-2" literals: - - MIGRATION_VERSION=5 + - MIGRATION_VERSION=13 + - name: kubearchive-deployment-schema-version + literals: + - MIGRATION_VERSION=13 - name: kubearchive-logging-writer literals: - | @@ -111,7 +114,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.20.0 + image: quay.io/kubearchive/vacuum:v1.21.4 - patch: |- apiVersion: batch/v1 @@ -129,13 +132,14 @@ patches: spec: containers: - name: migration - image: quay.io/kubearchive/postgresql:v1.21.3@sha256:2ce1545b19d29bd36c1022de13f451f14847aed04d62ab896a3254d74f7c0d39 env: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: name: kubearchive-schema-version key: MIGRATION_VERSION + - name: BATCH_SIZE + value: "10000" securityContext: runAsUser: null # Add version suffix to Job name so syncs with unchanged version are a no-op @@ -147,7 +151,7 @@ patches: patch: |- - op: replace path: /metadata/name - value: kubearchive-schema-migration-v13 + value: kubearchive-schema-migration-v13b # We don't need the Secret as it will be created by the ExternalSecrets Operator - patch: |- $patch: delete @@ -229,7 +233,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true @@ -288,7 +292,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true From f28ded312e13d27245265f41677219294367014d Mon Sep 17 00:00:00 2001 From: Flavius Lacatusu Date: Wed, 20 May 2026 12:56:49 +0200 Subject: [PATCH 30/83] Ring 0: promote dummy-deployment to development and staging (#11911) Co-authored-by: Kargo --- .../overlays/development/kustomization.yaml | 26 ++++++++----------- .../overlays/staging/kustomization.yaml | 26 ++++++++----------- 2 files changed, 22 insertions(+), 30 deletions(-) diff --git a/components/dummy-deployment/overlays/development/kustomization.yaml b/components/dummy-deployment/overlays/development/kustomization.yaml index 6bfe0ab1195..28d50f08e9e 100644 --- a/components/dummy-deployment/overlays/development/kustomization.yaml +++ b/components/dummy-deployment/overlays/development/kustomization.yaml @@ -1,20 +1,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization - resources: - - ../../base - - https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=6581c25de3b4979c7d4653fc48c9e01818493d4a - +- ../../base +- https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=dc87f05445031d218b6b66a583513d051ce0ef84 images: - - name: quay.io/redhat-appstudio-qe/dummy-deployment - newName: quay.io/redhat-appstudio-qe/dummy-deployment - newTag: 6581c25de3b4979c7d4653fc48c9e01818493d4a - +- name: quay.io/redhat-appstudio-qe/dummy-deployment + newTag: dc87f05445031d218b6b66a583513d051ce0ef84 patches: - - target: - kind: ConfigMap - name: dummy-deployment-config - patch: | - - op: replace - path: /data/DISPLAY_TEXT - value: "Hello from DEVELOPMENT!" +- target: + kind: ConfigMap + name: dummy-deployment-config + patch: | + - op: replace + path: /data/DISPLAY_TEXT + value: "Hello from DEVELOPMENT!" diff --git a/components/dummy-deployment/overlays/staging/kustomization.yaml b/components/dummy-deployment/overlays/staging/kustomization.yaml index f56b7ccc088..560d56aa155 100644 --- a/components/dummy-deployment/overlays/staging/kustomization.yaml +++ b/components/dummy-deployment/overlays/staging/kustomization.yaml @@ -1,20 +1,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization - resources: - - ../../base - - https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=6581c25de3b4979c7d4653fc48c9e01818493d4a - +- ../../base +- https://github.com/flacatus/konflux-dummy-deploy//k8s?ref=dc87f05445031d218b6b66a583513d051ce0ef84 images: - - name: quay.io/redhat-appstudio-qe/dummy-deployment - newName: quay.io/redhat-appstudio-qe/dummy-deployment - newTag: 6581c25de3b4979c7d4653fc48c9e01818493d4a - +- name: quay.io/redhat-appstudio-qe/dummy-deployment + newTag: dc87f05445031d218b6b66a583513d051ce0ef84 patches: - - target: - kind: ConfigMap - name: dummy-deployment-config - patch: | - - op: replace - path: /data/DISPLAY_TEXT - value: "Hello from STAGE!" +- target: + kind: ConfigMap + name: dummy-deployment-config + patch: | + - op: replace + path: /data/DISPLAY_TEXT + value: "Hello from STAGE!" From 3fd39962269b581f6bb060d1193ef9eb8ccf343a Mon Sep 17 00:00:00 2001 From: Asaf Aviv <72219135+asafaviv-devops@users.noreply.github.com> Date: Wed, 20 May 2026 14:17:16 +0300 Subject: [PATCH 31/83] SPRE-5349: add kube_deployment_status_replicas_updated metric for tekton-kueue in production (#11904) Required by the TektonKueueRolloutStuck alert to detect stuck rollouts where updated replicas are fewer than desired. Validated in staging first. Co-authored-by: Asaf Aviv --- .../production/base/monitoringstack/endpoints-params.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml index a115ef8da83..33eb34fce3c 100644 --- a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml @@ -113,6 +113,7 @@ # Namespace: tekton-kueue - '{__name__="kube_deployment_status_replicas_ready", namespace="tekton-kueue"}' - '{__name__="kube_deployment_status_replicas_available", namespace="tekton-kueue"}' + - '{__name__="kube_deployment_status_replicas_updated", namespace="tekton-kueue"}' - '{__name__="kube_deployment_spec_replicas", namespace="tekton-kueue"}' # Namespace: kueue-external-admission From eabc1e926267e6c025a01dc86f9bf578c8d85954 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Wed, 20 May 2026 13:59:18 +0200 Subject: [PATCH 32/83] feat(KONFLUX-13961): Update perf in-cluster dashboards on Prod (#11873) --- .../grafana/production/dashboards/perfscale/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml b/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml index 96c55cb02ea..9e6db8db38f 100644 --- a/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml +++ b/components/monitoring/grafana/production/dashboards/perfscale/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/konflux-ci/perfscale/grafana/?ref=4b4b9640667964558eb974f658d02d0546b65665 + - https://github.com/konflux-ci/perfscale/grafana/?ref=038081278c493c8d8b3185daeccfb9816ca28bb8 From cb2daa2e0d84e50723f117a2b5648658f9b10850 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Wed, 20 May 2026 13:15:15 +0000 Subject: [PATCH 33/83] mintmaker update (#11886) * update components/mintmaker/development/kustomization.yaml * update components/mintmaker/staging/base/kustomization.yaml --------- Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/development/kustomization.yaml | 6 +++--- components/mintmaker/staging/base/kustomization.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/components/mintmaker/development/kustomization.yaml b/components/mintmaker/development/kustomization.yaml index 79b9eb21c46..7ad439e9358 100644 --- a/components/mintmaker/development/kustomization.yaml +++ b/components/mintmaker/development/kustomization.yaml @@ -3,13 +3,13 @@ kind: Kustomization resources: - ../base - plrs-resource-quota.yaml - - https://github.com/konflux-ci/mintmaker/config/default?ref=f630842900c1caf0080e113925b3295b6c008df2 - - https://github.com/konflux-ci/mintmaker/config/renovate?ref=f630842900c1caf0080e113925b3295b6c008df2 + - https://github.com/konflux-ci/mintmaker/config/default?ref=70cfa98ddf51f87166807d7f2787677422471d20 + - https://github.com/konflux-ci/mintmaker/config/renovate?ref=70cfa98ddf51f87166807d7f2787677422471d20 images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: f630842900c1caf0080e113925b3295b6c008df2 + newTag: 70cfa98ddf51f87166807d7f2787677422471d20 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image newTag: latest diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index 0a90e98f4c9..fd733d978d8 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -5,15 +5,15 @@ resources: - ../../base/external-secrets - ../blackbox - plrs-resource-quota.yaml -- https://github.com/konflux-ci/mintmaker/config/default?ref=f630842900c1caf0080e113925b3295b6c008df2 -- https://github.com/konflux-ci/mintmaker/config/renovate?ref=f630842900c1caf0080e113925b3295b6c008df2 +- https://github.com/konflux-ci/mintmaker/config/default?ref=70cfa98ddf51f87166807d7f2787677422471d20 +- https://github.com/konflux-ci/mintmaker/config/renovate?ref=70cfa98ddf51f87166807d7f2787677422471d20 namespace: mintmaker images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: f630842900c1caf0080e113925b3295b6c008df2 + newTag: 70cfa98ddf51f87166807d7f2787677422471d20 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image newTag: 8e655fcf49dc462caf48424d40aecbfd5313391a From cf2bb229cfb97fecf6c37982815776a4137daa47 Mon Sep 17 00:00:00 2001 From: Oleg Betsun Date: Wed, 20 May 2026 17:22:24 +0300 Subject: [PATCH 34/83] KAR-639: set up kubearchive-logging dev monitoring (#11694) * KAR-639: set up kubearchive-logging dev monitoring Assisted-by: Claude Signed-off-by: obetsun * fix linter errors Signed-off-by: obetsun * fix servicemonitor kubelinter error Signed-off-by: obetsun * fix the service monitor patch Signed-off-by: obetsun * fix namespace patch for observability Signed-off-by: obetsun * separate namespace creation for dev Signed-off-by: obetsun * remove unnecessary service-monitor-patch file Signed-off-by: obetsun * fix prometeus alert rules and service monitor patch Signed-off-by: obetsun * fix patch error Signed-off-by: obetsun * fix servicemonitor patch for dev Signed-off-by: obetsun * fix namespace patch Signed-off-by: obetsun --------- Signed-off-by: obetsun --- .../development/kustomization.yaml | 32 ++++++++++++ .../development/namespace.yaml | 6 +++ .../development/prometheus-rules.yaml | 51 +++++++++++++++++++ .../development/rbac.yaml | 30 +++++++++++ 4 files changed, 119 insertions(+) create mode 100644 components/vector-kubearchive-log-collector/development/namespace.yaml create mode 100644 components/vector-kubearchive-log-collector/development/prometheus-rules.yaml diff --git a/components/vector-kubearchive-log-collector/development/kustomization.yaml b/components/vector-kubearchive-log-collector/development/kustomization.yaml index 44aa63a1898..94aa9ff5cdd 100644 --- a/components/vector-kubearchive-log-collector/development/kustomization.yaml +++ b/components/vector-kubearchive-log-collector/development/kustomization.yaml @@ -22,6 +22,8 @@ resources: - rbac.yaml - loki-secret.yaml - sa.yaml +- prometheus-rules.yaml +- namespace.yaml patches: - path: scc-patch.yaml @@ -51,6 +53,36 @@ patches: kind: StatefulSet namespace: product-kubearchive-logging labelSelector: app.kubernetes.io/name=loki,app.kubernetes.io/component=ingester + - patch: |- + - op: replace + path: /spec/endpoints/0/scheme + value: http + - op: replace + path: /spec/endpoints/0/port + value: http-metrics + - op: remove + path: /spec/endpoints/0/bearerTokenSecret + - op: remove + path: /spec/endpoints/0/tlsConfig + - op: replace + path: /spec/selector/matchExpressions + value: + - key: app.kubernetes.io/component + operator: In + values: + - querier + - ingester + - distributor + - compactor + - key: app.kubernetes.io/name + operator: In + values: + - loki + target: + group: monitoring.coreos.com + version: v1 + kind: ServiceMonitor + name: product-kubearchive-logging-monitor generators: - vector-helm-generator.yaml diff --git a/components/vector-kubearchive-log-collector/development/namespace.yaml b/components/vector-kubearchive-log-collector/development/namespace.yaml new file mode 100644 index 00000000000..a51177f0829 --- /dev/null +++ b/components/vector-kubearchive-log-collector/development/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: product-kubearchive-logging + labels: + openshift.io/cluster-monitoring: "true" diff --git a/components/vector-kubearchive-log-collector/development/prometheus-rules.yaml b/components/vector-kubearchive-log-collector/development/prometheus-rules.yaml new file mode 100644 index 00000000000..2c26f0fbbe2 --- /dev/null +++ b/components/vector-kubearchive-log-collector/development/prometheus-rules.yaml @@ -0,0 +1,51 @@ +--- +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: kubearchive-logging-rules + namespace: product-kubearchive-logging + labels: + openshift.io/prometheus-rule-evaluation-scope: leaf-prometheus +spec: + groups: + - name: loki + interval: 30s + rules: + - alert: LokiComponentDown + expr: up{namespace="product-kubearchive-logging",job=~"loki-(ingester|distributor|querier|compactor).*"} == 0 + for: 5m + labels: + severity: critical + annotations: + summary: "Loki component {{ $labels.job }} is down" + description: "{{ $labels.job }} has been down for more than 5 minutes" + - alert: LokiHighRequestLatency + expr: | + histogram_quantile(0.99, + rate(loki_request_duration_seconds_bucket{namespace="product-kubearchive-logging"}[5m]) + ) > 10 + for: 10m + labels: + severity: warning + annotations: + summary: "Loki high request latency" + description: "99th percentile latency is {{ $value }}s" + - alert: LokiIngestionFailure + expr: | + 100 * sum(rate(loki_request_duration_seconds_count{ + namespace="product-kubearchive-logging", + status_code=~"5..", + route=~".*push.*" + }[5m])) by (job) + / + sum(rate(loki_request_duration_seconds_count{ + namespace="product-kubearchive-logging", + route=~".*push.*" + }[5m])) by (job) + > 10 + for: 5m + labels: + severity: warning + annotations: + summary: "Loki ingestion failures detected" + description: "{{ $labels.job }} push error rate is {{ $value | printf \"%.1f\" }}%" diff --git a/components/vector-kubearchive-log-collector/development/rbac.yaml b/components/vector-kubearchive-log-collector/development/rbac.yaml index 66b5d020b8b..6ce79c71db5 100644 --- a/components/vector-kubearchive-log-collector/development/rbac.yaml +++ b/components/vector-kubearchive-log-collector/development/rbac.yaml @@ -17,3 +17,33 @@ subjects: - kind: ServiceAccount name: minio namespace: product-kubearchive-logging +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: prometheus-k8s + namespace: product-kubearchive-logging +rules: +- apiGroups: [""] + resources: + - services + - endpoints + - pods + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: prometheus-k8s + namespace: product-kubearchive-logging +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: prometheus-k8s +subjects: +- kind: ServiceAccount + name: prometheus-k8s + namespace: openshift-monitoring From 00c028f3bb58fd392df4e81e3c973d6b40b3f9fb Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Wed, 20 May 2026 14:32:30 +0000 Subject: [PATCH 35/83] update components/mintmaker/staging/base/kustomization.yaml (#11913) Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/staging/base/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index fd733d978d8..5e40f2e06cd 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -16,7 +16,7 @@ images: newTag: 70cfa98ddf51f87166807d7f2787677422471d20 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: 8e655fcf49dc462caf48424d40aecbfd5313391a + newTag: ea0ea056fc323d2f007e6433d318ea3a64b7bf2d commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From c34464de8491fe0c9ea10e7c2bd1bd66c7661dc2 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Wed, 20 May 2026 17:18:02 +0000 Subject: [PATCH 36/83] Update from release-service (#11925) Co-authored-by: release-service --- components/squid/development/squid-helm-generator.yaml | 2 +- components/squid/staging/squid-helm-generator.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/squid/development/squid-helm-generator.yaml b/components/squid/development/squid-helm-generator.yaml index 34a33c6556d..f7d1f848633 100644 --- a/components/squid/development/squid-helm-generator.yaml +++ b/components/squid/development/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1506+abe1045 +version: 0.1.1519+809441d valuesInline: installCertManagerComponents: false mirrord: diff --git a/components/squid/staging/squid-helm-generator.yaml b/components/squid/staging/squid-helm-generator.yaml index 4fc80cde724..9941df41fcf 100644 --- a/components/squid/staging/squid-helm-generator.yaml +++ b/components/squid/staging/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1506+abe1045 +version: 0.1.1519+809441d valuesInline: installCertManagerComponents: false mirrord: From 773796e5717c31751cf55038d39e9f55b0c44cd9 Mon Sep 17 00:00:00 2001 From: Flavius Lacatusu Date: Wed, 20 May 2026 20:31:59 +0200 Subject: [PATCH 37/83] Feat: reduce kubearchive vector replicas to 1 in development (#11922) * fix: sync fork with upstream before creating preview branch preview.sh now fetches and merges upstream/main before creating the preview branch, ensuring component bumps (like build-service) are included even when the fork's branch is behind upstream. Co-Authored-By: Claude Opus 4.6 * feat: reduce vector kubearchive memory Signed-off-by: flacatus --------- Signed-off-by: flacatus Co-authored-by: Claude Opus 4.6 --- .../development/vector-helm-dev-values.yaml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml b/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml index df2369deddd..f9f65bd28be 100644 --- a/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml +++ b/components/vector-kubearchive-log-collector/development/vector-helm-dev-values.yaml @@ -1,10 +1,11 @@ --- +replicas: 1 resources: requests: - cpu: 200m - memory: 1024Mi - ephemeral-storage: 2Gi # Request ephemeral storage to prevent DiskPressure evictions + cpu: 100m + memory: 512Mi + ephemeral-storage: 1Gi limits: - cpu: 1000m - memory: 2048Mi - ephemeral-storage: 5Gi # Limit ephemeral storage usage to prevent unbounded disk growth + cpu: 500m + memory: 1024Mi + ephemeral-storage: 3Gi From 6ab52520d8e8b0d686ade9bd262284f19235b7f9 Mon Sep 17 00:00:00 2001 From: Alex Misstear Date: Wed, 20 May 2026 16:42:43 -0400 Subject: [PATCH 38/83] KFLUXVNGD-999: increase cache TTL and add service traffic distribution to artifact-registry-proxy (#11928) Increase nginx cache TTL to 30d so cached S3 redirect responses are considered fresh for 30 days before being marked stale. Enable PreferClose traffic distribution to route requests to the nearest proxy replica, reducing cross-zone latency. Assisted-by: Claude claude-opus-4-6 Signed-off-by: amisstea --- components/squid/development/squid-helm-generator.yaml | 2 ++ components/squid/staging/squid-helm-generator.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/components/squid/development/squid-helm-generator.yaml b/components/squid/development/squid-helm-generator.yaml index f7d1f848633..756110a8932 100644 --- a/components/squid/development/squid-helm-generator.yaml +++ b/components/squid/development/squid-helm-generator.yaml @@ -16,6 +16,7 @@ valuesInline: enabled: true secretName: artifact-registry-proxy-tls service: + trafficDistribution: PreferClose annotations: service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls upstream: @@ -26,6 +27,7 @@ valuesInline: - ^/.+/@v/.* # /@v/.info|.mod|.zip and /@v/list - ^/sumdb/.* # checksum database (e.g. sum.golang.org) size: 1024 + ttl: 30d test: enabled: false cert-manager: diff --git a/components/squid/staging/squid-helm-generator.yaml b/components/squid/staging/squid-helm-generator.yaml index 9941df41fcf..ca2af48a4f6 100644 --- a/components/squid/staging/squid-helm-generator.yaml +++ b/components/squid/staging/squid-helm-generator.yaml @@ -18,6 +18,7 @@ valuesInline: secretName: artifact-registry-proxy-tls service: port: 443 + trafficDistribution: PreferClose annotations: service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls upstream: @@ -30,6 +31,7 @@ valuesInline: # Cache all traffic to nexus repositories - ^/repository/ size: 51200 + ttl: 30d resources: requests: cpu: "2" From a7ad997a29d2efc994ae27b71161baf18974028b Mon Sep 17 00:00:00 2001 From: Riley Saar <44530786+staticf0x@users.noreply.github.com> Date: Thu, 21 May 2026 10:00:54 +0200 Subject: [PATCH 39/83] Update MintMaker code owners (#11920) --- components/mintmaker/OWNERS | 2 -- 1 file changed, 2 deletions(-) diff --git a/components/mintmaker/OWNERS b/components/mintmaker/OWNERS index 4ed131acf73..d4f30c7d5aa 100644 --- a/components/mintmaker/OWNERS +++ b/components/mintmaker/OWNERS @@ -3,7 +3,6 @@ approvers: - scoheb - staticf0x -- querti - FernandesMF - HozifaWasfy - KristianTkacik @@ -12,7 +11,6 @@ approvers: reviewers: - scoheb - staticf0x -- querti - FernandesMF - HozifaWasfy - KristianTkacik From fd33c76c3a3a1eebb6f64e1f72b8d7a79dcc4980 Mon Sep 17 00:00:00 2001 From: Tomas Man <36169139+mantomas@users.noreply.github.com> Date: Thu, 21 May 2026 11:56:32 +0200 Subject: [PATCH 40/83] Update image-controller notification-resetter cronjob resources in prod (#11584) --- .../production/base/kustomization.yaml | 1 + ...tion_resetter_cronjob_resources_patch.yaml | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 components/image-controller/production/base/notification_resetter_cronjob_resources_patch.yaml diff --git a/components/image-controller/production/base/kustomization.yaml b/components/image-controller/production/base/kustomization.yaml index 9824a0fed87..ac6a5adce54 100644 --- a/components/image-controller/production/base/kustomization.yaml +++ b/components/image-controller/production/base/kustomization.yaml @@ -27,3 +27,4 @@ patches: group: external-secrets.io version: v1 - path: ./pruner_cronjob_resources_patch.yaml + - path: ./notification_resetter_cronjob_resources_patch.yaml diff --git a/components/image-controller/production/base/notification_resetter_cronjob_resources_patch.yaml b/components/image-controller/production/base/notification_resetter_cronjob_resources_patch.yaml new file mode 100644 index 00000000000..b4245d7451b --- /dev/null +++ b/components/image-controller/production/base/notification_resetter_cronjob_resources_patch.yaml @@ -0,0 +1,19 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: image-controller-notification-resetter-cronjob + namespace: image-controller-system +spec: + jobTemplate: + spec: + template: + spec: + containers: + - name: notification-resetter + resources: + limits: + cpu: 500m + memory: 1Gi + requests: + cpu: 150m + memory: 1Gi From 04c0215374e3205048c2ea0518fd4e563c441f80 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 11:55:33 +0000 Subject: [PATCH 41/83] release-service update (#11931) * update components/monitoring/grafana/development/dashboards/release/kustomization.yaml * update components/release/development/kustomization.yaml --------- Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- .../grafana/development/dashboards/release/kustomization.yaml | 2 +- components/release/development/kustomization.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/monitoring/grafana/development/dashboards/release/kustomization.yaml b/components/monitoring/grafana/development/dashboards/release/kustomization.yaml index 3406720c6bf..040fe2029c1 100644 --- a/components/monitoring/grafana/development/dashboards/release/kustomization.yaml +++ b/components/monitoring/grafana/development/dashboards/release/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- https://github.com/konflux-ci/release-service/config/grafana/?ref=98f4196defe6e8cc3addb22af44b07cd6ba6cec1 +- https://github.com/konflux-ci/release-service/config/grafana/?ref=03669a226885c2fe70c20c90c37721548bf3e6ed diff --git a/components/release/development/kustomization.yaml b/components/release/development/kustomization.yaml index e4e164ce529..364fb81be15 100644 --- a/components/release/development/kustomization.yaml +++ b/components/release/development/kustomization.yaml @@ -3,13 +3,13 @@ kind: Kustomization resources: - ../base - ../base/monitor/development - - https://github.com/konflux-ci/release-service/config/default?ref=98f4196defe6e8cc3addb22af44b07cd6ba6cec1 + - https://github.com/konflux-ci/release-service/config/default?ref=03669a226885c2fe70c20c90c37721548bf3e6ed - release_service_config.yaml images: - name: quay.io/konflux-ci/release-service newName: quay.io/konflux-ci/release-service - newTag: 98f4196defe6e8cc3addb22af44b07cd6ba6cec1 + newTag: 03669a226885c2fe70c20c90c37721548bf3e6ed namespace: release-service From 776f5a2f8fd6358ba80edcff852acb66ef056ee1 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 11:58:18 +0000 Subject: [PATCH 42/83] update components/mintmaker/production/base/kustomization.yaml (#11921) Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/production/base/kustomization.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/components/mintmaker/production/base/kustomization.yaml b/components/mintmaker/production/base/kustomization.yaml index 4173eb7f4c4..41cf2ea3389 100644 --- a/components/mintmaker/production/base/kustomization.yaml +++ b/components/mintmaker/production/base/kustomization.yaml @@ -3,18 +3,18 @@ kind: Kustomization resources: - ../../base - ../../base/external-secrets - - https://github.com/konflux-ci/mintmaker/config/default?ref=f630842900c1caf0080e113925b3295b6c008df2 - - https://github.com/konflux-ci/mintmaker/config/renovate?ref=f630842900c1caf0080e113925b3295b6c008df2 + - https://github.com/konflux-ci/mintmaker/config/default?ref=70cfa98ddf51f87166807d7f2787677422471d20 + - https://github.com/konflux-ci/mintmaker/config/renovate?ref=70cfa98ddf51f87166807d7f2787677422471d20 namespace: mintmaker images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: f630842900c1caf0080e113925b3295b6c008df2 + newTag: 70cfa98ddf51f87166807d7f2787677422471d20 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: 94810e0758480e3632374ab49eb03f1e27b59157 + newTag: ea0ea056fc323d2f007e6433d318ea3a64b7bf2d commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From 3fba4af41e57c2d869d87c7f11cfeed5a17991f3 Mon Sep 17 00:00:00 2001 From: Francesco Ilario Date: Fri, 22 May 2026 00:32:07 +0200 Subject: [PATCH 43/83] remove kueue-external-admission from dev/stg (#11827) We paused development and are now archiving kueue-external-admission. As part of this process we want to remove it from where it's deployed. Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED --- .../controller-patch.yaml | 14 ------ .../kustomization.yaml | 33 ------------- .../kueue-external-admission/monitoring.yaml | 44 ----------------- .../kueue/development/kustomization.yaml | 1 - .../queue-config/cluster-queue.yaml | 10 ---- .../kueue-prometheus-alerts.yaml | 20 ++++---- .../controller-patch.yaml | 49 ------------------- .../kustomization.yaml | 33 ------------- .../kueue-external-admission/monitoring.yaml | 44 ----------------- .../kueue/staging/base/kustomization.yaml | 1 - .../kueue-prometheus-alerts.yaml | 20 ++++---- .../queue-config/cluster-queue.yaml | 10 ---- .../queue-config/cluster-queue.yaml | 7 --- .../monitoringstack/endpoints-params.yaml | 47 ++++++++---------- 14 files changed, 41 insertions(+), 292 deletions(-) delete mode 100644 components/kueue/development/kueue-external-admission/controller-patch.yaml delete mode 100644 components/kueue/development/kueue-external-admission/kustomization.yaml delete mode 100644 components/kueue/development/kueue-external-admission/monitoring.yaml delete mode 100644 components/kueue/staging/base/kueue-external-admission/controller-patch.yaml delete mode 100644 components/kueue/staging/base/kueue-external-admission/kustomization.yaml delete mode 100644 components/kueue/staging/base/kueue-external-admission/monitoring.yaml diff --git a/components/kueue/development/kueue-external-admission/controller-patch.yaml b/components/kueue/development/kueue-external-admission/controller-patch.yaml deleted file mode 100644 index 976aca5d2df..00000000000 --- a/components/kueue/development/kueue-external-admission/controller-patch.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Development: 1 replica so sync does not revert scale-down. -- op: replace - path: /spec/replicas - value: 1 -- op: replace - path: /spec/template/spec/containers/0/resources/requests - value: - cpu: 500m - memory: 512Mi -- op: add - path: /spec/template/spec/containers/0/resources/limits - value: - cpu: 500m - memory: 512Mi diff --git a/components/kueue/development/kueue-external-admission/kustomization.yaml b/components/kueue/development/kueue-external-admission/kustomization.yaml deleted file mode 100644 index 6af4de8239f..00000000000 --- a/components/kueue/development/kueue-external-admission/kustomization.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- https://github.com/konflux-ci/kueue-external-admission/config/default?ref=aa92aa7f658e34577a23b072204de2af5768b3cc -- monitoring.yaml - -images: -- name: example.com/alert-manager-kueue-admission - newName: quay.io/konflux-ci/kueue-external-admission - newTag: aa92aa7f658e34577a23b072204de2af5768b3cc - -namespace: kueue-external-admission - -# ensure that installation starts after the installation of kueue complete -commonAnnotations: - argocd.argoproj.io/sync-wave: "10" - -patches: - - target: - group: "" - version: v1 - kind: ConfigMap - name: config - patch: |- - - op: replace - path: /data/shouldAdmit - value: "true" - - path: controller-patch.yaml - target: - group: apps - kind: Deployment - name: alert-mgr-kueue-admission-controller-manager - version: v1 diff --git a/components/kueue/development/kueue-external-admission/monitoring.yaml b/components/kueue/development/kueue-external-admission/monitoring.yaml deleted file mode 100644 index 25e1f38cd8e..00000000000 --- a/components/kueue/development/kueue-external-admission/monitoring.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: metrics-reader ---- -apiVersion: v1 -kind: Secret -metadata: - name: metrics-reader - annotations: - kubernetes.io/service-account.name: metrics-reader -type: kubernetes.io/service-account-token ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: prometheus-kueue-external-admission-metrics-reader -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: alert-mgr-kueue-admission-metrics-reader -subjects: -- kind: ServiceAccount - name: metrics-reader - namespace: kueue-external-admission ---- -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: kueue-external-admission -spec: - endpoints: - - path: /metrics - interval: 15s - port: https - scheme: https - bearerTokenSecret: - name: "metrics-reader" - key: token - tlsConfig: - insecureSkipVerify: true - selector: - matchLabels: - control-plane: controller-manager diff --git a/components/kueue/development/kustomization.yaml b/components/kueue/development/kustomization.yaml index 13c474eb3a6..553358fa899 100644 --- a/components/kueue/development/kustomization.yaml +++ b/components/kueue/development/kustomization.yaml @@ -4,7 +4,6 @@ resources: - kueue - tekton-kueue - tekton-kueue-monitoring -- kueue-external-admission - queue-config commonAnnotations: diff --git a/components/kueue/development/queue-config/cluster-queue.yaml b/components/kueue/development/queue-config/cluster-queue.yaml index 04259bc07de..43bc42dfdc0 100644 --- a/components/kueue/development/queue-config/cluster-queue.yaml +++ b/components/kueue/development/queue-config/cluster-queue.yaml @@ -5,20 +5,10 @@ metadata: name: "default-flavor" --- apiVersion: kueue.x-k8s.io/v1beta2 -kind: AdmissionCheck -metadata: - name: static-admission -spec: - controllerName: konflux-ci.dev/kueue-external-admission ---- -apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: - admissionChecksStrategy: - admissionChecks: - - name: static-admission flavorFungibility: whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor diff --git a/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml b/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml index f4e5920bff8..210ba059594 100644 --- a/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml +++ b/components/kueue/development/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml @@ -23,11 +23,11 @@ spec: - alert: KueueReplicasNotAvailable expr: | ( - kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"} + kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue"} ) / clamp_min( - kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"}, + kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue"}, 1 ) * 100 < 100 for: 5m @@ -44,12 +44,12 @@ spec: - alert: KueueHighMemoryUtilization expr: | ( - container_memory_working_set_bytes{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator", image!=""} + container_memory_working_set_bytes{namespace=~"tekton-kueue|openshift-kueue-operator", image!=""} * on(container, pod) group_left - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} ) - / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} * 100 > 70 + / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|openshift-kueue-operator"} * 100 > 70 for: 5m labels: severity: warning @@ -64,10 +64,10 @@ spec: - alert: KueueHighCPUUtilization expr: | ( - pod:container_cpu_usage:sum{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + pod:container_cpu_usage:sum{namespace=~"tekton-kueue|openshift-kueue-operator"} * on(pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} - ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}) * 100 > 85 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} + ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|openshift-kueue-operator"}) * 100 > 85 for: 5m labels: severity: warning @@ -94,9 +94,9 @@ spec: - alert: KueueHighContainerRestarts expr: | - increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}[1h]) + increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|openshift-kueue-operator"}[1h]) * on(container, pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} >= 3 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} >= 3 for: 0m labels: severity: warning diff --git a/components/kueue/staging/base/kueue-external-admission/controller-patch.yaml b/components/kueue/staging/base/kueue-external-admission/controller-patch.yaml deleted file mode 100644 index adbb29e0ad2..00000000000 --- a/components/kueue/staging/base/kueue-external-admission/controller-patch.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -- op: replace - path: /spec/replicas - value: 2 - -- op: add - path: /metadata/annotations/ignore-check.kube-linter.io~1no-anti-affinity - value: "Using topologySpreadConstraints" - -- op: add - path: /spec/strategy - value: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 0 - -- op: add - path: /spec/template/spec/topologySpreadConstraints - value: - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/name: tekton-kueue - -- op: add - path: /spec/template/spec/containers/0/resources/requests - value: - cpu: 500m - memory: 4Gi - -- op: add - path: /spec/template/spec/containers/0/resources/limits - value: - cpu: 500m - memory: 4Gi - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-lease-duration=137s" - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-renew-deadline=107s" - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-retry-period=26s" diff --git a/components/kueue/staging/base/kueue-external-admission/kustomization.yaml b/components/kueue/staging/base/kueue-external-admission/kustomization.yaml deleted file mode 100644 index 6af4de8239f..00000000000 --- a/components/kueue/staging/base/kueue-external-admission/kustomization.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- https://github.com/konflux-ci/kueue-external-admission/config/default?ref=aa92aa7f658e34577a23b072204de2af5768b3cc -- monitoring.yaml - -images: -- name: example.com/alert-manager-kueue-admission - newName: quay.io/konflux-ci/kueue-external-admission - newTag: aa92aa7f658e34577a23b072204de2af5768b3cc - -namespace: kueue-external-admission - -# ensure that installation starts after the installation of kueue complete -commonAnnotations: - argocd.argoproj.io/sync-wave: "10" - -patches: - - target: - group: "" - version: v1 - kind: ConfigMap - name: config - patch: |- - - op: replace - path: /data/shouldAdmit - value: "true" - - path: controller-patch.yaml - target: - group: apps - kind: Deployment - name: alert-mgr-kueue-admission-controller-manager - version: v1 diff --git a/components/kueue/staging/base/kueue-external-admission/monitoring.yaml b/components/kueue/staging/base/kueue-external-admission/monitoring.yaml deleted file mode 100644 index 25e1f38cd8e..00000000000 --- a/components/kueue/staging/base/kueue-external-admission/monitoring.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: metrics-reader ---- -apiVersion: v1 -kind: Secret -metadata: - name: metrics-reader - annotations: - kubernetes.io/service-account.name: metrics-reader -type: kubernetes.io/service-account-token ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: prometheus-kueue-external-admission-metrics-reader -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: alert-mgr-kueue-admission-metrics-reader -subjects: -- kind: ServiceAccount - name: metrics-reader - namespace: kueue-external-admission ---- -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: kueue-external-admission -spec: - endpoints: - - path: /metrics - interval: 15s - port: https - scheme: https - bearerTokenSecret: - name: "metrics-reader" - key: token - tlsConfig: - insecureSkipVerify: true - selector: - matchLabels: - control-plane: controller-manager diff --git a/components/kueue/staging/base/kustomization.yaml b/components/kueue/staging/base/kustomization.yaml index 7ea027a28b1..0517a62873f 100644 --- a/components/kueue/staging/base/kustomization.yaml +++ b/components/kueue/staging/base/kustomization.yaml @@ -4,7 +4,6 @@ resources: - kueue - tekton-kueue - tekton-kueue-monitoring -- kueue-external-admission commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true diff --git a/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml b/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml index f4e5920bff8..210ba059594 100644 --- a/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml +++ b/components/kueue/staging/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml @@ -23,11 +23,11 @@ spec: - alert: KueueReplicasNotAvailable expr: | ( - kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"} + kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue"} ) / clamp_min( - kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"}, + kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue"}, 1 ) * 100 < 100 for: 5m @@ -44,12 +44,12 @@ spec: - alert: KueueHighMemoryUtilization expr: | ( - container_memory_working_set_bytes{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator", image!=""} + container_memory_working_set_bytes{namespace=~"tekton-kueue|openshift-kueue-operator", image!=""} * on(container, pod) group_left - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} ) - / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} * 100 > 70 + / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|openshift-kueue-operator"} * 100 > 70 for: 5m labels: severity: warning @@ -64,10 +64,10 @@ spec: - alert: KueueHighCPUUtilization expr: | ( - pod:container_cpu_usage:sum{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + pod:container_cpu_usage:sum{namespace=~"tekton-kueue|openshift-kueue-operator"} * on(pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} - ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}) * 100 > 85 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} + ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|openshift-kueue-operator"}) * 100 > 85 for: 5m labels: severity: warning @@ -94,9 +94,9 @@ spec: - alert: KueueHighContainerRestarts expr: | - increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}[1h]) + increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|openshift-kueue-operator"}[1h]) * on(container, pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} >= 3 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} >= 3 for: 0m labels: severity: warning diff --git a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml index 90f1c3c15b2..92876c5a9c8 100644 --- a/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stage-p01/queue-config/cluster-queue.yaml @@ -1,18 +1,8 @@ apiVersion: kueue.x-k8s.io/v1beta2 -kind: AdmissionCheck -metadata: - name: static-admission -spec: - controllerName: konflux-ci.dev/kueue-external-admission ---- -apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: - admissionChecksStrategy: - admissionChecks: - - name: static-admission flavorFungibility: whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor diff --git a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml index 5f214bc0a3c..6c0bc409859 100644 --- a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml @@ -1,11 +1,4 @@ apiVersion: kueue.x-k8s.io/v1beta2 -kind: AdmissionCheck -metadata: - name: static-admission -spec: - controllerName: konflux-ci.dev/kueue-external-admission ---- -apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue diff --git a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml index e160f81698a..857894d5303 100644 --- a/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/staging/base/monitoringstack/endpoints-params.yaml @@ -130,15 +130,10 @@ - '{__name__="kube_deployment_status_replicas_updated", namespace="tekton-kueue"}' - '{__name__="kube_deployment_spec_replicas", namespace="tekton-kueue"}' - # Namespace: kueue-external-admission - - '{__name__="kube_deployment_status_replicas_ready", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_status_replicas_available", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_spec_replicas", namespace="kueue-external-admission"}' - ## Container Metrics - '{__name__="kube_pod_container_status_waiting_reason", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_pod_container_resource_limits", namespace=~"release-service|rhtap-releng-tenant"}' - - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="kube_pod_container_status_terminated_reason", namespace=~".*-tenant", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", namespace="release-service"}' @@ -146,25 +141,25 @@ - '{__name__="container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd"}' - '{__name__="container_memory_usage_bytes", namespace=~"release-service|openshift-etcd|rhtap-releng-tenant"}' - '{__name__="kube_pod_container_status_restarts_total", namespace!~".*-tenant"}' - - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|openshift-monitoring|openshift-user-workload-monitoring|appstudio-monitoring"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' - - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|openshift-monitoring|openshift-user-workload-monitoring|appstudio-monitoring"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="node_namespace_pod_container:container_memory_working_set_bytes", pod=~"etcd-ip-.*|kube-apiserver.*"}' - '{__name__="node_namespace_pod_container:container_memory_working_set_bytes", namespace=~"openshift-monitoring|openshift-user-workload-monitoring|appstudio-monitoring"}' - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", pod=~"etcd-ip-.*|kube-apiserver.*"}' @@ -194,7 +189,7 @@ - '{__name__="kube_pod_status_phase", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_running_pods_ready", namespace="konflux-ui"}' - '{__name__="kube_running_pods_ready", namespace="konflux-kite"}' - - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|konflux-kite|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' ## Tekton & Pipeline Metrics - '{__name__="pipeline_service_schedule_overhead_percentage_sum"}' From 450d9051ba8bb58436cf0496c53a5e143a164f10 Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Mon, 25 May 2026 09:26:50 +0300 Subject: [PATCH 44/83] KONFLUX-13356: Upgrade kueue operator from stable-v1.2 to stable-v1.3 and tekton-kueue to cec0b3c8 for ring 2 production clusters: kflux-osp-p01, kflux-prd-rh03, stone-prod-p02 (#11935) Assisted-by: Claude Code Signed-off-by: Gal Levi --- .../production/kflux-osp-p01/kustomization.yaml | 14 +++++++++++++- .../kflux-osp-p01/queue-config/cluster-queue.yaml | 3 +-- .../production/kflux-prd-rh03/kustomization.yaml | 14 +++++++++++++- .../kflux-prd-rh03/queue-config/cluster-queue.yaml | 3 +-- .../production/stone-prod-p02/kustomization.yaml | 14 +++++++++++++- .../stone-prod-p02/queue-config/cluster-queue.yaml | 3 +-- 6 files changed, 42 insertions(+), 9 deletions(-) diff --git a/components/kueue/production/kflux-osp-p01/kustomization.yaml b/components/kueue/production/kflux-osp-p01/kustomization.yaml index 24145d9cf86..b51ca37688b 100644 --- a/components/kueue/production/kflux-osp-p01/kustomization.yaml +++ b/components/kueue/production/kflux-osp-p01/kustomization.yaml @@ -1,8 +1,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base +- ../base/kueue +- ../base-ring1-tekton-kueue +- ../base/tekton-kueue-monitoring - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +patches: +- target: + kind: Subscription + name: openshift-kueue-operator + namespace: openshift-kueue-operator + patch: |- + - op: replace + path: /spec/channel + value: stable-v1.3 diff --git a/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml index 76307bfc09f..04b19ea587e 100644 --- a/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -144,7 +144,6 @@ spec: resources: - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor diff --git a/components/kueue/production/kflux-prd-rh03/kustomization.yaml b/components/kueue/production/kflux-prd-rh03/kustomization.yaml index 24145d9cf86..b51ca37688b 100644 --- a/components/kueue/production/kflux-prd-rh03/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh03/kustomization.yaml @@ -1,8 +1,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base +- ../base/kueue +- ../base-ring1-tekton-kueue +- ../base/tekton-kueue-monitoring - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +patches: +- target: + kind: Subscription + name: openshift-kueue-operator + namespace: openshift-kueue-operator + patch: |- + - op: replace + path: /spec/channel + value: stable-v1.3 diff --git a/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml index 0f1fd70864f..b0bb54187f1 100644 --- a/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -168,7 +168,6 @@ spec: nominalQuota: '1000' - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor diff --git a/components/kueue/production/stone-prod-p02/kustomization.yaml b/components/kueue/production/stone-prod-p02/kustomization.yaml index 24145d9cf86..b51ca37688b 100644 --- a/components/kueue/production/stone-prod-p02/kustomization.yaml +++ b/components/kueue/production/stone-prod-p02/kustomization.yaml @@ -1,8 +1,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base +- ../base/kueue +- ../base-ring1-tekton-kueue +- ../base/tekton-kueue-monitoring - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +patches: +- target: + kind: Subscription + name: openshift-kueue-operator + namespace: openshift-kueue-operator + patch: |- + - op: replace + path: /spec/channel + value: stable-v1.3 diff --git a/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml index e379e187718..d6884694b49 100644 --- a/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -186,7 +186,6 @@ spec: nominalQuota: '5' - name: windows-4xlarge-amd64 nominalQuota: '5' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor From 5bc6189ecfd0cb997abc4d5b256bd6e50b796871 Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Mon, 25 May 2026 11:58:50 +0300 Subject: [PATCH 45/83] KONFLUX-13356: migrate kueue CRs from v1beta1 to v1beta2 for prod ring 2 (#11936) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clusters: kflux-osp-p01, kflux-prd-rh03, stone-prod-p02. - apiVersion v1beta1 → v1beta2 - '1000' → 1k (canonical resource.Quantity) - Reference base-ring1-queue-config for v1beta2 WorkloadPriorityClasses Assisted-by: Claude Code Signed-off-by: Gal Levi --- .../queue-config/cluster-queue.yaml | 16 ++++++++-------- .../queue-config/kustomization.yaml | 2 +- .../queue-config/cluster-queue.yaml | 16 ++++++++-------- .../queue-config/kustomization.yaml | 2 +- .../queue-config/cluster-queue.yaml | 16 ++++++++-------- .../queue-config/kustomization.yaml | 2 +- 6 files changed, 27 insertions(+), 27 deletions(-) diff --git a/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml index 04b19ea587e..9ca8732a00e 100644 --- a/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-osp-p01/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -134,35 +134,35 @@ spec: - name: linux-root-arm64 nominalQuota: '250' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - coveredResources: - localhost flavors: - name: platform-group-3 resources: - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml b/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml index f9fd4ed82c8..3c0e1b51f71 100644 --- a/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base/queue-config +- ../../base-ring1-queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: diff --git a/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml index b0bb54187f1..e0e00b80ae0 100644 --- a/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-prd-rh03/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -163,30 +163,30 @@ spec: - name: linux-s390x nominalQuota: '56' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml b/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml index f9fd4ed82c8..3c0e1b51f71 100644 --- a/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base/queue-config +- ../../base-ring1-queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: diff --git a/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml index d6884694b49..bb19c6ba917 100644 --- a/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -177,34 +177,34 @@ spec: - name: linux-s390x nominalQuota: '72' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k - name: macos-mac2metal-arm64 nominalQuota: '5' - name: windows-4xlarge-amd64 nominalQuota: '5' --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml b/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml index f9fd4ed82c8..3c0e1b51f71 100644 --- a/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml +++ b/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base/queue-config +- ../../base-ring1-queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: From 76ae58255936d7ce211ceb3d089cedd30ffe76fb Mon Sep 17 00:00:00 2001 From: Jen Cullinan <113446385+jencull@users.noreply.github.com> Date: Mon, 25 May 2026 11:19:33 +0100 Subject: [PATCH 46/83] chore(STONEINTG-1594a): add prod endpoint params for image_rbac-proxy (#11916) Signed-off-by: jcullina --- .../production/base/monitoringstack/endpoints-params.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml index 33eb34fce3c..794028b6f1e 100644 --- a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml @@ -116,6 +116,10 @@ - '{__name__="kube_deployment_status_replicas_updated", namespace="tekton-kueue"}' - '{__name__="kube_deployment_spec_replicas", namespace="tekton-kueue"}' + # Namespace: image-rbac-proxy + - '{__name__="kube_deployment_spec_replicas", namespace="image-rbac-proxy"}' + - '{__name__="kube_deployment_status_replicas_available", namespace="image-rbac-proxy"}' + # Namespace: kueue-external-admission - '{__name__="kube_deployment_status_replicas_ready", namespace="kueue-external-admission"}' - '{__name__="kube_deployment_status_replicas_available", namespace="kueue-external-admission"}' From 944eeff9d63de4751c50f53becf5cce9d07b4da0 Mon Sep 17 00:00:00 2001 From: Francesco Ilario Date: Mon, 25 May 2026 13:19:10 +0200 Subject: [PATCH 47/83] fix ClusterQueue in stg-rh01 (#11961) PR 11827 removed the kueue-external-admission component. A left-over was left in stg-rh01's ClusterQueue. PLRs are not getting admitted. Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.4.0 rh-pre-commit.check-secrets: ENABLED --- .../staging/stone-stg-rh01/queue-config/cluster-queue.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml index 6c0bc409859..c166b3a4a7c 100644 --- a/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/staging/stone-stg-rh01/queue-config/cluster-queue.yaml @@ -3,9 +3,6 @@ kind: ClusterQueue metadata: name: cluster-pipeline-queue spec: - admissionChecksStrategy: - admissionChecks: - - name: static-admission flavorFungibility: whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor From f7da7c81ead5e2c463a95efdf1dea4d48e69ae14 Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Mon, 25 May 2026 16:31:20 +0300 Subject: [PATCH 48/83] KFLUXINFRA-3732: add AGENTS.md (#11843) Assisted-by: Claude Code Signed-off-by: Gal Levi --- AGENTS.md | 35 +++++++++++++++++++++++++++++++++++ CLAUDE.md | 1 + 2 files changed, 36 insertions(+) create mode 100644 AGENTS.md create mode 100644 CLAUDE.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000000..0148dc22921 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,35 @@ +# infra-deployments + +GitOps monorepo deploying 50+ Kubernetes components across multiple clusters via Kustomize and ArgoCD ApplicationSets. + +## Quick Commands + +| Action | Command | +|----------------|--------------------------------------------| +| Build overlay | `kustomize build components///` | +| Lint YAML | `yamllint .` | +| K8s lint | `kube-linter lint ` | +| Chainsaw tests | `chainsaw test` | +| infra-tools | `cd infra-tools && make build test lint` | + +## Project Layout + +- `components//{base,development,staging,production}/` — per-component Kustomize overlays; production is further split per-cluster +- `argo-cd-apps/overlays/` — maps to deployment targets (development, staging-downstream, production-downstream, etc.) +- `hack/` — deployment and utility scripts +- `infra-tools/` — Go CLI tools (env-detector, render-diff) with their own Makefile + +## Key Conventions + +- Prefer using scripts in `hack/` over manual steps when available +- Promotion order: development/staging → production; changes must be validated in dev/staging before promoting to production +- Production has per-cluster overlay directories; rollouts must be split into rings (subsets of clusters), not applied to all at once +- All changes via PR; CODEOWNERS approval required +- Production PRs must include `## Risk Assessment` (level, description, rollback plan) and `## Validation` (staging evidence if applicable) +- Commits - Jira ID at start (e.g., `KFLUXINFRA-1234 description`). Interactive sessions: Use the -s flag and `Assisted-by:` trailer. Agentic workflow: `Authored-by:` trailer. Include agent name and tool. + +## Gotchas + +- E2E tests are conditional — they only run on dev/staging PRs when specific files change. Production PRs do not run E2E; rely on prior dev/staging validation +- E2E tests frequently fail due to intermittent infrastructure issues. If the PR looks correct and E2E logs show no relevant errors, comment `/retest` to re-trigger +- When updating component images, also update image references in `hack/new-cluster/templates/` as part of the production ring deployments — new clusters are bootstrapped from these and won't get ArgoCD-synced versions diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 00000000000..43c994c2d36 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +@AGENTS.md From 40592eb72c1920836aba407a45827573f1b3b807 Mon Sep 17 00:00:00 2001 From: Joao Pedro Poloni Ponce Date: Mon, 25 May 2026 11:05:15 -0300 Subject: [PATCH 49/83] chore: replace appstudio-utils by task-runner in konflux ui stage (#11966) Replace appstudio-utils image reference in Konflux UI resources by task-runner image. This change is only for stage environemnt. Production should come after validation in stage in separeted PR. Jira KONFLUX-13284 --- .../staging/stone-stage-p01/configure-oauth-proxy-secret.yaml | 2 +- .../staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml index 28886774e95..d3576f461f8 100644 --- a/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/staging/stone-stage-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml index 28886774e95..d3576f461f8 100644 --- a/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/staging/stone-stg-rh01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: From 1c9403909591436a09c7e406ca40f5605d37aa6d Mon Sep 17 00:00:00 2001 From: Manish Kumar <30774250+manish-jangra@users.noreply.github.com> Date: Mon, 25 May 2026 19:41:05 +0530 Subject: [PATCH 50/83] KFLUXINFRA-3786: revoke Role write permissions from tenant admins (production) (#11951) Co-authored-by: Claude Sonnet 4.6 --- .../production/base/konflux-admin-user-actions.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml b/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml index 926d9cf59dc..175a2d27c81 100644 --- a/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml +++ b/components/konflux-rbac/production/base/konflux-admin-user-actions.yaml @@ -159,6 +159,14 @@ rules: resources: - cronjobs - jobs + - verbs: + - get + - list + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles - verbs: - get - list @@ -169,7 +177,6 @@ rules: apiGroups: - rbac.authorization.k8s.io resources: - - roles - rolebindings - verbs: - get From 91ebbbc8be1cd7de8ead15e3c20492fdbc2e6c63 Mon Sep 17 00:00:00 2001 From: Francesco Ilario Date: Mon, 25 May 2026 20:07:42 +0200 Subject: [PATCH 51/83] remove kueue-external-admission from prod (#11828) * remove kueue-external-admission from dev/stg We paused development and are now archiving kueue-external-admission. As part of this process we want to remove it from where it's deployed. Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED * remove kueue-external-admission from prod Requires: * [ ] #11827 Signed-off-by: Francesco Ilario rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED --- .../kueue-prometheus-alerts.yaml | 20 ++++---- .../grafana/base/dashboards/kueue/kueue.json | 18 +++---- .../monitoringstack/endpoints-params.yaml | 47 +++++++++---------- 3 files changed, 40 insertions(+), 45 deletions(-) diff --git a/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml b/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml index f4e5920bff8..210ba059594 100644 --- a/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml +++ b/components/kueue/production/base/tekton-kueue-monitoring/kueue-prometheus-alerts.yaml @@ -23,11 +23,11 @@ spec: - alert: KueueReplicasNotAvailable expr: | ( - kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"} + kube_deployment_status_replicas_available{namespace=~"openshift-kueue-operator|tekton-kueue"} ) / clamp_min( - kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue|kueue-external-admission"}, + kube_deployment_spec_replicas{namespace=~"openshift-kueue-operator|tekton-kueue"}, 1 ) * 100 < 100 for: 5m @@ -44,12 +44,12 @@ spec: - alert: KueueHighMemoryUtilization expr: | ( - container_memory_working_set_bytes{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator", image!=""} + container_memory_working_set_bytes{namespace=~"tekton-kueue|openshift-kueue-operator", image!=""} * on(container, pod) group_left - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} ) - / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} * 100 > 70 + / on (pod) kube_pod_resource_limit{resource='memory',namespace=~"tekton-kueue|openshift-kueue-operator"} * 100 > 70 for: 5m labels: severity: warning @@ -64,10 +64,10 @@ spec: - alert: KueueHighCPUUtilization expr: | ( - pod:container_cpu_usage:sum{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} + pod:container_cpu_usage:sum{namespace=~"tekton-kueue|openshift-kueue-operator"} * on(pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} - ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}) * 100 > 85 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} + ) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~"tekton-kueue|openshift-kueue-operator"}) * 100 > 85 for: 5m labels: severity: warning @@ -94,9 +94,9 @@ spec: - alert: KueueHighContainerRestarts expr: | - increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"}[1h]) + increase(kube_pod_container_status_restarts_total{namespace=~"tekton-kueue|openshift-kueue-operator"}[1h]) * on(container, pod) - kube_pod_container_status_ready{namespace=~"tekton-kueue|kueue-external-admission|openshift-kueue-operator"} >= 3 + kube_pod_container_status_ready{namespace=~"tekton-kueue|openshift-kueue-operator"} >= 3 for: 0m labels: severity: warning diff --git a/components/monitoring/grafana/base/dashboards/kueue/kueue.json b/components/monitoring/grafana/base/dashboards/kueue/kueue.json index 3efe40132cb..f7795611151 100644 --- a/components/monitoring/grafana/base/dashboards/kueue/kueue.json +++ b/components/monitoring/grafana/base/dashboards/kueue/kueue.json @@ -87,7 +87,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -173,7 +173,7 @@ { "editorMode": "code", "exemplar": false, - "expr": "(\n kube_deployment_status_replicas_available{namespace=~\"openshift-kueue-operator|tekton-kueue|kueue-external-admission\"}\n)\n/\nclamp_min(\n kube_deployment_spec_replicas{namespace=~\"openshift-kueue-operator|tekton-kueue|kueue-external-admission\"},\n 1\n) * 100", + "expr": "(\n kube_deployment_status_replicas_available{namespace=~\"openshift-kueue-operator|tekton-kueue\"}\n)\n/\nclamp_min(\n kube_deployment_spec_replicas{namespace=~\"openshift-kueue-operator|tekton-kueue\"},\n 1\n) * 100", "format": "time_series", "instant": false, "legendFormat": "{{deployment}}", @@ -252,7 +252,7 @@ "targets": [ { "editorMode": "code", - "expr": "(\n container_memory_working_set_bytes{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\", image!=\"\"} \n * on(container, pod)\n group_left\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}\n)\n / on (pod) max by (pod) (kube_pod_resource_limit{resource='memory',namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}) * 100", + "expr": "(\n container_memory_working_set_bytes{namespace=~\"tekton-kueue|openshift-kueue-operator\", image!=\"\"} \n * on(container, pod)\n group_left\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|openshift-kueue-operator\"}\n)\n / on (pod) max by (pod) (kube_pod_resource_limit{resource='memory',namespace=~\"tekton-kueue|openshift-kueue-operator\"}) * 100", "legendFormat": "__auto", "range": true, "refId": "A" @@ -399,7 +399,7 @@ "targets": [ { "editorMode": "code", - "expr": "(\n pod:container_cpu_usage:sum{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}\n * on(pod)\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}\n) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}) * 100", + "expr": "(\n pod:container_cpu_usage:sum{namespace=~\"tekton-kueue|openshift-kueue-operator\"}\n * on(pod)\n kube_pod_container_status_ready{namespace=~\"tekton-kueue|openshift-kueue-operator\"}\n) / on (pod) group_right max by (pod) (kube_pod_resource_limit{resource='cpu',namespace=~\"tekton-kueue|openshift-kueue-operator\"}) * 100", "legendFormat": "{{pod}}", "range": true, "refId": "A" @@ -602,7 +602,7 @@ "targets": [ { "editorMode": "code", - "expr": "increase(kube_pod_container_status_restarts_total{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}[1h])\n* on(container, pod)\nkube_pod_container_status_ready{namespace=~\"tekton-kueue|kueue-external-admission|openshift-kueue-operator\"}", + "expr": "increase(kube_pod_container_status_restarts_total{namespace=~\"tekton-kueue|openshift-kueue-operator\"}[1h])\n* on(container, pod)\nkube_pod_container_status_ready{namespace=~\"tekton-kueue|openshift-kueue-operator\"}", "legendFormat": "{{pod}}", "range": true, "refId": "A" @@ -1258,7 +1258,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -1331,7 +1331,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -1404,7 +1404,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true @@ -1845,7 +1845,7 @@ "color": "rgba(255,0,255,0.7)" }, "filterValues": { - "le": 1e-9 + "le": 1E-9 }, "legend": { "show": true diff --git a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml index 794028b6f1e..4ad6278715a 100644 --- a/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml +++ b/components/monitoring/prometheus/production/base/monitoringstack/endpoints-params.yaml @@ -120,15 +120,10 @@ - '{__name__="kube_deployment_spec_replicas", namespace="image-rbac-proxy"}' - '{__name__="kube_deployment_status_replicas_available", namespace="image-rbac-proxy"}' - # Namespace: kueue-external-admission - - '{__name__="kube_deployment_status_replicas_ready", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_status_replicas_available", namespace="kueue-external-admission"}' - - '{__name__="kube_deployment_spec_replicas", namespace="kueue-external-admission"}' - ## Container Metrics - '{__name__="kube_pod_container_status_waiting_reason", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_pod_container_resource_limits", namespace=~"release-service|rhtap-releng-tenant"}' - - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="kube_pod_container_status_terminated_reason", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="kube_pod_container_status_terminated_reason", namespace=~".*-tenant", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", reason="OOMKilled"}' - '{__name__="kube_pod_container_status_last_terminated_reason", namespace="release-service"}' @@ -136,25 +131,25 @@ - '{__name__="container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd"}' - '{__name__="container_memory_usage_bytes", namespace=~"release-service|openshift-etcd|rhtap-releng-tenant"}' - '{__name__="kube_pod_container_status_restarts_total", namespace!~".*-tenant"}' - - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' - - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_memory_usage_bytes:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace:container_cpu_usage:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_requests:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_memory:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_cpu:kube_pod_container_resource_limits:sum", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_writes_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_fs_reads_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_bytes_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_receive_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="container_network_transmit_packets_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_limits", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="cluster:namespace:pod_memory:active:kube_pod_container_resource_requests", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' + - '{__name__="namespace_container:container_memory_working_set_bytes", namespace=~"release-service|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="namespace_container:container_cpu_usage_seconds_total", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client"}' - '{__name__="node_namespace_pod_container:container_memory_working_set_bytes", pod=~"etcd-ip-.*|kube-apiserver.*"}' - '{__name__="node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate", pod=~"etcd-ip-.*|kube-apiserver.*"}' - '{__name__="kube_pod_container_info", namespace!~".*-tenant|openshift-.*|kube-.*"}' @@ -168,7 +163,7 @@ - '{__name__="kube_pod_status_unschedulable", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_pod_status_phase", namespace!~".*-tenant|openshift-.*|kube-.*"}' - '{__name__="kube_running_pods_ready", namespace="konflux-ui"}' - - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|kueue-external-admission|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' + - '{__name__="node_namespace_pod:kube_pod_info:", namespace=~"release-service|openshift-etcd|openshift-kube-apiserver|build-service|image-controller|integration-service|konflux-ui|product-kubearchive|product-kubearchive-logging|openshift-kueue-operator|tekton-kueue|mintmaker|multi-platform-controller|namespace-lister|openshift-pipelines|tekton-results|project-controller|smee|smee-client|rhtap-releng-tenant"}' ## Tekton & Pipeline Metrics - '{__name__="pipeline_service_schedule_overhead_percentage_sum"}' From 17317b701d3d48462d5339f98887a3b6bed361d2 Mon Sep 17 00:00:00 2001 From: Manish Kumar <30774250+manish-jangra@users.noreply.github.com> Date: Tue, 26 May 2026 08:58:20 +0530 Subject: [PATCH 52/83] Fix image-controller and image-rbac-proxy Quay org for kflux-fedora-01 (#11958) The kflux-fedora-01 cluster was missing a cluster-specific image-controller overlay, causing it to use the default production quaytoken (organization: redhat-user-workloads). This made new ImageRepositories push to the wrong Quay org, where Tekton Chains lacks signing permissions, breaking attestations and signatures. - Add kflux-fedora-01 to the image-controller ArgoCD ApplicationSet - Create cluster overlay pointing quaytoken to Vault path production/build/image-controller-fedora (organization: konflux-fedora) - Override image-pruner-token to production/build/image-pruner-token-fedora - Fix image-rbac-proxy backend-namespace to konflux-fedora Resolves https://github.com/konflux-ci/support/issues/20 Co-authored-by: Cursor --- .../image-controller/image-controller.yaml | 2 ++ .../kflux-fedora-01/image-pruner-token.yaml | 4 ++++ .../kflux-fedora-01/kustomization.yaml | 18 ++++++++++++++++++ .../production/kflux-fedora-01/quaytoken.yaml | 4 ++++ .../production/kflux-fedora-01/configmap.yaml | 2 +- 5 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 components/image-controller/production/kflux-fedora-01/image-pruner-token.yaml create mode 100644 components/image-controller/production/kflux-fedora-01/kustomization.yaml create mode 100644 components/image-controller/production/kflux-fedora-01/quaytoken.yaml diff --git a/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml b/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml index 4d7e3340561..cba46a05359 100644 --- a/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml +++ b/argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml @@ -17,6 +17,8 @@ spec: elements: - nameNormalized: stone-prd-rh01 values.clusterDir: stone-prd-rh01 + - nameNormalized: kflux-fedora-01 + values.clusterDir: kflux-fedora-01 template: metadata: name: image-controller-{{nameNormalized}} diff --git a/components/image-controller/production/kflux-fedora-01/image-pruner-token.yaml b/components/image-controller/production/kflux-fedora-01/image-pruner-token.yaml new file mode 100644 index 00000000000..568b4c2d690 --- /dev/null +++ b/components/image-controller/production/kflux-fedora-01/image-pruner-token.yaml @@ -0,0 +1,4 @@ +--- +- op: replace + path: /spec/dataFrom/0/extract/key + value: production/build/image-pruner-token-fedora diff --git a/components/image-controller/production/kflux-fedora-01/kustomization.yaml b/components/image-controller/production/kflux-fedora-01/kustomization.yaml new file mode 100644 index 00000000000..e4779e0a820 --- /dev/null +++ b/components/image-controller/production/kflux-fedora-01/kustomization.yaml @@ -0,0 +1,18 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../base + +patches: + - path: quaytoken.yaml + target: + name: quaytoken + kind: ExternalSecret + group: external-secrets.io + version: v1 + - path: image-pruner-token.yaml + target: + name: image-pruner-token + kind: ExternalSecret + group: external-secrets.io + version: v1 diff --git a/components/image-controller/production/kflux-fedora-01/quaytoken.yaml b/components/image-controller/production/kflux-fedora-01/quaytoken.yaml new file mode 100644 index 00000000000..6b1bc830835 --- /dev/null +++ b/components/image-controller/production/kflux-fedora-01/quaytoken.yaml @@ -0,0 +1,4 @@ +--- +- op: replace + path: /spec/dataFrom/0/extract/key + value: production/build/image-controller-fedora diff --git a/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml b/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml index 78dde65baee..eab24ec3f2c 100644 --- a/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml +++ b/components/image-rbac-proxy/production/kflux-fedora-01/configmap.yaml @@ -4,7 +4,7 @@ metadata: name: image-rbac-proxy namespace: image-rbac-proxy data: - backend-namespace: redhat-user-workloads + backend-namespace: konflux-fedora cluster-url: https://api.kflux-fedora-01.84db.p1.openshiftapps.com:6443 proxy-url: https://image-rbac-proxy.apps.kflux-fedora-01.84db.p1.openshiftapps.com dex-url: https://image-rbac-proxy.apps.kflux-fedora-01.84db.p1.openshiftapps.com/idp From 09f6e57b93a6c8f4fff23f275de09054f83f9488 Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Tue, 26 May 2026 11:42:40 +0300 Subject: [PATCH 53/83] KFLUXINFRA-3732: address AGENTS.md review feedback (#11986) Assisted-by: Claude Code Signed-off-by: Gal Levi --- AGENTS.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 0148dc22921..c52d7b4ef24 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -9,13 +9,14 @@ GitOps monorepo deploying 50+ Kubernetes components across multiple clusters via | Build overlay | `kustomize build components///` | | Lint YAML | `yamllint .` | | K8s lint | `kube-linter lint ` | -| Chainsaw tests | `chainsaw test` | +| Chainsaw tests | `./hack/chainsaw/chainsaw-prepare.sh` and `chainsaw test ` | | infra-tools | `cd infra-tools && make build test lint` | ## Project Layout -- `components//{base,development,staging,production}/` — per-component Kustomize overlays; production is further split per-cluster +- `components//{base,development,staging,production}/` — per-component Kustomize overlays; staging and production are often further split per-cluster - `argo-cd-apps/overlays/` — maps to deployment targets (development, staging-downstream, production-downstream, etc.) +- `configs/` — cluster-level configurations (etcd-defrag, kubelet settings) - `hack/` — deployment and utility scripts - `infra-tools/` — Go CLI tools (env-detector, render-diff) with their own Makefile @@ -30,6 +31,7 @@ GitOps monorepo deploying 50+ Kubernetes components across multiple clusters via ## Gotchas +- E2E tests are designed to validate in an isolated environment in GitHub Actions CI and should not be run locally - E2E tests are conditional — they only run on dev/staging PRs when specific files change. Production PRs do not run E2E; rely on prior dev/staging validation - E2E tests frequently fail due to intermittent infrastructure issues. If the PR looks correct and E2E logs show no relevant errors, comment `/retest` to re-trigger - When updating component images, also update image references in `hack/new-cluster/templates/` as part of the production ring deployments — new clusters are bootstrapped from these and won't get ArgoCD-synced versions From 14c78baecd2eaa196d68125fb622894850984db4 Mon Sep 17 00:00:00 2001 From: Aurel Balteaux Date: Tue, 26 May 2026 02:04:17 -0700 Subject: [PATCH 54/83] feat(SPRE-5169): Add konflux-ui probes (staging) (#11980) --- .../blackbox/staging/stone-stage-p01/kustomization.yaml | 2 +- .../blackbox/staging/stone-stg-rh01/kustomization.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml b/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml index b6eb95c4008..d233a253097 100644 --- a/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml +++ b/components/monitoring/blackbox/staging/stone-stage-p01/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/private/stone-stage-p01?ref=724f162701643ed0f59596c882f0beb40b62b045 + - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/private/stone-stage-p01?ref=7280329e718665003f36f8874351ecba3706e422 namespace: appstudio-monitoring diff --git a/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml b/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml index 134c92e9531..15db88bb27b 100644 --- a/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml +++ b/components/monitoring/blackbox/staging/stone-stg-rh01/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/public/stone-stg-rh01?ref=5e48bb6dca3eb756f5de24fe2664e14dbf55388f + - https://github.com/redhat-appstudio/internal-infra-deployments/components/monitoring/blackbox-exporter/staging/public/stone-stg-rh01?ref=7280329e718665003f36f8874351ecba3706e422 namespace: appstudio-monitoring From b05a9f85f7b9f6fa1c9d06f6c1c7d7aacb957f18 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Tue, 26 May 2026 10:02:04 +0000 Subject: [PATCH 55/83] update components/mintmaker/staging/base/kustomization.yaml (#11971) Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/staging/base/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index 5e40f2e06cd..e0bea426ec7 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -16,7 +16,7 @@ images: newTag: 70cfa98ddf51f87166807d7f2787677422471d20 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: ea0ea056fc323d2f007e6433d318ea3a64b7bf2d + newTag: d2bff51dfd5b136a5cc0e0108d02336f96085fc5 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From bf7aa7bde2c61d1f2d99a64044b5bd7b8fb1a953 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Tue, 26 May 2026 13:22:07 +0200 Subject: [PATCH 56/83] Add event-reading RBAC to perf-team-prometheus-reader production (#11984) Backport tenants-rbac from staging to production, granting konflux-bot-0 permission to read events in konflux-perfscale-{1,2,3}-tenant namespaces. Remove the namespace directive from production kustomization since all resources already specify their namespaces explicitly, and it would conflict with the per-tenant namespaces in tenants-rbac. Generated-by: Claude Assisted-by: Claude Co-authored-by: Claude Opus 4.6 (1M context) --- .../production/base/kustomization.yaml | 2 +- .../kustomization.yaml | 4 ++++ .../tenant-rbac.yaml | 24 +++++++++++++++++++ .../kustomization.yaml | 4 ++++ .../tenant-rbac.yaml | 24 +++++++++++++++++++ .../kustomization.yaml | 4 ++++ .../tenant-rbac.yaml | 24 +++++++++++++++++++ .../base/tenants-rbac/kustomization.yaml | 6 +++++ 8 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/kustomization.yaml create mode 100644 components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/tenant-rbac.yaml create mode 100644 components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/kustomization.yaml create mode 100644 components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/tenant-rbac.yaml create mode 100644 components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/kustomization.yaml create mode 100644 components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/tenant-rbac.yaml create mode 100644 components/perf-team-prometheus-reader/production/base/tenants-rbac/kustomization.yaml diff --git a/components/perf-team-prometheus-reader/production/base/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/kustomization.yaml index 156798b85fa..d8581687f9b 100644 --- a/components/perf-team-prometheus-reader/production/base/kustomization.yaml +++ b/components/perf-team-prometheus-reader/production/base/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: perf-team-prometheus-reader resources: - serviceaccount.yaml - serviceaccount-oomcrash.yaml - perf-team.yaml + - tenants-rbac diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/kustomization.yaml new file mode 100644 index 00000000000..4be86f47098 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - tenant-rbac.yaml diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/tenant-rbac.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/tenant-rbac.yaml new file mode 100644 index 00000000000..d4ea9da4f53 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-1-tenant/tenant-rbac.yaml @@ -0,0 +1,24 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-role + namespace: konflux-perfscale-1-tenant +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["get", "list", "watch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-binding + namespace: konflux-perfscale-1-tenant +subjects: +- kind: ServiceAccount + name: konflux-bot-0 + namespace: konflux-perfscale-1-tenant +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-event-reader-role diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/kustomization.yaml new file mode 100644 index 00000000000..4be86f47098 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - tenant-rbac.yaml diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/tenant-rbac.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/tenant-rbac.yaml new file mode 100644 index 00000000000..7420a7369f9 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-2-tenant/tenant-rbac.yaml @@ -0,0 +1,24 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-role + namespace: konflux-perfscale-2-tenant +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["get", "list", "watch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-binding + namespace: konflux-perfscale-2-tenant +subjects: +- kind: ServiceAccount + name: konflux-bot-0 + namespace: konflux-perfscale-2-tenant +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-event-reader-role diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/kustomization.yaml new file mode 100644 index 00000000000..4be86f47098 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - tenant-rbac.yaml diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/tenant-rbac.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/tenant-rbac.yaml new file mode 100644 index 00000000000..f8d1d3c8b6b --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/konflux-perfscale-3-tenant/tenant-rbac.yaml @@ -0,0 +1,24 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-role + namespace: konflux-perfscale-3-tenant +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["get", "list", "watch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: perf-team-event-reader-binding + namespace: konflux-perfscale-3-tenant +subjects: +- kind: ServiceAccount + name: konflux-bot-0 + namespace: konflux-perfscale-3-tenant +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-event-reader-role diff --git a/components/perf-team-prometheus-reader/production/base/tenants-rbac/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/tenants-rbac/kustomization.yaml new file mode 100644 index 00000000000..f21c0ce51d1 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/tenants-rbac/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - konflux-perfscale-1-tenant + - konflux-perfscale-2-tenant + - konflux-perfscale-3-tenant From cdcaa5f19dbfcbaec34b34ed4a07cb35d18d3264 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Tue, 26 May 2026 15:24:00 +0200 Subject: [PATCH 57/83] Allow konflux-performance group to create SA tokens in perf-team-prometheus-reader (#11983) Add Role and RoleBinding granting the konflux-performance group permission to create tokens for perf-team-prometheus-reader-cluster-sa and perf-team-prometheus-reader-oomcrash-sa service accounts. Added to base/core which is used by development and staging overlays only (production has its own standalone resources). Generated-by: Claude Assisted-by: Claude Co-authored-by: Claude Opus 4.6 (1M context) --- .../base/core/kustomization.yaml | 1 + .../base/core/sa-token-rbac.yaml | 29 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 components/perf-team-prometheus-reader/base/core/sa-token-rbac.yaml diff --git a/components/perf-team-prometheus-reader/base/core/kustomization.yaml b/components/perf-team-prometheus-reader/base/core/kustomization.yaml index 156798b85fa..ca031a21b04 100644 --- a/components/perf-team-prometheus-reader/base/core/kustomization.yaml +++ b/components/perf-team-prometheus-reader/base/core/kustomization.yaml @@ -5,3 +5,4 @@ resources: - serviceaccount.yaml - serviceaccount-oomcrash.yaml - perf-team.yaml + - sa-token-rbac.yaml diff --git a/components/perf-team-prometheus-reader/base/core/sa-token-rbac.yaml b/components/perf-team-prometheus-reader/base/core/sa-token-rbac.yaml new file mode 100644 index 00000000000..d5cfb73fba3 --- /dev/null +++ b/components/perf-team-prometheus-reader/base/core/sa-token-rbac.yaml @@ -0,0 +1,29 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +rules: + - verbs: + - create + apiGroups: + - "" + resources: + - serviceaccounts/token + resourceNames: + - perf-team-prometheus-reader-cluster-sa + - perf-team-prometheus-reader-oomcrash-sa +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +subjects: + - kind: Group + apiGroup: rbac.authorization.k8s.io + name: konflux-performance +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-sa-token-creator From 39cb6926798a86deb1208d90a9b1ba2e7393ed84 Mon Sep 17 00:00:00 2001 From: Homaja Marisetty <116022361+hmariset@users.noreply.github.com> Date: Tue, 26 May 2026 09:58:52 -0400 Subject: [PATCH 58/83] chore(KFLUXVNGD-994): increase artifact-registry-proxy cache volume to 100GB in staging (#11940) With redirect caching enabled, nginx now caches actual artifact content from S3 rather than passing through 302 redirects. Increase the cache volume from 50GB to 100GB to accommodate the larger working set. Production will be increased to 1TB in a separate PR. Note: This change requires manual intervention after ArgoCD sync fails. See KFLUXVNGD-994 for the resize procedure. Jira-Url: https://redhat.atlassian.net/browse/KFLUXVNGD-994 Signed-off-by: Homaja Marisetty Co-authored-by: Claude Opus 4.6 --- components/squid/staging/squid-helm-generator.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/squid/staging/squid-helm-generator.yaml b/components/squid/staging/squid-helm-generator.yaml index ca2af48a4f6..7680fb4d51e 100644 --- a/components/squid/staging/squid-helm-generator.yaml +++ b/components/squid/staging/squid-helm-generator.yaml @@ -30,7 +30,7 @@ valuesInline: allowList: # Cache all traffic to nexus repositories - ^/repository/ - size: 51200 + size: 102400 ttl: 30d resources: requests: From f3867bd879b1ebe6e0844117752e430a4f091f7e Mon Sep 17 00:00:00 2001 From: Gabriel Soares <197765854+gcpsoares@users.noreply.github.com> Date: Tue, 26 May 2026 11:39:44 -0300 Subject: [PATCH 59/83] feat(SPRE-5381): Include label severity for blackbox monitoring in production. (#11974) Signed-off-by: Gabriel Soares --- .../production/base/monitoringstack/writeRelabelConfigs.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml b/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml index ec5f9c33e24..b0f6e2f524d 100644 --- a/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml +++ b/components/monitoring/prometheus/production/base/monitoringstack/writeRelabelConfigs.yaml @@ -17,4 +17,4 @@ policy_name|policy_background_mode|rule_type|policy_type|policy_validation_mode|\ resource_request_operation|resource_kind|policy_change_type|event_type|\ name|cluster_queue|quantile|slice|scrape_job|tested_registry|error|queue|\ - priority_class|finalizers" + priority_class|finalizers|severity" From 58512ae2f984bb428869b7d11b9f8fa5675e0ce5 Mon Sep 17 00:00:00 2001 From: Hugo Ares Date: Tue, 26 May 2026 11:02:44 -0400 Subject: [PATCH 60/83] Switch back to ppc in us-east (#11995) We are done with testing in us-south, go back to us-east to be able to clean up IBMC resources in us-south. Also clean up ssh key ExternalSecrets, since we no longer have 2 for ppc we can use standard name for the one left. KFLUXINFRA-3315 Signed-off-by: Hugo Ares --- .../staging-downstream/external-secrets.yaml | 25 +------------------ .../staging-downstream/host-values.yaml | 9 +------ 2 files changed, 2 insertions(+), 32 deletions(-) diff --git a/components/multi-platform-controller/staging-downstream/external-secrets.yaml b/components/multi-platform-controller/staging-downstream/external-secrets.yaml index 6838e0fdeb7..cc5d6bc5761 100644 --- a/components/multi-platform-controller/staging-downstream/external-secrets.yaml +++ b/components/multi-platform-controller/staging-downstream/external-secrets.yaml @@ -77,29 +77,6 @@ metadata: annotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true argocd.argoproj.io/sync-wave: "-1" -spec: - dataFrom: - - extract: - key: staging/infrastructure/multi-platform-controller/stone-stage-p01/ibm-ppc64le-ssh-key - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: appsre-stonesoup-vault - target: - creationPolicy: Owner - deletionPolicy: Delete - name: ibm-ppc64le-ssh-key ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: ibm-ppc64le-ssh-key-us-east - namespace: multi-platform-controller - labels: - build.appstudio.redhat.com/multi-platform-secret: "true" - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "-1" spec: dataFrom: - extract: @@ -111,7 +88,7 @@ spec: target: creationPolicy: Owner deletionPolicy: Delete - name: ibm-ppc64le-ssh-key-us-east + name: ibm-ppc64le-ssh-key --- apiVersion: external-secrets.io/v1 kind: ExternalSecret diff --git a/components/multi-platform-controller/staging-downstream/host-values.yaml b/components/multi-platform-controller/staging-downstream/host-values.yaml index 6674e661403..f1b37c57584 100644 --- a/components/multi-platform-controller/staging-downstream/host-values.yaml +++ b/components/multi-platform-controller/staging-downstream/host-values.yaml @@ -205,19 +205,12 @@ dynamicConfigs: # Static hosts configuration staticHosts: ppc64le-static-1: - address: "10.130.103.155" + address: "10.130.72.59" concurrency: "2" platform: "linux/ppc64le" secret: "ibm-ppc64le-ssh-key" user: "root" -# ppc64le-static-2: -# address: "10.130.72.59" -# concurrency: "1" -# platform: "linux/ppc64le" -# secret: "ibm-ppc64le-ssh-key-us-east" -# user: "root" - s390x-static-1: address: "10.130.72.6" concurrency: "2" From e83cbd98bb8d69837fa9eb4861ab68ad3315ec60 Mon Sep 17 00:00:00 2001 From: Emily Keefe Date: Tue, 26 May 2026 11:27:42 -0400 Subject: [PATCH 61/83] Delete all group-sync resources (#11891) KFLUXINFRA-3287 --- components/authentication/README.md | 34 + .../admin-checker/admin-checker-sa.yaml | 0 .../admin-checker/cronjob.yaml | 0 .../external-secrets/kustomization.yaml | 0 .../external-secrets/rhtap-infra-secrets.yaml | 0 .../admin-checker/kustomization.yaml | 0 .../admin-checker/namespace.yaml | 0 .../base/authentication/kustomization.yaml | 43 - .../component-maintainer.yaml | 0 .../everyone-can-view-patch.yaml | 0 .../everyone-can-view.yaml | 0 .../grafana-view-only.yaml | 0 .../base/group-sync-olm/kustomization.yaml | 5 - .../base/group-sync-olm/namespaces.yaml | 4 - .../base/group-sync-olm/subscription.yaml | 18 - .../external-secrets/konflux-ldap-sa.yaml | 21 - .../external-secrets/kustomization.yaml | 5 - .../external-secrets/mtls-ca-validators.yaml | 21 - .../base/group-sync/group-sync.yaml | 12 - .../base/group-sync/konflux-rover-groups.yaml | 42 - .../base/group-sync/kustomization.yaml | 8 - .../test-platform-ci-admins-rover-group.yaml | 42 - .../konflux-admins-pod-admin.yaml | 0 .../{authentication => }/konflux-admins.yaml | 0 .../{authentication => }/konflux-sre.yaml | 0 .../authentication/base/kustomization.yaml | 42 +- .../test-platform-ci-admins-can-view.yaml | 0 .../authentication/helm-charts/crd.yaml | 919 ------------------ .../group-sync-operator-chart/.helmignore | 23 - .../group-sync-operator-chart/Chart.yaml | 10 - .../templates/_helpers.tpl | 85 -- .../auth_proxy_client_clusterrole.yaml | 7 - .../templates/auth_proxy_role.yaml | 13 - .../templates/auth_proxy_role_binding.yaml | 12 - .../templates/auth_proxy_service.yaml | 17 - .../templates/groupsync_editor_role.yaml | 24 - .../templates/groupsync_viewer_role.yaml | 20 - .../templates/leader_election_role.yaml | 38 - .../leader_election_role_binding.yaml | 12 - .../templates/manager.yaml | 114 --- .../templates/manager_role.yaml | 51 - .../templates/monitor.yaml | 25 - .../templates/namespace.yaml | 6 - .../templates/prometheus-role.yaml | 16 - .../templates/prometheus-rolebinding.yaml | 13 - .../templates/role_binding.yaml | 12 - .../templates/service-account.yaml | 7 - .../group-sync-operator-chart/values.yaml | 53 - .../helm-charts/kustomization.yaml | 16 - .../helm-charts/metrics/kustomization.yaml | 5 - .../helm-charts/metrics/monitor.yaml | 24 - .../ldap-url-patch/kustomization.yaml | 16 - .../ldap-url-patch/ldap-url-patch.yaml | 4 - .../base/konflux-ldap-sa-patch.yaml | 4 - .../production/base/kustomization.yaml | 2 +- .../base/mtls-ca-validators-patch.yaml | 4 - .../staging/base/kustomization.yaml | 2 +- .../schedules/backup-tenants-schedule.yaml | 1 - .../backup-tenants-schedule.yaml | 1 - .../appsre-stonesoup-vault-secret-store.yaml | 1 - .../backup/backup-tenants-schedule.yaml | 1 - .../private/authentication/kustomization.yaml | 2 - 62 files changed, 76 insertions(+), 1781 deletions(-) create mode 100644 components/authentication/README.md rename components/authentication/base/{authentication => }/admin-checker/admin-checker-sa.yaml (100%) rename components/authentication/base/{authentication => }/admin-checker/cronjob.yaml (100%) rename components/authentication/base/{authentication => }/admin-checker/external-secrets/kustomization.yaml (100%) rename components/authentication/base/{authentication => }/admin-checker/external-secrets/rhtap-infra-secrets.yaml (100%) rename components/authentication/base/{authentication => }/admin-checker/kustomization.yaml (100%) rename components/authentication/base/{authentication => }/admin-checker/namespace.yaml (100%) delete mode 100644 components/authentication/base/authentication/kustomization.yaml rename components/authentication/base/{authentication => }/component-maintainer.yaml (100%) rename components/authentication/base/{authentication => }/everyone-can-view-patch.yaml (100%) rename components/authentication/base/{authentication => }/everyone-can-view.yaml (100%) rename components/authentication/base/{authentication => }/grafana-view-only.yaml (100%) delete mode 100644 components/authentication/base/group-sync-olm/kustomization.yaml delete mode 100644 components/authentication/base/group-sync-olm/namespaces.yaml delete mode 100644 components/authentication/base/group-sync-olm/subscription.yaml delete mode 100644 components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml delete mode 100644 components/authentication/base/group-sync/external-secrets/kustomization.yaml delete mode 100644 components/authentication/base/group-sync/external-secrets/mtls-ca-validators.yaml delete mode 100644 components/authentication/base/group-sync/group-sync.yaml delete mode 100644 components/authentication/base/group-sync/konflux-rover-groups.yaml delete mode 100644 components/authentication/base/group-sync/kustomization.yaml delete mode 100644 components/authentication/base/group-sync/test-platform-ci-admins-rover-group.yaml rename components/authentication/base/{authentication => }/konflux-admins-pod-admin.yaml (100%) rename components/authentication/base/{authentication => }/konflux-admins.yaml (100%) rename components/authentication/base/{authentication => }/konflux-sre.yaml (100%) rename components/authentication/base/{authentication => }/test-platform-ci-admins-can-view.yaml (100%) delete mode 100644 components/authentication/helm-charts/crd.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/.helmignore delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/Chart.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/_helpers.tpl delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_client_clusterrole.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role_binding.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_service.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_editor_role.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_viewer_role.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role_binding.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/manager.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/manager_role.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/monitor.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/namespace.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-role.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-rolebinding.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/role_binding.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/templates/service-account.yaml delete mode 100644 components/authentication/helm-charts/group-sync-operator-chart/values.yaml delete mode 100644 components/authentication/helm-charts/kustomization.yaml delete mode 100644 components/authentication/helm-charts/metrics/kustomization.yaml delete mode 100644 components/authentication/helm-charts/metrics/monitor.yaml delete mode 100644 components/authentication/k-components/ldap-url-patch/kustomization.yaml delete mode 100644 components/authentication/k-components/ldap-url-patch/ldap-url-patch.yaml delete mode 100644 components/authentication/production/base/konflux-ldap-sa-patch.yaml delete mode 100644 components/authentication/production/base/mtls-ca-validators-patch.yaml diff --git a/components/authentication/README.md b/components/authentication/README.md new file mode 100644 index 00000000000..ccdeedf7772 --- /dev/null +++ b/components/authentication/README.md @@ -0,0 +1,34 @@ +# Authentication + +The Authentication component contains GitOps manifests for Konflux cluster **authentication and authorization**: OpenShift RBAC (**ClusterRoles**, **ClusterRoleBindings**) for Konflux LDAP/Rover groups, baseline view permissions for authenticated users, and the **admin-checker** job that audits cluster admin group membership. + +## What gets deployed + +### RBAC roles and bindings + +| Manifest | Kind | Purpose | +| --- | --- | --- | +| `konflux-admins.yaml` | `ClusterRole` / `ClusterRoleBinding` | Broad cluster permissions **without** `secrets` or `internalrequests` | +| `konflux-admins-pod-admin.yaml` | `ClusterRole` + `RoleBinding` | Pod create/exec/attach in selected namespaces only | +| `konflux-sre.yaml` | `ClusterRole` / `ClusterRoleBinding` | Read-only pod access; delete allowed for cleanup | +| `component-maintainer.yaml` | `ClusterRole` | OLM `installplans`, Tekton Results, limited SA patch | +| `grafana-view-only.yaml` | `ClusterRole` / `RoleBinding` | Read `appstudio-grafana` namespace | +| `test-platform-ci-admins-can-view.yaml` | `ClusterRole` / `ClusterRoleBinding` | View test platform / Crossplane resources | +| `everyone-can-view.yaml` + patch | `ClusterRole` / `ClusterRoleBinding` | Shared view roles for App Studio, monitoring, cluster version, compute | + +`everyone-can-view-patch.yaml` centralizes the list of Konflux Rover groups that receive the “everyone can view” bindings so the same group list is not duplicated across multiple bindings. + +### Admin checker + +Runs in namespace `admin-checker` as CronJob `check-cluster-admins` (Mondays 11:30 UTC). It: + +1. Reads OpenShift `Group` objects `cluster-admins` and `dedicated-admins`. +2. POSTs membership to the workflow URL in secret `rhtap-infra-secrets` (`admin-checker-workflow-url`). + +The service account has read-only access to `user.openshift.io/groups`. Credentials are synced from Vault via External Secrets (`appsre-stonesoup-vault` ClusterSecretStore). + +## Related documentation + +- [Extending the service — Authentication](../../docs/deployment/extending-the-service.md#authentication) +- [k8s-groups component](https://github.com/redhat-appstudio/internal-infra-deployments/tree/main/components/k8s-groups) + diff --git a/components/authentication/base/authentication/admin-checker/admin-checker-sa.yaml b/components/authentication/base/admin-checker/admin-checker-sa.yaml similarity index 100% rename from components/authentication/base/authentication/admin-checker/admin-checker-sa.yaml rename to components/authentication/base/admin-checker/admin-checker-sa.yaml diff --git a/components/authentication/base/authentication/admin-checker/cronjob.yaml b/components/authentication/base/admin-checker/cronjob.yaml similarity index 100% rename from components/authentication/base/authentication/admin-checker/cronjob.yaml rename to components/authentication/base/admin-checker/cronjob.yaml diff --git a/components/authentication/base/authentication/admin-checker/external-secrets/kustomization.yaml b/components/authentication/base/admin-checker/external-secrets/kustomization.yaml similarity index 100% rename from components/authentication/base/authentication/admin-checker/external-secrets/kustomization.yaml rename to components/authentication/base/admin-checker/external-secrets/kustomization.yaml diff --git a/components/authentication/base/authentication/admin-checker/external-secrets/rhtap-infra-secrets.yaml b/components/authentication/base/admin-checker/external-secrets/rhtap-infra-secrets.yaml similarity index 100% rename from components/authentication/base/authentication/admin-checker/external-secrets/rhtap-infra-secrets.yaml rename to components/authentication/base/admin-checker/external-secrets/rhtap-infra-secrets.yaml diff --git a/components/authentication/base/authentication/admin-checker/kustomization.yaml b/components/authentication/base/admin-checker/kustomization.yaml similarity index 100% rename from components/authentication/base/authentication/admin-checker/kustomization.yaml rename to components/authentication/base/admin-checker/kustomization.yaml diff --git a/components/authentication/base/authentication/admin-checker/namespace.yaml b/components/authentication/base/admin-checker/namespace.yaml similarity index 100% rename from components/authentication/base/authentication/admin-checker/namespace.yaml rename to components/authentication/base/admin-checker/namespace.yaml diff --git a/components/authentication/base/authentication/kustomization.yaml b/components/authentication/base/authentication/kustomization.yaml deleted file mode 100644 index da7b65aca5e..00000000000 --- a/components/authentication/base/authentication/kustomization.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- admin-checker -- component-maintainer.yaml -- everyone-can-view.yaml -- konflux-admins.yaml -- konflux-admins-pod-admin.yaml -- grafana-view-only.yaml -- test-platform-ci-admins-can-view.yaml -- konflux-sre.yaml - -patches: - - path: everyone-can-view-patch.yaml - target: - name: everyone-view - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-appstudio - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-cluster-version - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-cluster-monitoring - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 - - path: everyone-can-view-patch.yaml - target: - name: everyone-view-compute - kind: ClusterRoleBinding - group: rbac.authorization.k8s.io - version: v1 diff --git a/components/authentication/base/authentication/component-maintainer.yaml b/components/authentication/base/component-maintainer.yaml similarity index 100% rename from components/authentication/base/authentication/component-maintainer.yaml rename to components/authentication/base/component-maintainer.yaml diff --git a/components/authentication/base/authentication/everyone-can-view-patch.yaml b/components/authentication/base/everyone-can-view-patch.yaml similarity index 100% rename from components/authentication/base/authentication/everyone-can-view-patch.yaml rename to components/authentication/base/everyone-can-view-patch.yaml diff --git a/components/authentication/base/authentication/everyone-can-view.yaml b/components/authentication/base/everyone-can-view.yaml similarity index 100% rename from components/authentication/base/authentication/everyone-can-view.yaml rename to components/authentication/base/everyone-can-view.yaml diff --git a/components/authentication/base/authentication/grafana-view-only.yaml b/components/authentication/base/grafana-view-only.yaml similarity index 100% rename from components/authentication/base/authentication/grafana-view-only.yaml rename to components/authentication/base/grafana-view-only.yaml diff --git a/components/authentication/base/group-sync-olm/kustomization.yaml b/components/authentication/base/group-sync-olm/kustomization.yaml deleted file mode 100644 index 35921ec89ec..00000000000 --- a/components/authentication/base/group-sync-olm/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - namespaces.yaml - - subscription.yaml diff --git a/components/authentication/base/group-sync-olm/namespaces.yaml b/components/authentication/base/group-sync-olm/namespaces.yaml deleted file mode 100644 index e58b45330ac..00000000000 --- a/components/authentication/base/group-sync-olm/namespaces.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: group-sync-operator diff --git a/components/authentication/base/group-sync-olm/subscription.yaml b/components/authentication/base/group-sync-olm/subscription.yaml deleted file mode 100644 index 20a39f99fbd..00000000000 --- a/components/authentication/base/group-sync-olm/subscription.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: group-sync-operator -spec: - channel: alpha - installPlanApproval: Automatic - name: group-sync-operator - source: community-operators - sourceNamespace: openshift-marketplace ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: group-sync-operator -spec: - targetNamespaces: - - group-sync-operator diff --git a/components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml b/components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml deleted file mode 100644 index f5442dd1113..00000000000 --- a/components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: konflux-ldap-sa - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "-1" -spec: - dataFrom: - - extract: - conversionStrategy: Default - decodingStrategy: None - key: staging/infrastructure/group-sync/konflux-ldap-sa - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: appsre-stonesoup-vault - target: - creationPolicy: Owner - deletionPolicy: Delete - name: konflux-ldap-sa diff --git a/components/authentication/base/group-sync/external-secrets/kustomization.yaml b/components/authentication/base/group-sync/external-secrets/kustomization.yaml deleted file mode 100644 index 9e90c5affa8..00000000000 --- a/components/authentication/base/group-sync/external-secrets/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - konflux-ldap-sa.yaml - - mtls-ca-validators.yaml diff --git a/components/authentication/base/group-sync/external-secrets/mtls-ca-validators.yaml b/components/authentication/base/group-sync/external-secrets/mtls-ca-validators.yaml deleted file mode 100644 index cca6b0d5a07..00000000000 --- a/components/authentication/base/group-sync/external-secrets/mtls-ca-validators.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: mtls-ca-validators - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "-1" -spec: - dataFrom: - - extract: - conversionStrategy: Default - decodingStrategy: None - key: staging/infrastructure/group-sync/mtls-ca-validators - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: appsre-stonesoup-vault - target: - creationPolicy: Owner - deletionPolicy: Delete - name: mtls-ca-validators diff --git a/components/authentication/base/group-sync/group-sync.yaml b/components/authentication/base/group-sync/group-sync.yaml deleted file mode 100644 index c21cfbc02a4..00000000000 --- a/components/authentication/base/group-sync/group-sync.yaml +++ /dev/null @@ -1,12 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: group-sync-operator-maintainers - namespace: group-sync-operator -subjects: - - kind: Group - name: konflux-infra -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: component-maintainer diff --git a/components/authentication/base/group-sync/konflux-rover-groups.yaml b/components/authentication/base/group-sync/konflux-rover-groups.yaml deleted file mode 100644 index 77151f20d36..00000000000 --- a/components/authentication/base/group-sync/konflux-rover-groups.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: redhatcop.redhat.io/v1alpha1 -kind: GroupSync -metadata: - name: konflux-rover-groups - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - providers: - - ldap: - ca: - key: ca.crt - kind: Secret - name: mtls-ca-validators - namespace: group-sync-operator - credentialsSecret: - name: konflux-ldap-sa - namespace: group-sync-operator - insecure: false - prune: true - rfc2307: - usersQuery: - baseDN: 'dc=redhat,dc=com' - derefAliases: never - scope: sub - groupNameAttributes: - - cn - tolerateMemberNotFoundErrors: true - tolerateMemberOutOfScopeErrors: true - groupUIDAttribute: dn - groupMembershipAttributes: - - uniqueMember - userNameAttributes: - - uid - groupsQuery: - baseDN: 'ou=adhoc,ou=managedGroups,dc=redhat,dc=com' - derefAliases: never - filter: (&(objectClass=rhatRoverGroup)(|(cn=konflux-*)(cn=ai-konflux-user-support)(cn=plm-poe))) - scope: sub - userUIDAttribute: dn - url: 'ldaps://ldapfrac.corp.redhat.com' - name: ldap-corp - schedule: '*/15 * * * *' diff --git a/components/authentication/base/group-sync/kustomization.yaml b/components/authentication/base/group-sync/kustomization.yaml deleted file mode 100644 index 7a6e8bdc2b2..00000000000 --- a/components/authentication/base/group-sync/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: group-sync-operator -resources: -- group-sync.yaml -- external-secrets -- konflux-rover-groups.yaml -- test-platform-ci-admins-rover-group.yaml diff --git a/components/authentication/base/group-sync/test-platform-ci-admins-rover-group.yaml b/components/authentication/base/group-sync/test-platform-ci-admins-rover-group.yaml deleted file mode 100644 index cc4d8621b56..00000000000 --- a/components/authentication/base/group-sync/test-platform-ci-admins-rover-group.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: redhatcop.redhat.io/v1alpha1 -kind: GroupSync -metadata: - name: test-platform-ci-rover-groups - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - providers: - - ldap: - ca: - key: ca.crt - kind: Secret - name: mtls-ca-validators - namespace: group-sync-operator - credentialsSecret: - name: konflux-ldap-sa - namespace: group-sync-operator - insecure: false - prune: true - rfc2307: - usersQuery: - baseDN: 'dc=redhat,dc=com' - derefAliases: never - scope: sub - groupNameAttributes: - - cn - tolerateMemberNotFoundErrors: true - tolerateMemberOutOfScopeErrors: true - groupUIDAttribute: dn - groupMembershipAttributes: - - uniqueMember - userNameAttributes: - - uid - groupsQuery: - baseDN: 'ou=adhoc,ou=managedGroups,dc=redhat,dc=com' - derefAliases: never - filter: (&(objectClass=rhatRoverGroup)(cn=test-platform-ci-admins)) - scope: sub - userUIDAttribute: dn - url: 'ldaps://ldapfrac.corp.redhat.com' - name: ldap-corp - schedule: '*/15 * * * *' diff --git a/components/authentication/base/authentication/konflux-admins-pod-admin.yaml b/components/authentication/base/konflux-admins-pod-admin.yaml similarity index 100% rename from components/authentication/base/authentication/konflux-admins-pod-admin.yaml rename to components/authentication/base/konflux-admins-pod-admin.yaml diff --git a/components/authentication/base/authentication/konflux-admins.yaml b/components/authentication/base/konflux-admins.yaml similarity index 100% rename from components/authentication/base/authentication/konflux-admins.yaml rename to components/authentication/base/konflux-admins.yaml diff --git a/components/authentication/base/authentication/konflux-sre.yaml b/components/authentication/base/konflux-sre.yaml similarity index 100% rename from components/authentication/base/authentication/konflux-sre.yaml rename to components/authentication/base/konflux-sre.yaml diff --git a/components/authentication/base/kustomization.yaml b/components/authentication/base/kustomization.yaml index 20cb6f47927..da7b65aca5e 100644 --- a/components/authentication/base/kustomization.yaml +++ b/components/authentication/base/kustomization.yaml @@ -1,5 +1,43 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - group-sync - - authentication +- admin-checker +- component-maintainer.yaml +- everyone-can-view.yaml +- konflux-admins.yaml +- konflux-admins-pod-admin.yaml +- grafana-view-only.yaml +- test-platform-ci-admins-can-view.yaml +- konflux-sre.yaml + +patches: + - path: everyone-can-view-patch.yaml + target: + name: everyone-view + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-appstudio + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-cluster-version + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-cluster-monitoring + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 + - path: everyone-can-view-patch.yaml + target: + name: everyone-view-compute + kind: ClusterRoleBinding + group: rbac.authorization.k8s.io + version: v1 diff --git a/components/authentication/base/authentication/test-platform-ci-admins-can-view.yaml b/components/authentication/base/test-platform-ci-admins-can-view.yaml similarity index 100% rename from components/authentication/base/authentication/test-platform-ci-admins-can-view.yaml rename to components/authentication/base/test-platform-ci-admins-can-view.yaml diff --git a/components/authentication/helm-charts/crd.yaml b/components/authentication/helm-charts/crd.yaml deleted file mode 100644 index 6ad9936c16c..00000000000 --- a/components/authentication/helm-charts/crd.yaml +++ /dev/null @@ -1,919 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null - name: groupsyncs.redhatcop.redhat.io -spec: - group: redhatcop.redhat.io - names: - kind: GroupSync - listKind: GroupSyncList - plural: groupsyncs - singular: groupsync - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: GroupSync is the Schema for the groupsyncs API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: GroupSyncSpec defines the desired state of GroupSync - properties: - excludeInvalidGroupNames: - description: ExcludeInvalidGroupNames excludes Groups with names that are not RFC 1035 compliant. - type: boolean - providers: - description: List of Providers that can be mounted by containers belonging to the pod. - items: - description: Provider represents the container for a single provider - properties: - azure: - description: Azure represents the Azure provider - properties: - authorityHost: - description: AuthorityHost is the location of the Azure Active Directory endpoint - type: string - baseGroups: - description: BaseGroups allows for a set of groups to be specified to start searching from instead of searching all groups in the directory - items: - type: string - type: array - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to Azure - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to Azure Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for communicating to Azure - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - filter: - description: Filter allows for limiting the results from the groups response using the Filter feature of the Azure Graph API - type: string - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to Azure - type: boolean - prune: - description: Prune Whether to prune groups that are no longer in Azure. Default is false - type: boolean - userNameAttributes: - description: UserNameAttributes are the fields to consider on the User object containing the username - items: - type: string - type: array - required: - - credentialsSecret - type: object - github: - description: GitHub represents the GitHub provider - properties: - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to the GitHub server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to the GitHub server Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the GitHub server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to GitHab - type: boolean - mapByScimId: - description: Map users by SCIM Id. This will usually match your IDP id, like UPN when using AAD. - type: boolean - organization: - description: Organization represents the location to source teams to synchronize - type: string - prune: - description: Prune Whether to prune groups that are no longer in GitHub. Default is false - type: boolean - teams: - description: Teams represents a filtered list of teams to synchronize - items: - type: string - type: array - url: - default: https://api.github.com/ - description: URL is the location of the GitHub server - type: string - v4url: - default: https://api.github.com/graphql - description: V4URL is the location of the GitHub server graphql endpoint. - type: string - required: - - credentialsSecret - type: object - gitlab: - description: GitLab represents the GitLab provider - properties: - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to the GitLab server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to the GitLab server Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the GitLab server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to GitLab - type: boolean - prune: - description: Prune Whether to prune groups that are no longer in GitLab. Default is false - type: boolean - scope: - description: Scope represents the depth for which groups will be synchronized - enum: - - one - - sub - type: string - url: - default: https://gitlab.com - description: URL is the location of the GitLab server - type: string - required: - - credentialsSecret - type: object - keycloak: - description: Keycloak represents the Keycloak provider - properties: - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to the Keycloak server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to the Keycloak server Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the Keycloak server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to Keycloak - type: boolean - loginRealm: - description: LoginRealm is the Keycloak realm to authenticate against - type: string - prune: - description: Prune Whether to prune groups that are no longer in Keycloak. Default is false - type: boolean - realm: - description: Realm is the realm containing the groups to synchronize against - type: string - scope: - description: Scope represents the depth for which groups will be synchronized - enum: - - one - - sub - type: string - url: - description: URL is the location of the Keycloak server - type: string - required: - - credentialsSecret - - realm - - url - type: object - ibmsecurityverify: - description: The IBM Security Verify (ISV) provider - properties: - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the ISV server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groups: - description: The ISV groups to synchronize - type: array - items: - type: object - properties: - name: - description: Name of the ISV group - type: string - id: - description: ID of the ISV group - type: string - required: - - id - tenantUrl: - description: URL for the ISV server of the tenant - type: string - required: - - credentialsSecret - - tenantUrl - - groups - type: object - ldap: - description: Ldap represents the LDAP provider - properties: - activeDirectory: - description: ActiveDirectoryConfig represents the configuration for Active Directory - properties: - groupMembershipAttributes: - description: GroupMembershipAttributes defines which attributes on an LDAP user entry will be interpreted as the groups it is a member of - items: - type: string - type: array - userNameAttributes: - description: UserNameAttributes defines which attributes on an LDAP user entry will be interpreted as its OpenShift user name. - items: - type: string - type: array - usersQuery: - description: AllUsersQuery holds the template for an LDAP query that returns user entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - required: - - groupMembershipAttributes - - userNameAttributes - - usersQuery - type: object - augmentedActiveDirectory: - description: ActiveDirectoryConfig represents the configuration for Augmented Active Directory - properties: - groupMembershipAttributes: - description: GroupMembershipAttributes defines which attributes on an LDAP user entry will be interpreted as the groups it is a member of - items: - type: string - type: array - groupNameAttributes: - description: GroupNameAttributes defines which attributes on an LDAP group entry will be interpreted as its name to use for an OpenShift group - items: - type: string - type: array - groupUIDAttribute: - description: GroupUIDAttributes defines which attribute on an LDAP group entry will be interpreted as its unique identifier. (ldapGroupUID) - type: string - groupsQuery: - description: AllGroupsQuery holds the template for an LDAP query that returns group entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - userNameAttributes: - description: UserNameAttributes defines which attributes on an LDAP user entry will be interpreted as its OpenShift user name. - items: - type: string - type: array - usersQuery: - description: AllUsersQuery holds the template for an LDAP query that returns user entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - required: - - groupMembershipAttributes - - groupNameAttributes - - groupUIDAttribute - - groupsQuery - - userNameAttributes - - usersQuery - type: object - blacklist: - description: Blacklist represents a list of groups to not synchronize - items: - type: string - type: array - ca: - description: Ca is a reference to a Secret or ConfigMap containing a CA certificate to communicate to LDAP - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - caSecret: - description: 'CaSecret is a reference to a secret containing a CA certificate to communicate to LDAP Deprecated: Use Ca instead.' - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for communicating to LDAP - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - groupUIDNameMapping: - additionalProperties: - type: string - description: / LDAPGroupUIDToOpenShiftGroupNameMapping is an optional direct mapping of LDAP group UIDs to OpenShift group names - type: object - insecure: - description: Insecure specifies whether to allow for unverified certificates to be used when communicating to LDAP - type: boolean - prune: - description: Prune Whether to prune groups that are no longer in LDAP. Default is false - type: boolean - rfc2307: - description: RFC2307Config represents the configuration for a RFC2307 schema - properties: - groupMembershipAttributes: - description: GroupMembershipAttributes defines which attributes on an LDAP group entry will be interpreted as its members. The values contained in those attributes must be queryable by your UserUIDAttribute - items: - type: string - type: array - groupNameAttributes: - description: GroupNameAttributes defines which attributes on an LDAP group entry will be interpreted as its name to use for an OpenShift group - items: - type: string - type: array - groupUIDAttribute: - description: GroupUIDAttributes defines which attribute on an LDAP group entry will be interpreted as its unique identifier. (ldapGroupUID) - type: string - groupsQuery: - description: AllGroupsQuery holds the template for an LDAP query that returns group entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - tolerateMemberNotFoundErrors: - description: TolerateMemberNotFoundErrors determines the behavior of the LDAP sync job when missing user entries are encountered. If 'true', an LDAP query for users that doesn't find any will be tolerated and an only and error will be logged. If 'false', the LDAP sync job will fail if a query for users doesn't find any. The default value is 'false'. Misconfigured LDAP sync jobs with this flag set to 'true' can cause group membership to be removed, so it is recommended to use this flag with caution. - type: boolean - tolerateMemberOutOfScopeErrors: - description: TolerateMemberOutOfScopeErrors determines the behavior of the LDAP sync job when out-of-scope user entries are encountered. If 'true', an LDAP query for a user that falls outside of the base DN given for the all user query will be tolerated and only an error will be logged. If 'false', the LDAP sync job will fail if a user query would search outside of the base DN specified by the all user query. Misconfigured LDAP sync jobs with this flag set to 'true' can result in groups missing users, so it is recommended to use this flag with caution. - type: boolean - userNameAttributes: - description: UserNameAttributes defines which attributes on an LDAP user entry will be used, in order, as its OpenShift user name. The first attribute with a non-empty value is used. This should match your PreferredUsername setting for your LDAPPasswordIdentityProvider - items: - type: string - type: array - userUIDAttribute: - description: UserUIDAttribute defines which attribute on an LDAP user entry will be interpreted as its unique identifier. It must correspond to values that will be found from the GroupMembershipAttributes - type: string - usersQuery: - description: AllUsersQuery holds the template for an LDAP query that returns user entries. - properties: - baseDN: - description: The DN of the branch of the directory where all searches should start from - type: string - derefAliases: - description: 'The (optional) behavior of the search with regards to alisases. Can be: never: never dereference aliases, search: only dereference in searching, base: only dereference in finding the base object, always: always dereference Defaults to always dereferencing if not set' - type: string - filter: - description: Filter is a valid LDAP search filter that retrieves all relevant entries from the LDAP server with the base DN - type: string - pageSize: - description: PageSize is the maximum preferred page size, measured in LDAP entries. A page size of 0 means no paging will be done. - type: integer - scope: - description: 'The (optional) scope of the search. Can be: base: only the base object, one: all object on the base level, sub: the entire subtree Defaults to the entire subtree if not set' - type: string - timeout: - description: TimeLimit holds the limit of time in seconds that any request to the server can remain outstanding before the wait for a response is given up. If this is 0, no client-side limit is imposed - type: integer - required: - - baseDN - type: object - required: - - groupMembershipAttributes - - groupNameAttributes - - groupUIDAttribute - - groupsQuery - - userNameAttributes - - userUIDAttribute - - usersQuery - type: object - url: - description: URL is the location of the LDAP Server - type: string - whitelist: - description: Whitelist represents a list of groups to synchronize - items: - type: string - type: array - required: - - url - type: object - name: - description: Name represents the name of the provider - type: string - okta: - description: Okta represents the Okta provider - properties: - appId: - description: AppId is the id of the application we are syncing groups for - type: string - credentialsSecret: - description: CredentialsSecret is a reference to a secret containing authentication details for the Okta server - properties: - key: - description: Key represents the specific key to reference from the resource - type: string - kind: - default: Secret - description: Kind is a string value representing the resource type - enum: - - ConfigMap - - Secret - type: string - name: - description: Name represents the name of the resource - type: string - namespace: - description: Namespace represents the namespace containing the resource - type: string - required: - - name - - namespace - type: object - extractLoginUsername: - description: ExtractLoginUsername is true if Okta username's are defaulted to emails and you would like the username only - type: boolean - groupLimit: - description: GroupLimit is the maximum number of groups that are requested from OKTA per request. Multiple requests will be made using pagination if you have more groups than this limit. Default is "1000" - type: integer - groups: - description: Groups represents a filtered list of groups to synchronize - items: - type: string - type: array - profileKey: - description: ProfileKey the attribute from Okta you would like to use as the user identifier. Default is "login" - type: string - prune: - description: Prune Whether to prune groups that are no longer in OKTA. Default is false - type: boolean - url: - description: URL is the location of the Okta domain server - type: string - required: - - appId - - credentialsSecret - - url - type: object - required: - - name - type: object - type: array - schedule: - description: Schedule represents a cron based configuration for synchronization - type: string - type: object - status: - description: GroupSyncStatus defines the observed state of GroupSync - properties: - conditions: - items: - description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" - properties: - lastTransitionTime: - description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: message is a human readable message indicating details about the transition. This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - lastSyncSuccessTime: - description: LastSyncSuccessTime represents the time last synchronization completed successfully - format: date-time - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/.helmignore b/components/authentication/helm-charts/group-sync-operator-chart/.helmignore deleted file mode 100644 index 0e8a0eb36f4..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/components/authentication/helm-charts/group-sync-operator-chart/Chart.yaml b/components/authentication/helm-charts/group-sync-operator-chart/Chart.yaml deleted file mode 100644 index 93a99722fb4..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/Chart.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -name: group-sync-operator -version: 0.1.0 -appVersion: latest -description: Helm chart that deploys the group-sync-operator -keywords: - - authorization - - security -sources: - - https://github.com/glevi-rh/group-sync-operator diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/_helpers.tpl b/components/authentication/helm-charts/group-sync-operator-chart/templates/_helpers.tpl deleted file mode 100644 index d417128bb3e..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/_helpers.tpl +++ /dev/null @@ -1,85 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "group-sync-operator.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "group-sync-operator.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "group-sync-operator.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "group-sync-operator.labels" -}} -helm.sh/chart: {{ include "group-sync-operator.chart" . }} -{{ include "group-sync-operator.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.commonLabels }} -{{ toYaml .Values.commonLabels }} -{{- end }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "group-sync-operator.selectorLabels" -}} -app.kubernetes.io/name: {{ include "group-sync-operator.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - - -{{/* -Service Acount Name -*/}} -{{- define "group-sync-operator.serviceAccountName" -}} -{{- printf "%s-%s" (include "group-sync-operator.name" .) "controller-manager" }} -{{- end }} - -{{/* -Create the image path for the passed in image field -*/}} -{{- define "group-sync-operator.image" -}} -{{- if eq (substr 0 7 .version) "sha256:" -}} -{{- printf "%s@%s" .repository .version -}} -{{- else -}} -{{- printf "%s:%s" .repository .version -}} -{{- end -}} -{{- end -}} - -{{/* -Check if WATCH_NAMESPACE environment variable has been provided -*/}} -{{- define "group-sync-operator.checkWatchNamespace" -}} -{{- range .Values.env -}} -{{- if eq .name "WATCH_NAMESPACE" -}} -{{- print "true" -}} -{{- end -}} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_client_clusterrole.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_client_clusterrole.yaml deleted file mode 100644 index bd4af137a9f..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_client_clusterrole.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: metrics-reader -rules: -- nonResourceURLs: ["/metrics"] - verbs: ["get"] diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role.yaml deleted file mode 100644 index 618f5e4177c..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: proxy-role -rules: -- apiGroups: ["authentication.k8s.io"] - resources: - - tokenreviews - verbs: ["create"] -- apiGroups: ["authorization.k8s.io"] - resources: - - subjectaccessreviews - verbs: ["create"] diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role_binding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role_binding.yaml deleted file mode 100644 index 558667b285b..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_role_binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: proxy-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: proxy-role -subjects: -- kind: ServiceAccount - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_service.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_service.yaml deleted file mode 100644 index 4030ced8776..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/auth_proxy_service.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - control-plane: group-sync-operator - {{- include "group-sync-operator.labels" . | nindent 4 }} - annotations: - service.alpha.openshift.io/serving-cert-secret-name: group-sync-operator-certs - name: controller-manager-metrics-service - namespace: {{ .Release.Namespace }} -spec: - ports: - - name: https - port: 8443 - targetPort: https - selector: - control-plane: group-sync-operator diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_editor_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_editor_role.yaml deleted file mode 100644 index 25b08cd4fb9..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_editor_role.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# permissions for end users to edit groupsyncs. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: groupsync-editor-role -rules: -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs/status - verbs: - - get diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_viewer_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_viewer_role.yaml deleted file mode 100644 index 0e286e366da..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/groupsync_viewer_role.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# permissions for end users to view groupsyncs. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: groupsync-viewer-role -rules: -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs - verbs: - - get - - list - - watch -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs/status - verbs: - - get diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role.yaml deleted file mode 100644 index 645c961512c..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role.yaml +++ /dev/null @@ -1,38 +0,0 @@ -# permissions to do leader election. -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: leader-election-role - namespace: {{ .Release.Namespace }} -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role_binding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role_binding.yaml deleted file mode 100644 index 5b4f868d813..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/leader_election_role_binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: leader-election-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: leader-election-role -subjects: -- kind: ServiceAccount - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/manager.yaml deleted file mode 100644 index c8b37d06009..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager.yaml +++ /dev/null @@ -1,114 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "group-sync-operator.fullname" . }} - labels: - {{- include "group-sync-operator.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "group-sync-operator.selectorLabels" . | nindent 6 }} - replicas: {{ .Values.replicaCount }} - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "group-sync-operator.selectorLabels" . | nindent 8 }} - control-plane: group-sync-operator - {{- with .Values.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - serviceAccountName: {{ include "group-sync-operator.serviceAccountName" . }} - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --tls-cert-file=/etc/certs/tls/tls.crt - - --tls-private-key-file=/etc/certs/tls/tls.key - image: "{{ template "group-sync-operator.image" .Values.kube_rbac_proxy.image }}" - name: kube-rbac-proxy - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - ports: - - containerPort: 8443 - name: https - volumeMounts: - - mountPath: /etc/certs/tls - name: tls-cert - imagePullPolicy: {{ .Values.kube_rbac_proxy.image.pullPolicy }} - {{- with .Values.env }} - env: - {{- toYaml . | nindent 10 }} - {{- end }} - resources: - {{- toYaml .Values.kube_rbac_proxy.resources | nindent 12 }} - - command: - - /manager - args: - - --health-probe-bind-address=:8081 - - --metrics-addr=127.0.0.1:8080 - - --leader-elect - image: "{{ template "group-sync-operator.image" .Values.image }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - name: {{ .Chart.Name }} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - env: - {{- if eq (include "group-sync-operator.checkWatchNamespace" .) "" }} - - name: WATCH_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- end }} - {{- with .Values.env }} - {{- toYaml . | nindent 12 }} - {{- end }} - volumeMounts: - - mountPath: /tmp - name: tmp-dir - resources: - {{- toYaml .Values.resources | nindent 12 }} - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - volumes: - - name: tls-cert - secret: - defaultMode: 420 - secretName: group-sync-operator-certs - - name: tmp-dir - emptyDir: {} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager_role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/manager_role.yaml deleted file mode 100644 index 458a7a50664..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/manager_role.yaml +++ /dev/null @@ -1,51 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: manager-role -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - get -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - redhatcop.redhat.io - resources: - - groupsyncs/status - verbs: - - get - - patch - - update -- apiGroups: - - user.openshift.io - resources: - - groups - verbs: - - create - - delete - - get - - list - - patch - - update - - watch diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/monitor.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/monitor.yaml deleted file mode 100644 index 5a9926d85a5..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/monitor.yaml +++ /dev/null @@ -1,25 +0,0 @@ -# Prometheus Monitor Service (Metrics) -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - labels: - control-plane: group-sync-operator - {{- include "group-sync-operator.labels" . | nindent 4 }} - name: controller-manager-metrics-monitor - namespace: {{ .Release.Namespace }} -spec: - endpoints: - - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token - interval: 30s - port: https - scheme: https - tlsConfig: - ca: - secret: - key: 'tls.crt' - name: group-sync-operator-certs - optional: false - serverName: controller-manager-metrics-service.{{ .Release.Namespace }}.svc - selector: - matchLabels: - control-plane: group-sync-operator diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/namespace.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/namespace.yaml deleted file mode 100644 index c2c907bd2f3..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: {{ .Release.Namespace }} - labels: - openshift.io/cluster-monitoring: "true" diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-role.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-role.yaml deleted file mode 100644 index 0c8f508749c..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-role.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: prometheus-k8s - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: - - "" - resources: - - endpoints - - pods - - services - verbs: - - get - - list - - watch diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-rolebinding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-rolebinding.yaml deleted file mode 100644 index ec02c18bf86..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/prometheus-rolebinding.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: prometheus-k8s - namespace: {{ .Release.Namespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prometheus-k8s -subjects: - - kind: ServiceAccount - name: prometheus-k8s - namespace: openshift-monitoring diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/role_binding.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/role_binding.yaml deleted file mode 100644 index 70e05a47ec9..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/role_binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: manager-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: manager-role -subjects: -- kind: ServiceAccount - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/templates/service-account.yaml b/components/authentication/helm-charts/group-sync-operator-chart/templates/service-account.yaml deleted file mode 100644 index 9a29026a5d1..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/templates/service-account.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "group-sync-operator.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "group-sync-operator.labels" . | nindent 4 }} diff --git a/components/authentication/helm-charts/group-sync-operator-chart/values.yaml b/components/authentication/helm-charts/group-sync-operator-chart/values.yaml deleted file mode 100644 index fed73866424..00000000000 --- a/components/authentication/helm-charts/group-sync-operator-chart/values.yaml +++ /dev/null @@ -1,53 +0,0 @@ -# Default values for group-sync-operator -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - repository: quay.io/konflux-ci/group-sync-operator - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: sha256:4f384c760c7821be60c8f2d9b46152c986af8723f71ad6bfc5cc8372a7c658b8 - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" -podAnnotations: {} - -podLabels: {} - -commonLabels: {} - -resources: - requests: - cpu: 300m - memory: 200Mi - limits: - cpu: 500m - memory: 512Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -env: - # - name: VAR_NAME - # value: var-value - -kube_rbac_proxy: - image: - repository: registry.redhat.io/openshift4/ose-kube-rbac-proxy - pullPolicy: IfNotPresent - version: sha256:c8336efb1269a7f40113aa9767c6dc9affe4fd830a1ca6004206bcef1d0274a3 - resources: - requests: - cpu: 100m - memory: 20Mi - limits: - cpu: 200m - memory: 128Mi - -enableMonitoring: true diff --git a/components/authentication/helm-charts/kustomization.yaml b/components/authentication/helm-charts/kustomization.yaml deleted file mode 100644 index f97463a6ac9..00000000000 --- a/components/authentication/helm-charts/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: group-sync-operator - -resources: - - crd.yaml - -helmGlobals: - chartHome: . - -helmCharts: - - name: group-sync-operator-chart - releaseName: group-sync-operator - namespace: group-sync-operator - valuesFile: group-sync-operator-chart/values.yaml diff --git a/components/authentication/helm-charts/metrics/kustomization.yaml b/components/authentication/helm-charts/metrics/kustomization.yaml deleted file mode 100644 index 8f54b3273e3..00000000000 --- a/components/authentication/helm-charts/metrics/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- monitor.yaml diff --git a/components/authentication/helm-charts/metrics/monitor.yaml b/components/authentication/helm-charts/metrics/monitor.yaml deleted file mode 100644 index 100d71815be..00000000000 --- a/components/authentication/helm-charts/metrics/monitor.yaml +++ /dev/null @@ -1,24 +0,0 @@ ---- -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: group-sync-operator-metrics - namespace: group-sync-operator - labels: - control-plane: group-sync-operator -spec: - endpoints: - - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token - interval: 30s - port: https - scheme: https - tlsConfig: - ca: - secret: - key: tls.crt - name: group-sync-operator-certs - optional: false - serverName: controller-manager-metrics-service.group-sync-operator.svc - selector: - matchLabels: - control-plane: group-sync-operator diff --git a/components/authentication/k-components/ldap-url-patch/kustomization.yaml b/components/authentication/k-components/ldap-url-patch/kustomization.yaml deleted file mode 100644 index 6fa3abd5977..00000000000 --- a/components/authentication/k-components/ldap-url-patch/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component -patches: - - path: ldap-url-patch.yaml - target: - name: konflux-rover-groups - kind: GroupSync - group: redhatcop.redhat.io - version: v1alpha1 - - path: ldap-url-patch.yaml - target: - name: test-platform-ci-rover-groups - kind: GroupSync - group: redhatcop.redhat.io - version: v1alpha1 diff --git a/components/authentication/k-components/ldap-url-patch/ldap-url-patch.yaml b/components/authentication/k-components/ldap-url-patch/ldap-url-patch.yaml deleted file mode 100644 index 20c5dbe69d9..00000000000 --- a/components/authentication/k-components/ldap-url-patch/ldap-url-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/providers/0/ldap/url - value: ldaps://ldap.corp.redhat.com diff --git a/components/authentication/production/base/konflux-ldap-sa-patch.yaml b/components/authentication/production/base/konflux-ldap-sa-patch.yaml deleted file mode 100644 index 0d152974656..00000000000 --- a/components/authentication/production/base/konflux-ldap-sa-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/dataFrom/0/extract/key - value: production/infrastructure/group-sync/konflux-ldap-sa diff --git a/components/authentication/production/base/kustomization.yaml b/components/authentication/production/base/kustomization.yaml index 2f47aec25dc..0691bcd59e4 100644 --- a/components/authentication/production/base/kustomization.yaml +++ b/components/authentication/production/base/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../../base/authentication + - ../../base patches: - path: rhtap-infra-secrets-patch.yaml target: diff --git a/components/authentication/production/base/mtls-ca-validators-patch.yaml b/components/authentication/production/base/mtls-ca-validators-patch.yaml deleted file mode 100644 index 1b92a1fb5c8..00000000000 --- a/components/authentication/production/base/mtls-ca-validators-patch.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: add - path: /spec/dataFrom/0/extract/key - value: production/infrastructure/group-sync/mtls-ca-validators diff --git a/components/authentication/staging/base/kustomization.yaml b/components/authentication/staging/base/kustomization.yaml index 8cece4d8a41..2333422e2d3 100644 --- a/components/authentication/staging/base/kustomization.yaml +++ b/components/authentication/staging/base/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../../base/authentication + - ../../base diff --git a/components/backup/base/member/schedules/backup-tenants-schedule.yaml b/components/backup/base/member/schedules/backup-tenants-schedule.yaml index d0ca81c6576..df5f296053a 100644 --- a/components/backup/base/member/schedules/backup-tenants-schedule.yaml +++ b/components/backup/base/member/schedules/backup-tenants-schedule.yaml @@ -23,7 +23,6 @@ spec: - dora-metrics - enterprise-contract-service - external-secrets-operator - - group-sync-operator - hac-pact-broker - image-controller - integration-service diff --git a/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml b/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml index 0f228d1bca9..9be2cd1f1b0 100644 --- a/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml +++ b/components/backup/development/in-cluster-local/backup-tenants-schedule.yaml @@ -24,7 +24,6 @@ spec: - dora-metrics - enterprise-contract-service - external-secrets-operator - - group-sync-operator - hac-pact-broker - image-controller - integration-service diff --git a/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml b/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml index dae50c1c938..a35247b9d0d 100644 --- a/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml +++ b/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml @@ -32,7 +32,6 @@ spec: - dynatrace - application-service - appstudio-workload-monitoring - - group-sync-operator - build-templates - build-templates-e2e - build-service diff --git a/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml b/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml index fdb79082f81..c0013eef8b6 100644 --- a/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml +++ b/hack/new-cluster/templates/backup/backup-tenants-schedule.yaml @@ -23,7 +23,6 @@ spec: - dora-metrics - enterprise-contract-service - external-secrets-operator - - group-sync-operator - hac-pact-broker - image-controller - integration-service diff --git a/hack/new-cluster/templates/private/authentication/kustomization.yaml b/hack/new-cluster/templates/private/authentication/kustomization.yaml index 48c2e849040..27bb5cb0b48 100644 --- a/hack/new-cluster/templates/private/authentication/kustomization.yaml +++ b/hack/new-cluster/templates/private/authentication/kustomization.yaml @@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base -components: - - ../../k-components/ldap-url-patch From e9bd6202cadaa1534f9773a2c95175e9a37628e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marta=20A=C3=B1=C3=B3n=20Ruiz?= Date: Wed, 27 May 2026 10:57:19 +0200 Subject: [PATCH 62/83] chore: bump kubearchive staging to v1.22.1 (#12008) Signed-off-by: Marta Anon Co-authored-by: Claude Opus 4.6 --- .../kubearchive/development/kubearchive.yaml | 82 +++++++++---------- .../development/kustomization.yaml | 6 +- 2 files changed, 44 insertions(+), 44 deletions(-) diff --git a/components/kubearchive/development/kubearchive.yaml b/components/kubearchive/development/kubearchive.yaml index 4e85291246f..59e250253ba 100644 --- a/components/kubearchive/development/kubearchive.yaml +++ b/components/kubearchive/development/kubearchive.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/component: namespace app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive --- apiVersion: apiextensions.k8s.io/v1 @@ -552,7 +552,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive --- @@ -563,7 +563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-cluster-vacuum namespace: kubearchive --- @@ -574,7 +574,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -585,7 +585,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive --- @@ -596,7 +596,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive rules: @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive rules: @@ -659,7 +659,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server rules: - apiGroups: @@ -677,7 +677,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-edit app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-edit: "true" name: kubearchive-edit rules: @@ -791,7 +791,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-editor app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-editor rules: - apiGroups: @@ -820,7 +820,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-viewer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-viewer rules: - apiGroups: @@ -844,7 +844,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-view app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-view: "true" name: kubearchive-view rules: @@ -868,7 +868,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive roleRef: @@ -887,7 +887,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive roleRef: @@ -906,7 +906,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server roleRef: apiGroup: rbac.authorization.k8s.io @@ -924,7 +924,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -943,7 +943,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-reader app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-reader namespace: kubearchive --- @@ -955,7 +955,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-writer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-writer namespace: kubearchive --- @@ -972,7 +972,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -990,7 +990,7 @@ metadata: app.kubernetes.io/component: database app.kubernetes.io/name: kubearchive-database-credentials app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-database-credentials namespace: kubearchive type: Opaque @@ -1002,7 +1002,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging namespace: kubearchive stringData: @@ -1016,7 +1016,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1035,7 +1035,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-webhooks app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-webhooks namespace: kubearchive spec: @@ -1058,7 +1058,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1076,7 +1076,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1130,7 +1130,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/api:v1.21.4@sha256:b176b1651fe024ecd94207f690e727eb246f57436957115274647c2947494dc8 + image: quay.io/kubearchive/api:v1.22.1@sha256:f8d51f53cca320c04ee90c607dc7ddf4e0dc1060b5fd05349c8cdb9d61bab83e livenessProbe: httpGet: path: /livez @@ -1182,7 +1182,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive spec: @@ -1232,7 +1232,7 @@ spec: valueFrom: resourceFieldRef: resource: limits.cpu - image: quay.io/kubearchive/operator:v1.21.4@sha256:2beeaeb53a17056249b666e8f9bd67a9a237d3394a66a651cb5caca3f8ac4901 + image: quay.io/kubearchive/operator:v1.22.1@sha256:8e50b5bb60058722910a7b073b80c92635683eb50a86191dc5994c4ecea0cbbf livenessProbe: httpGet: path: /healthz @@ -1294,7 +1294,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1346,7 +1346,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/sink:v1.21.4@sha256:3b6603fa0cdd9daf99142573a0cdddce3467cdd8d180fd795e465209584c14b0 + image: quay.io/kubearchive/sink:v1.22.1@sha256:33d01159261fafb309119df22d3b0ba1ca5b39a1476a75e6c1cdff13f890b78d livenessProbe: httpGet: path: /livez @@ -1387,7 +1387,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: cluster-vacuum namespace: kubearchive spec: @@ -1408,7 +1408,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: quay.io/kubearchive/vacuum:v1.21.4@sha256:3ededff190a125e51f2f675ae55d0559295580bda715bb2e3406d1cec7aac339 + image: quay.io/kubearchive/vacuum:v1.22.1@sha256:5dfbbb5c4f66b0573f0a42f40bc1e508dce835881b176fd397455299bfa32bfb name: vacuum restartPolicy: Never serviceAccount: kubearchive-cluster-vacuum @@ -1422,7 +1422,7 @@ metadata: app.kubernetes.io/component: kubearchive app.kubernetes.io/name: kubearchive-schema-migration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-schema-migration namespace: kubearchive spec: @@ -1438,7 +1438,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/postgresql:v1.21.4@sha256:58bcad4798c71746b0c9d11eb482a1075a9b073cbc146187fe2670df16b6d785 + image: quay.io/kubearchive/postgresql:v1.22.1@sha256:806e2c585a998ed51d14a87fac8667bdc27077a5f47d25df1a951a66f1ebacb5 name: migration resources: limits: @@ -1459,7 +1459,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server-certificate namespace: kubearchive spec: @@ -1493,7 +1493,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1515,7 +1515,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-certificate namespace: kubearchive spec: @@ -1534,7 +1534,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive namespace: kubearchive spec: @@ -1548,7 +1548,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1563,7 +1563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-mutating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -1676,7 +1676,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-validating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.21.4 + app.kubernetes.io/version: v1.22.1 name: kubearchive-validating-webhook-configuration webhooks: - admissionReviewVersions: diff --git a/components/kubearchive/development/kustomization.yaml b/components/kubearchive/development/kustomization.yaml index 7fd698b7d2c..e36fd6af520 100644 --- a/components/kubearchive/development/kustomization.yaml +++ b/components/kubearchive/development/kustomization.yaml @@ -99,7 +99,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.21.4 + image: quay.io/kubearchive/vacuum:v1.22.1 - patch: |- apiVersion: batch/v1 kind: CronJob @@ -112,7 +112,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.21.4 + image: quay.io/kubearchive/vacuum:v1.22.1 - patch: |- apiVersion: batch/v1 kind: CronJob @@ -125,7 +125,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.21.4 + image: quay.io/kubearchive/vacuum:v1.22.1 # Ensure database is ready before schema-migration job runs - patch: |- apiVersion: apps/v1 From 2457241edafdf75cdf65f606cd2f866f970d2f66 Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Wed, 27 May 2026 14:39:49 +0300 Subject: [PATCH 63/83] KONFLUX-13356: upgrade kueue operator and tekton-kueue for prod ring 3 and consolidate base (#12013) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * KONFLUX-13356: remove temporary base-ring1-tekton-kueue directory Assisted-by: Claude Code Signed-off-by: Gal Levi * KONFLUX-13356: revert rings 1/2 to shared base and fix ring 3 ClusterQueue drift - Revert rings 1/2 kustomizations to ../base, remove per-cluster Subscription patches and base-ring1-tekton-kueue references - Fix ring 3 ClusterQueue drift: whenCanBorrow Borrow → MayStopSearch, remove stopPolicy Assisted-by: Claude Code Signed-off-by: Gal Levi * KONFLUX-13356: update shared kueue base to stable-v1.3 and tekton-kueue cec0b3c8 - Subscription channel stable-v1.2 → stable-v1.3 - tekton-kueue ref and image 964790ee → cec0b3c8 Assisted-by: Claude Code Signed-off-by: Gal Levi --------- Signed-off-by: Gal Levi --- .../base-ring1-tekton-kueue/config.yaml | 137 ------------------ .../controller-patch.yaml | 49 ------- .../kustomization.yaml | 45 ------ .../webhook-patch.yaml | 41 ------ .../kueue/production/base/kueue/operator.yaml | 2 +- .../base/tekton-kueue/kustomization.yaml | 4 +- .../queue-config/cluster-queue.yaml | 3 +- .../kflux-ocp-p01/kustomization.yaml | 14 +- .../kflux-osp-p01/kustomization.yaml | 14 +- .../kflux-prd-rh02/kustomization.yaml | 14 +- .../kflux-prd-rh03/kustomization.yaml | 14 +- .../queue-config/cluster-queue.yaml | 3 +- .../queue-config/cluster-queue.yaml | 3 +- .../stone-prod-p01/kustomization.yaml | 14 +- .../stone-prod-p02/kustomization.yaml | 14 +- 15 files changed, 12 insertions(+), 359 deletions(-) delete mode 100644 components/kueue/production/base-ring1-tekton-kueue/config.yaml delete mode 100644 components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml delete mode 100644 components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml delete mode 100644 components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml diff --git a/components/kueue/production/base-ring1-tekton-kueue/config.yaml b/components/kueue/production/base-ring1-tekton-kueue/config.yaml deleted file mode 100644 index 70b10d01db0..00000000000 --- a/components/kueue/production/base-ring1-tekton-kueue/config.yaml +++ /dev/null @@ -1,137 +0,0 @@ -queueName: pipelines-queue -cel: - expressions: - # Set resource requests for multi platform pipelines - - | - has(pipelineRun.spec.params) && - pipelineRun.spec.params.exists(p, p.name == 'build-platforms') ? - pipelineRun.spec.params.filter( - p, - p.name == 'build-platforms')[0] - .value.map( - p, - resource(replace(replace(p, "/", "-"), "_", "-"), 1) - ) : [] - - # Request AWS IP for AWS-based platforms - - | - has(pipelineRun.spec.params) && - pipelineRun.spec.params.exists(p, p.name == 'build-platforms') ? - pipelineRun.spec.params.filter( - p, - p.name == 'build-platforms')[0] - .value.filter( - p, - !( - p in [ - 'linux/ppc64le', - 'linux/s390x', - 'linux/x86_64', - 'local', - 'localhost', - ] - ) - ).map( - p, - resource('aws-ip', 1) - ) : [] - - # Set resource requests for multi platform pipelines which doesn't use the build-platforms parameter (old style) - - | - !( - has(pipelineRun.spec.params) && - pipelineRun.spec.params.exists(p, p.name == 'build-platforms') - ) && - has(pipelineRun.spec.pipelineSpec) && - has(pipelineRun.spec.pipelineSpec.tasks) && - pipelineRun.spec.pipelineSpec.tasks.size() > 0 ? - pipelineRun.spec.pipelineSpec.tasks.map( - task, - has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : [] - ) - .filter(p, p.size() > 0) - .map( - p, - resource(replace(replace(p[0].value, "/", "-"), "_", "-"), 1) - ) : [] - - # Request AWS IP for AWS-based platforms which doesn't use the build-platforms parameter (old style) - - | - !( - has(pipelineRun.spec.params) && - pipelineRun.spec.params.exists(p, p.name == 'build-platforms') - ) && - has(pipelineRun.spec.pipelineSpec) && - has(pipelineRun.spec.pipelineSpec.tasks) && - pipelineRun.spec.pipelineSpec.tasks.size() > 0 ? - pipelineRun.spec.pipelineSpec.tasks.map( - task, - has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : [] - ) - .filter(p, p.size() > 0) - .filter( - p, - !( - p[0].value in [ - 'linux/ppc64le', - 'linux/s390x', - 'linux/x86_64', - 'local', - 'localhost', - ] - ) - ) - .map( - p, - resource('aws-ip', 1) - ) : [] - - # Set mintmaker resource requests. - # Necessary since mintmaker refreshes can overload clusters without a - # bottleneck on the number of pipelineruns running. - - | - plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : [] - - # Set the pipeline priority - - | - has(pipelineRun.metadata.labels) && - 'build.appstudio.openshift.io/type' in pipelineRun.metadata.labels && - pipelineRun.metadata.labels['build.appstudio.openshift.io/type'] == 'nudge' ? - priority('konflux-dependency-update') : - - pacEventType == 'push' ? priority('konflux-post-merge-build') : - pacEventType == 'pull_request' || - pacEventType == "Merge_Request" || - pacEventType == 'test-comment' || - pacEventType == 'retest-comment' || - pacEventType == 'retest-all-comment' || - pacEventType == 'ok-to-test-comment' ? priority('konflux-pre-merge-build') : - pacTestEventType == 'push' ? priority('konflux-post-merge-test') : - pacTestEventType == 'pull_request' || - pacTestEventType == "Merge_Request" || - pacTestEventType == 'test-comment' || - pacTestEventType == 'retest-comment' || - pacTestEventType == 'retest-all-comment' || - pacTestEventType == 'ok-to-test-comment' ? priority('konflux-pre-merge-test') : - - has(pipelineRun.metadata.labels) && - 'appstudio.openshift.io/service' in pipelineRun.metadata.labels && - pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' && - 'pipelines.appstudio.openshift.io/type' in pipelineRun.metadata.labels && - pipelineRun.metadata.labels['pipelines.appstudio.openshift.io/type'] == 'managed' ? - priority('konflux-release') : - - has(pipelineRun.metadata.labels) && - 'appstudio.openshift.io/service' in pipelineRun.metadata.labels && - pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' && - 'release.appstudio.openshift.io/namespace' in pipelineRun.metadata.labels && - pipelineRun.metadata.labels['release.appstudio.openshift.io/namespace'] == plrNamespace ? - priority('konflux-tenant-release') : - - plrNamespace == 'mintmaker' ? priority('konflux-dependency-update') : - - has(pipelineRun.metadata.labels) && - 'internal-services.appstudio.openshift.io/pipelinerun-uid' in pipelineRun.metadata.labels ? - priority('konflux-release') : - - priority('konflux-default') diff --git a/components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml b/components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml deleted file mode 100644 index 2004b89d0e0..00000000000 --- a/components/kueue/production/base-ring1-tekton-kueue/controller-patch.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -- op: replace - path: /spec/replicas - value: 2 - -- op: add - path: /metadata/annotations/ignore-check.kube-linter.io~1no-anti-affinity - value: "Using topologySpreadConstraints" - -- op: add - path: /spec/strategy - value: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 0 - -- op: add - path: /spec/template/spec/topologySpreadConstraints - value: - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/name: tekton-kueue - -- op: add - path: /spec/template/spec/containers/0/resources/requests - value: - cpu: 500m - memory: 2Gi - -- op: add - path: /spec/template/spec/containers/0/resources/limits - value: - cpu: 500m - memory: 2Gi - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-lease-duration=137s" - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-renew-deadline=107s" - -- op: add - path: /spec/template/spec/containers/0/args/- - value: "--leader-elect-retry-period=26s" diff --git a/components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml b/components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml deleted file mode 100644 index f3454368085..00000000000 --- a/components/kueue/production/base-ring1-tekton-kueue/kustomization.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- https://github.com/konflux-ci/tekton-kueue/config/default?ref=cec0b3c8a240a289bb7aff4313ea647b292d96cc - -images: -- name: konflux-ci/tekton-kueue - newName: quay.io/konflux-ci/tekton-kueue - newTag: cec0b3c8a240a289bb7aff4313ea647b292d96cc - -namespace: tekton-kueue -# ensure that installation starts after the installation of kueue complete -commonAnnotations: - argocd.argoproj.io/sync-wave: "10" - -configMapGenerator: - - name: tekton-kueue-config - namespace: tekton-kueue - behavior: replace - files: - - config.yaml - -generatorOptions: - disableNameSuffixHash: true - -patches: -- path: webhook-patch.yaml - target: - group: apps - kind: Deployment - name: tekton-kueue-webhook - version: v1 -- path: controller-patch.yaml - target: - group: apps - kind: Deployment - name: tekton-kueue-controller-manager - version: v1 -- target: - kind: Namespace - name: tekton-kueue - patch: |- - - op: add - path: /metadata/labels/openshift.io~1cluster-monitoring - value: "true" diff --git a/components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml b/components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml deleted file mode 100644 index 39e53690c53..00000000000 --- a/components/kueue/production/base-ring1-tekton-kueue/webhook-patch.yaml +++ /dev/null @@ -1,41 +0,0 @@ ---- -- op: replace - path: /spec/replicas - value: 3 - -- op: add - path: /metadata/annotations/ignore-check.kube-linter.io~1no-anti-affinity - value: "Using topologySpreadConstraints" - -- op: add - path: /spec/strategy - value: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 0 - -- op: add - path: /spec/template/spec/topologySpreadConstraints - value: - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/name: tekton-kueue-webhook - -- op: add - path: /spec/template/spec/containers/0/resources/requests - value: - cpu: 200m - memory: 256Mi - -- op: add - path: /spec/template/spec/containers/0/resources/limits - value: - cpu: 200m - memory: 256Mi - -- op: add - path: /spec/template/spec/containers/0/args/- - value: --zap-log-level=5 diff --git a/components/kueue/production/base/kueue/operator.yaml b/components/kueue/production/base/kueue/operator.yaml index 442bd44fab9..7d2c4134a03 100644 --- a/components/kueue/production/base/kueue/operator.yaml +++ b/components/kueue/production/base/kueue/operator.yaml @@ -40,7 +40,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "-1" spec: - channel: stable-v1.2 + channel: stable-v1.3 installPlanApproval: Automatic name: kueue-operator source: redhat-operators-1-18 diff --git a/components/kueue/production/base/tekton-kueue/kustomization.yaml b/components/kueue/production/base/tekton-kueue/kustomization.yaml index 83087e5f2de..f3454368085 100644 --- a/components/kueue/production/base/tekton-kueue/kustomization.yaml +++ b/components/kueue/production/base/tekton-kueue/kustomization.yaml @@ -1,12 +1,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- https://github.com/konflux-ci/tekton-kueue/config/default?ref=964790eef15cef723654b6f62b36b8cde867f9f7 +- https://github.com/konflux-ci/tekton-kueue/config/default?ref=cec0b3c8a240a289bb7aff4313ea647b292d96cc images: - name: konflux-ci/tekton-kueue newName: quay.io/konflux-ci/tekton-kueue - newTag: 964790eef15cef723654b6f62b36b8cde867f9f7 + newTag: cec0b3c8a240a289bb7aff4313ea647b292d96cc namespace: tekton-kueue # ensure that installation starts after the installation of kueue complete diff --git a/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml index db6351a3eb0..e4831c9f367 100644 --- a/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -162,7 +162,6 @@ spec: nominalQuota: '1000' - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor diff --git a/components/kueue/production/kflux-ocp-p01/kustomization.yaml b/components/kueue/production/kflux-ocp-p01/kustomization.yaml index f8bccc0de40..08061c36c7f 100644 --- a/components/kueue/production/kflux-ocp-p01/kustomization.yaml +++ b/components/kueue/production/kflux-ocp-p01/kustomization.yaml @@ -1,9 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base/kueue -- ../base-ring1-tekton-kueue -- ../base/tekton-kueue-monitoring +- ../base - queue-config commonAnnotations: @@ -15,13 +13,3 @@ configMapGenerator: behavior: replace files: - config.yaml - -patches: -- target: - kind: Subscription - name: openshift-kueue-operator - namespace: openshift-kueue-operator - patch: |- - - op: replace - path: /spec/channel - value: stable-v1.3 diff --git a/components/kueue/production/kflux-osp-p01/kustomization.yaml b/components/kueue/production/kflux-osp-p01/kustomization.yaml index b51ca37688b..24145d9cf86 100644 --- a/components/kueue/production/kflux-osp-p01/kustomization.yaml +++ b/components/kueue/production/kflux-osp-p01/kustomization.yaml @@ -1,20 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base/kueue -- ../base-ring1-tekton-kueue -- ../base/tekton-kueue-monitoring +- ../base - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -patches: -- target: - kind: Subscription - name: openshift-kueue-operator - namespace: openshift-kueue-operator - patch: |- - - op: replace - path: /spec/channel - value: stable-v1.3 diff --git a/components/kueue/production/kflux-prd-rh02/kustomization.yaml b/components/kueue/production/kflux-prd-rh02/kustomization.yaml index b51ca37688b..24145d9cf86 100644 --- a/components/kueue/production/kflux-prd-rh02/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh02/kustomization.yaml @@ -1,20 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base/kueue -- ../base-ring1-tekton-kueue -- ../base/tekton-kueue-monitoring +- ../base - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -patches: -- target: - kind: Subscription - name: openshift-kueue-operator - namespace: openshift-kueue-operator - patch: |- - - op: replace - path: /spec/channel - value: stable-v1.3 diff --git a/components/kueue/production/kflux-prd-rh03/kustomization.yaml b/components/kueue/production/kflux-prd-rh03/kustomization.yaml index b51ca37688b..24145d9cf86 100644 --- a/components/kueue/production/kflux-prd-rh03/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh03/kustomization.yaml @@ -1,20 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base/kueue -- ../base-ring1-tekton-kueue -- ../base/tekton-kueue-monitoring +- ../base - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -patches: -- target: - kind: Subscription - name: openshift-kueue-operator - namespace: openshift-kueue-operator - patch: |- - - op: replace - path: /spec/channel - value: stable-v1.3 diff --git a/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml index 2734e4a586e..8389185901e 100644 --- a/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -183,7 +183,6 @@ spec: nominalQuota: '1000' - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor diff --git a/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml index d5405dd6b76..81fa7d15844 100644 --- a/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml @@ -4,7 +4,7 @@ metadata: name: cluster-pipeline-queue spec: flavorFungibility: - whenCanBorrow: Borrow + whenCanBorrow: MayStopSearch whenCanPreempt: TryNextFlavor namespaceSelector: {} preemption: @@ -174,7 +174,6 @@ spec: nominalQuota: '1000' - name: localhost nominalQuota: '1000' - stopPolicy: None --- apiVersion: kueue.x-k8s.io/v1beta1 kind: ResourceFlavor diff --git a/components/kueue/production/stone-prod-p01/kustomization.yaml b/components/kueue/production/stone-prod-p01/kustomization.yaml index b51ca37688b..24145d9cf86 100644 --- a/components/kueue/production/stone-prod-p01/kustomization.yaml +++ b/components/kueue/production/stone-prod-p01/kustomization.yaml @@ -1,20 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base/kueue -- ../base-ring1-tekton-kueue -- ../base/tekton-kueue-monitoring +- ../base - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -patches: -- target: - kind: Subscription - name: openshift-kueue-operator - namespace: openshift-kueue-operator - patch: |- - - op: replace - path: /spec/channel - value: stable-v1.3 diff --git a/components/kueue/production/stone-prod-p02/kustomization.yaml b/components/kueue/production/stone-prod-p02/kustomization.yaml index b51ca37688b..24145d9cf86 100644 --- a/components/kueue/production/stone-prod-p02/kustomization.yaml +++ b/components/kueue/production/stone-prod-p02/kustomization.yaml @@ -1,20 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../base/kueue -- ../base-ring1-tekton-kueue -- ../base/tekton-kueue-monitoring +- ../base - queue-config commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -patches: -- target: - kind: Subscription - name: openshift-kueue-operator - namespace: openshift-kueue-operator - patch: |- - - op: replace - path: /spec/channel - value: stable-v1.3 From 0f71d0c1005532d4bda99df32a7b23ade79b2278 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Wed, 27 May 2026 15:03:30 +0200 Subject: [PATCH 64/83] Allow konflux-performance group to create SA tokens in production (#12012) Backport sa-token-rbac from staging (cdcaa5f) to production, granting the konflux-performance group permission to create tokens for perf-team-prometheus-reader-cluster-sa and perf-team-prometheus-reader-oomcrash-sa service accounts. Generated-by: Claude Assisted-by: Claude Co-authored-by: Claude Opus 4.6 (1M context) --- .../production/base/kustomization.yaml | 1 + .../production/base/sa-token-rbac.yaml | 29 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 components/perf-team-prometheus-reader/production/base/sa-token-rbac.yaml diff --git a/components/perf-team-prometheus-reader/production/base/kustomization.yaml b/components/perf-team-prometheus-reader/production/base/kustomization.yaml index d8581687f9b..f50ab7da0ff 100644 --- a/components/perf-team-prometheus-reader/production/base/kustomization.yaml +++ b/components/perf-team-prometheus-reader/production/base/kustomization.yaml @@ -4,4 +4,5 @@ resources: - serviceaccount.yaml - serviceaccount-oomcrash.yaml - perf-team.yaml + - sa-token-rbac.yaml - tenants-rbac diff --git a/components/perf-team-prometheus-reader/production/base/sa-token-rbac.yaml b/components/perf-team-prometheus-reader/production/base/sa-token-rbac.yaml new file mode 100644 index 00000000000..d5cfb73fba3 --- /dev/null +++ b/components/perf-team-prometheus-reader/production/base/sa-token-rbac.yaml @@ -0,0 +1,29 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +rules: + - verbs: + - create + apiGroups: + - "" + resources: + - serviceaccounts/token + resourceNames: + - perf-team-prometheus-reader-cluster-sa + - perf-team-prometheus-reader-oomcrash-sa +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: perf-team-sa-token-creator + namespace: perf-team-prometheus-reader +subjects: + - kind: Group + apiGroup: rbac.authorization.k8s.io + name: konflux-performance +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: perf-team-sa-token-creator From 1e90a2290bd1ee581fc206223628f93117bb8671 Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Wed, 27 May 2026 14:34:46 +0000 Subject: [PATCH 65/83] Update from release-service (#12010) Co-authored-by: release-service --- .../grafana/development/dashboards/release/kustomization.yaml | 2 +- components/release/development/kustomization.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/monitoring/grafana/development/dashboards/release/kustomization.yaml b/components/monitoring/grafana/development/dashboards/release/kustomization.yaml index 040fe2029c1..526b7325c0d 100644 --- a/components/monitoring/grafana/development/dashboards/release/kustomization.yaml +++ b/components/monitoring/grafana/development/dashboards/release/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- https://github.com/konflux-ci/release-service/config/grafana/?ref=03669a226885c2fe70c20c90c37721548bf3e6ed +- https://github.com/konflux-ci/release-service/config/grafana/?ref=530b605bcfa10e668f821cdc046d35f6b3f476a5 diff --git a/components/release/development/kustomization.yaml b/components/release/development/kustomization.yaml index 364fb81be15..0dbbaf0810d 100644 --- a/components/release/development/kustomization.yaml +++ b/components/release/development/kustomization.yaml @@ -3,13 +3,13 @@ kind: Kustomization resources: - ../base - ../base/monitor/development - - https://github.com/konflux-ci/release-service/config/default?ref=03669a226885c2fe70c20c90c37721548bf3e6ed + - https://github.com/konflux-ci/release-service/config/default?ref=530b605bcfa10e668f821cdc046d35f6b3f476a5 - release_service_config.yaml images: - name: quay.io/konflux-ci/release-service newName: quay.io/konflux-ci/release-service - newTag: 03669a226885c2fe70c20c90c37721548bf3e6ed + newTag: 530b605bcfa10e668f821cdc046d35f6b3f476a5 namespace: release-service From 72bea8545726ea6e1b9c7692b35e83533ae4e27c Mon Sep 17 00:00:00 2001 From: sean conroy Date: Wed, 27 May 2026 15:58:16 +0100 Subject: [PATCH 66/83] Promote release-service and grafana-dashboard from development to staging (#12019) --- .../grafana/staging/dashboards/release/kustomization.yaml | 2 +- components/release/staging/kustomization.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml b/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml index 0529f05a3bf..d2277d2475d 100644 --- a/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml +++ b/components/monitoring/grafana/staging/dashboards/release/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- https://github.com/konflux-ci/release-service/config/grafana/?ref=5f0b67ab53d64072c1fce4d9e18e3297e91da126 +- https://github.com/konflux-ci/release-service/config/grafana/?ref=d02b958bcf790f72dbb38625d5f851f843351f83 diff --git a/components/release/staging/kustomization.yaml b/components/release/staging/kustomization.yaml index 86b4daf5a5c..afc15c4d945 100644 --- a/components/release/staging/kustomization.yaml +++ b/components/release/staging/kustomization.yaml @@ -4,7 +4,7 @@ resources: - ../base - ../base/monitor/staging - external-secrets/release-monitor-secret.yaml - - https://github.com/konflux-ci/release-service/config/default?ref=5f0b67ab53d64072c1fce4d9e18e3297e91da126 + - https://github.com/konflux-ci/release-service/config/default?ref=d02b958bcf790f72dbb38625d5f851f843351f83 - release_service_config.yaml - signing_configs.yaml @@ -14,6 +14,6 @@ components: images: - name: quay.io/konflux-ci/release-service newName: quay.io/konflux-ci/release-service - newTag: 5f0b67ab53d64072c1fce4d9e18e3297e91da126 + newTag: d02b958bcf790f72dbb38625d5f851f843351f83 namespace: release-service From 0d0e14059524789a6487dbc044143279a36e418c Mon Sep 17 00:00:00 2001 From: Joao Pedro Poloni Ponce Date: Wed, 27 May 2026 12:01:35 -0300 Subject: [PATCH 67/83] chore: replace appstudio-utils by task-runner in konflux ui prod (#11975) Replace appstudio-utils image reference in Konflux UI resources by task-runner image in prod environment. Jira KONFLUX-13284 --- .../kflux-fedora-01/configure-oauth-proxy-secret.yaml | 2 +- .../production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml | 2 +- .../production/kflux-osp-p01/configure-oauth-proxy-secret.yaml | 2 +- .../production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml | 2 +- .../production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml | 2 +- .../production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml | 2 +- .../production/stone-prd-rh01/configure-oauth-proxy-secret.yaml | 2 +- .../production/stone-prod-p01/configure-oauth-proxy-secret.yaml | 2 +- .../production/stone-prod-p02/configure-oauth-proxy-secret.yaml | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml index b7733c929d0..d4cf4f3c175 100644 --- a/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-fedora-01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:2b13f3d1921be90df96ae0c6f8d14ca7936ebb6b@sha256:8c923e6d93d5f4541bc5bc9a19e92c42413f48f57490df595488c27ecdf80f9c + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml index 2f51cc062d3..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-osp-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:610e03266bfd0b30e53fc51dbdd56debb33cbe5b@sha256:ecc156d6fb19032ba817a8c4bc41e7453a061db173655f0500afbe8d68dcaf59 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-prd-rh02/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-prd-rh03/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml index 763368e420b..86b85ae83d0 100644 --- a/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/kflux-rhel-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:832a8c1360cfbb68db63813bd5cfa0c6c2a9b54d@sha256:c06432ceda6fe759c548b19c9784d34c63101909be98d82203be9d04656f6d78 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/stone-prod-p01/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: diff --git a/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml b/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml index 13cb24c1e32..86b85ae83d0 100644 --- a/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml +++ b/components/konflux-ui/production/stone-prod-p02/configure-oauth-proxy-secret.yaml @@ -102,7 +102,7 @@ spec: echo "skipping dex restart" fi - image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 + image: quay.io/konflux-ci/task-runner:955c3525538ea50bf0f562dbd1f0cda330df9054@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc imagePullPolicy: Always name: konflux-oauth-client-secret-generation resources: From 0b50863cc5e1da2d6de3e7ebb26767c02671432a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Huta=C5=99?= Date: Wed, 27 May 2026 18:13:51 +0200 Subject: [PATCH 68/83] Add docs for perf-team-prometheus-reader component (#12016) * Add docs for perf-team-prometheus-reader component Rewrite README.md with directory layout, promotion workflow (soak in staging then copy-paste to production), expanded SA descriptions with RBAC grants, production PR template, and link to repo-level conventions. Add AGENTS.md with kustomize build commands and production isolation warning. Add operational hints as YAML comments to SA files (token generation commands and vault path for storing secrets). Co-Authored-By: Claude Opus 4.6 (1M context) Generated-by: Claude Assisted-by: Claude * docs: Adding links, small manual cleanup, serviceaccount-oomcrash token is not stored in Vault --------- Co-authored-by: Claude Opus 4.6 (1M context) --- .../perf-team-prometheus-reader/AGENTS.md | 21 ++++++++ .../perf-team-prometheus-reader/README.md | 48 +++++++++++++++++-- .../base/core/serviceaccount.yaml | 2 + .../production/base/serviceaccount.yaml | 2 + 4 files changed, 70 insertions(+), 3 deletions(-) create mode 100644 components/perf-team-prometheus-reader/AGENTS.md diff --git a/components/perf-team-prometheus-reader/AGENTS.md b/components/perf-team-prometheus-reader/AGENTS.md new file mode 100644 index 00000000000..1e9644a111e --- /dev/null +++ b/components/perf-team-prometheus-reader/AGENTS.md @@ -0,0 +1,21 @@ +# perf-team-prometheus-reader + +## Validation + +``` +kustomize build components/perf-team-prometheus-reader/development/ +kustomize build components/perf-team-prometheus-reader/staging/base/ +kustomize build components/perf-team-prometheus-reader/production/base/ +``` + +## Production Isolation + +`production/base/` has its own copies of all resource files. It does NOT reference the shared `base/` directory. When making changes: + +- Modifying `base/core/` or `base/tenants-rbac/` only affects development and staging. +- Production requires a separate PR that copies the validated files into `production/base/`. +- Never refactor production to reference `../../base` — the isolation is intentional. + +## General Conventions + +See the [README.md](README.md) for general info about this component and workflow for changes and the repo-level [AGENTS.md](/AGENTS.md) for commit format, PR requirements, and other conventions. diff --git a/components/perf-team-prometheus-reader/README.md b/components/perf-team-prometheus-reader/README.md index dfaed09fd5d..e0167db63b8 100644 --- a/components/perf-team-prometheus-reader/README.md +++ b/components/perf-team-prometheus-reader/README.md @@ -1,8 +1,50 @@ # perf-team-prometheus-reader -Component used by Konflux Perf&Scale team +Monitoring and observability resources for the Konflux Perf&Scale team. Deploys service accounts and RBAC for reading cluster Prometheus metrics, detecting OOMKills/crashloops, and reading events in tenant namespaces. + +## Directory Layout + +- `base/core/` — service accounts, RBAC grants, maintainer bindings (shared by development and staging) +- `base/tenants-rbac/` — event-reader roles for `konflux-perfscale-{1,2,3}-tenant` namespaces (shared by development and staging) +- `development/` — overlay for dev clusters, also defines tenant namespace resources +- `staging/base/` — overlay for staging clusters +- `production/base/` — standalone overlay with its own copies of all resources (does not reference shared `base/`) + +## Promotion Workflow + +Development and staging overlays reference the shared `base/` directory. Production has its own standalone copies of resources and does not inherit from `base/`. + +To roll out a change: + +1. **First PR** — modify files in `base/` (and `development/` or `staging/` if needed). This applies to development and staging clusters. +2. **Soak** — let the change run in staging to validate stability over time. +3. **Second PR** — copy the tested files into `production/base/`. Production PRs should be small, simple copy-pastes of what was already validated in staging to minimize risk of introducing new issues. + +This separation is intentional. Do not refactor production to reference the shared `base/` — the isolation ensures production changes are always explicit and deliberate. ## Service Accounts -- `perf-team-prometheus-reader-cluster-sa`: Used to read monitoring data from cluster Prometheus. -- `perf-team-prometheus-reader-oomcrash-sa`: Used by the [oomkill-and-crashloopbackoff-detector](https://github.com/konflux-ci/perfscale/tree/main/tools/oomkill-and-crashloopbackoff-detector) tool to monitor and detect OOMKills and crashloops across the cluster. +- **`perf-team-prometheus-reader-cluster-sa`** — reads monitoring data from cluster Prometheus. Bound to `cluster-monitoring-view` ClusterRole via `sa-read-permissions-openshift-monitoring` ClusterRoleBinding. + +- **`perf-team-prometheus-reader-oomcrash-sa`** — used by [oomkill-and-crashloopbackoff-detector](https://github.com/konflux-ci/perfscale/tree/main/tools/oomkill-and-crashloopbackoff-detector) to monitor OOMKills and crashloops. Bound to `perf-team-prometheus-reader-oomcrash-role` ClusterRole (list namespaces, get/list events and pods, get pods/log and pods/status). Has a long-lived token Secret. + +- **`konflux-bot-0`** (defined in tenants config, e.g. [here](https://gitlab.cee.redhat.com/releng/konflux-release-data/-/blob/6a23b46f6031be732474324f7da7ed0ae027739e/tenants-config/cluster/stone-prd-rh01/tenants/konflux-perfscale-1-tenant/konflux-bot-0.yaml)) — granted `perf-team-event-reader-role` (get/list/watch events) in each `konflux-perfscale-{1,2,3}-tenant` namespace via `tenants-rbac/`. This SA is used to run [Probe runs](https://docs.google.com/document/d/1lIWwBXeBxlyHkucNJu__NrAsPtRMgoPGjf_0EbHUhcs/edit?tab=t.0#heading=h.lxuqoglzqrgk) in those namespaces. + +Members of the `konflux-performance` group can create tokens for both SAs via the `perf-team-sa-token-creator` Role. To become a member of that group for Red Hat clusters you need to be in [this](https://rover.redhat.com/groups/group/konflux-performance) Rover group, for Fedora cluster add yourself to [this](https://github.com/redhat-appstudio/internal-infra-deployments/blob/6802797bcb8b66968e363d5e8811ac6e1ff348e3/components/k8s-groups/production/fas/groups/konflux-performance.yaml) file. + +## Production PR Template + +Production PRs require `## Risk Assessment` and `## Validation` sections ([full docs](https://konflux-production-approval-tool-982507.pages.redhat.com/#/docs/developer-guide)). Use this template: + +``` +## Risk Assessment +**Risk Level:** Low +**Description:** +**Rollback:** Revert PR + +## Validation +Tested on staging — no regressions observed. +Staging PR: +``` + +Risk levels: Low / Medium / High / Very High. Given purpose of our component, we will be Low or Medium. diff --git a/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml b/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml index 7a6c130935d..95a236d8163 100644 --- a/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml +++ b/components/perf-team-prometheus-reader/base/core/serviceaccount.yaml @@ -1,3 +1,5 @@ +# To generate a token: oc -n perf-team-prometheus-reader create token perf-team-prometheus-reader-cluster-sa --duration "$((24*365))h" +# Store the token in https://vault.devshift.net/ stonesoup /{staging,production}/perfscale/shared/ apiVersion: v1 kind: ServiceAccount metadata: diff --git a/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml b/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml index 7a6c130935d..95a236d8163 100644 --- a/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml +++ b/components/perf-team-prometheus-reader/production/base/serviceaccount.yaml @@ -1,3 +1,5 @@ +# To generate a token: oc -n perf-team-prometheus-reader create token perf-team-prometheus-reader-cluster-sa --duration "$((24*365))h" +# Store the token in https://vault.devshift.net/ stonesoup /{staging,production}/perfscale/shared/ apiVersion: v1 kind: ServiceAccount metadata: From a169b9c2f77215d09ca6a9ab9532850a3962c554 Mon Sep 17 00:00:00 2001 From: Shubham Mathur Date: Wed, 27 May 2026 15:31:05 -0400 Subject: [PATCH 69/83] Update pipelines to next nightly build in dev/staging 5.0.5-830 (#12009) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update the OpenShift Pipelines OLM catalog index image in dev and staging environments. v5.0.5-819 → v5.0.5-830 Key changes: - PAC: v0.46.0 → v0.47.0 (label fixes, CEL extensions, Bitbucket/GitLab fixes) - Pipeline: release-v1.12.x HEAD (+18 commits, includes generateName fix) - Chains: CVE-2026-33814 fix (golang.org/x/net HTTP/2) - CLI: v0.44.1 → v0.45.0 - Pruner: v0.3.5 → v0.4.0 Image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 --- .../development/main-pipeline-service-configuration.yaml | 2 +- .../staging/base/main-pipeline-service-configuration.yaml | 2 +- components/pipeline-service/staging/stone-stage-p01/deploy.yaml | 2 +- components/pipeline-service/staging/stone-stg-rh01/deploy.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/components/pipeline-service/development/main-pipeline-service-configuration.yaml b/components/pipeline-service/development/main-pipeline-service-configuration.yaml index e1b2f6f92d2..3d5e487f332 100644 --- a/components/pipeline-service/development/main-pipeline-service-configuration.yaml +++ b/components/pipeline-service/development/main-pipeline-service-configuration.yaml @@ -2243,7 +2243,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: diff --git a/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml b/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml index aa17334c3c8..b62ce13cc14 100644 --- a/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml +++ b/components/pipeline-service/staging/base/main-pipeline-service-configuration.yaml @@ -2073,7 +2073,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: diff --git a/components/pipeline-service/staging/stone-stage-p01/deploy.yaml b/components/pipeline-service/staging/stone-stage-p01/deploy.yaml index 68ef78ac99f..26cfa2c71bb 100644 --- a/components/pipeline-service/staging/stone-stage-p01/deploy.yaml +++ b/components/pipeline-service/staging/stone-stage-p01/deploy.yaml @@ -2649,7 +2649,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: diff --git a/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml b/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml index 442b2c37978..914aac10d83 100644 --- a/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml +++ b/components/pipeline-service/staging/stone-stg-rh01/deploy.yaml @@ -2661,7 +2661,7 @@ metadata: namespace: openshift-marketplace spec: displayName: custom-operators - image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:7a6ffa6b08f3ec1ef6bf6b704e8d8a07621ec55e3f146779c786d8b174ca9107 + image: quay.io/openshift-pipeline/pipelines-index-4.18@sha256:a4aa211a70b0a92c98c885cca8fed2cce490e3fec656ad1ea68bf7e7c3c18304 sourceType: grpc updateStrategy: registryPoll: From ffcf908a69ff8357d170a8af250b9ebd1175c551 Mon Sep 17 00:00:00 2001 From: Gal Levi Date: Thu, 28 May 2026 11:14:22 +0300 Subject: [PATCH 70/83] =?UTF-8?q?KONFLUX-13356:=20ring=203=20CRs=20migrati?= =?UTF-8?q?on=20v1beta1=20=E2=86=92=20v1beta2=20+=20base=20cleanup=20(#120?= =?UTF-8?q?23)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * KONFLUX-13356: delete temporary base-ring1-queue-config directory Assisted-by: Claude Code Signed-off-by: Gal Levi * KONFLUX-13356: revert ring 1/2 queue-config references to shared base Assisted-by: Claude Code Signed-off-by: Gal Levi * KONFLUX-13356: migrate CRs to v1beta2 (ring 3 + shared base) Assisted-by: Claude Code Signed-off-by: Gal Levi --------- Signed-off-by: Gal Levi --- .../kustomization.yaml | 8 --- .../workload-priority-class.yaml | 56 ------------------- .../queue-config/workload-priority-class.yaml | 16 +++--- .../queue-config/cluster-queue.yaml | 16 +++--- .../queue-config/kustomization.yaml | 2 +- .../queue-config/kustomization.yaml | 2 +- .../queue-config/kustomization.yaml | 2 +- .../queue-config/kustomization.yaml | 2 +- .../queue-config/cluster-queue.yaml | 16 +++--- .../queue-config/cluster-queue.yaml | 16 +++--- .../queue-config/kustomization.yaml | 2 +- .../queue-config/kustomization.yaml | 2 +- 12 files changed, 38 insertions(+), 102 deletions(-) delete mode 100644 components/kueue/production/base-ring1-queue-config/kustomization.yaml delete mode 100644 components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml diff --git a/components/kueue/production/base-ring1-queue-config/kustomization.yaml b/components/kueue/production/base-ring1-queue-config/kustomization.yaml deleted file mode 100644 index f717b27bc45..00000000000 --- a/components/kueue/production/base-ring1-queue-config/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- workload-priority-class.yaml - -# ensure that installation starts after the installation of kueue complete -commonAnnotations: - argocd.argoproj.io/sync-wave: "10" diff --git a/components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml b/components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml deleted file mode 100644 index 8d8c62654ec..00000000000 --- a/components/kueue/production/base-ring1-queue-config/workload-priority-class.yaml +++ /dev/null @@ -1,56 +0,0 @@ ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-release -value: 1000 -description: "Highest priority for release pipelines" ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-tenant-release -value: 900 -description: "High priority for tenant release pipelines" ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-post-merge-test -value: 800 -description: "Priority for post-merge tests" ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-post-merge-build -value: 700 -description: "Priority for post-merge builds" ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-pre-merge-test -value: 600 -description: "Priority for pre-merge tests" ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-pre-merge-build -value: 500 -description: "Priority for pre-merge builds" ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-default -value: 400 -description: "Default priority for konflux pipelines" ---- -apiVersion: kueue.x-k8s.io/v1beta2 -kind: WorkloadPriorityClass -metadata: - name: konflux-dependency-update -value: 300 -description: "Lower priority for dependency updates" diff --git a/components/kueue/production/base/queue-config/workload-priority-class.yaml b/components/kueue/production/base/queue-config/workload-priority-class.yaml index ddea072ce76..8d8c62654ec 100644 --- a/components/kueue/production/base/queue-config/workload-priority-class.yaml +++ b/components/kueue/production/base/queue-config/workload-priority-class.yaml @@ -1,54 +1,54 @@ --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-release value: 1000 description: "Highest priority for release pipelines" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-tenant-release value: 900 description: "High priority for tenant release pipelines" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-post-merge-test value: 800 description: "Priority for post-merge tests" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-post-merge-build value: 700 description: "Priority for post-merge builds" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-pre-merge-test value: 600 description: "Priority for pre-merge tests" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-pre-merge-build value: 500 description: "Priority for pre-merge builds" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-default value: 400 description: "Default priority for konflux pipelines" --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: WorkloadPriorityClass metadata: name: konflux-dependency-update diff --git a/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml index e4831c9f367..fc4360dc6c9 100644 --- a/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-fedora-01/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -157,30 +157,30 @@ spec: - name: linux-s390x nominalQuota: '24' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml b/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml index dd7b8e25f17..99ae9c2c9f5 100644 --- a/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-ocp-p01/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base-ring1-queue-config +- ../../base/queue-config - ocp-build-workload-priority-class.yaml # ensure that installation starts after the installation of kueue complete diff --git a/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml b/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml index 3c0e1b51f71..f9fd4ed82c8 100644 --- a/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-osp-p01/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base-ring1-queue-config +- ../../base/queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: diff --git a/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml b/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml index 3c0e1b51f71..f9fd4ed82c8 100644 --- a/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh02/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base-ring1-queue-config +- ../../base/queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: diff --git a/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml b/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml index 3c0e1b51f71..f9fd4ed82c8 100644 --- a/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml +++ b/components/kueue/production/kflux-prd-rh03/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base-ring1-queue-config +- ../../base/queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: diff --git a/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml b/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml index 8389185901e..ec6cd50f779 100644 --- a/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/kflux-rhel-p01/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -178,30 +178,30 @@ spec: - name: linux-s390x nominalQuota: '60' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml b/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml index 81fa7d15844..2161fc7d10e 100644 --- a/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml +++ b/components/kueue/production/stone-prd-rh01/queue-config/cluster-queue.yaml @@ -1,4 +1,4 @@ -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ClusterQueue metadata: name: cluster-pipeline-queue @@ -169,30 +169,30 @@ spec: - name: linux-test-arm64 nominalQuota: '250' - name: linux-x86-64 - nominalQuota: '1000' + nominalQuota: 1k - name: local - nominalQuota: '1000' + nominalQuota: 1k - name: localhost - nominalQuota: '1000' + nominalQuota: 1k --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: default-flavor --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-1 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-2 spec: {} --- -apiVersion: kueue.x-k8s.io/v1beta1 +apiVersion: kueue.x-k8s.io/v1beta2 kind: ResourceFlavor metadata: name: platform-group-3 diff --git a/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml b/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml index 3c0e1b51f71..f9fd4ed82c8 100644 --- a/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml +++ b/components/kueue/production/stone-prod-p01/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base-ring1-queue-config +- ../../base/queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: diff --git a/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml b/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml index 3c0e1b51f71..f9fd4ed82c8 100644 --- a/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml +++ b/components/kueue/production/stone-prod-p02/queue-config/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cluster-queue.yaml -- ../../base-ring1-queue-config +- ../../base/queue-config # ensure that installation starts after the installation of kueue complete commonAnnotations: From 3c4f963d9cb1d4b89f852d05f7543c51fced0a8a Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Thu, 28 May 2026 09:29:47 +0000 Subject: [PATCH 71/83] Update from release-service (#12041) Co-authored-by: release-service --- components/mintmaker/staging/base/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index e0bea426ec7..87e661b5044 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -16,7 +16,7 @@ images: newTag: 70cfa98ddf51f87166807d7f2787677422471d20 - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image - newTag: d2bff51dfd5b136a5cc0e0108d02336f96085fc5 + newTag: 5fa9e2f0134e156c6430eac52c16b8010f489539 commonAnnotations: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true From b935c4f345d2526c7002730e3373877a33791132 Mon Sep 17 00:00:00 2001 From: Yftach Herzog Date: Thu, 28 May 2026 13:51:32 +0300 Subject: [PATCH 72/83] feat(KFLUXVNGD-907): add konflux operator CR (#11900) Finalize the development overlay CR for the Konflux Operator. Also drop the appstudio-pipelines-scc from the pipeline-service for the development-operator overlay, as it is deployed by the operator. This allows deploying Konflux using the operator in dev environments. Assisted-by: Cursor Signed-off-by: Yftach Herzog --- .../development-operator/kustomization.yaml | 9 ++++++- .../pipeline-service-operator-patch.yaml | 4 +++ .../default-tenant/default-tenant.yaml | 7 ++++++ .../default-tenant/kustomization.yaml | 4 +++ .../image-controller/image-controller.yaml | 4 ++- .../cr/overlay-patches/konflux-ui/ui.yaml | 2 +- .../development/invariant/release-config.yaml | 4 +-- .../development/kustomization.yaml | 1 + .../development-operator/kustomization.yaml | 24 ++++++++++++++++++ hack/preview.sh | 25 +++++++++++++++++++ 10 files changed, 79 insertions(+), 5 deletions(-) create mode 100644 argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml create mode 100644 components/konflux-operator/development/cr/overlay-patches/default-tenant/default-tenant.yaml create mode 100644 components/konflux-operator/development/cr/overlay-patches/default-tenant/kustomization.yaml create mode 100644 components/pipeline-service/development-operator/kustomization.yaml diff --git a/argo-cd-apps/overlays/development-operator/kustomization.yaml b/argo-cd-apps/overlays/development-operator/kustomization.yaml index a4a463f2b9d..b8024ae421d 100644 --- a/argo-cd-apps/overlays/development-operator/kustomization.yaml +++ b/argo-cd-apps/overlays/development-operator/kustomization.yaml @@ -3,6 +3,8 @@ # policies, pipeline-service, etc.) and deletes only the legacy Konflux # microservice ApplicationSets listed in delete-legacy-konflux-member-appsets.yaml # so those workloads are not deployed alongside the operator-managed stack. +# pipeline-service uses components/pipeline-service/development-operator/ (no +# appstudio-pipelines-scc); the operator build-service component owns that SCC. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: @@ -10,10 +12,15 @@ resources: - ../../base/member/infra-deployments/konflux-operator patchesStrategicMerge: - delete-legacy-konflux-member-appsets.yaml +namespace: openshift-gitops patches: - path: development-operator-generator-patch.yaml target: kind: ApplicationSet version: v1alpha1 name: konflux-operator -namespace: openshift-gitops + - path: pipeline-service-operator-patch.yaml + target: + kind: ApplicationSet + version: v1alpha1 + name: pipeline-service diff --git a/argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml b/argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml new file mode 100644 index 00000000000..535b6a9761e --- /dev/null +++ b/argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml @@ -0,0 +1,4 @@ +--- +- op: replace + path: /spec/generators/0/merge/generators/0/clusters/values/environment + value: development-operator diff --git a/components/konflux-operator/development/cr/overlay-patches/default-tenant/default-tenant.yaml b/components/konflux-operator/development/cr/overlay-patches/default-tenant/default-tenant.yaml new file mode 100644 index 00000000000..cc8c216bbc2 --- /dev/null +++ b/components/konflux-operator/development/cr/overlay-patches/default-tenant/default-tenant.yaml @@ -0,0 +1,7 @@ +apiVersion: konflux.konflux-ci.dev/v1alpha1 +kind: Konflux +metadata: + name: konflux +spec: + defaultTenant: + enabled: true diff --git a/components/konflux-operator/development/cr/overlay-patches/default-tenant/kustomization.yaml b/components/konflux-operator/development/cr/overlay-patches/default-tenant/kustomization.yaml new file mode 100644 index 00000000000..3789e4bd6c4 --- /dev/null +++ b/components/konflux-operator/development/cr/overlay-patches/default-tenant/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - path: default-tenant.yaml diff --git a/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml b/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml index d453dd0e3c8..3ca388c2fc1 100644 --- a/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml +++ b/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml @@ -4,4 +4,6 @@ metadata: name: konflux spec: imageController: - enabled: true + # patched by hack/preview.sh if IMAGE_CONTROLLER_QUAY_ORG and + # IMAGE_CONTROLLER_QUAY_TOKEN are set + enabled: false diff --git a/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml b/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml index 2d00cbe994f..59c25ef9cd2 100644 --- a/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml +++ b/components/konflux-operator/development/cr/overlay-patches/konflux-ui/ui.yaml @@ -10,7 +10,7 @@ spec: httpsPort: 30011 proxy: replicas: 1 - nginx: + reverseProxy: resources: requests: cpu: 30m diff --git a/components/konflux-operator/development/invariant/release-config.yaml b/components/konflux-operator/development/invariant/release-config.yaml index 3b4ab410ce1..bfccd1b44c6 100644 --- a/components/konflux-operator/development/invariant/release-config.yaml +++ b/components/konflux-operator/development/invariant/release-config.yaml @@ -7,6 +7,6 @@ spec: certManager: createClusterIssuer: true internalRegistry: - enabled: true + enabled: false defaultTenant: - enabled: true + enabled: false diff --git a/components/konflux-operator/development/kustomization.yaml b/components/konflux-operator/development/kustomization.yaml index 2b0b4a132f9..2e4ac7edc13 100644 --- a/components/konflux-operator/development/kustomization.yaml +++ b/components/konflux-operator/development/kustomization.yaml @@ -10,6 +10,7 @@ kind: Kustomization resources: - invariant components: + - cr/overlay-patches/default-tenant - cr/overlay-patches/build - cr/overlay-patches/image-controller - cr/overlay-patches/integration diff --git a/components/pipeline-service/development-operator/kustomization.yaml b/components/pipeline-service/development-operator/kustomization.yaml new file mode 100644 index 00000000000..3fea1fa84fb --- /dev/null +++ b/components/pipeline-service/development-operator/kustomization.yaml @@ -0,0 +1,24 @@ +# Used when Konflux is installed via the operator (development-operator Argo overlay). +# Reuses development Tekton/pipeline-service configuration but omits +# appstudio-pipelines-scc so build-service (operator) can own it with ownerReferences. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../development + +# This overlay is applied as live kustomize. Staging/production pipeline-service often +# uses per-cluster deploy.yaml (see components/pipeline-service/README.md); operator +# overlays there require the same SCC omission in whatever path Argo actually syncs. +patches: + - target: + group: security.openshift.io + version: v1 + kind: SecurityContextConstraints + name: appstudio-pipelines-scc + patch: | + apiVersion: security.openshift.io/v1 + kind: SecurityContextConstraints + metadata: + name: appstudio-pipelines-scc + $patch: delete diff --git a/hack/preview.sh b/hack/preview.sh index b6701d13dcd..ec44780e0c6 100755 --- a/hack/preview.sh +++ b/hack/preview.sh @@ -270,6 +270,8 @@ print_help() { echo "Environment (optional):" echo " PREVIEW_WAIT_KONFLUX_CR_READY=true When using --operator-overlay, additionally wait for the Konflux" echo " custom resource konflux to exist and report Ready=True (off by default)." + echo " IMAGE_CONTROLLER_QUAY_ORG, IMAGE_CONTROLLER_QUAY_TOKEN With --operator-overlay, both must be set in" + echo " hack/preview.env to enable image-controller on the Konflux CR (off by default)." echo echo "Example: \`$0 preview --obo --grafana --eaas\`" } @@ -378,6 +380,28 @@ configure_kueue_for_ocp_version() { log_success "Kueue disabled for OCP version $ocp_version" } +# Enable Konflux CR image-controller only when Quay credentials are provided (operator overlay). +configure_operator_image_controller() { + [ "$TARGET_PREVIEW_OVERLAY" != "development-operator" ] && return + + local cr_patch="$ROOT/components/konflux-operator/development/cr/overlay-patches/image-controller/image-controller.yaml" + + log_step "Configuring Konflux operator image-controller (Quay credentials)" + + if [[ -n "${IMAGE_CONTROLLER_QUAY_ORG}" && -n "${IMAGE_CONTROLLER_QUAY_TOKEN}" ]]; then + log_info "IMAGE_CONTROLLER_QUAY_ORG and IMAGE_CONTROLLER_QUAY_TOKEN are set" + log_info " - Quay organization: ${IMAGE_CONTROLLER_QUAY_ORG}" + yq -i '.spec.imageController.enabled = true' "$cr_patch" + log_success "Konflux CR image-controller: enabled (operator will deploy image-controller)" + else + log_info "IMAGE_CONTROLLER_QUAY_ORG and/or IMAGE_CONTROLLER_QUAY_TOKEN are not set" + [ -z "${IMAGE_CONTROLLER_QUAY_ORG}" ] && log_info " - IMAGE_CONTROLLER_QUAY_ORG: not set" + [ -z "${IMAGE_CONTROLLER_QUAY_TOKEN}" ] && log_info " - IMAGE_CONTROLLER_QUAY_TOKEN: not set" + yq -i '.spec.imageController.enabled = false' "$cr_patch" + log_warn "Konflux CR image-controller: disabled (set both Quay variables in hack/preview.env to enable)" + fi +} + # Apply service image overrides from environment variables apply_service_image_overrides() { log_step "Applying service image overrides from environment variables" @@ -1066,6 +1090,7 @@ label_cluster_nodes if [ "$TARGET_PREVIEW_OVERLAY" = "development" ] || [ "$TARGET_PREVIEW_OVERLAY" = "development-operator" ]; then configure_deploy_only configure_kueue_for_ocp_version + configure_operator_image_controller # Configure GitHub org log_step "Configuring GitHub organization" From 3ce44b54375363b8170e37e02890228e318c02fc Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Thu, 28 May 2026 10:51:41 +0000 Subject: [PATCH 73/83] mintmaker update (#11968) * update components/mintmaker/development/kustomization.yaml * update components/mintmaker/staging/base/kustomization.yaml --------- Co-authored-by: rh-tap-build-team[bot] <127938674+rh-tap-build-team[bot]@users.noreply.github.com> --- components/mintmaker/development/kustomization.yaml | 6 +++--- components/mintmaker/staging/base/kustomization.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/components/mintmaker/development/kustomization.yaml b/components/mintmaker/development/kustomization.yaml index 7ad439e9358..e0117bc2a4f 100644 --- a/components/mintmaker/development/kustomization.yaml +++ b/components/mintmaker/development/kustomization.yaml @@ -3,13 +3,13 @@ kind: Kustomization resources: - ../base - plrs-resource-quota.yaml - - https://github.com/konflux-ci/mintmaker/config/default?ref=70cfa98ddf51f87166807d7f2787677422471d20 - - https://github.com/konflux-ci/mintmaker/config/renovate?ref=70cfa98ddf51f87166807d7f2787677422471d20 + - https://github.com/konflux-ci/mintmaker/config/default?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d + - https://github.com/konflux-ci/mintmaker/config/renovate?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: 70cfa98ddf51f87166807d7f2787677422471d20 + newTag: c8d93fd9fbbe59b2cb567a319af71a156b1d788d - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image newTag: latest diff --git a/components/mintmaker/staging/base/kustomization.yaml b/components/mintmaker/staging/base/kustomization.yaml index 87e661b5044..88563d4f566 100644 --- a/components/mintmaker/staging/base/kustomization.yaml +++ b/components/mintmaker/staging/base/kustomization.yaml @@ -5,15 +5,15 @@ resources: - ../../base/external-secrets - ../blackbox - plrs-resource-quota.yaml -- https://github.com/konflux-ci/mintmaker/config/default?ref=70cfa98ddf51f87166807d7f2787677422471d20 -- https://github.com/konflux-ci/mintmaker/config/renovate?ref=70cfa98ddf51f87166807d7f2787677422471d20 +- https://github.com/konflux-ci/mintmaker/config/default?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d +- https://github.com/konflux-ci/mintmaker/config/renovate?ref=c8d93fd9fbbe59b2cb567a319af71a156b1d788d namespace: mintmaker images: - name: quay.io/konflux-ci/mintmaker newName: quay.io/konflux-ci/mintmaker - newTag: 70cfa98ddf51f87166807d7f2787677422471d20 + newTag: c8d93fd9fbbe59b2cb567a319af71a156b1d788d - name: quay.io/konflux-ci/mintmaker-renovate-image newName: quay.io/konflux-ci/mintmaker-renovate-image newTag: 5fa9e2f0134e156c6430eac52c16b8010f489539 From 0c23446dae08f5871b6ef3b8a8cd8f0d66357b27 Mon Sep 17 00:00:00 2001 From: Maksym Shaposhnyk Date: Thu, 28 May 2026 15:36:08 +0300 Subject: [PATCH 74/83] UI proxy: replace long-lived token with rotated short-lived tokens (production ring 1) (#11800) Ring 1 clusters: kflux-fedora-01, kflux-osp-p01, kflux-prd-rh02, kflux-prd-rh03, kflux-rhel-p01, stone-prod-p01 Ring 2 clusters (stone-prd-rh01, stone-prod-p02, kflux-ocp-p01) temporarily point to base-ring2 which preserves the old layout, to be migrated in a follow-up PR. Changes: - Add generate-nginx-configs-loop sidecar with liveness probe - Replace direct nginx command with bash wrapper for hot-reload - Replace long-lived SA token secret with projected token (600s TTL) - Add script ConfigMaps for proxy-nginx-run and proxy-nginx-generate-loop - Port bug fixes from konflux-ci/konflux-ci#6780 - Fix container index in overlay patches for ring 1 clusters - Update hack/new-cluster templates Signed-off-by: Max Shaposhnyk Co-authored-by: Cursor --- .../production/base-ring2/dex/dex.yaml | 128 ++++++ .../base-ring2/dex/kustomization.yaml | 4 + .../production/base-ring2/kustomization.yaml | 19 + .../production/base-ring2/proxy/auth.conf | 5 + .../production/base-ring2/proxy/kite.conf | 9 + .../base-ring2/proxy/kubearchive.conf | 7 + .../base-ring2/proxy/kustomization.yaml | 21 + .../production/base-ring2/proxy/nginx.conf | 190 +++++++++ .../proxy/otel-collector-config.yaml | 59 +++ .../production/base-ring2/proxy/proxy.yaml | 382 ++++++++++++++++++ .../proxy/tekton-results-workspaces.conf | 9 + .../base-ring2/proxy/tekton-results.conf | 8 + .../base-ring2/route-and-oauth.yaml | 52 +++ .../production/base/proxy/kustomization.yaml | 7 + .../production/base/proxy/proxy.yaml | 88 +++- .../proxy-nginx-generate-loop-probe.sh | 13 + .../scripts/proxy-nginx-generate-loop.sh | 40 ++ .../base/proxy/scripts/proxy-nginx-run.sh | 66 +++ .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 2 + .../kflux-ocp-p01/kustomization.yaml | 2 +- .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 2 + .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 2 + .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 2 + .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 2 + .../stone-prd-rh01/kustomization.yaml | 2 +- .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 2 + .../stone-prod-p02/kustomization.yaml | 2 +- .../konflux-ui/oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 2 + 35 files changed, 1112 insertions(+), 29 deletions(-) create mode 100644 components/konflux-ui/production/base-ring2/dex/dex.yaml create mode 100644 components/konflux-ui/production/base-ring2/dex/kustomization.yaml create mode 100644 components/konflux-ui/production/base-ring2/kustomization.yaml create mode 100644 components/konflux-ui/production/base-ring2/proxy/auth.conf create mode 100644 components/konflux-ui/production/base-ring2/proxy/kite.conf create mode 100644 components/konflux-ui/production/base-ring2/proxy/kubearchive.conf create mode 100644 components/konflux-ui/production/base-ring2/proxy/kustomization.yaml create mode 100644 components/konflux-ui/production/base-ring2/proxy/nginx.conf create mode 100644 components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml create mode 100644 components/konflux-ui/production/base-ring2/proxy/proxy.yaml create mode 100644 components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf create mode 100644 components/konflux-ui/production/base-ring2/proxy/tekton-results.conf create mode 100644 components/konflux-ui/production/base-ring2/route-and-oauth.yaml create mode 100644 components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop-probe.sh create mode 100644 components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop.sh create mode 100644 components/konflux-ui/production/base/proxy/scripts/proxy-nginx-run.sh diff --git a/components/konflux-ui/production/base-ring2/dex/dex.yaml b/components/konflux-ui/production/base-ring2/dex/dex.yaml new file mode 100644 index 00000000000..a9bfc5a552a --- /dev/null +++ b/components/konflux-ui/production/base-ring2/dex/dex.yaml @@ -0,0 +1,128 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: dex + name: dex + annotations: + ignore-check.kube-linter.io/no-anti-affinity: "Using topologySpreadConstraints" +spec: + replicas: 1 + selector: + matchLabels: + app: dex + template: + metadata: + labels: + app: dex + spec: + serviceAccountName: dex + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app: dex + containers: + - image: ghcr.io/dexidp/dex:v2.32.0 + name: dex + command: ["/usr/local/bin/dex", "serve", "/etc/dex/cfg/config.yaml"] + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 100m + memory: 256Mi + ports: + - name: https + containerPort: 9443 + - name: telemetry + containerPort: 5558 + protocol: TCP + volumeMounts: + - name: dex + mountPath: /etc/dex/cfg + - name: tls + mountPath: /etc/dex/tls + readinessProbe: + httpGet: + path: /healthz/ready + port: telemetry + env: + - name: GODEBUG + value: "http2server=0" + - name: OPENSHIFT_OAUTH_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: dex-client + key: token + - name: OAUTH2_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: oauth2-proxy-client-secret + key: client-secret + volumes: + - name: dex + configMap: + name: dex + defaultMode: 420 + items: + - key: dex-config.yaml + path: config.yaml + - name: tls + secret: + secretName: dex-cert +--- +apiVersion: v1 +kind: Service +metadata: + name: dex + annotations: + service.beta.openshift.io/serving-cert-secret-name: dex-cert +spec: + type: ClusterIP + ports: + - name: dex + port: 9443 + protocol: TCP + targetPort: 9443 + selector: + app: dex +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: dex + name: dex +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: dex +rules: +- apiGroups: ["dex.coreos.com"] # API group created by dex + resources: ["*"] + verbs: ["*"] +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["create"] # To manage its own resources, dex must be able to create customresourcedefinitions +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: dex +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: dex +subjects: +- kind: ServiceAccount + name: dex # Service account assigned to the dex pod, created above + namespace: konflux-ui # The namespace dex is running in diff --git a/components/konflux-ui/production/base-ring2/dex/kustomization.yaml b/components/konflux-ui/production/base-ring2/dex/kustomization.yaml new file mode 100644 index 00000000000..32291d2371d --- /dev/null +++ b/components/konflux-ui/production/base-ring2/dex/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - dex.yaml diff --git a/components/konflux-ui/production/base-ring2/kustomization.yaml b/components/konflux-ui/production/base-ring2/kustomization.yaml new file mode 100644 index 00000000000..33aa6477e8b --- /dev/null +++ b/components/konflux-ui/production/base-ring2/kustomization.yaml @@ -0,0 +1,19 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - dex + - proxy + - route-and-oauth.yaml + - ../../base + +images: + - name: quay.io/konflux-ci/workspace-manager + digest: sha256:48df30520a766101473e80e7a4abbf59ce06097a5f5919e15075afaa86bd1a2d + + - name: quay.io/konflux-ci/konflux-ui + newTag: ed23c9b83394454b5822049748939a26a5626093 + + - name: quay.io/oauth2-proxy/oauth2-proxy + digest: sha256:3da33b9670c67bd782277f99acadf7026f75b9507bfba2088eb2d497266ef7fc + +namespace: konflux-ui diff --git a/components/konflux-ui/production/base-ring2/proxy/auth.conf b/components/konflux-ui/production/base-ring2/proxy/auth.conf new file mode 100644 index 00000000000..6b5cad3adaf --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/auth.conf @@ -0,0 +1,5 @@ +# Auth configuration with impersonation enabled +auth_request_set $user $upstream_http_x_auth_request_email; +proxy_set_header Impersonate-User $user; +proxy_set_header Impersonate-Group system:authenticated; +proxy_set_header Authorization "Bearer __BEARER_TOKEN__"; diff --git a/components/konflux-ui/production/base-ring2/proxy/kite.conf b/components/konflux-ui/production/base-ring2/proxy/kite.conf new file mode 100644 index 00000000000..a8d5ed7daeb --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/kite.conf @@ -0,0 +1,9 @@ +location /api/k8s/plugins/kite/ { + auth_request /oauth2/auth; + rewrite /api/k8s/plugins/kite/(.+) /$1 break; + proxy_read_timeout 30m; + proxy_pass https://konflux-kite.konflux-kite.svc.cluster.local; + include /mnt/nginx-generated-config/auth.conf; +} + + diff --git a/components/konflux-ui/production/base-ring2/proxy/kubearchive.conf b/components/konflux-ui/production/base-ring2/proxy/kubearchive.conf new file mode 100644 index 00000000000..d87f2dbf983 --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/kubearchive.conf @@ -0,0 +1,7 @@ +location /api/k8s/plugins/kubearchive/ { + auth_request /oauth2/auth; + rewrite /api/k8s/plugins/kubearchive/(.+) /$1 break; + proxy_read_timeout 30m; + proxy_pass https://kubearchive-api-server.product-kubearchive.svc.cluster.local:8081; + include /mnt/nginx-generated-config/auth.conf; +} diff --git a/components/konflux-ui/production/base-ring2/proxy/kustomization.yaml b/components/konflux-ui/production/base-ring2/proxy/kustomization.yaml new file mode 100644 index 00000000000..1c632296456 --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/kustomization.yaml @@ -0,0 +1,21 @@ +kind: Kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +resources: + - proxy.yaml + +configMapGenerator: + - name: proxy + files: + - nginx.conf + - name: proxy-nginx-templates + files: + - auth.conf + - name: proxy-nginx-static + files: + - tekton-results.conf + - tekton-results-workspaces.conf + - kite.conf + - kubearchive.conf + - name: otel-collector-config + files: + - otel-collector-config.yaml diff --git a/components/konflux-ui/production/base-ring2/proxy/nginx.conf b/components/konflux-ui/production/base-ring2/proxy/nginx.conf new file mode 100644 index 00000000000..04cb4160075 --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/nginx.conf @@ -0,0 +1,190 @@ +worker_processes auto; +error_log /var/log/nginx/error.log; +pid /run/nginx.pid; + +# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. +include /usr/share/nginx/modules/*.conf; + +events { + worker_connections 1024; +} + +http { + log_format upstreamlog '[$time_local] $remote_addr - $remote_user - $server_name $host to: $proxy_host $upstream_addr: $request $status upstream_response_time $upstream_response_time msec $msec request_time $request_time'; + access_log /dev/stderr upstreamlog; + error_log /dev/stderr; + + log_format combined_custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"'; + access_log /var/log/nginx/access.log combined_custom; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 4096; + + default_type application/octet-stream; + include /etc/nginx/mime.types; + + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + map $request_method $ns_target { + GET @namespacelister; + default @kubeapi; + } + + server { + listen 9443 ssl; + ssl_certificate /mnt/tls.crt; + ssl_certificate_key /mnt/tls.key; + server_name _; + root /opt/app-root/src; + + location / { + alias /opt/app-root/src/static-content/; + try_files $uri /index.html; + } + + location = /404.html { + } + + location = /oauth2/auth { + internal; + proxy_pass http://127.0.0.1:6000; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Scheme $scheme; + # nginx auth_request includes headers but not body + proxy_set_header Content-Length ""; + proxy_pass_request_body off; + } + + location /oauth2/ { + proxy_pass http://127.0.0.1:6000/oauth2/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Scheme $scheme; + } + + location /api/k8s/registration/ { + # Registration Service registration endpoint + auth_request_set $email $upstream_http_x_auth_request_email; + proxy_set_header X-Email $email; + auth_request_set $user $upstream_http_x_auth_request_user; + proxy_set_header X-User $user; + auth_request_set $username $upstream_http_x_auth_request_preferred_username; + proxy_set_header X-Auth-Request-Preferred-Username $username; + auth_request_set $groups $upstream_http_x_auth_request_groups; + proxy_set_header X-Auth-Request-Groups $user; + + auth_request /oauth2/auth; + proxy_pass http://127.0.0.1:5000/; + } + + location /api/k8s/apis/toolchain.dev.openshift.com/v1alpha1/workspaces { + # Registration Service workspaces endpoint + auth_request_set $email $upstream_http_x_auth_request_email; + proxy_set_header X-Email $email; + auth_request_set $user $upstream_http_x_auth_request_user; + proxy_set_header X-User $user; + auth_request_set $username $upstream_http_x_auth_request_preferred_username; + proxy_set_header X-Auth-Request-Preferred-Username $username; + auth_request_set $groups $upstream_http_x_auth_request_groups; + proxy_set_header X-Auth-Request-Groups $user; + + auth_request /oauth2/auth; + proxy_pass http://127.0.0.1:5000/workspaces; + } + + location /api/k8s/workspaces/ { + # Kube-API + auth_request /oauth2/auth; + + rewrite /api/k8s/workspaces/.+?/(.+) /$1 break; + proxy_pass https://kubernetes.default.svc; + proxy_read_timeout 30m; + include /mnt/nginx-generated-config/auth.conf; + } + + location /wss/k8s/workspaces/ { + auth_request /oauth2/auth; + + rewrite /wss/k8s/workspaces/.+?/(.+) /$1 break; + proxy_pass https://kubernetes.default.svc/; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_read_timeout 30m; + include /mnt/nginx-generated-config/auth.conf; + } + + location /api/k8s/ { + # Kube-API + auth_request /oauth2/auth; + + proxy_pass https://kubernetes.default.svc/; + proxy_read_timeout 30m; + include /mnt/nginx-generated-config/auth.conf; + } + + location /wss/k8s/ { + auth_request /oauth2/auth; + + rewrite /wss/k8s/(.+) /$1 break; + proxy_pass https://kubernetes.default.svc/; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_read_timeout 30m; + include /mnt/nginx-generated-config/auth.conf; + } + + + + # GET requests to /api/k8s/api/v1/namespaces and /api/k8s/api/v1/namespaces/ + # are handled from the namespace-lister. + # Requests with other methods are handled by the Kube-API + location = /api/k8s/api/v1/namespaces { + try_files /dev/null $ns_target; + } + location = /api/k8s/api/v1/namespaces/ { + try_files /dev/null $ns_target; + } + + location @namespacelister { + auth_request_set $email $upstream_http_x_auth_request_email; + auth_request /oauth2/auth; + proxy_read_timeout 30m; + proxy_set_header X-User $email; + proxy_set_header X-Group system:authenticated; + proxy_hide_header X-Correlation-ID; + + rewrite ^.*$ /api/v1/namespaces break; + + proxy_pass https://namespace-lister.namespace-lister.svc.cluster.local:8080; + } + + location @kubeapi { + auth_request_set $email $upstream_http_x_auth_request_email; + auth_request /oauth2/auth; + proxy_read_timeout 30m; + proxy_set_header X-Email $email; + + rewrite ^/api/k8s/(.*)/$ /$1 break; + + proxy_pass https://kubernetes.default.svc; + proxy_set_header Impersonate-User $email; + include /mnt/nginx-generated-config/auth.conf; + } + + location /health { + # Used for liveness probes + return 200; + } + + include /mnt/nginx-additional-location-configs/*.conf; + } +} diff --git a/components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml b/components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml new file mode 100644 index 00000000000..46afbc956c7 --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml @@ -0,0 +1,59 @@ +receivers: + filelog/nginx: + include: + - /var/log/nginx/access.log + start_at: end + operators: + - type: regex_parser + regex: '^(?P[^ ]*) - (?P[^ ]*) \[(?P[^\]]*)\] "(?P[^ ]*) (?P[^ ]*) (?P[^"]*)" (?P\d+) (?P\d+) "(?P[^"]*)" "(?P[^"]*)"$' + - type: time_parser + parse_from: attributes.time_local + layout: '%d/%b/%Y:%H:%M:%S %z' + to_timestamp: true + +processors: + transform/status_to_int: + log_statements: + - context: log + statements: + - set(attributes["status_int"], Int(attributes["status"])) + deltatocumulative: + max_stale: 10m + max_streams: 10000 + batch: + timeout: 10s + send_batch_size: 100 + send_batch_max_size: 200 + +extensions: + health_check: + endpoint: "0.0.0.0:13133" + +exporters: + prometheus: + endpoint: "0.0.0.0:8889" + +connectors: + count: + logs: + nginx_otel_http_request_errors: + description: HTTP 4xx and 5xx errors from NGINX + conditions: + - 'attributes["status_int"] >= 400 and attributes["status_int"] < 600' + attributes: + - key: method + value: attributes["method"] + - key: status + value: attributes["status"] + +service: + extensions: [health_check] + pipelines: + logs: + receivers: [filelog/nginx] + processors: [transform/status_to_int, batch] + exporters: [count] + metrics: + receivers: [count] + processors: [deltatocumulative, batch] + exporters: [prometheus] diff --git a/components/konflux-ui/production/base-ring2/proxy/proxy.yaml b/components/konflux-ui/production/base-ring2/proxy/proxy.yaml new file mode 100644 index 00000000000..c6648654bd7 --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/proxy.yaml @@ -0,0 +1,382 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: proxy + name: proxy + annotations: + ignore-check.kube-linter.io/no-anti-affinity: "Using topologySpreadConstraints" +spec: + replicas: 1 + selector: + matchLabels: + app: proxy + minReadySeconds: 30 + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 0 + template: + metadata: + labels: + app: proxy + spec: + serviceAccountName: proxy + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app: proxy + initContainers: + - name: copy-static-content + image: quay.io/konflux-ci/konflux-ui:68500b32e57278bf33ac18d4ef631ef243abb579 + command: + - cp + - -R + - /opt/app-root/src/. + - /mnt/static-content/ + volumeMounts: + - name: static-content + mountPath: /mnt/static-content + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + - name: generate-nginx-configs + image: registry.access.redhat.com/ubi9/ubi@sha256:66233eebd72bb5baa25190d4f55e1dc3fff3a9b77186c1f91a0abdb274452072 + command: + - sh + - -c + - | + set -e + + # Generate auth.conf with bearer token replacement + token=$(cat /mnt/api-token/token) + sed "s/__BEARER_TOKEN__/$token/g" /mnt/nginx-templates/auth.conf > /mnt/nginx-generated-config/auth.conf + + chmod 640 /mnt/nginx-generated-config/auth.conf + + volumeMounts: + - name: nginx-generated-config + mountPath: /mnt/nginx-generated-config + - name: nginx-templates + mountPath: /mnt/nginx-templates + - name: api-token + mountPath: /mnt/api-token + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + containers: + - image: registry.access.redhat.com/ubi9/nginx-124@sha256:b924363ff07ee0f8fd4f680497da774ac0721722a119665998ff5b2111098ad1 + name: nginx + command: + - nginx + - "-g" + - "daemon off;" + - -c + - /etc/nginx/nginx.conf + livenessProbe: + failureThreshold: 3 + httpGet: + path: /health + port: 9443 + scheme: HTTPS + initialDelaySeconds: 30 + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + failureThreshold: 3 + httpGet: + path: /health + port: 9443 + scheme: HTTPS + initialDelaySeconds: 30 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + ports: + - containerPort: 8080 + name: web + protocol: TCP + - containerPort: 9443 + name: web-tls + protocol: TCP + resources: + limits: + cpu: 300m + memory: 256Mi + requests: + cpu: 30m + memory: 128Mi + volumeMounts: + - mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + name: proxy + readOnly: true + - name: logs + mountPath: /var/log/nginx + - name: nginx-tmp + mountPath: /var/lib/nginx/tmp + - name: run + mountPath: /run + - name: serving-cert + mountPath: /mnt + - name: nginx-generated-config + mountPath: /mnt/nginx-generated-config + - name: nginx-static + mountPath: /mnt/nginx-additional-location-configs + - name: static-content + mountPath: /opt/app-root/src/static-content + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + - image: quay.io/konflux-ci/workspace-manager@sha256:48df30520a766101473e80e7a4abbf59ce06097a5f5919e15075afaa86bd1a2d + name: workspace-manager + ports: + - containerPort: 5000 + name: web + protocol: TCP + resources: + limits: + cpu: 300m + memory: 256Mi + requests: + cpu: 30m + memory: 128Mi + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + - image: quay.io/oauth2-proxy/oauth2-proxy@sha256:3da33b9670c67bd782277f99acadf7026f75b9507bfba2088eb2d497266ef7fc + name: oauth2-proxy + env: + - name: OAUTH2_PROXY_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: oauth2-proxy-client-secret + key: client-secret + - name: OAUTH2_PROXY_COOKIE_SECRET + valueFrom: + secretKeyRef: + name: oauth2-proxy-cookie-secret + key: cookie-secret + args: + - tba + ports: + - containerPort: 6000 + name: web + protocol: TCP + resources: + limits: + cpu: 300m + memory: 256Mi + requests: + cpu: 30m + memory: 128Mi + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + - image: quay.io/factory2/otel-collector-sp/otel-binary-image:0.137.0 + imagePullPolicy: Always + name: otel-collector + command: ["/usr/local/bin/otel-collector-sp", "--config", "/conf/otel-collector-config.yaml"] + ports: + - containerPort: 8889 + name: otel-metrics + - containerPort: 13133 + name: otel-health + protocol: TCP + volumeMounts: + - name: logs + mountPath: /var/log/nginx + - mountPath: /conf/otel-collector-config.yaml + subPath: otel-collector-config.yaml + name: otel-collector-config + readOnly: true + readinessProbe: + httpGet: + path: /health + port: 13133 + initialDelaySeconds: 5 + periodSeconds: 5 + livenessProbe: + httpGet: + path: /health + port: 13133 + initialDelaySeconds: 30 + periodSeconds: 60 + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + resources: + limits: + cpu: 150m + memory: 256Mi + requests: + cpu: 50m + memory: 128Mi + volumes: + - configMap: + defaultMode: 420 + name: proxy + items: + - key: nginx.conf + path: nginx.conf + name: proxy + - configMap: + defaultMode: 420 + name: proxy-nginx-templates + name: nginx-templates + - configMap: + defaultMode: 420 + name: proxy-nginx-static + name: nginx-static + - name: logs + emptyDir: {} + - name: nginx-tmp + emptyDir: {} + - name: run + emptyDir: {} + - name: serving-cert + secret: + secretName: serving-cert + - name: nginx-generated-config + emptyDir: {} + - name: api-token + secret: + secretName: proxy + - name: static-content + emptyDir: {} + - configMap: + defaultMode: 420 + name: otel-collector-config + items: + - key: otel-collector-config.yaml + path: otel-collector-config.yaml + name: otel-collector-config +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: proxy + name: proxy +spec: + type: ClusterIP + internalTrafficPolicy: Cluster + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - name: web + port: 8888 + protocol: TCP + targetPort: web + - name: web-tls + port: 9443 + protocol: TCP + targetPort: web-tls + - name: otel-metrics + protocol: TCP + port: 8889 + targetPort: 8889 + selector: + app: proxy +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: proxy +--- +apiVersion: v1 +kind: Secret +metadata: + name: proxy + annotations: + kubernetes.io/service-account.name: proxy +type: kubernetes.io/service-account-token +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: konflux-proxy +rules: +- apiGroups: [""] + resources: ["groups"] + verbs: ["impersonate"] + resourceNames: ["system:authenticated"] +- apiGroups: [""] + resources: ["users"] + verbs: ["impersonate"] +- apiGroups: ["authorization.k8s.io"] + resources: ["localsubjectaccessreviews"] + verbs: ["create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: konflux-proxy +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: konflux-proxy +subjects: +- kind: ServiceAccount + name: proxy + namespace: konflux-ui +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: konflux-proxy-namespace-lister +rules: +- apiGroups: [""] + resources: ["namespaces"] + verbs: ["list", "get"] +--- +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: nginx-proxy-monitor +spec: + selector: + matchLabels: + app: proxy + endpoints: + - port: otel-metrics + interval: 15s +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: konflux-proxy-namespace-lister +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: konflux-proxy-namespace-lister +subjects: +- kind: ServiceAccount + name: proxy + namespace: konflux-ui diff --git a/components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf b/components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf new file mode 100644 index 00000000000..922b3d676e3 --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf @@ -0,0 +1,9 @@ +# Deprecated +location /api/k8s/plugins/tekton-results/workspaces/ { + auth_request /oauth2/auth; + + rewrite /api/k8s/plugins/tekton-results/workspaces/.+?/(.+) /$1 break; + proxy_read_timeout 30m; + proxy_pass https://tekton-results-api-service.tekton-results.svc.cluster.local:8080; + include /mnt/nginx-generated-config/auth.conf; +} diff --git a/components/konflux-ui/production/base-ring2/proxy/tekton-results.conf b/components/konflux-ui/production/base-ring2/proxy/tekton-results.conf new file mode 100644 index 00000000000..b6fc7cd5921 --- /dev/null +++ b/components/konflux-ui/production/base-ring2/proxy/tekton-results.conf @@ -0,0 +1,8 @@ +location /api/k8s/plugins/tekton-results/ { + auth_request /oauth2/auth; + + rewrite /api/k8s/plugins/tekton-results/(.+) /$1 break; + proxy_read_timeout 30m; + proxy_pass https://tekton-results-api-service.tekton-results.svc.cluster.local:8080; + include /mnt/nginx-generated-config/auth.conf; +} diff --git a/components/konflux-ui/production/base-ring2/route-and-oauth.yaml b/components/konflux-ui/production/base-ring2/route-and-oauth.yaml new file mode 100644 index 00000000000..89ec448f98e --- /dev/null +++ b/components/konflux-ui/production/base-ring2/route-and-oauth.yaml @@ -0,0 +1,52 @@ +--- +apiVersion: route.openshift.io/v1 +kind: Route +metadata: + name: konflux + annotations: + # Needed for running a local development env for the Konflux UI + haproxy.router.openshift.io/set-forwarded-headers: if-none +spec: + host: tba + path: / + port: + targetPort: web-tls + tls: + insecureEdgeTerminationPolicy: Redirect + termination: reencrypt + to: + kind: Service + name: proxy + weight: 100 +--- +apiVersion: route.openshift.io/v1 +kind: Route +metadata: + name: konflux-idp +spec: + host: tba + path: /idp + port: + targetPort: dex + tls: + insecureEdgeTerminationPolicy: Redirect + termination: reencrypt + to: + kind: Service + name: dex + weight: 100 +--- +kind: ServiceAccount +apiVersion: v1 +metadata: + name: dex-client + annotations: + serviceaccounts.openshift.io/oauth-redirecturi.konflux: tba +--- +kind: Secret +apiVersion: v1 +metadata: + name: dex-client + annotations: + kubernetes.io/service-account.name: dex-client +type: kubernetes.io/service-account-token diff --git a/components/konflux-ui/production/base/proxy/kustomization.yaml b/components/konflux-ui/production/base/proxy/kustomization.yaml index 1c632296456..1a669027d27 100644 --- a/components/konflux-ui/production/base/proxy/kustomization.yaml +++ b/components/konflux-ui/production/base/proxy/kustomization.yaml @@ -10,6 +10,13 @@ configMapGenerator: - name: proxy-nginx-templates files: - auth.conf + - name: proxy-nginx-run + files: + - proxy-nginx-run.sh=scripts/proxy-nginx-run.sh + - name: proxy-nginx-generate-loop + files: + - proxy-nginx-generate-loop.sh=scripts/proxy-nginx-generate-loop.sh + - proxy-nginx-generate-loop-probe.sh=scripts/proxy-nginx-generate-loop-probe.sh - name: proxy-nginx-static files: - tekton-results.conf diff --git a/components/konflux-ui/production/base/proxy/proxy.yaml b/components/konflux-ui/production/base/proxy/proxy.yaml index c6648654bd7..80cb6c46d03 100644 --- a/components/konflux-ui/production/base/proxy/proxy.yaml +++ b/components/konflux-ui/production/base/proxy/proxy.yaml @@ -61,18 +61,19 @@ spec: set -e # Generate auth.conf with bearer token replacement - token=$(cat /mnt/api-token/token) + token=$(cat /var/run/secrets/konflux-ci.dev/serviceaccount/token) sed "s/__BEARER_TOKEN__/$token/g" /mnt/nginx-templates/auth.conf > /mnt/nginx-generated-config/auth.conf chmod 640 /mnt/nginx-generated-config/auth.conf volumeMounts: + - mountPath: /var/run/secrets/konflux-ci.dev/serviceaccount + name: kube-api-token + readOnly: true - name: nginx-generated-config mountPath: /mnt/nginx-generated-config - name: nginx-templates mountPath: /mnt/nginx-templates - - name: api-token - mountPath: /mnt/api-token securityContext: readOnlyRootFilesystem: true runAsNonRoot: true @@ -85,14 +86,48 @@ spec: cpu: 10m memory: 64Mi containers: + - name: generate-nginx-configs-loop + image: quay.io/konflux-ci/konflux-ui:68500b32e57278bf33ac18d4ef631ef243abb579 + command: + - bash + args: + - "/var/run/scripts/konflux-ci.dev/proxy-nginx-generate-loop.sh" + livenessProbe: + exec: + command: + - bash + - "/var/run/scripts/konflux-ci.dev/proxy-nginx-generate-loop-probe.sh" + initialDelaySeconds: 30 + periodSeconds: 30 + failureThreshold: 3 + volumeMounts: + - mountPath: /var/run/scripts/konflux-ci.dev/ + name: proxy-generate-loop-script + readOnly: true + - mountPath: /var/run/secrets/konflux-ci.dev/serviceaccount + name: kube-api-token + readOnly: true + - name: nginx-generated-config + mountPath: /mnt/nginx-generated-config + - name: nginx-templates + mountPath: /mnt/nginx-templates + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi - image: registry.access.redhat.com/ubi9/nginx-124@sha256:b924363ff07ee0f8fd4f680497da774ac0721722a119665998ff5b2111098ad1 name: nginx command: - - nginx - - "-g" - - "daemon off;" - - -c - - /etc/nginx/nginx.conf + - bash + args: + - "/var/run/scripts/konflux-ci.dev/proxy-nginx-run.sh" livenessProbe: failureThreshold: 3 httpGet: @@ -128,6 +163,9 @@ spec: cpu: 30m memory: 128Mi volumeMounts: + - mountPath: /var/run/scripts/konflux-ci.dev/ + name: proxy-nginx-run-script + readOnly: true - mountPath: /etc/nginx/nginx.conf subPath: nginx.conf name: proxy @@ -238,6 +276,29 @@ spec: cpu: 50m memory: 128Mi volumes: + - name: proxy-generate-loop-script + configMap: + defaultMode: 0750 + name: proxy-nginx-generate-loop + items: + - key: proxy-nginx-generate-loop.sh + path: proxy-nginx-generate-loop.sh + - key: proxy-nginx-generate-loop-probe.sh + path: proxy-nginx-generate-loop-probe.sh + - name: proxy-nginx-run-script + configMap: + defaultMode: 0750 + name: proxy-nginx-run + items: + - key: proxy-nginx-run.sh + path: proxy-nginx-run.sh + - name: kube-api-token + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + expirationSeconds: 600 + path: token - configMap: defaultMode: 420 name: proxy @@ -264,9 +325,6 @@ spec: secretName: serving-cert - name: nginx-generated-config emptyDir: {} - - name: api-token - secret: - secretName: proxy - name: static-content emptyDir: {} - configMap: @@ -310,14 +368,6 @@ kind: ServiceAccount metadata: name: proxy --- -apiVersion: v1 -kind: Secret -metadata: - name: proxy - annotations: - kubernetes.io/service-account.name: proxy -type: kubernetes.io/service-account-token ---- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop-probe.sh b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop-probe.sh new file mode 100644 index 00000000000..d545b25cab6 --- /dev/null +++ b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop-probe.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +set -euo pipefail + +for cmd in date stat; do + command -v "${cmd}" >/dev/null 2>&1 || { echo "required command not found: ${cmd}"; exit 1; } +done + +AUTH_CONF_FILE=/mnt/nginx-generated-config/auth.conf +AUTH_CONF_NEW_FILE=/mnt/nginx-generated-config/auth.conf.new + +{ [ -f "${AUTH_CONF_NEW_FILE}" ] && [ $(( $(date +%s) - $(stat -c %Y "${AUTH_CONF_NEW_FILE}") )) -lt 60 ]; } || \ + { [ -f "${AUTH_CONF_FILE}" ] && [ $(( $(date +%s) - $(stat -c %Y "${AUTH_CONF_FILE}") )) -lt 60 ]; } diff --git a/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop.sh b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop.sh new file mode 100644 index 00000000000..62bc290de19 --- /dev/null +++ b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-generate-loop.sh @@ -0,0 +1,40 @@ +#!/bin/bash + +set -euo pipefail + +RETRY_INTERVAL=10 +TOKEN_FILEPATH=/var/run/secrets/konflux-ci.dev/serviceaccount/token +AUTH_CONF_FILE=/mnt/nginx-generated-config/auth.conf.new +AUTH_CONF_TMP_FILE=/mnt/nginx-generated-config/auth.conf.new.tmp +AUTH_CONF_TEMPLATE_FILE=/mnt/nginx-templates/auth.conf + +for cmd in cat sed chmod mv sleep date; do + command -v "${cmd}" >/dev/null 2>&1 || { echo "required command not found: ${cmd}"; exit 1; } +done + +log() { echo "$(date -Iseconds) generate-loop: $*"; } + +log "starting" + +produceToken() ( + # Copy the auth.conf template and replace the bearer token + token=$(cat "${TOKEN_FILEPATH}") + + # Produce a tmp file + sed "s/__BEARER_TOKEN__/${token}/" "${AUTH_CONF_TEMPLATE_FILE}" > "${AUTH_CONF_TMP_FILE}" + chmod 640 "${AUTH_CONF_TMP_FILE}" + + # Rename (atomic) the file to avoid sync issues + mv "${AUTH_CONF_TMP_FILE}" "${AUTH_CONF_FILE}" +) + +produceTokenWithRetry() ( + produceToken || \ + { sleep 3; produceToken; } || \ + { sleep 5; produceToken; } +) + +while produceTokenWithRetry; do sleep "${RETRY_INTERVAL}"; done + +echo "loop broke, crashing" +exit 1 diff --git a/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-run.sh b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-run.sh new file mode 100644 index 00000000000..1de84b7557c --- /dev/null +++ b/components/konflux-ui/production/base/proxy/scripts/proxy-nginx-run.sh @@ -0,0 +1,66 @@ +#!/bin/bash + +set -euo pipefail + +NGINX_AUTH_CONF_FILE='/mnt/nginx-generated-config/auth.conf' +NGINX_NEW_AUTH_CONF_FILE='/mnt/nginx-generated-config/auth.conf.new' + +NGINX_CONF_FILE='/etc/nginx/nginx.conf' +RETRY_INTERVAL=10 + +for cmd in nginx cksum mv sleep date; do + command -v "${cmd}" >/dev/null 2>&1 || { echo "required command not found: ${cmd}"; exit 1; } +done + +log() { echo "$(date -Iseconds) proxy-nginx-run: $*"; } + +log "starting" + +# test configuration +nginx -g "daemon off;" -c "${NGINX_CONF_FILE}" -t + +# run the hot-reload loop in background +( + # wait for nginx to start before first reload attempt + while [ ! -f /run/nginx.pid ]; do sleep 1; done + + log "hot-reload loop started" + + # retries hot reloading the nginx configuration multiple + # times with increasing timeouts before returning the error + reloadWithRetry() { + if [ -f "${NGINX_NEW_AUTH_CONF_FILE}" ] && \ + [ "$(cksum < "${NGINX_NEW_AUTH_CONF_FILE}")" != "$(cksum < "${NGINX_AUTH_CONF_FILE}")" ]; then + log "config changed, reloading nginx" + # Move (atomic) the new configuration and reload it in NGINX + mv "${NGINX_NEW_AUTH_CONF_FILE}" "${NGINX_AUTH_CONF_FILE}" && \ + { + nginx -s reload || \ + { sleep 3; nginx -s reload; } || \ + { sleep 5; nginx -s reload; } + } + fi + } + + # hot reload infinite loop + while reloadWithRetry; do sleep "${RETRY_INTERVAL}"; done + + log "loop broke, crashing" + exit 1 +) & +RELOAD_PID=$! + +# run the nginx server in background +( + nginx -g "daemon off;" -c "${NGINX_CONF_FILE}" + log "nginx crashed" + exit 1 +) & +# forward SIGTERM/SIGINT for graceful shutdown +trap 'log "received signal, shutting down"; nginx -s quit 2>/dev/null; kill "${RELOAD_PID}" 2>/dev/null; wait; exit 0' TERM INT + +# wait for any of the background tasks to crash +wait -n +EXIT_CODE=$? +log "child exited with code ${EXIT_CODE}, terminating" +exit "${EXIT_CODE}" diff --git a/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml index 0e34d2388f4..fa08442b63d 100644 --- a/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-fedora-01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-fedora-01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml b/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml index a927dc3b6f9..190231184c2 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base + - ../base-ring2 # Remove this comment to rotate dex and proxy secrets # - configure-oauth-proxy-secret.yaml diff --git a/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml index 02d4fd44253..b55eec1b85c 100644 --- a/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-osp-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-osp-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml index 117aae75f28..4521b614e86 100644 --- a/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh02/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh02/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml index 7892819994d..870077fe5e0 100644 --- a/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh03/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-prd-rh03/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml index 23a2ea2bbe9..e6b3c55b976 100644 --- a/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-rhel-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-rhel-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml b/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml index 4e2a7843e47..c5f32bfb02a 100644 --- a/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base + - ../base-ring2 # Remove this comment to rotate dex and proxy secrets # - configure-oauth-proxy-secret.yaml diff --git a/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml index ea18a09b25f..22ead7b8458 100644 --- a/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/stone-prod-p02/kustomization.yaml b/components/konflux-ui/production/stone-prod-p02/kustomization.yaml index 4e2a7843e47..c5f32bfb02a 100644 --- a/components/konflux-ui/production/stone-prod-p02/kustomization.yaml +++ b/components/konflux-ui/production/stone-prod-p02/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base + - ../base-ring2 # Remove this comment to rotate dex and proxy secrets # - configure-oauth-proxy-secret.yaml diff --git a/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml b/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml index 26e0e712985..55d366028e7 100644 --- a/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml +++ b/hack/new-cluster/templates/konflux-ui/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml b/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..f2b77944793 100644 --- a/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml +++ b/hack/new-cluster/templates/konflux-ui/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,5 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser From 6603ad700d9747c83076d56f3aeda7344837bd80 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marta=20A=C3=B1=C3=B3n=20Ruiz?= Date: Thu, 28 May 2026 15:26:51 +0200 Subject: [PATCH 75/83] Upgrade kubearchive to v1.22.1 in stone-prd-rh01 (#12040) Split MIGRATION_VERSION into two configmaps following the staging/p02 pattern: kubearchive-schema-version (for the migration Job) and kubearchive-deployment-schema-version (for deployments). This ensures deployments pick up the new schema version only after the migration Job completes via ArgoCD sync waves. Signed-off-by: Marta Anon Co-authored-by: Claude Opus 4.6 --- .../stone-prd-rh01/kubearchive.yaml | 84 +++++++++---------- .../stone-prd-rh01/kustomization.yaml | 25 ++++-- 2 files changed, 61 insertions(+), 48 deletions(-) diff --git a/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml b/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml index 04132be852a..59e250253ba 100644 --- a/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml +++ b/components/kubearchive/production/stone-prd-rh01/kubearchive.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/component: namespace app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive --- apiVersion: apiextensions.k8s.io/v1 @@ -552,7 +552,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive --- @@ -563,7 +563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-cluster-vacuum namespace: kubearchive --- @@ -574,7 +574,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -585,7 +585,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive --- @@ -596,7 +596,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive rules: @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive rules: @@ -659,7 +659,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server rules: - apiGroups: @@ -677,7 +677,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-edit app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-edit: "true" name: kubearchive-edit rules: @@ -791,7 +791,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-editor app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-editor rules: - apiGroups: @@ -820,7 +820,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-config-viewer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-config-viewer rules: - apiGroups: @@ -844,7 +844,7 @@ metadata: labels: app.kubernetes.io/name: kubearchive-view app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 rbac.authorization.k8s.io/aggregate-to-view: "true" name: kubearchive-view rules: @@ -868,7 +868,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-leader-election app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-leader-election namespace: kubearchive roleRef: @@ -887,7 +887,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-vacuum namespace: kubearchive roleRef: @@ -906,7 +906,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server roleRef: apiGroup: rbac.authorization.k8s.io @@ -924,7 +924,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -943,7 +943,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-reader app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-reader namespace: kubearchive --- @@ -955,7 +955,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging-writer app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging-writer namespace: kubearchive --- @@ -972,7 +972,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive --- @@ -980,7 +980,7 @@ apiVersion: v1 data: DATABASE_DB: a3ViZWFyY2hpdmU= DATABASE_KIND: cG9zdGdyZXNxbA== - DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== + DATABASE_PASSWORD: RGF0IWFiYXNdM1Bhc3MqdzByZA== # gitleaks:allow DATABASE_PORT: NTQzMg== DATABASE_URL: a3ViZWFyY2hpdmUtcncucG9zdGdyZXNxbC5zdmMuY2x1c3Rlci5sb2NhbA== DATABASE_USER: a3ViZWFyY2hpdmU= @@ -990,7 +990,7 @@ metadata: app.kubernetes.io/component: database app.kubernetes.io/name: kubearchive-database-credentials app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-database-credentials namespace: kubearchive type: Opaque @@ -1002,7 +1002,7 @@ metadata: app.kubernetes.io/component: logging app.kubernetes.io/name: kubearchive-logging app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-logging namespace: kubearchive stringData: @@ -1016,7 +1016,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1035,7 +1035,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-webhooks app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-webhooks namespace: kubearchive spec: @@ -1058,7 +1058,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1076,7 +1076,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server namespace: kubearchive spec: @@ -1130,7 +1130,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/api:v1.20.0@sha256:43938bb7fabcc543cd3b5af0c9074196328f393d6e712f379572cca5ecfaab3c + image: quay.io/kubearchive/api:v1.22.1@sha256:f8d51f53cca320c04ee90c607dc7ddf4e0dc1060b5fd05349c8cdb9d61bab83e livenessProbe: httpGet: path: /livez @@ -1182,7 +1182,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator namespace: kubearchive spec: @@ -1232,7 +1232,7 @@ spec: valueFrom: resourceFieldRef: resource: limits.cpu - image: quay.io/kubearchive/operator:v1.20.0@sha256:eb8b363f5cfddd190011aa1d0e7cdff5c50aefae0bd4207024755146b3840db9 + image: quay.io/kubearchive/operator:v1.22.1@sha256:8e50b5bb60058722910a7b073b80c92635683eb50a86191dc5994c4ecea0cbbf livenessProbe: httpGet: path: /healthz @@ -1294,7 +1294,7 @@ metadata: app.kubernetes.io/component: sink app.kubernetes.io/name: kubearchive-sink app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-sink namespace: kubearchive spec: @@ -1346,7 +1346,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/sink:v1.20.0@sha256:8a13e20ba373f00f7e8889af2a67a61c44d9e8bab74a5c0186f324f2eb0cb120 + image: quay.io/kubearchive/sink:v1.22.1@sha256:33d01159261fafb309119df22d3b0ba1ca5b39a1476a75e6c1cdff13f890b78d livenessProbe: httpGet: path: /livez @@ -1387,7 +1387,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-vacuum app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: cluster-vacuum namespace: kubearchive spec: @@ -1408,7 +1408,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: quay.io/kubearchive/vacuum:v1.20.0@sha256:fe373300d999379656f78860906d7a30d77af088d6ba3bfa37a102c422d45480 + image: quay.io/kubearchive/vacuum:v1.22.1@sha256:5dfbbb5c4f66b0573f0a42f40bc1e508dce835881b176fd397455299bfa32bfb name: vacuum restartPolicy: Never serviceAccount: kubearchive-cluster-vacuum @@ -1422,7 +1422,7 @@ metadata: app.kubernetes.io/component: kubearchive app.kubernetes.io/name: kubearchive-schema-migration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-schema-migration namespace: kubearchive spec: @@ -1438,7 +1438,7 @@ spec: envFrom: - secretRef: name: kubearchive-database-credentials - image: quay.io/kubearchive/postgresql:v1.20.0@sha256:0aae85e8885295c87c3241915b8be86e08d5439f38ec9de9f95b012c67633874 + image: quay.io/kubearchive/postgresql:v1.22.1@sha256:806e2c585a998ed51d14a87fac8667bdc27077a5f47d25df1a951a66f1ebacb5 name: migration resources: limits: @@ -1459,7 +1459,7 @@ metadata: app.kubernetes.io/component: api-server app.kubernetes.io/name: kubearchive-api-server-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-api-server-certificate namespace: kubearchive spec: @@ -1493,7 +1493,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1515,7 +1515,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-operator-certificate app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-operator-certificate namespace: kubearchive spec: @@ -1534,7 +1534,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive namespace: kubearchive spec: @@ -1548,7 +1548,7 @@ metadata: app.kubernetes.io/component: certs app.kubernetes.io/name: kubearchive-ca app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-ca namespace: kubearchive spec: @@ -1563,7 +1563,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-mutating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -1676,7 +1676,7 @@ metadata: app.kubernetes.io/component: operator app.kubernetes.io/name: kubearchive-validating-webhook-configuration app.kubernetes.io/part-of: kubearchive - app.kubernetes.io/version: v1.20.0 + app.kubernetes.io/version: v1.22.1 name: kubearchive-validating-webhook-configuration webhooks: - admissionReviewVersions: diff --git a/components/kubearchive/production/stone-prd-rh01/kustomization.yaml b/components/kubearchive/production/stone-prd-rh01/kustomization.yaml index 242947e19a6..701d1823c82 100644 --- a/components/kubearchive/production/stone-prd-rh01/kustomization.yaml +++ b/components/kubearchive/production/stone-prd-rh01/kustomization.yaml @@ -23,7 +23,10 @@ configMapGenerator: annotations: argocd.argoproj.io/sync-wave: "-2" literals: - - MIGRATION_VERSION=5 + - MIGRATION_VERSION=13 + - name: kubearchive-deployment-schema-version + literals: + - MIGRATION_VERSION=13 - name: kubearchive-logging-writer literals: - | @@ -116,7 +119,7 @@ patches: spec: containers: - name: vacuum - image: quay.io/kubearchive/vacuum:v1.20.0 + image: quay.io/kubearchive/vacuum:v1.22.1 - patch: |- apiVersion: batch/v1 @@ -125,8 +128,6 @@ patches: name: kubearchive-schema-migration namespace: kubearchive annotations: - # Needed if just the command is changed, otherwise the job needs to be deleted manually - argocd.argoproj.io/sync-options: Force=true,Replace=true argocd.argoproj.io/sync-wave: "-1" ignore-check.kube-linter.io/no-read-only-root-fs: > "This job needs to clone a repository to do its job, so it needs write access to the FS." @@ -142,8 +143,20 @@ patches: configMapKeyRef: name: kubearchive-schema-version key: MIGRATION_VERSION + - name: BATCH_SIZE + value: "10000" securityContext: runAsUser: null + # Add version suffix to Job name so syncs with unchanged version are a no-op + # (immutable Job, same name = nothing to do). On upgrade, new name = new Job + # created, old completed one pruned. Update suffix when changing MIGRATION_VERSION. + - target: + kind: Job + name: kubearchive-schema-migration + patch: |- + - op: replace + path: /metadata/name + value: kubearchive-schema-migration-v13 # We don't need the Secret as it will be created by the ExternalSecrets Operator - patch: |- $patch: delete @@ -225,7 +238,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true @@ -284,7 +297,7 @@ patches: - name: MIGRATION_VERSION valueFrom: configMapKeyRef: - name: kubearchive-schema-version + name: kubearchive-deployment-schema-version key: MIGRATION_VERSION securityContext: readOnlyRootFilesystem: true From dd9b60ae3e9ab707789272b26449d7e44f388e5c Mon Sep 17 00:00:00 2001 From: Homaja Marisetty <116022361+hmariset@users.noreply.github.com> Date: Thu, 28 May 2026 12:08:38 -0400 Subject: [PATCH 76/83] KFLUXVNGD-1000 Restructure squid production overlay ring 1 (#12018) Add per-cluster overlays for ring 1 production clusters: kflux-ocp-p01, kflux-prd-rh02, stone-prod-p01. Each overlay is self-contained with its own helm generator and credentials. Existing flat production files are kept for unmigrated clusters. Rings 2 and 3 will follow in subsequent PRs. Assisted-by: Claude Code --- .../member/infra-deployments/squid/squid.yaml | 8 +- .../artifact-registry-credentials.yaml | 22 ++++ .../kflux-ocp-p01/kustomization.yaml | 8 ++ .../kflux-ocp-p01/squid-helm-generator.yaml | 101 ++++++++++++++++++ .../artifact-registry-credentials.yaml | 22 ++++ .../kflux-prd-rh02/kustomization.yaml | 8 ++ .../kflux-prd-rh02/squid-helm-generator.yaml | 101 ++++++++++++++++++ .../artifact-registry-credentials.yaml | 22 ++++ .../stone-prod-p01/kustomization.yaml | 8 ++ .../stone-prod-p01/squid-helm-generator.yaml | 101 ++++++++++++++++++ 10 files changed, 400 insertions(+), 1 deletion(-) create mode 100644 components/squid/production/kflux-ocp-p01/artifact-registry-credentials.yaml create mode 100644 components/squid/production/kflux-ocp-p01/kustomization.yaml create mode 100644 components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml create mode 100644 components/squid/production/kflux-prd-rh02/artifact-registry-credentials.yaml create mode 100644 components/squid/production/kflux-prd-rh02/kustomization.yaml create mode 100644 components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml create mode 100644 components/squid/production/stone-prod-p01/artifact-registry-credentials.yaml create mode 100644 components/squid/production/stone-prod-p01/kustomization.yaml create mode 100644 components/squid/production/stone-prod-p01/squid-helm-generator.yaml diff --git a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml index 789158cf9d2..09fb94cbe3a 100644 --- a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml +++ b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml @@ -17,7 +17,13 @@ spec: environment: staging clusterDir: "" - list: - elements: [] + elements: + - nameNormalized: kflux-ocp-p01 + values.clusterDir: kflux-ocp-p01 + - nameNormalized: kflux-prd-rh02 + values.clusterDir: kflux-prd-rh02 + - nameNormalized: stone-prod-p01 + values.clusterDir: stone-prod-p01 template: metadata: name: squid-{{nameNormalized}} diff --git a/components/squid/production/kflux-ocp-p01/artifact-registry-credentials.yaml b/components/squid/production/kflux-ocp-p01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-ocp-p01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-ocp-p01/kustomization.yaml b/components/squid/production/kflux-ocp-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-ocp-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml b/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/kflux-prd-rh02/artifact-registry-credentials.yaml b/components/squid/production/kflux-prd-rh02/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-prd-rh02/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-prd-rh02/kustomization.yaml b/components/squid/production/kflux-prd-rh02/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-prd-rh02/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml b/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/stone-prod-p01/artifact-registry-credentials.yaml b/components/squid/production/stone-prod-p01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/stone-prod-p01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/stone-prod-p01/kustomization.yaml b/components/squid/production/stone-prod-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/stone-prod-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/stone-prod-p01/squid-helm-generator.yaml b/components/squid/production/stone-prod-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/stone-prod-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true From e03fd934682ed54c6f11e3254cc2eb809c004999 Mon Sep 17 00:00:00 2001 From: Homaja Marisetty <116022361+hmariset@users.noreply.github.com> Date: Thu, 28 May 2026 13:26:57 -0400 Subject: [PATCH 77/83] KFLUXVNGD-1024 Restructure squid production overlay ring 2 (#12050) Add per-cluster overlays for ring 2 production clusters: kflux-osp-p01, kflux-prd-rh03, stone-prod-p02. Flat production files kept for remaining 3 unmigrated clusters. Assisted-by: Claude Code --- .../member/infra-deployments/squid/squid.yaml | 6 ++ .../artifact-registry-credentials.yaml | 22 ++++ .../kflux-osp-p01/kustomization.yaml | 8 ++ .../kflux-osp-p01/squid-helm-generator.yaml | 101 ++++++++++++++++++ .../artifact-registry-credentials.yaml | 22 ++++ .../kflux-prd-rh03/kustomization.yaml | 8 ++ .../kflux-prd-rh03/squid-helm-generator.yaml | 101 ++++++++++++++++++ .../artifact-registry-credentials.yaml | 22 ++++ .../stone-prod-p02/kustomization.yaml | 8 ++ .../stone-prod-p02/squid-helm-generator.yaml | 101 ++++++++++++++++++ 10 files changed, 399 insertions(+) create mode 100644 components/squid/production/kflux-osp-p01/artifact-registry-credentials.yaml create mode 100644 components/squid/production/kflux-osp-p01/kustomization.yaml create mode 100644 components/squid/production/kflux-osp-p01/squid-helm-generator.yaml create mode 100644 components/squid/production/kflux-prd-rh03/artifact-registry-credentials.yaml create mode 100644 components/squid/production/kflux-prd-rh03/kustomization.yaml create mode 100644 components/squid/production/kflux-prd-rh03/squid-helm-generator.yaml create mode 100644 components/squid/production/stone-prod-p02/artifact-registry-credentials.yaml create mode 100644 components/squid/production/stone-prod-p02/kustomization.yaml create mode 100644 components/squid/production/stone-prod-p02/squid-helm-generator.yaml diff --git a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml index 09fb94cbe3a..e5398ce50c8 100644 --- a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml +++ b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml @@ -24,6 +24,12 @@ spec: values.clusterDir: kflux-prd-rh02 - nameNormalized: stone-prod-p01 values.clusterDir: stone-prod-p01 + - nameNormalized: kflux-osp-p01 + values.clusterDir: kflux-osp-p01 + - nameNormalized: kflux-prd-rh03 + values.clusterDir: kflux-prd-rh03 + - nameNormalized: stone-prod-p02 + values.clusterDir: stone-prod-p02 template: metadata: name: squid-{{nameNormalized}} diff --git a/components/squid/production/kflux-osp-p01/artifact-registry-credentials.yaml b/components/squid/production/kflux-osp-p01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-osp-p01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-osp-p01/kustomization.yaml b/components/squid/production/kflux-osp-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-osp-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-osp-p01/squid-helm-generator.yaml b/components/squid/production/kflux-osp-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-osp-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/kflux-prd-rh03/artifact-registry-credentials.yaml b/components/squid/production/kflux-prd-rh03/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-prd-rh03/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-prd-rh03/kustomization.yaml b/components/squid/production/kflux-prd-rh03/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-prd-rh03/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-prd-rh03/squid-helm-generator.yaml b/components/squid/production/kflux-prd-rh03/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-prd-rh03/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/stone-prod-p02/artifact-registry-credentials.yaml b/components/squid/production/stone-prod-p02/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/stone-prod-p02/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/stone-prod-p02/kustomization.yaml b/components/squid/production/stone-prod-p02/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/stone-prod-p02/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/stone-prod-p02/squid-helm-generator.yaml b/components/squid/production/stone-prod-p02/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/stone-prod-p02/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true From b3ca3e2b4eba3711516ca7ef6a9725bcbd46b722 Mon Sep 17 00:00:00 2001 From: Homaja Marisetty <116022361+hmariset@users.noreply.github.com> Date: Thu, 28 May 2026 15:09:21 -0400 Subject: [PATCH 78/83] KFLUXVNGD-1024 Restructure squid production overlay - ring 3 (#12051) Add per-cluster overlays for kflux-fedora-01, kflux-rhel-p01, and stone-prd-rh01. Add empty-base fallback directory and squid-specific production patch. Remove flat production files. Assisted-by: Claude Code --- .../member/infra-deployments/squid/squid.yaml | 6 ++ .../kustomization.yaml | 2 +- .../squid-production-overlay-patch.yaml | 7 ++ .../production-downstream/kustomization.yaml | 2 +- .../squid-production-overlay-patch.yaml | 7 ++ .../production/empty-base/kustomization.yaml | 5 + .../artifact-registry-credentials.yaml | 0 .../{ => kflux-fedora-01}/kustomization.yaml | 3 +- .../squid-helm-generator.yaml | 0 .../artifact-registry-credentials.yaml | 22 ++++ .../kflux-rhel-p01/kustomization.yaml | 8 ++ .../kflux-rhel-p01/squid-helm-generator.yaml | 101 ++++++++++++++++++ .../artifact-registry-credentials.yaml | 22 ++++ .../stone-prd-rh01/kustomization.yaml | 8 ++ .../stone-prd-rh01/squid-helm-generator.yaml | 101 ++++++++++++++++++ 15 files changed, 290 insertions(+), 4 deletions(-) create mode 100644 argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml create mode 100644 argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml create mode 100644 components/squid/production/empty-base/kustomization.yaml rename components/squid/production/{ => kflux-fedora-01}/artifact-registry-credentials.yaml (100%) rename components/squid/production/{ => kflux-fedora-01}/kustomization.yaml (92%) rename components/squid/production/{ => kflux-fedora-01}/squid-helm-generator.yaml (100%) create mode 100644 components/squid/production/kflux-rhel-p01/artifact-registry-credentials.yaml create mode 100644 components/squid/production/kflux-rhel-p01/kustomization.yaml create mode 100644 components/squid/production/kflux-rhel-p01/squid-helm-generator.yaml create mode 100644 components/squid/production/stone-prd-rh01/artifact-registry-credentials.yaml create mode 100644 components/squid/production/stone-prd-rh01/kustomization.yaml create mode 100644 components/squid/production/stone-prd-rh01/squid-helm-generator.yaml diff --git a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml index e5398ce50c8..47942fe9110 100644 --- a/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml +++ b/argo-cd-apps/base/member/infra-deployments/squid/squid.yaml @@ -30,6 +30,12 @@ spec: values.clusterDir: kflux-prd-rh03 - nameNormalized: stone-prod-p02 values.clusterDir: stone-prod-p02 + - nameNormalized: kflux-fedora-01 + values.clusterDir: kflux-fedora-01 + - nameNormalized: kflux-rhel-p01 + values.clusterDir: kflux-rhel-p01 + - nameNormalized: stone-prd-rh01 + values.clusterDir: stone-prd-rh01 template: metadata: name: squid-{{nameNormalized}} diff --git a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml index 3cf7e915101..c864fcdda7c 100644 --- a/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml +++ b/argo-cd-apps/overlays/konflux-public-production/kustomization.yaml @@ -241,7 +241,7 @@ patches: kind: ApplicationSet version: v1alpha1 name: pulp-access-controller - - path: production-overlay-patch.yaml + - path: squid-production-overlay-patch.yaml target: kind: ApplicationSet version: v1alpha1 diff --git a/argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml b/argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml new file mode 100644 index 00000000000..ee19f8b1808 --- /dev/null +++ b/argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/environment + value: production +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/clusterDir + value: empty-base diff --git a/argo-cd-apps/overlays/production-downstream/kustomization.yaml b/argo-cd-apps/overlays/production-downstream/kustomization.yaml index 45376a7bf4b..7049247116d 100644 --- a/argo-cd-apps/overlays/production-downstream/kustomization.yaml +++ b/argo-cd-apps/overlays/production-downstream/kustomization.yaml @@ -255,7 +255,7 @@ patches: kind: ApplicationSet version: v1alpha1 name: pulp-access-controller - - path: production-overlay-patch.yaml + - path: squid-production-overlay-patch.yaml target: kind: ApplicationSet version: v1alpha1 diff --git a/argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml b/argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml new file mode 100644 index 00000000000..ee19f8b1808 --- /dev/null +++ b/argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml @@ -0,0 +1,7 @@ +--- +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/environment + value: production +- op: add + path: /spec/generators/0/merge/generators/0/clusters/values/clusterDir + value: empty-base diff --git a/components/squid/production/empty-base/kustomization.yaml b/components/squid/production/empty-base/kustomization.yaml new file mode 100644 index 00000000000..1eff9b93ee1 --- /dev/null +++ b/components/squid/production/empty-base/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: caching +resources: +- ../../base diff --git a/components/squid/production/artifact-registry-credentials.yaml b/components/squid/production/kflux-fedora-01/artifact-registry-credentials.yaml similarity index 100% rename from components/squid/production/artifact-registry-credentials.yaml rename to components/squid/production/kflux-fedora-01/artifact-registry-credentials.yaml diff --git a/components/squid/production/kustomization.yaml b/components/squid/production/kflux-fedora-01/kustomization.yaml similarity index 92% rename from components/squid/production/kustomization.yaml rename to components/squid/production/kflux-fedora-01/kustomization.yaml index 7cde65eb463..6fbdca2f113 100644 --- a/components/squid/production/kustomization.yaml +++ b/components/squid/production/kflux-fedora-01/kustomization.yaml @@ -1,8 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization - resources: -- ../base +- ../../base - artifact-registry-credentials.yaml generators: diff --git a/components/squid/production/squid-helm-generator.yaml b/components/squid/production/kflux-fedora-01/squid-helm-generator.yaml similarity index 100% rename from components/squid/production/squid-helm-generator.yaml rename to components/squid/production/kflux-fedora-01/squid-helm-generator.yaml diff --git a/components/squid/production/kflux-rhel-p01/artifact-registry-credentials.yaml b/components/squid/production/kflux-rhel-p01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/kflux-rhel-p01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/kflux-rhel-p01/kustomization.yaml b/components/squid/production/kflux-rhel-p01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/kflux-rhel-p01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/kflux-rhel-p01/squid-helm-generator.yaml b/components/squid/production/kflux-rhel-p01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/kflux-rhel-p01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true diff --git a/components/squid/production/stone-prd-rh01/artifact-registry-credentials.yaml b/components/squid/production/stone-prd-rh01/artifact-registry-credentials.yaml new file mode 100644 index 00000000000..5cc5cd38bcf --- /dev/null +++ b/components/squid/production/stone-prd-rh01/artifact-registry-credentials.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: artifact-registry-credentials + namespace: caching + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: appsre-stonesoup-vault + target: + creationPolicy: Owner + deletionPolicy: Delete + name: artifact-registry-credentials + data: + - secretKey: authorization + remoteRef: + key: production/vanguard/nexus/proxy-sa-1 + property: authz_header diff --git a/components/squid/production/stone-prd-rh01/kustomization.yaml b/components/squid/production/stone-prd-rh01/kustomization.yaml new file mode 100644 index 00000000000..6fbdca2f113 --- /dev/null +++ b/components/squid/production/stone-prd-rh01/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../base +- artifact-registry-credentials.yaml + +generators: +- squid-helm-generator.yaml diff --git a/components/squid/production/stone-prd-rh01/squid-helm-generator.yaml b/components/squid/production/stone-prd-rh01/squid-helm-generator.yaml new file mode 100644 index 00000000000..4fc80cde724 --- /dev/null +++ b/components/squid/production/stone-prd-rh01/squid-helm-generator.yaml @@ -0,0 +1,101 @@ +apiVersion: builtin +kind: HelmChartInflationGenerator +metadata: + name: squid-helm +name: squid-helm +repo: oci://quay.io/konflux-ci/caching +version: 0.1.1506+abe1045 +valuesInline: + installCertManagerComponents: false + mirrord: + enabled: false + nginx: + enabled: true + replicaCount: 3 + name: artifact-registry-proxy + tls: + enabled: true + secretName: artifact-registry-proxy-tls + service: + port: 443 + annotations: + service.beta.openshift.io/serving-cert-secret-name: artifact-registry-proxy-tls + upstream: + url: https://red-hat.repo.sonatype.app + auth: + enabled: true + secretName: artifact-registry-credentials + cache: + allowList: + # Cache all traffic to nexus repositories + - ^/repository/ + size: 51200 + resources: + requests: + cpu: "2" + memory: 2Gi + limits: + cpu: "2" + memory: 2Gi + test: + enabled: false + cert-manager: + enabled: false + environment: release + replicaCount: 3 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 2Gi + icapServer: + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + squidExporter: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 64Mi + cache: + allowList: + - ^https://cdn([0-9]{2})?\.quay\.io/.+/sha256/.+/[a-f0-9]{64} + - ^https://s3\.[a-z0-9-]+\.amazonaws\.com/quayio-production-s3/sha256/.+/[a-f0-9]{64} + - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64} + - ^https://production\.cloudflare\.docker\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.[a-f0-9]{32}\.r2\.cloudflarestorage\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://docker-images-prod\.s3[a-z0-9.-]*\.amazonaws\.com/registry-v2/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://cdn\.registry\.fedoraproject\.org/v2/.+/blobs/sha256:[a-f0-9]{64} + - ^https://[a-f0-9]{32}\.r2\.cloudflarestorage\.com/app-ci-image-registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://layers\.nvcr\.io/registry/docker/registry/v2/blobs/sha256/[a-f0-9]{2}/[a-f0-9]{64}/data + - ^https://[a-z0-9]+\.cloudfront\.net/sha256/[a-f0-9]{2}/[a-f0-9]{64} + size: 51200 + maxObjectSize: 1024 + prometheus: + serviceMonitor: + nginxTLS: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + tlsOutgoingOptions: + caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + volumes: + - name: trusted-ca + configMap: + name: trusted-ca + items: + - key: ca-bundle.crt + path: tls-ca-bundle.pem + volumeMounts: + - name: trusted-ca + mountPath: /etc/pki/ca-trust/extracted/pem + readOnly: true From e62ac9bd32f5a3803cff15b1a1d0fa5a6af834cf Mon Sep 17 00:00:00 2001 From: "rh-tap-build-team[bot]" <127938674+rh-tap-build-team[bot]@users.noreply.github.com> Date: Thu, 28 May 2026 20:15:21 +0000 Subject: [PATCH 79/83] Update from release-service (#12028) Co-authored-by: release-service --- components/squid/development/squid-helm-generator.yaml | 2 +- components/squid/staging/squid-helm-generator.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/squid/development/squid-helm-generator.yaml b/components/squid/development/squid-helm-generator.yaml index 756110a8932..f8fbee40c44 100644 --- a/components/squid/development/squid-helm-generator.yaml +++ b/components/squid/development/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1519+809441d +version: 0.1.1521+3e9d8b9 valuesInline: installCertManagerComponents: false mirrord: diff --git a/components/squid/staging/squid-helm-generator.yaml b/components/squid/staging/squid-helm-generator.yaml index 7680fb4d51e..b975026c428 100644 --- a/components/squid/staging/squid-helm-generator.yaml +++ b/components/squid/staging/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1519+809441d +version: 0.1.1521+3e9d8b9 valuesInline: installCertManagerComponents: false mirrord: From 07246ca1f405f9485bfcb29d38cb8600f39366a1 Mon Sep 17 00:00:00 2001 From: Homaja Marisetty <116022361+hmariset@users.noreply.github.com> Date: Thu, 28 May 2026 16:21:53 -0400 Subject: [PATCH 80/83] KFLUXVNGD-994 Increase nginx cache volume to 1TB for ring 1 production clusters (#12052) With redirect caching enabled (KFLUXVNGD-997), nginx caches actual artifact content from S3 rather than passing through 302 redirects. This increases cache disk usage significantly. Bump nginx.cache.size from 51200 (50GB) to 1048576 (1TB) and update chart version to 0.1.1521+3e9d8b9 which includes the int rendering fix for large values. Clusters: kflux-ocp-p01, kflux-prd-rh02, stone-prod-p01 Assisted-by: Claude Code --- .../squid/production/kflux-ocp-p01/squid-helm-generator.yaml | 4 ++-- .../squid/production/kflux-prd-rh02/squid-helm-generator.yaml | 4 ++-- .../squid/production/stone-prod-p01/squid-helm-generator.yaml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml b/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml index 4fc80cde724..50f1c13e36f 100644 --- a/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml +++ b/components/squid/production/kflux-ocp-p01/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1506+abe1045 +version: 0.1.1521+3e9d8b9 valuesInline: installCertManagerComponents: false mirrord: @@ -29,7 +29,7 @@ valuesInline: allowList: # Cache all traffic to nexus repositories - ^/repository/ - size: 51200 + size: 1048576 resources: requests: cpu: "2" diff --git a/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml b/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml index 4fc80cde724..50f1c13e36f 100644 --- a/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml +++ b/components/squid/production/kflux-prd-rh02/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1506+abe1045 +version: 0.1.1521+3e9d8b9 valuesInline: installCertManagerComponents: false mirrord: @@ -29,7 +29,7 @@ valuesInline: allowList: # Cache all traffic to nexus repositories - ^/repository/ - size: 51200 + size: 1048576 resources: requests: cpu: "2" diff --git a/components/squid/production/stone-prod-p01/squid-helm-generator.yaml b/components/squid/production/stone-prod-p01/squid-helm-generator.yaml index 4fc80cde724..50f1c13e36f 100644 --- a/components/squid/production/stone-prod-p01/squid-helm-generator.yaml +++ b/components/squid/production/stone-prod-p01/squid-helm-generator.yaml @@ -4,7 +4,7 @@ metadata: name: squid-helm name: squid-helm repo: oci://quay.io/konflux-ci/caching -version: 0.1.1506+abe1045 +version: 0.1.1521+3e9d8b9 valuesInline: installCertManagerComponents: false mirrord: @@ -29,7 +29,7 @@ valuesInline: allowList: # Cache all traffic to nexus repositories - ^/repository/ - size: 51200 + size: 1048576 resources: requests: cpu: "2" From c9b9b70e2c224bba8491dd4714d083e26408392b Mon Sep 17 00:00:00 2001 From: p8r-the-gr8 <119434861+p8r-the-gr8@users.noreply.github.com> Date: Fri, 29 May 2026 11:55:59 +0100 Subject: [PATCH 81/83] Allow hotfixes to target both staging and prod (#12056) If the PR has the "skip-ring-deployment/hotfix" label applied, the "enforce-ring-deployments" Github Action will automatically pass. This is to avoid blocking critical hotfixes that need to reach both staging and production environments as quickly as possible. Assisted-by: Cursor --- .../workflows/enforce-ring-deployment.yaml | 35 +++++++++++++++---- 1 file changed, 29 insertions(+), 6 deletions(-) diff --git a/.github/workflows/enforce-ring-deployment.yaml b/.github/workflows/enforce-ring-deployment.yaml index 369b2ae7129..0cf1ef266b4 100644 --- a/.github/workflows/enforce-ring-deployment.yaml +++ b/.github/workflows/enforce-ring-deployment.yaml @@ -2,7 +2,7 @@ name: Enforce Ring Deployment on: pull_request_target: - types: [opened, synchronize, reopened] + types: [opened, synchronize, reopened, labeled, unlabeled] branches: [main] paths: - 'components/**' @@ -19,35 +19,46 @@ jobs: pull-requests: write issues: write steps: + - name: Check for hotfix label + id: hotfix + if: contains(github.event.pull_request.labels.*.name, 'skip-ring-deployment/hotfix') + run: echo "skip=true" >> "$GITHUB_OUTPUT" + # Check out the BASE branch (trusted code) so we never execute PR code. - uses: actions/checkout@v6 + if: steps.hotfix.outputs.skip != 'true' with: fetch-depth: 0 - uses: actions/setup-go@v5 + if: steps.hotfix.outputs.skip != 'true' with: go-version-file: infra-tools/go.mod cache-dependency-path: infra-tools/go.sum - name: Setup Kustomize + if: steps.hotfix.outputs.skip != 'true' uses: multani/action-setup-kustomize@v1 with: version: 5.6.0 # Build from the trusted base branch before switching to PR code. - name: Build env-detector (from base branch) + if: steps.hotfix.outputs.skip != 'true' working-directory: infra-tools run: go build -o bin/env-detector ./cmd/env-detector # Fetch the GitHub-synthesized merge commit so the tool analyses the # post-merge state, while the binary remains the trusted base build. - name: Checkout PR merge ref + if: steps.hotfix.outputs.skip != 'true' run: | git fetch origin pull/${{ github.event.pull_request.number }}/merge:pr-merge git checkout pr-merge - name: Check ring deployment policy id: ring-check + if: steps.hotfix.outputs.skip != 'true' continue-on-error: true working-directory: infra-tools run: | @@ -59,19 +70,31 @@ jobs: --dry-run - name: Post or update PR comment - if: always() && steps.ring-check.outcome != 'skipped' + if: always() && (steps.ring-check.outcome != 'skipped' || steps.hotfix.outputs.skip == 'true') env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | COMMENT_MARKER="" - # Delete any previous comment from this workflow gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ --paginate --jq ".[] | select(.body | contains(\"${COMMENT_MARKER}\")) | .id" \ | xargs -r -I {} gh api "repos/${{ github.repository }}/issues/comments/{}" -X DELETE - # Post a new comment only if the report file was generated - if [ -s /tmp/ring-report.md ]; then + if [ "${{ steps.hotfix.outputs.skip }}" = "true" ]; then + cat > /tmp/ring-report.md <<'BODY' + ## ✅ Ring Deployment Check — Passed (Hotfix Override) + + This check **passed** because the `skip-ring-deployment/hotfix` label is applied. + The normal ring deployment policy has been bypassed for this PR. + + > **Note:** This override should only be used for emergency hotfixes. + > The label application is tracked in the PR timeline for audit purposes. + BODY + echo "${COMMENT_MARKER}" >> /tmp/ring-report.md + gh pr comment ${{ github.event.pull_request.number }} \ + --repo ${{ github.repository }} \ + --body-file /tmp/ring-report.md + elif [ -s /tmp/ring-report.md ]; then echo "${COMMENT_MARKER}" >> /tmp/ring-report.md gh pr comment ${{ github.event.pull_request.number }} \ --repo ${{ github.repository }} \ @@ -79,5 +102,5 @@ jobs: fi - name: Fail on ring deployment violation - if: always() && steps.ring-check.outcome == 'failure' + if: always() && steps.hotfix.outputs.skip != 'true' && steps.ring-check.outcome == 'failure' run: exit 1 From 08a094eaa209cd59b49516ea09aa2a254d048da6 Mon Sep 17 00:00:00 2001 From: Oleg Betsun Date: Fri, 29 May 2026 16:06:04 +0300 Subject: [PATCH 82/83] fix(KONFLUX-14215): update otel collector to 0.153.0 on staging (#12048) Signed-off-by: obetsun --- components/kubearchive/staging/base/kustomization.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/components/kubearchive/staging/base/kustomization.yaml b/components/kubearchive/staging/base/kustomization.yaml index aae923b985b..5e32f06dcc5 100644 --- a/components/kubearchive/staging/base/kustomization.yaml +++ b/components/kubearchive/staging/base/kustomization.yaml @@ -46,4 +46,5 @@ patches: spec: containers: - name: otel-collector - image: quay.io/kubearchive/opentelemetry-collector@sha256:b17fec48359d78477cfdeb758bb5d71c86ef70e08a6b3944d70d038352211d03 + image: quay.io/kubearchive/opentelemetry-collector@sha256:74edb825a429b415262e7eb7a99ed77685c9b2b7238ef69fb42a3625df75458f + From 501093c71b718bd8d28c0f64b7267d091c31e8bb Mon Sep 17 00:00:00 2001 From: Max Shaposhnyk Date: Thu, 14 May 2026 13:07:09 +0300 Subject: [PATCH 83/83] UI proxy: migrate ring 2 clusters and remove base-ring2 (production ring 2) Switch stone-prd-rh01, stone-prod-p02, kflux-ocp-p01 from base-ring2 back to the updated base with short-lived token hot-reload. - Fix container index in overlay patches for ring 2 clusters - Delete the temporary base-ring2 directory Signed-off-by: Max Shaposhnyk Co-authored-by: Cursor --- .../production/base-ring2/dex/dex.yaml | 128 ------ .../base-ring2/dex/kustomization.yaml | 4 - .../production/base-ring2/kustomization.yaml | 19 - .../production/base-ring2/proxy/auth.conf | 5 - .../production/base-ring2/proxy/kite.conf | 9 - .../base-ring2/proxy/kubearchive.conf | 7 - .../base-ring2/proxy/kustomization.yaml | 21 - .../production/base-ring2/proxy/nginx.conf | 190 --------- .../proxy/otel-collector-config.yaml | 59 --- .../production/base-ring2/proxy/proxy.yaml | 382 ------------------ .../proxy/tekton-results-workspaces.conf | 9 - .../base-ring2/proxy/tekton-results.conf | 8 - .../base-ring2/route-and-oauth.yaml | 52 --- .../kflux-ocp-p01/kustomization.yaml | 2 +- .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 3 + .../stone-prd-rh01/kustomization.yaml | 2 +- .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 3 + .../stone-prod-p02/kustomization.yaml | 2 +- .../oauth2-proxy-args-patch.yaml | 2 +- .../remove-run-as-user-proxy-patch.yaml | 3 + 22 files changed, 15 insertions(+), 899 deletions(-) delete mode 100644 components/konflux-ui/production/base-ring2/dex/dex.yaml delete mode 100644 components/konflux-ui/production/base-ring2/dex/kustomization.yaml delete mode 100644 components/konflux-ui/production/base-ring2/kustomization.yaml delete mode 100644 components/konflux-ui/production/base-ring2/proxy/auth.conf delete mode 100644 components/konflux-ui/production/base-ring2/proxy/kite.conf delete mode 100644 components/konflux-ui/production/base-ring2/proxy/kubearchive.conf delete mode 100644 components/konflux-ui/production/base-ring2/proxy/kustomization.yaml delete mode 100644 components/konflux-ui/production/base-ring2/proxy/nginx.conf delete mode 100644 components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml delete mode 100644 components/konflux-ui/production/base-ring2/proxy/proxy.yaml delete mode 100644 components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf delete mode 100644 components/konflux-ui/production/base-ring2/proxy/tekton-results.conf delete mode 100644 components/konflux-ui/production/base-ring2/route-and-oauth.yaml diff --git a/components/konflux-ui/production/base-ring2/dex/dex.yaml b/components/konflux-ui/production/base-ring2/dex/dex.yaml deleted file mode 100644 index a9bfc5a552a..00000000000 --- a/components/konflux-ui/production/base-ring2/dex/dex.yaml +++ /dev/null @@ -1,128 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: dex - name: dex - annotations: - ignore-check.kube-linter.io/no-anti-affinity: "Using topologySpreadConstraints" -spec: - replicas: 1 - selector: - matchLabels: - app: dex - template: - metadata: - labels: - app: dex - spec: - serviceAccountName: dex - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app: dex - containers: - - image: ghcr.io/dexidp/dex:v2.32.0 - name: dex - command: ["/usr/local/bin/dex", "serve", "/etc/dex/cfg/config.yaml"] - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - resources: - limits: - cpu: 100m - memory: 256Mi - requests: - cpu: 100m - memory: 256Mi - ports: - - name: https - containerPort: 9443 - - name: telemetry - containerPort: 5558 - protocol: TCP - volumeMounts: - - name: dex - mountPath: /etc/dex/cfg - - name: tls - mountPath: /etc/dex/tls - readinessProbe: - httpGet: - path: /healthz/ready - port: telemetry - env: - - name: GODEBUG - value: "http2server=0" - - name: OPENSHIFT_OAUTH_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: dex-client - key: token - - name: OAUTH2_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: oauth2-proxy-client-secret - key: client-secret - volumes: - - name: dex - configMap: - name: dex - defaultMode: 420 - items: - - key: dex-config.yaml - path: config.yaml - - name: tls - secret: - secretName: dex-cert ---- -apiVersion: v1 -kind: Service -metadata: - name: dex - annotations: - service.beta.openshift.io/serving-cert-secret-name: dex-cert -spec: - type: ClusterIP - ports: - - name: dex - port: 9443 - protocol: TCP - targetPort: 9443 - selector: - app: dex ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app: dex - name: dex ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: dex -rules: -- apiGroups: ["dex.coreos.com"] # API group created by dex - resources: ["*"] - verbs: ["*"] -- apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - verbs: ["create"] # To manage its own resources, dex must be able to create customresourcedefinitions ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: dex -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: dex -subjects: -- kind: ServiceAccount - name: dex # Service account assigned to the dex pod, created above - namespace: konflux-ui # The namespace dex is running in diff --git a/components/konflux-ui/production/base-ring2/dex/kustomization.yaml b/components/konflux-ui/production/base-ring2/dex/kustomization.yaml deleted file mode 100644 index 32291d2371d..00000000000 --- a/components/konflux-ui/production/base-ring2/dex/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - dex.yaml diff --git a/components/konflux-ui/production/base-ring2/kustomization.yaml b/components/konflux-ui/production/base-ring2/kustomization.yaml deleted file mode 100644 index 33aa6477e8b..00000000000 --- a/components/konflux-ui/production/base-ring2/kustomization.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - dex - - proxy - - route-and-oauth.yaml - - ../../base - -images: - - name: quay.io/konflux-ci/workspace-manager - digest: sha256:48df30520a766101473e80e7a4abbf59ce06097a5f5919e15075afaa86bd1a2d - - - name: quay.io/konflux-ci/konflux-ui - newTag: ed23c9b83394454b5822049748939a26a5626093 - - - name: quay.io/oauth2-proxy/oauth2-proxy - digest: sha256:3da33b9670c67bd782277f99acadf7026f75b9507bfba2088eb2d497266ef7fc - -namespace: konflux-ui diff --git a/components/konflux-ui/production/base-ring2/proxy/auth.conf b/components/konflux-ui/production/base-ring2/proxy/auth.conf deleted file mode 100644 index 6b5cad3adaf..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/auth.conf +++ /dev/null @@ -1,5 +0,0 @@ -# Auth configuration with impersonation enabled -auth_request_set $user $upstream_http_x_auth_request_email; -proxy_set_header Impersonate-User $user; -proxy_set_header Impersonate-Group system:authenticated; -proxy_set_header Authorization "Bearer __BEARER_TOKEN__"; diff --git a/components/konflux-ui/production/base-ring2/proxy/kite.conf b/components/konflux-ui/production/base-ring2/proxy/kite.conf deleted file mode 100644 index a8d5ed7daeb..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/kite.conf +++ /dev/null @@ -1,9 +0,0 @@ -location /api/k8s/plugins/kite/ { - auth_request /oauth2/auth; - rewrite /api/k8s/plugins/kite/(.+) /$1 break; - proxy_read_timeout 30m; - proxy_pass https://konflux-kite.konflux-kite.svc.cluster.local; - include /mnt/nginx-generated-config/auth.conf; -} - - diff --git a/components/konflux-ui/production/base-ring2/proxy/kubearchive.conf b/components/konflux-ui/production/base-ring2/proxy/kubearchive.conf deleted file mode 100644 index d87f2dbf983..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/kubearchive.conf +++ /dev/null @@ -1,7 +0,0 @@ -location /api/k8s/plugins/kubearchive/ { - auth_request /oauth2/auth; - rewrite /api/k8s/plugins/kubearchive/(.+) /$1 break; - proxy_read_timeout 30m; - proxy_pass https://kubearchive-api-server.product-kubearchive.svc.cluster.local:8081; - include /mnt/nginx-generated-config/auth.conf; -} diff --git a/components/konflux-ui/production/base-ring2/proxy/kustomization.yaml b/components/konflux-ui/production/base-ring2/proxy/kustomization.yaml deleted file mode 100644 index 1c632296456..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/kustomization.yaml +++ /dev/null @@ -1,21 +0,0 @@ -kind: Kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -resources: - - proxy.yaml - -configMapGenerator: - - name: proxy - files: - - nginx.conf - - name: proxy-nginx-templates - files: - - auth.conf - - name: proxy-nginx-static - files: - - tekton-results.conf - - tekton-results-workspaces.conf - - kite.conf - - kubearchive.conf - - name: otel-collector-config - files: - - otel-collector-config.yaml diff --git a/components/konflux-ui/production/base-ring2/proxy/nginx.conf b/components/konflux-ui/production/base-ring2/proxy/nginx.conf deleted file mode 100644 index 04cb4160075..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/nginx.conf +++ /dev/null @@ -1,190 +0,0 @@ -worker_processes auto; -error_log /var/log/nginx/error.log; -pid /run/nginx.pid; - -# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. -include /usr/share/nginx/modules/*.conf; - -events { - worker_connections 1024; -} - -http { - log_format upstreamlog '[$time_local] $remote_addr - $remote_user - $server_name $host to: $proxy_host $upstream_addr: $request $status upstream_response_time $upstream_response_time msec $msec request_time $request_time'; - access_log /dev/stderr upstreamlog; - error_log /dev/stderr; - - log_format combined_custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"'; - access_log /var/log/nginx/access.log combined_custom; - - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 4096; - - default_type application/octet-stream; - include /etc/nginx/mime.types; - - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - - map $request_method $ns_target { - GET @namespacelister; - default @kubeapi; - } - - server { - listen 9443 ssl; - ssl_certificate /mnt/tls.crt; - ssl_certificate_key /mnt/tls.key; - server_name _; - root /opt/app-root/src; - - location / { - alias /opt/app-root/src/static-content/; - try_files $uri /index.html; - } - - location = /404.html { - } - - location = /oauth2/auth { - internal; - proxy_pass http://127.0.0.1:6000; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Scheme $scheme; - # nginx auth_request includes headers but not body - proxy_set_header Content-Length ""; - proxy_pass_request_body off; - } - - location /oauth2/ { - proxy_pass http://127.0.0.1:6000/oauth2/; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Scheme $scheme; - } - - location /api/k8s/registration/ { - # Registration Service registration endpoint - auth_request_set $email $upstream_http_x_auth_request_email; - proxy_set_header X-Email $email; - auth_request_set $user $upstream_http_x_auth_request_user; - proxy_set_header X-User $user; - auth_request_set $username $upstream_http_x_auth_request_preferred_username; - proxy_set_header X-Auth-Request-Preferred-Username $username; - auth_request_set $groups $upstream_http_x_auth_request_groups; - proxy_set_header X-Auth-Request-Groups $user; - - auth_request /oauth2/auth; - proxy_pass http://127.0.0.1:5000/; - } - - location /api/k8s/apis/toolchain.dev.openshift.com/v1alpha1/workspaces { - # Registration Service workspaces endpoint - auth_request_set $email $upstream_http_x_auth_request_email; - proxy_set_header X-Email $email; - auth_request_set $user $upstream_http_x_auth_request_user; - proxy_set_header X-User $user; - auth_request_set $username $upstream_http_x_auth_request_preferred_username; - proxy_set_header X-Auth-Request-Preferred-Username $username; - auth_request_set $groups $upstream_http_x_auth_request_groups; - proxy_set_header X-Auth-Request-Groups $user; - - auth_request /oauth2/auth; - proxy_pass http://127.0.0.1:5000/workspaces; - } - - location /api/k8s/workspaces/ { - # Kube-API - auth_request /oauth2/auth; - - rewrite /api/k8s/workspaces/.+?/(.+) /$1 break; - proxy_pass https://kubernetes.default.svc; - proxy_read_timeout 30m; - include /mnt/nginx-generated-config/auth.conf; - } - - location /wss/k8s/workspaces/ { - auth_request /oauth2/auth; - - rewrite /wss/k8s/workspaces/.+?/(.+) /$1 break; - proxy_pass https://kubernetes.default.svc/; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_read_timeout 30m; - include /mnt/nginx-generated-config/auth.conf; - } - - location /api/k8s/ { - # Kube-API - auth_request /oauth2/auth; - - proxy_pass https://kubernetes.default.svc/; - proxy_read_timeout 30m; - include /mnt/nginx-generated-config/auth.conf; - } - - location /wss/k8s/ { - auth_request /oauth2/auth; - - rewrite /wss/k8s/(.+) /$1 break; - proxy_pass https://kubernetes.default.svc/; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_read_timeout 30m; - include /mnt/nginx-generated-config/auth.conf; - } - - - - # GET requests to /api/k8s/api/v1/namespaces and /api/k8s/api/v1/namespaces/ - # are handled from the namespace-lister. - # Requests with other methods are handled by the Kube-API - location = /api/k8s/api/v1/namespaces { - try_files /dev/null $ns_target; - } - location = /api/k8s/api/v1/namespaces/ { - try_files /dev/null $ns_target; - } - - location @namespacelister { - auth_request_set $email $upstream_http_x_auth_request_email; - auth_request /oauth2/auth; - proxy_read_timeout 30m; - proxy_set_header X-User $email; - proxy_set_header X-Group system:authenticated; - proxy_hide_header X-Correlation-ID; - - rewrite ^.*$ /api/v1/namespaces break; - - proxy_pass https://namespace-lister.namespace-lister.svc.cluster.local:8080; - } - - location @kubeapi { - auth_request_set $email $upstream_http_x_auth_request_email; - auth_request /oauth2/auth; - proxy_read_timeout 30m; - proxy_set_header X-Email $email; - - rewrite ^/api/k8s/(.*)/$ /$1 break; - - proxy_pass https://kubernetes.default.svc; - proxy_set_header Impersonate-User $email; - include /mnt/nginx-generated-config/auth.conf; - } - - location /health { - # Used for liveness probes - return 200; - } - - include /mnt/nginx-additional-location-configs/*.conf; - } -} diff --git a/components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml b/components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml deleted file mode 100644 index 46afbc956c7..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/otel-collector-config.yaml +++ /dev/null @@ -1,59 +0,0 @@ -receivers: - filelog/nginx: - include: - - /var/log/nginx/access.log - start_at: end - operators: - - type: regex_parser - regex: '^(?P[^ ]*) - (?P[^ ]*) \[(?P[^\]]*)\] "(?P[^ ]*) (?P[^ ]*) (?P[^"]*)" (?P\d+) (?P\d+) "(?P[^"]*)" "(?P[^"]*)"$' - - type: time_parser - parse_from: attributes.time_local - layout: '%d/%b/%Y:%H:%M:%S %z' - to_timestamp: true - -processors: - transform/status_to_int: - log_statements: - - context: log - statements: - - set(attributes["status_int"], Int(attributes["status"])) - deltatocumulative: - max_stale: 10m - max_streams: 10000 - batch: - timeout: 10s - send_batch_size: 100 - send_batch_max_size: 200 - -extensions: - health_check: - endpoint: "0.0.0.0:13133" - -exporters: - prometheus: - endpoint: "0.0.0.0:8889" - -connectors: - count: - logs: - nginx_otel_http_request_errors: - description: HTTP 4xx and 5xx errors from NGINX - conditions: - - 'attributes["status_int"] >= 400 and attributes["status_int"] < 600' - attributes: - - key: method - value: attributes["method"] - - key: status - value: attributes["status"] - -service: - extensions: [health_check] - pipelines: - logs: - receivers: [filelog/nginx] - processors: [transform/status_to_int, batch] - exporters: [count] - metrics: - receivers: [count] - processors: [deltatocumulative, batch] - exporters: [prometheus] diff --git a/components/konflux-ui/production/base-ring2/proxy/proxy.yaml b/components/konflux-ui/production/base-ring2/proxy/proxy.yaml deleted file mode 100644 index c6648654bd7..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/proxy.yaml +++ /dev/null @@ -1,382 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: proxy - name: proxy - annotations: - ignore-check.kube-linter.io/no-anti-affinity: "Using topologySpreadConstraints" -spec: - replicas: 1 - selector: - matchLabels: - app: proxy - minReadySeconds: 30 - strategy: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 0 - template: - metadata: - labels: - app: proxy - spec: - serviceAccountName: proxy - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app: proxy - initContainers: - - name: copy-static-content - image: quay.io/konflux-ci/konflux-ui:68500b32e57278bf33ac18d4ef631ef243abb579 - command: - - cp - - -R - - /opt/app-root/src/. - - /mnt/static-content/ - volumeMounts: - - name: static-content - mountPath: /mnt/static-content - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1001 - resources: - limits: - cpu: 50m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - - name: generate-nginx-configs - image: registry.access.redhat.com/ubi9/ubi@sha256:66233eebd72bb5baa25190d4f55e1dc3fff3a9b77186c1f91a0abdb274452072 - command: - - sh - - -c - - | - set -e - - # Generate auth.conf with bearer token replacement - token=$(cat /mnt/api-token/token) - sed "s/__BEARER_TOKEN__/$token/g" /mnt/nginx-templates/auth.conf > /mnt/nginx-generated-config/auth.conf - - chmod 640 /mnt/nginx-generated-config/auth.conf - - volumeMounts: - - name: nginx-generated-config - mountPath: /mnt/nginx-generated-config - - name: nginx-templates - mountPath: /mnt/nginx-templates - - name: api-token - mountPath: /mnt/api-token - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1001 - resources: - limits: - cpu: 50m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - containers: - - image: registry.access.redhat.com/ubi9/nginx-124@sha256:b924363ff07ee0f8fd4f680497da774ac0721722a119665998ff5b2111098ad1 - name: nginx - command: - - nginx - - "-g" - - "daemon off;" - - -c - - /etc/nginx/nginx.conf - livenessProbe: - failureThreshold: 3 - httpGet: - path: /health - port: 9443 - scheme: HTTPS - initialDelaySeconds: 30 - periodSeconds: 60 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - failureThreshold: 3 - httpGet: - path: /health - port: 9443 - scheme: HTTPS - initialDelaySeconds: 30 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 1 - ports: - - containerPort: 8080 - name: web - protocol: TCP - - containerPort: 9443 - name: web-tls - protocol: TCP - resources: - limits: - cpu: 300m - memory: 256Mi - requests: - cpu: 30m - memory: 128Mi - volumeMounts: - - mountPath: /etc/nginx/nginx.conf - subPath: nginx.conf - name: proxy - readOnly: true - - name: logs - mountPath: /var/log/nginx - - name: nginx-tmp - mountPath: /var/lib/nginx/tmp - - name: run - mountPath: /run - - name: serving-cert - mountPath: /mnt - - name: nginx-generated-config - mountPath: /mnt/nginx-generated-config - - name: nginx-static - mountPath: /mnt/nginx-additional-location-configs - - name: static-content - mountPath: /opt/app-root/src/static-content - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1001 - - image: quay.io/konflux-ci/workspace-manager@sha256:48df30520a766101473e80e7a4abbf59ce06097a5f5919e15075afaa86bd1a2d - name: workspace-manager - ports: - - containerPort: 5000 - name: web - protocol: TCP - resources: - limits: - cpu: 300m - memory: 256Mi - requests: - cpu: 30m - memory: 128Mi - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1001 - - image: quay.io/oauth2-proxy/oauth2-proxy@sha256:3da33b9670c67bd782277f99acadf7026f75b9507bfba2088eb2d497266ef7fc - name: oauth2-proxy - env: - - name: OAUTH2_PROXY_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: oauth2-proxy-client-secret - key: client-secret - - name: OAUTH2_PROXY_COOKIE_SECRET - valueFrom: - secretKeyRef: - name: oauth2-proxy-cookie-secret - key: cookie-secret - args: - - tba - ports: - - containerPort: 6000 - name: web - protocol: TCP - resources: - limits: - cpu: 300m - memory: 256Mi - requests: - cpu: 30m - memory: 128Mi - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1001 - - image: quay.io/factory2/otel-collector-sp/otel-binary-image:0.137.0 - imagePullPolicy: Always - name: otel-collector - command: ["/usr/local/bin/otel-collector-sp", "--config", "/conf/otel-collector-config.yaml"] - ports: - - containerPort: 8889 - name: otel-metrics - - containerPort: 13133 - name: otel-health - protocol: TCP - volumeMounts: - - name: logs - mountPath: /var/log/nginx - - mountPath: /conf/otel-collector-config.yaml - subPath: otel-collector-config.yaml - name: otel-collector-config - readOnly: true - readinessProbe: - httpGet: - path: /health - port: 13133 - initialDelaySeconds: 5 - periodSeconds: 5 - livenessProbe: - httpGet: - path: /health - port: 13133 - initialDelaySeconds: 30 - periodSeconds: 60 - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1001 - resources: - limits: - cpu: 150m - memory: 256Mi - requests: - cpu: 50m - memory: 128Mi - volumes: - - configMap: - defaultMode: 420 - name: proxy - items: - - key: nginx.conf - path: nginx.conf - name: proxy - - configMap: - defaultMode: 420 - name: proxy-nginx-templates - name: nginx-templates - - configMap: - defaultMode: 420 - name: proxy-nginx-static - name: nginx-static - - name: logs - emptyDir: {} - - name: nginx-tmp - emptyDir: {} - - name: run - emptyDir: {} - - name: serving-cert - secret: - secretName: serving-cert - - name: nginx-generated-config - emptyDir: {} - - name: api-token - secret: - secretName: proxy - - name: static-content - emptyDir: {} - - configMap: - defaultMode: 420 - name: otel-collector-config - items: - - key: otel-collector-config.yaml - path: otel-collector-config.yaml - name: otel-collector-config ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: proxy - name: proxy -spec: - type: ClusterIP - internalTrafficPolicy: Cluster - ipFamilies: - - IPv4 - ipFamilyPolicy: SingleStack - ports: - - name: web - port: 8888 - protocol: TCP - targetPort: web - - name: web-tls - port: 9443 - protocol: TCP - targetPort: web-tls - - name: otel-metrics - protocol: TCP - port: 8889 - targetPort: 8889 - selector: - app: proxy ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: proxy ---- -apiVersion: v1 -kind: Secret -metadata: - name: proxy - annotations: - kubernetes.io/service-account.name: proxy -type: kubernetes.io/service-account-token ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: konflux-proxy -rules: -- apiGroups: [""] - resources: ["groups"] - verbs: ["impersonate"] - resourceNames: ["system:authenticated"] -- apiGroups: [""] - resources: ["users"] - verbs: ["impersonate"] -- apiGroups: ["authorization.k8s.io"] - resources: ["localsubjectaccessreviews"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: konflux-proxy -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: konflux-proxy -subjects: -- kind: ServiceAccount - name: proxy - namespace: konflux-ui ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: konflux-proxy-namespace-lister -rules: -- apiGroups: [""] - resources: ["namespaces"] - verbs: ["list", "get"] ---- -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: nginx-proxy-monitor -spec: - selector: - matchLabels: - app: proxy - endpoints: - - port: otel-metrics - interval: 15s ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: konflux-proxy-namespace-lister -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: konflux-proxy-namespace-lister -subjects: -- kind: ServiceAccount - name: proxy - namespace: konflux-ui diff --git a/components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf b/components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf deleted file mode 100644 index 922b3d676e3..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/tekton-results-workspaces.conf +++ /dev/null @@ -1,9 +0,0 @@ -# Deprecated -location /api/k8s/plugins/tekton-results/workspaces/ { - auth_request /oauth2/auth; - - rewrite /api/k8s/plugins/tekton-results/workspaces/.+?/(.+) /$1 break; - proxy_read_timeout 30m; - proxy_pass https://tekton-results-api-service.tekton-results.svc.cluster.local:8080; - include /mnt/nginx-generated-config/auth.conf; -} diff --git a/components/konflux-ui/production/base-ring2/proxy/tekton-results.conf b/components/konflux-ui/production/base-ring2/proxy/tekton-results.conf deleted file mode 100644 index b6fc7cd5921..00000000000 --- a/components/konflux-ui/production/base-ring2/proxy/tekton-results.conf +++ /dev/null @@ -1,8 +0,0 @@ -location /api/k8s/plugins/tekton-results/ { - auth_request /oauth2/auth; - - rewrite /api/k8s/plugins/tekton-results/(.+) /$1 break; - proxy_read_timeout 30m; - proxy_pass https://tekton-results-api-service.tekton-results.svc.cluster.local:8080; - include /mnt/nginx-generated-config/auth.conf; -} diff --git a/components/konflux-ui/production/base-ring2/route-and-oauth.yaml b/components/konflux-ui/production/base-ring2/route-and-oauth.yaml deleted file mode 100644 index 89ec448f98e..00000000000 --- a/components/konflux-ui/production/base-ring2/route-and-oauth.yaml +++ /dev/null @@ -1,52 +0,0 @@ ---- -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: konflux - annotations: - # Needed for running a local development env for the Konflux UI - haproxy.router.openshift.io/set-forwarded-headers: if-none -spec: - host: tba - path: / - port: - targetPort: web-tls - tls: - insecureEdgeTerminationPolicy: Redirect - termination: reencrypt - to: - kind: Service - name: proxy - weight: 100 ---- -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: konflux-idp -spec: - host: tba - path: /idp - port: - targetPort: dex - tls: - insecureEdgeTerminationPolicy: Redirect - termination: reencrypt - to: - kind: Service - name: dex - weight: 100 ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - name: dex-client - annotations: - serviceaccounts.openshift.io/oauth-redirecturi.konflux: tba ---- -kind: Secret -apiVersion: v1 -metadata: - name: dex-client - annotations: - kubernetes.io/service-account.name: dex-client -type: kubernetes.io/service-account-token diff --git a/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml b/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml index 190231184c2..a927dc3b6f9 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base-ring2 + - ../base # Remove this comment to rotate dex and proxy secrets # - configure-oauth-proxy-secret.yaml diff --git a/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml index bdac634b3d5..f1dda42f80c 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..24a649fa76c 100644 --- a/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/kflux-ocp-p01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,6 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser + +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml b/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml index c5f32bfb02a..4e2a7843e47 100644 --- a/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base-ring2 + - ../base # Remove this comment to rotate dex and proxy secrets # - configure-oauth-proxy-secret.yaml diff --git a/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml index ee3e70fb1a7..1fc0899edf0 100644 --- a/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..24a649fa76c 100644 --- a/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/stone-prd-rh01/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,6 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser + +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser diff --git a/components/konflux-ui/production/stone-prod-p02/kustomization.yaml b/components/konflux-ui/production/stone-prod-p02/kustomization.yaml index c5f32bfb02a..4e2a7843e47 100644 --- a/components/konflux-ui/production/stone-prod-p02/kustomization.yaml +++ b/components/konflux-ui/production/stone-prod-p02/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base-ring2 + - ../base # Remove this comment to rotate dex and proxy secrets # - configure-oauth-proxy-secret.yaml diff --git a/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml b/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml index b43257e5952..ca931007a83 100644 --- a/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p02/oauth2-proxy-args-patch.yaml @@ -1,6 +1,6 @@ --- - op: replace - path: /spec/template/spec/containers/2/args + path: /spec/template/spec/containers/3/args value: - --provider - oidc diff --git a/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml b/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml index a19cfc5b2b3..24a649fa76c 100644 --- a/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml +++ b/components/konflux-ui/production/stone-prod-p02/remove-run-as-user-proxy-patch.yaml @@ -16,3 +16,6 @@ - op: remove path: /spec/template/spec/containers/3/securityContext/runAsUser + +- op: remove + path: /spec/template/spec/containers/4/securityContext/runAsUser