UI proxy: migrate ring 2 clusters and remove base-ring2 (production ring 2)

.github/workflows/enforce-ring-deployment.yaml

@@ -2,7 +2,7 @@ name: Enforce Ring Deployment
 
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, labeled, unlabeled]
     branches: [main]
     paths:
       - 'components/**'
@@ -19,35 +19,46 @@ jobs:
       pull-requests: write
       issues: write
     steps:
+      - name: Check for hotfix label
+        id: hotfix
+        if: contains(github.event.pull_request.labels.*.name, 'skip-ring-deployment/hotfix')
+        run: echo "skip=true" >> "$GITHUB_OUTPUT"
+
       # Check out the BASE branch (trusted code) so we never execute PR code.
       - uses: actions/checkout@v6
+        if: steps.hotfix.outputs.skip != 'true'
         with:
           fetch-depth: 0
 
       - uses: actions/setup-go@v5
+        if: steps.hotfix.outputs.skip != 'true'
         with:
           go-version-file: infra-tools/go.mod
           cache-dependency-path: infra-tools/go.sum
 
       - name: Setup Kustomize
+        if: steps.hotfix.outputs.skip != 'true'
         uses: multani/action-setup-kustomize@v1
         with:
           version: 5.6.0
 
       # Build from the trusted base branch before switching to PR code.
       - name: Build env-detector (from base branch)
+        if: steps.hotfix.outputs.skip != 'true'
         working-directory: infra-tools
         run: go build -o bin/env-detector ./cmd/env-detector
 
       # Fetch the GitHub-synthesized merge commit so the tool analyses the
       # post-merge state, while the binary remains the trusted base build.
       - name: Checkout PR merge ref
+        if: steps.hotfix.outputs.skip != 'true'
         run: |
           git fetch origin pull/${{ github.event.pull_request.number }}/merge:pr-merge
           git checkout pr-merge
 
       - name: Check ring deployment policy
         id: ring-check
+        if: steps.hotfix.outputs.skip != 'true'
         continue-on-error: true
         working-directory: infra-tools
         run: |
@@ -59,25 +70,37 @@ jobs:
             --dry-run
 
       - name: Post or update PR comment
-        if: always() && steps.ring-check.outcome != 'skipped'
+        if: always() && (steps.ring-check.outcome != 'skipped' || steps.hotfix.outputs.skip == 'true')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           COMMENT_MARKER="<!-- ring-deployment-check -->"
 
-          # Delete any previous comment from this workflow
           gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
             --paginate --jq ".[] | select(.body | contains(\"${COMMENT_MARKER}\")) | .id" \
             | xargs -r -I {} gh api "repos/${{ github.repository }}/issues/comments/{}" -X DELETE
 
-          # Post a new comment only if the report file was generated
-          if [ -s /tmp/ring-report.md ]; then
+          if [ "${{ steps.hotfix.outputs.skip }}" = "true" ]; then
+            cat > /tmp/ring-report.md <<'BODY'
+          ## ✅ Ring Deployment Check — Passed (Hotfix Override)
+
+          This check **passed** because the `skip-ring-deployment/hotfix` label is applied.
+          The normal ring deployment policy has been bypassed for this PR.
+
+          > **Note:** This override should only be used for emergency hotfixes.
+          > The label application is tracked in the PR timeline for audit purposes.
+          BODY
+            echo "${COMMENT_MARKER}" >> /tmp/ring-report.md
+            gh pr comment ${{ github.event.pull_request.number }} \
+              --repo ${{ github.repository }} \
+              --body-file /tmp/ring-report.md
+          elif [ -s /tmp/ring-report.md ]; then
             echo "${COMMENT_MARKER}" >> /tmp/ring-report.md
             gh pr comment ${{ github.event.pull_request.number }} \
               --repo ${{ github.repository }} \
               --body-file /tmp/ring-report.md
           fi
 
       - name: Fail on ring deployment violation
-        if: always() && steps.ring-check.outcome == 'failure'
+        if: always() && steps.hotfix.outputs.skip != 'true' && steps.ring-check.outcome == 'failure'
         run: exit 1

AGENTS.md

@@ -0,0 +1,37 @@
+# infra-deployments
+
+GitOps monorepo deploying 50+ Kubernetes components across multiple clusters via Kustomize and ArgoCD ApplicationSets.
+
+## Quick Commands
+
+| Action         | Command                                    |
+|----------------|--------------------------------------------|
+| Build overlay  | `kustomize build components/<name>/<env>/` |
+| Lint YAML      | `yamllint .`                               |
+| K8s lint       | `kube-linter lint <path>`                  |
+| Chainsaw tests | `./hack/chainsaw/chainsaw-prepare.sh` and `chainsaw test <path to .chainsaw-test folder>` |
+| infra-tools    | `cd infra-tools && make build test lint`   |
+
+## Project Layout
+
+- `components/<name>/{base,development,staging,production}/` — per-component Kustomize overlays; staging and production are often further split per-cluster
+- `argo-cd-apps/overlays/` — maps to deployment targets (development, staging-downstream, production-downstream, etc.)
+- `configs/` — cluster-level configurations (etcd-defrag, kubelet settings)
+- `hack/` — deployment and utility scripts
+- `infra-tools/` — Go CLI tools (env-detector, render-diff) with their own Makefile
+
+## Key Conventions
+
+- Prefer using scripts in `hack/` over manual steps when available
+- Promotion order: development/staging → production; changes must be validated in dev/staging before promoting to production
+- Production has per-cluster overlay directories; rollouts must be split into rings (subsets of clusters), not applied to all at once
+- All changes via PR; CODEOWNERS approval required
+- Production PRs must include `## Risk Assessment` (level, description, rollback plan) and `## Validation` (staging evidence if applicable)
+- Commits - Jira ID at start (e.g., `KFLUXINFRA-1234 description`). Interactive sessions: Use the -s flag and `Assisted-by:` trailer. Agentic workflow: `Authored-by:` trailer. Include agent name and tool.
+
+## Gotchas
+
+- E2E tests are designed to validate in an isolated environment in GitHub Actions CI and should not be run locally
+- E2E tests are conditional — they only run on dev/staging PRs when specific files change. Production PRs do not run E2E; rely on prior dev/staging validation
+- E2E tests frequently fail due to intermittent infrastructure issues. If the PR looks correct and E2E logs show no relevant errors, comment `/retest` to re-trigger
+- When updating component images, also update image references in `hack/new-cluster/templates/` as part of the production ring deployments — new clusters are bootstrapped from these and won't get ArgoCD-synced versions

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

argo-cd-apps/base/all-clusters/infra-deployments/authentication/authentication.yaml

@@ -33,7 +33,7 @@ spec:
         repoURL: https://github.com/redhat-appstudio/infra-deployments.git
         targetRevision: main
       destination:
-        namespace: group-sync-operator
+        namespace: authentication
         server: '{{server}}'
       syncPolicy:
         automated:

argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/k8s-groups.yaml

@@ -0,0 +1,43 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: k8s-groups
+spec:
+  generators:
+    - merge:
+        mergeKeys:
+          - nameNormalized
+        generators:
+          - clusters:
+              values:
+                sourceRoot: components/k8s-groups
+                environment: staging
+                useCaseDir: rover
+          - list:
+              elements:
+                - nameNormalized: kflux-fedora-01
+                  values.useCaseDir: fas
+  template:
+    metadata:
+      name: k8s-groups-{{nameNormalized}}
+    spec:
+      project: default
+      source:
+        path: '{{values.sourceRoot}}/{{values.environment}}/{{values.useCaseDir}}'
+        repoURL: ''  # will be added by kustomization
+        targetRevision: main
+      destination:
+        namespace: k8s-groups
+        server: '{{server}}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+        retry:
+          limit: -1
+          backoff:
+            duration: 10s
+            factor: 2
+            maxDuration: 3m

components/authentication/helm-charts/metrics/kustomization.yaml → argo-cd-apps/base/all-clusters/internal-infra-deployments/k8s-groups/kustomization.yaml

@@ -1,5 +1,4 @@
----
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- monitor.yaml
+- k8s-groups.yaml

argo-cd-apps/base/all-clusters/internal-infra-deployments/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - k8s-groups
+components:
+  - ../../../k-components/inject-internal-infra-deployments-repo-details

argo-cd-apps/base/all-clusters/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - infra-deployments
+  - internal-infra-deployments
 components:
   - ../../k-components/inject-argocd-namespace
   - ../../k-components/deploy-to-all-clusters

argo-cd-apps/base/member/infra-deployments/image-controller/image-controller.yaml

@@ -17,6 +17,8 @@ spec:
               elements:
                 - nameNormalized: stone-prd-rh01
                   values.clusterDir: stone-prd-rh01
+                - nameNormalized: kflux-fedora-01
+                  values.clusterDir: kflux-fedora-01
   template:
     metadata:
       name: image-controller-{{nameNormalized}}

argo-cd-apps/base/member/infra-deployments/squid/squid.yaml

@@ -17,7 +17,25 @@ spec:
                 environment: staging
                 clusterDir: ""
           - list:
-              elements: []
+              elements:
+                - nameNormalized: kflux-ocp-p01
+                  values.clusterDir: kflux-ocp-p01
+                - nameNormalized: kflux-prd-rh02
+                  values.clusterDir: kflux-prd-rh02
+                - nameNormalized: stone-prod-p01
+                  values.clusterDir: stone-prod-p01
+                - nameNormalized: kflux-osp-p01
+                  values.clusterDir: kflux-osp-p01
+                - nameNormalized: kflux-prd-rh03
+                  values.clusterDir: kflux-prd-rh03
+                - nameNormalized: stone-prod-p02
+                  values.clusterDir: stone-prod-p02
+                - nameNormalized: kflux-fedora-01
+                  values.clusterDir: kflux-fedora-01
+                - nameNormalized: kflux-rhel-p01
+                  values.clusterDir: kflux-rhel-p01
+                - nameNormalized: stone-prd-rh01
+                  values.clusterDir: stone-prd-rh01
   template:
     metadata:
       name: squid-{{nameNormalized}}

argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-patch.yaml

@@ -0,0 +1,7 @@
+---
+- op: replace
+  path: /spec/source/repoURL
+  value: https://github.com/redhat-appstudio/internal-infra-deployments.git
+- op: replace
+  path: /spec/source/targetRevision
+  value: main

argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/application-set-patch.yaml

@@ -0,0 +1,7 @@
+---
+- op: replace
+  path: /spec/template/spec/source/repoURL
+  value: https://github.com/redhat-appstudio/internal-infra-deployments.git
+- op: replace
+  path: /spec/template/spec/source/targetRevision
+  value: main

argo-cd-apps/k-components/inject-internal-infra-deployments-repo-details/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+patches:
+  - path: application-set-patch.yaml
+    target:
+      group: argoproj.io
+      version: v1alpha1
+      kind: ApplicationSet
+      labelSelector: noSourceTransform != true
+  - path: application-patch.yaml
+    target:
+      group: argoproj.io
+      version: v1alpha1
+      kind: Application
+      labelSelector: noSourceTransform != true

argo-cd-apps/overlays/development-operator/kustomization.yaml

@@ -3,17 +3,24 @@
 # policies, pipeline-service, etc.) and deletes only the legacy Konflux
 # microservice ApplicationSets listed in delete-legacy-konflux-member-appsets.yaml
 # so those workloads are not deployed alongside the operator-managed stack.
+# pipeline-service uses components/pipeline-service/development-operator/ (no
+# appstudio-pipelines-scc); the operator build-service component owns that SCC.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../development
   - ../../base/member/infra-deployments/konflux-operator
 patchesStrategicMerge:
   - delete-legacy-konflux-member-appsets.yaml
+namespace: openshift-gitops
 patches:
   - path: development-operator-generator-patch.yaml
     target:
       kind: ApplicationSet
       version: v1alpha1
       name: konflux-operator
-namespace: openshift-gitops
+  - path: pipeline-service-operator-patch.yaml
+    target:
+      kind: ApplicationSet
+      version: v1alpha1
+      name: pipeline-service

argo-cd-apps/overlays/development-operator/pipeline-service-operator-patch.yaml

@@ -0,0 +1,4 @@
+---
+- op: replace
+  path: /spec/generators/0/merge/generators/0/clusters/values/environment
+  value: development-operator

argo-cd-apps/overlays/development/delete-applications.yaml

@@ -102,3 +102,9 @@ kind: ApplicationSet
 metadata:
   name: monitoring-workload-grafana
 $patch: delete
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: k8s-groups
+$patch: delete

argo-cd-apps/overlays/konflux-public-production/kustomization.yaml

@@ -241,7 +241,7 @@ patches:
       kind: ApplicationSet
       version: v1alpha1
       name: pulp-access-controller
-  - path: production-overlay-patch.yaml
+  - path: squid-production-overlay-patch.yaml
     target:
       kind: ApplicationSet
       version: v1alpha1
@@ -281,3 +281,8 @@ patches:
       kind: ApplicationSet
       version: v1alpha1
       name: perf-team-prometheus-reader
+  - path: production-overlay-patch.yaml
+    target:
+      kind: ApplicationSet
+      version: v1alpha1
+      name: k8s-groups

argo-cd-apps/overlays/konflux-public-production/squid-production-overlay-patch.yaml

@@ -0,0 +1,7 @@
+---
+- op: add
+  path: /spec/generators/0/merge/generators/0/clusters/values/environment
+  value: production
+- op: add
+  path: /spec/generators/0/merge/generators/0/clusters/values/clusterDir
+  value: empty-base

argo-cd-apps/overlays/production-downstream/kustomization.yaml

@@ -255,7 +255,7 @@ patches:
       kind: ApplicationSet
       version: v1alpha1
       name: pulp-access-controller
-  - path: production-overlay-patch.yaml
+  - path: squid-production-overlay-patch.yaml
     target:
       kind: ApplicationSet
       version: v1alpha1
@@ -295,3 +295,8 @@ patches:
       kind: ApplicationSet
       version: v1alpha1
       name: perf-team-prometheus-reader
+  - path: production-overlay-patch.yaml
+    target:
+      kind: ApplicationSet
+      version: v1alpha1
+      name: k8s-groups

argo-cd-apps/overlays/production-downstream/squid-production-overlay-patch.yaml

@@ -0,0 +1,7 @@
+---
+- op: add
+  path: /spec/generators/0/merge/generators/0/clusters/values/environment
+  value: production
+- op: add
+  path: /spec/generators/0/merge/generators/0/clusters/values/clusterDir
+  value: empty-base