sync to refactored break - #2
Open
brownzebra wants to merge 2385 commits into
Open
Conversation
merge main into grafana-user-and-httproute
Grafana user and httproute, keeping old dashboards, premade kubernetes dashboards, initial cluster health dashboard
get grafana into v210 branch
Revert "get grafana into v210 branch"
…ubernetes dashboards, initial cluster health dashboard"
…route Revert "Grafana user and httproute, keeping old dashboards, premade kubernetes dashboards, initial cluster health dashboard"
Revert "Revert "get grafana into v210 branch""
Polling (oci://):
apps:
aiwb:
repoURL: oci://ghcr.io/silogen/charts/aiwb
repoVersion: "0.0.0-int-test"
# path defaults to "."
Non-polling (Helm OCI):
apps:
aiwb:
repoURL: ghcr.io/silogen/charts # bare hostname
chart: aiwb
repoVersion: "0.0.0-int-test"
…rgoproj.io/sync-options: SkipDryRunOnMissingResource=true (clean retry over hard error)
…boostrap-script fix: remove deprecated script from release-pipeline
…tion fix via feature: add retry policy to cluster-apps.yaml template
Details to deploy on OpenShift environment
Provision a write credential for AIWB's ADR-0002 Scenario 2 key store, scoped to secrets/apikeys/* instead of reusing the root token: - secret-manager (reconciling, every 5m + init) idempotently ensures apikeys-write-policy and mints a scoped token at secrets/aiwb-openbao-token, re-minting only when the stored one is missing or invalid. No renewal machinery (nothing else in the stack renews); the token carries the default TTL and rotates on expiry. - aiwb-external-secrets: an ExternalSecret materializes that token into the aiwb namespace as aiwb-openbao-token, which the AIWB backend already consumes as OPENBAO_TOKEN. ESO reads it via the existing readonly store. Policy capabilities match the AIWB client exactly: data create/read/update and metadata create/update/delete (delete_version_after + revocation). The OCI publish of aiwb-external-secrets and the root repoVersion bump are handled by the external release pipeline, not here.
docs: update 2.2.0 refs to 2.2.2 in migration from 2.1.x guide
…edential EAI-7277: scoped OpenBao write credential for the API-key KV path
Add option to use local Helm values for apps
Minor correction
A feature which allows addition of extra apps managed by argo.
* feat: overhaul LGTM stack v1.0.8 with official Grafana image * lgtm overhaul v4 * old PROMETHEUS_EXTRA_ARGS to single line so retention.size flag isn't dropped * expose collector memory_limiter settings via values.yaml * docs: add otel-lgtm-stack per-cluster tuning guide * docs: polishing the doc
* Upgrade seaweedfs operator to 0.1.29 * Disable seaweed ingress, as we create HTTPRoutes. Remove seaweed crds (part of operator now) * Replace init-job with seaweedfs native bucket yaml definition * fix wrong values object reference * Add missing config to root values * Add missing value from root values * Fix scoping error in the bucket template * Upgrade to latest (0.1.36) * fix wrong value for Versioning attribute * Fix windows end line issue * Add quotation marks to get helm to correctly read value as string * Change the backwards-compatibility-enabling service "filer-s3" (the naming is anathema to the latest seaweed operator) to point to the new seaweedfs s3 service * Keep the httproute unchanged, no unneeded changes should be added * add a dummy file in crds, to allow migrating without removing seaweedfs-crds from apps * Update SBOM * update sbom components.yaml
A CloudNativePG Cluster with instances: 1 gets a <name>-primary PodDisruptionBudget at minAvailable: 1, which permits zero disruptions for as long as the cluster is single-instance. That PDB protects nothing, since there is no second replica to keep serving, and it blocks kubectl drain on whichever node the pod sits on. Node maintenance then stalls until an operator disables it by hand on the live cluster, out of band from Git. enablePDB now defaults to false while instances is 1 and true from two instances up, and an explicit cnpg.enablePDB wins either way.
keycloak-config renders the same keycloak-cnpg Cluster as keycloak-old, so it carries the same drain blocker. A single-instance PDB permits zero disruptions, which protects nothing and only stalls `kubectl drain` on whichever node the primary sits on. Introduce the cnpg values block this chart lacked and derive enablePDB from instances, with an explicit value winning. Matches the pattern already applied to keycloak-old in this branch.
EAI-7854 Skip the keycloak CNPG PDB for a single instance
The small profile had no override for aiwb-infra-cnpg, so it inherited instances: 3 from the published aiwb-cnpg chart, while the medium profile explicitly set instances: 1. A small cluster therefore ran three Postgres replicas silently, consuming more resources than a medium cluster. airm-infra-cnpg already defaults to a single instance upstream, so it needs no override. The large profile keeps three instances.
EAI-7854 Pin aiwb-infra-cnpg to one instance on small profile
…G topology Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>
EAI-7889 Add pod anti-affinity for SeaweedFS and fix keycloak-old CNPG topology
The airm-realm.json value is a YAML block scalar with 4-space indented content. The closing bracket of the emptied KeyProvider array sat at column 0, which terminates the block scalar early, so the parser read it as a new mapping key. This made 'helm template sources/keycloak-config' fail with 'line 2123: did not find expected key'. Indenting the bracket restores rendering. The embedded JSON is byte-identical after re-parsing, the empty array was intentional.
feat: extraApps for argo
EAI-7854 Repair YAML block scalar in keycloak realm ConfigMap
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
15 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.