@bluefly/openstandardagents 0.2.8 → 0.3.0

package/infrastructure/gitlab-agent/rbac.yaml

@@ -1,126 +0,0 @@
-# GitLab Kubernetes Agent RBAC Configuration
-# Production-ready RBAC with least privilege principles
-# This replaces the default cluster-admin role with more restrictive permissions
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: gitlab-agent
-  namespace: gitlab-agent
-  labels:
-    app: gitlab-agent
-    component: ossa-agent
----
-# ClusterRole with minimal required permissions for GitLab agent
-# Adjust based on your specific needs
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: gitlab-agent
-  labels:
-    app: gitlab-agent
-    component: ossa-agent
-rules:
-  # Core API access for agent operations
-  - apiGroups: [""]
-    resources:
-      - namespaces
-      - pods
-      - pods/exec
-      - pods/log
-      - pods/portforward
-      - services
-      - endpoints
-      - configmaps
-      - secrets
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  
-  # Deployment and workload management
-  - apiGroups: ["apps"]
-    resources:
-      - deployments
-      - replicasets
-      - statefulsets
-      - daemonsets
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  
-  # Job and CronJob management
-  - apiGroups: ["batch"]
-    resources:
-      - jobs
-      - cronjobs
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  
-  # Ingress management
-  - apiGroups: ["networking.k8s.io"]
-    resources:
-      - ingresses
-      - ingressclasses
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  
-  # Service account and RBAC (for CI/CD operations)
-  - apiGroups: [""]
-    resources:
-      - serviceaccounts
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
-  
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources:
-      - roles
-      - rolebindings
-      - clusterroles
-      - clusterrolebindings
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
-  
-  # Events for observability
-  - apiGroups: [""]
-    resources:
-      - events
-    verbs: ["get", "list", "watch", "create", "patch"]
-  
-  # Nodes (read-only for cluster info)
-  - apiGroups: [""]
-    resources:
-      - nodes
-    verbs: ["get", "list", "watch"]
-  
-  # Persistent volumes (if needed for deployments)
-  - apiGroups: [""]
-    resources:
-      - persistentvolumes
-      - persistentvolumeclaims
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
-  
-  # Custom resources (for OSSA agents and other CRDs)
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  
-  # Metrics and monitoring
-  - apiGroups: ["metrics.k8s.io"]
-    resources:
-      - nodes
-      - pods
-    verbs: ["get", "list"]
-  
-  # Health checks
-  - nonResourceURLs: ["/healthz", "/readyz", "/livez"]
-    verbs: ["get"]
----
-# ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: gitlab-agent
-  labels:
-    app: gitlab-agent
-    component: ossa-agent
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: gitlab-agent
-subjects:
-  - kind: ServiceAccount
-    name: gitlab-agent
-    namespace: gitlab-agent
-

package/infrastructure/gitlab-agent/values.yaml

@@ -1,150 +0,0 @@
-# GitLab Kubernetes Agent Helm Values
-# Production-ready configuration for OSSA agents
-
-# Agent configuration
-config:
-  # Agent token (set via --set config.token=<token> or from secret)
-  # token: ""
-  
-  # KAS address for self-hosted GitLab
-  # Replace with your GitLab instance URL
-  kasAddress: "wss://your-gitlab-instance.com/-/kubernetes-agent/"
-  
-  # Optional: KAS CA certificate for self-signed certs
-  # kasCaCert: ""
-
-# Image configuration
-image:
-  repository: registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk
-  tag: "v18.4.0"  # Match your GitLab version
-  pullPolicy: IfNotPresent
-
-# Service account configuration
-serviceAccount:
-  create: true
-  name: gitlab-agent
-  annotations: {}
-  # annotations:
-  #   eks.amazonaws.com/role-arn: "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
-
-# RBAC configuration
-rbac:
-  create: true
-  # Use existing role instead of creating cluster-admin
-  # useExistingRole: false
-  # existingRoleName: ""
-
-# Resource limits
-resources:
-  requests:
-    cpu: 100m
-    memory: 128Mi
-  limits:
-    cpu: 500m
-    memory: 512Mi
-
-# Pod configuration
-podAnnotations:
-  prometheus.io/scrape: "true"
-  prometheus.io/port: "8080"
-  prometheus.io/path: "/metrics"
-
-podLabels:
-  app: gitlab-agent
-  component: ossa-agent
-  managed-by: helm
-
-# Security context
-securityContext:
-  runAsNonRoot: true
-  runAsUser: 65534
-  fsGroup: 65534
-  seccompProfile:
-    type: RuntimeDefault
-
-# Node selector (optional)
-nodeSelector: {}
-
-# Tolerations (optional)
-tolerations: []
-
-# Affinity rules (optional)
-affinity: {}
-
-# Extra environment variables
-extraEnv: []
-# Example:
-# extraEnv:
-#   - name: LOG_LEVEL
-#     value: "debug"
-
-# Liveness and readiness probes
-livenessProbe:
-  httpGet:
-    path: /liveness
-    port: 8080
-  initialDelaySeconds: 30
-  periodSeconds: 30
-  timeoutSeconds: 5
-  failureThreshold: 3
-
-readinessProbe:
-  httpGet:
-    path: /readiness
-    port: 8080
-  initialDelaySeconds: 10
-  periodSeconds: 10
-  timeoutSeconds: 5
-  failureThreshold: 3
-
-# Pod disruption budget
-podDisruptionBudget:
-  enabled: true
-  minAvailable: 1
-
-# Service monitor for Prometheus (if Prometheus Operator is installed)
-serviceMonitor:
-  enabled: false
-  interval: 30s
-  scrapeTimeout: 10s
-  labels: {}
-
-# Network policy (if supported)
-networkPolicy:
-  enabled: false
-
-# Priority class (optional)
-priorityClassName: ""
-
-# Extra volumes
-extraVolumes: []
-
-# Extra volume mounts
-extraVolumeMounts: []
-
-# Init containers
-initContainers: []
-
-# Additional containers (sidecars)
-additionalContainers: []
-
-# Deployment configuration
-replicaCount: 1
-
-# Strategy
-strategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-
-# Termination grace period
-terminationGracePeriodSeconds: 30
-
-# Namespace configuration
-namespace:
-  create: true
-  name: gitlab-agent
-  annotations: {}
-  labels: {}
-

package/infrastructure/k8s/monitoring/00-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  labels:
-    name: monitoring
-    app.kubernetes.io/name: monitoring

package/infrastructure/k8s/monitoring/01-prometheus.yaml

@@ -1,142 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: prometheus-config
-  namespace: monitoring
-data:
-  prometheus.yml: |
-    global:
-      scrape_interval: 15s
-      evaluation_interval: 15s
-    
-    scrape_configs:
-      - job_name: 'prometheus'
-        static_configs:
-          - targets: ['localhost:9090']
-      
-      - job_name: 'gitlab-agent'
-        kubernetes_sd_configs:
-          - role: pod
-            namespaces:
-              names:
-                - gitlab-agent
-        relabel_configs:
-          - source_labels: [__meta_kubernetes_pod_label_app]
-            regex: gitlab-agent
-            action: keep
-          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
-            action: keep
-            regex: true
-          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_port]
-            action: replace
-            target_label: __address__
-            regex: ([^:]+)(?::\d+)?;(\d+)
-            replacement: $1:$2
-      
-      - job_name: 'ossa-agents'
-        kubernetes_sd_configs:
-          - role: pod
-            namespaces:
-              names:
-                - ossa-agents
-        relabel_configs:
-          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
-            action: keep
-            regex: true
-          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
-            action: replace
-            target_label: __metrics_path__
-            regex: (.+)
-          - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
-            action: replace
-            regex: ([^:]+)(?::\d+)?;(\d+)
-            replacement: $1:$2
-            target_label: __address__
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: prometheus
-  namespace: monitoring
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: prometheus
-  template:
-    metadata:
-      labels:
-        app: prometheus
-    spec:
-      serviceAccountName: prometheus
-      containers:
-      - name: prometheus
-        image: prom/prometheus:latest
-        args:
-          - '--config.file=/etc/prometheus/prometheus.yml'
-          - '--storage.tsdb.path=/prometheus'
-          - '--web.console.libraries=/usr/share/prometheus/console_libraries'
-          - '--web.console.templates=/usr/share/prometheus/consoles'
-        ports:
-        - containerPort: 9090
-        volumeMounts:
-        - name: config
-          mountPath: /etc/prometheus
-        - name: storage
-          mountPath: /prometheus
-      volumes:
-      - name: config
-        configMap:
-          name: prometheus-config
-      - name: storage
-        emptyDir: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prometheus
-  namespace: monitoring
-spec:
-  selector:
-    app: prometheus
-  ports:
-  - port: 9090
-    targetPort: 9090
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: prometheus
-  namespace: monitoring
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: prometheus
-rules:
-- apiGroups: [""]
-  resources:
-  - nodes
-  - nodes/proxy
-  - services
-  - endpoints
-  - pods
-  verbs: ["get", "list", "watch"]
-- apiGroups:
-  - extensions
-  resources:
-  - ingresses
-  verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: prometheus
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: prometheus
-subjects:
-- kind: ServiceAccount
-  name: prometheus
-  namespace: monitoring

package/infrastructure/k8s/monitoring/02-grafana.yaml

@@ -1,63 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-datasources
-  namespace: monitoring
-data:
-  prometheus.yaml: |
-    apiVersion: 1
-    datasources:
-    - name: Prometheus
-      type: prometheus
-      access: proxy
-      url: http://prometheus:9090
-      isDefault: true
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: grafana
-  namespace: monitoring
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: grafana
-  template:
-    metadata:
-      labels:
-        app: grafana
-    spec:
-      containers:
-      - name: grafana
-        image: grafana/grafana:latest
-        ports:
-        - containerPort: 3000
-        env:
-        - name: GF_SECURITY_ADMIN_PASSWORD
-          value: "admin"
-        - name: GF_USERS_ALLOW_SIGN_UP
-          value: "false"
-        volumeMounts:
-        - name: grafana-storage
-          mountPath: /var/lib/grafana
-        - name: grafana-datasources
-          mountPath: /etc/grafana/provisioning/datasources
-      volumes:
-      - name: grafana-storage
-        emptyDir: {}
-      - name: grafana-datasources
-        configMap:
-          name: grafana-datasources
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: grafana
-  namespace: monitoring
-spec:
-  selector:
-    app: grafana
-  ports:
-  - port: 3000
-    targetPort: 3000

package/infrastructure/k8s/monitoring/03-lightweight.yaml

@@ -1,121 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: prometheus-lite
-  namespace: monitoring
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: prometheus-lite
-  template:
-    metadata:
-      labels:
-        app: prometheus-lite
-    spec:
-      tolerations:
-      - key: "node.kubernetes.io/disk-pressure"
-        operator: "Exists"
-        effect: "NoSchedule"
-      containers:
-      - name: prometheus
-        image: prom/prometheus:latest
-        args:
-          - '--config.file=/etc/prometheus/prometheus.yml'
-          - '--storage.tsdb.path=/prometheus'
-          - '--storage.tsdb.retention.time=1h'
-          - '--storage.tsdb.retention.size=100MB'
-        ports:
-        - containerPort: 9090
-        resources:
-          requests:
-            memory: "128Mi"
-            cpu: "100m"
-          limits:
-            memory: "256Mi"
-            cpu: "200m"
-        volumeMounts:
-        - name: config
-          mountPath: /etc/prometheus
-        - name: storage
-          mountPath: /prometheus
-      volumes:
-      - name: config
-        configMap:
-          name: prometheus-config
-      - name: storage
-        emptyDir:
-          sizeLimit: 200Mi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prometheus-lite
-  namespace: monitoring
-spec:
-  selector:
-    app: prometheus-lite
-  ports:
-  - port: 9090
-    targetPort: 9090
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: grafana-lite
-  namespace: monitoring
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: grafana-lite
-  template:
-    metadata:
-      labels:
-        app: grafana-lite
-    spec:
-      tolerations:
-      - key: "node.kubernetes.io/disk-pressure"
-        operator: "Exists"
-        effect: "NoSchedule"
-      containers:
-      - name: grafana
-        image: grafana/grafana:latest
-        ports:
-        - containerPort: 3000
-        env:
-        - name: GF_SECURITY_ADMIN_PASSWORD
-          value: "admin"
-        - name: GF_USERS_ALLOW_SIGN_UP
-          value: "false"
-        resources:
-          requests:
-            memory: "128Mi"
-            cpu: "100m"
-          limits:
-            memory: "256Mi"
-            cpu: "200m"
-        volumeMounts:
-        - name: grafana-storage
-          mountPath: /var/lib/grafana
-        - name: grafana-datasources
-          mountPath: /etc/grafana/provisioning/datasources
-      volumes:
-      - name: grafana-storage
-        emptyDir:
-          sizeLimit: 100Mi
-      - name: grafana-datasources
-        configMap:
-          name: grafana-datasources
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: grafana-lite
-  namespace: monitoring
-spec:
-  selector:
-    app: grafana-lite
-  ports:
-  - port: 3000
-    targetPort: 3000

package/infrastructure/k8s/monitoring/README.md

@@ -1,73 +0,0 @@
-# OSSA Monitoring Stack
-
-Prometheus + Grafana monitoring for OSSA agents and GitLab agent.
-
-## Quick Deploy
-
-```bash
-# Deploy everything
-./deploy.sh
-
-# Or manually
-kubectl apply -f 00-namespace.yaml
-kubectl apply -f 01-prometheus.yaml
-kubectl apply -f 02-grafana.yaml
-```
-
-## Access Dashboards
-
-### Prometheus
-```bash
-kubectl port-forward -n monitoring svc/prometheus 9090:9090
-```
-Open: http://localhost:9090
-
-### Grafana
-```bash
-kubectl port-forward -n monitoring svc/grafana 3000:3000
-```
-Open: http://localhost:3000  
-Default: `admin` / `admin`
-
-## What's Monitored
-
-- **GitLab Agent** (gitlab-agent namespace)
-- **OSSA Agents** (ossa-agents namespace)
-- **Kubernetes Metrics**
-
-## Check Status
-
-```bash
-# Pods
-kubectl get pods -n monitoring
-
-# Services
-kubectl get svc -n monitoring
-
-# Logs
-kubectl logs -n monitoring -l app=prometheus
-kubectl logs -n monitoring -l app=grafana
-```
-
-## Cleanup
-
-```bash
-kubectl delete namespace monitoring
-```
-
-## Next Steps
-
-1. Deploy agents with metrics annotations:
-```yaml
-metadata:
-  annotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "9090"
-    prometheus.io/path: "/metrics"
-```
-
-2. Import Grafana dashboards
-3. Configure alerts
-4. Add Jaeger for tracing
-
-See: `.gitlab/docs/MONITORING-OBSERVABILITY.md`