@leverege/build-tools 2.101.1 → 2.102.0

package/src/helm-charts/cnpg-operator/helmup.bootstrap

@@ -26,34 +26,33 @@ function installCnpgOperatorEnvironment() {
   #
   # kubectl delete serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
   # gcloud --quiet iam service-accounts delete $CNPG_SVC_EMAIL  --project $GCP_PROJECT_ID&> $DEVNULL
-  kubectl describe serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
+
+  createNamespaceIfNeeded $CNPG_NAMESPACE
+
+  # Guard against accidental SA deletion on re-runs. Check the GCP SA (not the
+  # k8s SA) — consistent with ESO bootstrap pattern and correct for new clusters
+  # where the GCP SA exists but the k8s SA does not yet.
+  gcloud iam service-accounts describe $CNPG_SVC_EMAIL --project $GCP_PROJECT_ID &> $DEVNULL
   if [ $? -eq 0 ];
   then
     cat<<SKIP_CNPG_SA_CREATION
 
-  $YELO_WARN The CNPG SA $CNPG_SVC_ACCT already exists
+  $YELO_WARN The CNPG SA `color y $CNPG_SVC_ACCT` already exists - skipping creation
 
-  Deleting the SA for the purposes of upgrading the operator is going to
-  wreck someone's day (probably yours) if the desire is to simply upgrade
-  in place. To force a clean reinstall, delete both the k8s and gcp SA for
-  CNPG and try again. (see comments in helmup for more info)
+  To force a clean reinstall, delete both the GCP and k8s SAs for CNPG and
+  re-run helmup cnpg-operator.
 
 SKIP_CNPG_SA_CREATION
-    return
+  else
+    printf "\nCreating the gcloud `color g $CNPG_SVC_ACCT` service account (SA)\n"
+    gcloud iam service-accounts create $CNPG_SVC_ACCT \
+      --project "$GCP_PROJECT_ID" \
+      --description "CNPG Operands SA" \
+      --display-name "CNPG Operands SA" &> $DEVNULL
+    exitOnError $? "Failed to create GCP SA `color y $CNPG_SVC_ACCT`"
+    waitForSA "$CNPG_SVC_ACCT" "$GCP_PROJECT_ID" 60
   fi
 
-  # Create the operands namespace and annotate to allow redis access
-  createNamespaceIfNeeded $CNPG_NAMESPACE
-
-  # Create GCP SA and bind policies
-  printf "\nCreating the gcloud `color g $CNPG_SVC_ACCT` service account (SA)\n"
-  gcloud iam service-accounts create $CNPG_SVC_ACCT \
-    --project "$GCP_PROJECT_ID" \
-    --description "CNPG Operands SA" \
-    --display-name "CNPG Operands SA" &> $DEVNULL
-  warnOnError $? "the GCP SA `color y $CNPG_SVC_ACCT` may already exist"
-  waitForSA "$CNPG_SVC_ACCT" "$GCP_PROJECT_ID" 60
-
   CNPG_OPS_ROLE="cnpg.operands"
   printf "\nCreating the `color g $CNPG_OPS_ROLE` IAM role\n"
   ## Attach roles
@@ -136,7 +135,6 @@ driver: pd.csi.storage.gke.io
 deletionPolicy: Retain
 EOSNAPSC
 
-  sleep 2 # hold up processing for a moment to allow IAM mods to propagate
 }
 
 # this function is a little convoluted in the way it attempts to install the
@@ -184,7 +182,7 @@ CNPG_FETCH_CLEANUP_CRONJOB_YAML
     --project="$GCP_PROJECT_ID" \
     --description="Used for cronjob cleanup with Workload Identity" \
     --display-name="CNPG Cleanup SA" &> $DEVNULL
-    warnOnError $? "the GCP SA $CNPG_CLEANUP_SA may already exist"
+  warnOnError $? "the GCP SA $CNPG_CLEANUP_SA may already exist"
   waitForSA "$CNPG_CLEANUP_SA" "$GCP_PROJECT_ID" 60
 
   gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \

package/src/helm-charts/eso/helmup.bootstrap

@@ -11,6 +11,8 @@ function installEsoEnvironment() {
   ESO_SA="eso-sa"
   ESO_SA_EMAIL="$ESO_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com"
 
+  createNamespaceIfNeeded $ESO_NAMESPACE
+
   # Guard against accidental SA deletion on re-runs (see cnpg-operator for war story)
   gcloud iam service-accounts describe $ESO_SA_EMAIL --project $GCP_PROJECT_ID &> $DEVNULL
   if [ $? -eq 0 ];
@@ -50,8 +52,8 @@ SKIP_ESO_SA_CREATION
     --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[$ESO_NAMESPACE/external-secrets]" \
     --role roles/iam.workloadIdentityUser $ESO_SA_EMAIL
   warnOnError $? "gcloud workload identity binding may have failed"
-
-  createNamespaceIfNeeded $ESO_NAMESPACE
+  waitForSAIAM "$ESO_SA" "$GCP_PROJECT_ID" "roles/iam.workloadIdentityUser" \
+    "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[$ESO_NAMESPACE/external-secrets]" 60
 }
 
 installEsoEnvironment

package/src/helm-charts/prom-operator/README-CRD-UPGRADES.md

@@ -0,0 +1,105 @@
+# CRD Upgrades — kube-prometheus-stack
+
+## Why this exists
+
+Helm can install CustomResourceDefinitions (CRDs) but will not upgrade them
+when you bump chart versions. This chart ships a CRD upgrade job that uses
+server-side apply (SSA) to reconcile CRDs to the versions bundled with the
+chart.
+
+## Default: disabled
+
+The CRD upgrade job is disabled by default (`crds.enabled: false`) because it
+requires cluster-admin level permissions to run. Specifically, it creates and
+deletes ClusterRole and ClusterRoleBinding resources as pre-upgrade Helm hooks,
+which requires `container.clusterRoles.delete` in GCP IAM. Only enable it when
+explicitly bumping the chart version, and only a devops engineer should run
+`helmup prom-operator` when it is enabled.
+
+## Settings
+
+**`crds.enabled`** — controls whether the chart manages CRDs at all. When
+`false`, the CRD upgrade job and its associated hook resources are not rendered.
+Default: `false`.
+
+**`crds.upgradeJob.enabled`** — controls whether the SSA upgrade job hook runs.
+Must be `true` for CRDs to be reconciled on upgrade. Default: `false`.
+
+**`crds.upgradeJob.forceConflicts`** — adds `--force-conflicts` to the SSA
+apply, overriding fields owned by another field manager. Use only for a one-time
+conflict resolution. Revert to `false` immediately after. Default: `false`.
+
+## Permissions requirement
+
+The upgrade job runs as a pair of Helm pre-upgrade hooks that create a
+ClusterRole and ClusterRoleBinding. Helm's `before-hook-creation` delete policy
+causes it to attempt deletion of these resources before creating them — even if
+they don't yet exist in the cluster. The GCP IAM permission check fires before
+the existence check, so a 403 is returned for users without
+`container.clusterRoles.delete` regardless of whether the resources are present.
+
+The `admission-webhooks/job-patch` hooks have the same requirement and are
+always present, making `helmup prom-operator` a full-devops-only operation
+regardless of the CRD upgrade setting.
+
+## Hook lifecycle
+
+The ClusterRole and ClusterRoleBinding created by the upgrade job are ephemeral.
+They are deleted automatically after the job succeeds via the
+`hook-delete-policy: hook-succeeded` annotation. You will not see them in
+`kubectl get clusterrole` after a successful run.
+
+## Switching from enabled to disabled
+
+If `crds.enabled` was previously `true` and a successful upgrade ran, the CRD
+hook resources are recorded in the Helm release manifest even though they no
+longer exist in the cluster. Switching to `false` and running `helmup` will
+cause Helm to attempt to delete those orphaned hook resources from the previous
+release — again requiring cluster-admin permissions for that one transition run.
+
+To verify what hooks are currently stored in the release:
+```bash
+helm get hooks prometheus-stack -n prometheus | grep ^"# Source"
+```
+
+After a devops engineer runs `helmup prom-operator` with `crds.enabled: false`,
+the hooks will be cleared from the release manifest and subsequent runs will not
+require cluster-admin permissions (beyond the always-present admission-webhook
+hooks).
+
+## Runbook — bumping the chart version
+
+1. **Preflight** — confirm current CRD state:
+   ```bash
+   kubectl get crd | grep monitoring.coreos.com
+   kubectl apply --server-side --dry-run=server -f <crd-dir/>
+   ```
+
+2. **Enable** — set both flags in `prometheus-stack.yaml.ovh`:
+   ```yaml
+   crds:
+     enabled: true
+     upgradeJob:
+       enabled: true
+       forceConflicts: false
+   ```
+
+3. **Run** — as a devops engineer:
+   ```bash
+   helmup prom-operator
+   ```
+
+4. **If the job fails with field-manager conflicts:**
+   - Confirm no other source manages these CRDs
+   - Temporarily set `forceConflicts: true` for this run only
+   - Revert to `false` immediately after
+
+5. **Post-check:**
+   ```bash
+   kubectl get crd | grep monitoring.coreos.com
+   # verify CRDs show Established: True
+   # verify operator pod is healthy
+   # verify alerts and rules are normal
+   ```
+
+6. **Disable** — revert both flags to `false` before committing.

package/src/helm-charts/prom-operator/helmup.bootstrap

@@ -17,11 +17,14 @@ function installStackdriverExporterEnvironment() {
 
   createNamespaceIfNeeded $SDEXP_NS
 
-  # guarantee any previous remnants of the exporter are gone
-  printf "\n*** Removing the previous $SDEXP_SA installation...\n"
-  helm uninstall -n $SDEXP_NS "stackdriver-exporter"    &> $DEVNULL
-  kubectl delete serviceaccounts -n $SDEXP_NS $SDEXP_SA &> $DEVNULL
-  printf "*** Deleting the gcloud SA $SDEXP_EM\n"
+# used to remove this to avoid weird behavior when attempting to reboot
+# the service with udated configs - no longer doing this (for now)
+#
+# guarantee any previous remnants of the exporter are gone
+# printf "\n*** Removing the previous $SDEXP_SA installation...\n"
+# helm uninstall -n $SDEXP_NS "stackdriver-exporter"    &> $DEVNULL
+# kubectl delete serviceaccounts -n $SDEXP_NS $SDEXP_SA &> $DEVNULL
+# printf "*** Deleting the gcloud SA $SDEXP_EM\n"
 # gcloud --quiet iam service-accounts delete $SDEXP_EM  \
 #                            --project $GCP_PROJECT_ID  &> $DEVNULL
 
@@ -58,18 +61,19 @@ function createGrafanaOAuthSecret() {
     printf "\nCreating placeholder `color g grafana-google-oauth` secret in prometheus namespace\n"
     kubectl create secret generic grafana-google-oauth \
       --namespace prometheus \
-      --from-literal=GF_AUTH_GOOGLE_CLIENT_ID='' \
-      --from-literal=GF_AUTH_GOOGLE_CLIENT_SECRET=''
+      --from-literal=GF_AUTH_GOOGLE_CLIENT_ID='bootstrap id' \
+      --from-literal=GF_AUTH_GOOGLE_CLIENT_SECRET='boostrap secret'
     warnOnError $? "Failed to create grafana-google-oauth placeholder secret"
   else
     printf "\n`color g grafana-google-oauth` secret already exists - skipping\n"
   fi
 
-  # Wire up the ExternalSecret now that ESO is guaranteed to be deployed first
-  # in the SYSTEM array. This syncs credentials from GCP Secret Manager into the
-  # grafana-google-oauth secret once the deployment engineer populates them.
-  showInstalling "Grafana Google OAuth ExternalSecret"
-  cat<<GRAFANA_OAUTH_SECRET | kubectl apply -f -
+  # Wire up the ExternalSecret only if ESO is enabled for this cluster.
+  # Set ESO_ENABLED=true in overwhelm.yaml to activate (default: false).
+  if [ "${ESO_ENABLED}" = "true" ];
+  then
+    showInstalling "Grafana Google OAuth ExternalSecret"
+    cat<<GRAFANA_OAUTH_SECRET | kubectl apply -f -
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -86,11 +90,15 @@ spec:
   data:
     - secretKey: GF_AUTH_GOOGLE_CLIENT_ID
       remoteRef:
-        key: grafana-google-client-id
+        key: GF_AUTH_GOOGLE_CLIENT_ID
     - secretKey: GF_AUTH_GOOGLE_CLIENT_SECRET
       remoteRef:
-        key: grafana-google-client-secret
+        key: GF_AUTH_GOOGLE_CLIENT_SECRET
 GRAFANA_OAUTH_SECRET
+  else
+    printf "\n`color y '***WARNING:'` ESO_ENABLED is not set - skipping Grafana OAuth ExternalSecret\n"
+    printf "  Set ESO_ENABLED=true in overwhelm.yaml and re-run helmup prom-operator to wire up the OAuth secret.\n\n"
+  fi
 }
 
 installStackdriverExporterEnvironment

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="82.15.0"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="85.0.2"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -1,50 +1,13 @@
+#
+# Apparently you must have devops access in order to deploy the prometheus
+# operator since it attempts to create cluster roles during deployment.
+#
 crds:
-  # ─────────────────────────────────────────────────────────────────────────────
-  # CRD MANAGEMENT — kube-prometheus-stack
-  #
-  # Why this exists
-  #   Helm can install CustomResourceDefinitions (CRDs) but will not upgrade them
-  #   when you bump chart versions. This chart ships a CRD upgrade job that uses
-  #   server-side apply (SSA) to reconcile CRDs to the versions bundled with the
-  #   chart.
-  #
-  # Safe operating model
-  #   ✅ Leave the upgrade job ENABLED if this chart is the sole owner of the
-  #      Prometheus Operator CRDs.
-  #   ⚠️  Keep "forceConflicts" DISABLED unless you hit a specific field-manager
-  #      conflict that you’ve reviewed and want this chart to own.
-  #   ❌ If another source manages CRDs (e.g., a separate CRD chart, GitOps
-  #      bootstrap, platform repo), DISABLE the job to avoid ownership fights.
-  #
-  # Settings
-  #   enabled:        runs the SSA job on chart upgrade to reconcile CRDs.
-  #                   Recommended: true if chart owns the CRDs; false if
-  #                   another tool owns them.
-  #
-  #   forceConflicts: adds `--force-conflicts` to SSA, overriding fields owned by
-  #                   another controller. Use only for a one-time conflict
-  #                   resolution. Can overwrite annotations and mask real
-  #                   incompatibilities if left true.
-  #
-  # Recommended defaults
-  #   enabled: true
-  #   forceConflicts: false
-  #
-  # Mini-runbook
-  #   1) Preflight:
-  #      kubectl get crd | grep monitoring.coreos.com
-  #      kubectl apply --server-side --dry-run=server -f <crd-dir/>
-  #   2) Upgrade with enabled: true, forceConflicts: false.
-  #   3) If job fails with conflicts:
-  #        - confirm no other source manages these CRDs
-  #        - temporarily set forceConflicts: true for this upgrade only
-  #        - revert to false afterwards
-  #   4) Post-check: CRDs Established, operator healthy, alerts/rules normal
-  # ─────────────────────────────────────────────────────────────────────────────
+  # See README-CRD-UPGRADES.md — disabled by default, full-devops only
   enabled: true
   upgradeJob:
     enabled: true
-    forceConflicts: false # See README-CRD-UPGRADES.md
+    forceConflicts: false
 
 kubeControllerManager:
   enabled: false
@@ -180,13 +143,19 @@ grafana:
   sidecar:
       dashboards:
         enabled: true
+        folderAnnotation: grafana_folder
+        provider:
+          foldersFromFilesStructure: true
   # Credentials are injected from the grafana-google-oauth k8s secret, which is
   # managed by the ExternalSecret in helmup.plugin once ESO is deployed.
   # On first install, the secret is a placeholder created by helmup.bootstrap.
+  grafana.ini:
+    feature_toggles:
+      ssoSettingsApi: false
   envFromSecret: grafana-google-oauth
   env:
     GF_SERVER_ROOT_URL: https://${PROJECT_NAME}-monitoring.${HOST}.com
-    GF_AUTH_GOOGLE_ENABLED: "true"
+    GF_AUTH_GOOGLE_ENABLED: "${ESO_ENABLED}"
     GF_AUTH_GOOGLE_SCOPES: "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email"
     GF_AUTH_GOOGLE_AUTH_URL: "https://accounts.google.com/o/oauth2/auth"
     GF_AUTH_GOOGLE_TOKEN_URL: "https://accounts.google.com/o/oauth2/token"
@@ -284,7 +253,7 @@ alertmanager:
               {{- end }}
 
               {{- if .Labels.pod }}
-              *Pod Link:* *<https://console.cloud.google.com/kubernetes/pod/${GCE_REGION}/${CLUSTER_NAME}/{{ .Labels.namespace }}/{{ .Labels.pod }}?project=${PROJECT_NAME}|`{{ .Labels.pod }}`>*
+              *Pod Link:* *<https://console.cloud.google.com/kubernetes/pod/${GCE_REGION}/${CLUSTER_NAME}/{{ .Labels.namespace }}/{{ .Labels.pod }}?project=${PROJECT_ID}|`{{ .Labels.pod }}`>*
               {{- end }}
 
               *Status:* `{{ .Status }}` | *Severity:* `{{ .Labels.severity }}` {{- if .Labels.container }} *Container:* `{{ .Labels.container }}` {{- end }}
@@ -347,6 +316,15 @@ alertmanager:
           - namespace
           - alertname
 
+      # GKE node upgrade/maintenance suppresses expected churn alerts.
+      # PVC, disk pressure, and other infrastructure alerts are intentionally
+      # excluded so genuine storage/capacity problems are never silenced.
+      - source_matchers:
+          - alertname="GKEMaintenanceInProgress"
+          - maintenance="true"
+        target_matchers:
+          - alertname=~"KubernetesNodeNotReady|KubernetesPodNotHealthy|KubernetesPodCrashLooping|frequent_app_restarts"
+
     route:
       receiver: slack # default for everything
       group_by: ["alertname", "namespace"]

package/src/helm-charts/prom-operator/rules/gke-maintenance-rules.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: gke-maintenance-rules
+  namespace: prometheus
+
+spec:
+  groups:
+  - name: GKE Maintenance
+    rules:
+    - alert: GKEMaintenanceInProgress
+      expr: sum(kube_node_spec_unschedulable) > 0
+      for: 3m
+      labels:
+        severity: info
+        maintenance: "true"
+      annotations:
+        summary: "GKE node maintenance in progress"
+        description: "{{ $value }} node(s) are currently unschedulable — GKE upgrade or cordon in progress"

package/src/helm-charts/prom-operator/stackdriver-exporter.yaml.ovh

@@ -5,7 +5,7 @@
 fullnameOverride: "prometheus-stack-stackdriver-metrics"
 
 stackdriver:
-  projectId: "${PROJECT_NAME}"
+  projectId: "${PROJECT_ID}"
   metrics:
     typePrefixes:  >
       agent.googleapis.com/cpu/utilization,
@@ -19,7 +19,8 @@ stackdriver:
       kubernetes.io/container/accelerator/duty_cycle,
       kubernetes.io/container/accelerator/memory_total,
       kubernetes.io/container/accelerator/memory_used,
-      monitoring.googleapis.com/uptime_check/check_passed,
+      pubsub.googleapis.com/subscription/backlog_bytes,
+      pubsub.googleapis.com/subscription/dead_letter_message_count,
       pubsub.googleapis.com/subscription/num_undelivered_messages,
       pubsub.googleapis.com/subscription/oldest_unacked_message_age,
       pubsub.googleapis.com/subscription/pull_ack_request_count,

package/src/helm-charts/valkey/valkey-local.yaml

@@ -85,6 +85,7 @@ sentinel:
 
 metrics:
   enabled: true
+  resourcesPreset: "small"
   image:
     registry: us-docker.pkg.dev
     repository: leverege-registry/bitnami-mirror/images/redis-exporter

package/src/helm-charts/velero/helmup.bootstrap

@@ -86,6 +86,8 @@ function installVeleroEnvironment() {
       --role roles/iam.workloadIdentityUser \
       $SERVICE_ACCOUNT_EMAIL
   warnOnError $? "gcloud workload identity binding may have failed"
+  waitForSAIAM "velero" "$GCP_PROJECT_ID" "roles/iam.workloadIdentityUser" \
+    "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[velero/velero]" 60
 
   printf "\nCreate and annotate the k8s SA\n"
   kubectl create serviceaccount velero --namespace velero

package/src/helmup.sh

@@ -20,6 +20,7 @@ function giveHelp() {
       `color g "--k8s-match"` Only proceed if k8s context is correctly set
       `color g "--dry-run"`   Show what helm would do without applying changes
       `color g "--debug"`     Enable verbose debug output
+      `color g "--mutate"`    Forces a deployment mutation
       `color g "--help"`      Show this help message
 
     Invocation Modes:
@@ -48,6 +49,9 @@ for arg in "$@"; do
     --k8s-match)
       export OVERWHELM_ARGS="--matchk8s"
       ;;
+    --mutate)
+      MUTATE_DEPLOYMENT=1
+      ;;
     --help|-h)
       giveHelp && exit 0
       ;;
@@ -135,7 +139,7 @@ SYSTEM=(
   cnpg-operator
   preemptible-killer
   zombie-killer
-  reflector
+# reflector
   reloader
   velero
   cnpg-db-psql-stack
@@ -218,8 +222,8 @@ WORKLOAD_ID
       --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[${NAMESPACE}/${BOUND_SVC_ACCT}]" \
       --role roles/iam.workloadIdentityUser $SVC_ACCT_EMAIL
   warnOnError $? "gcloud workload identity binding may have failed"
-
-  sleep 2 # give the policy a chance to propagate
+  waitForSAIAM "$SVC_ACCT" "$GCP_PROJECT_ID" "roles/iam.workloadIdentityUser" \
+    "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[${NAMESPACE}/${BOUND_SVC_ACCT}]" 60
  
   # Verify the Kubernetes SA and create it if necessary
   printf "\nChecking for the `color g $NAMESPACE/$SVC_ACCT` k8s SA\n"
@@ -622,6 +626,25 @@ function doHelmup() {
   local from=
   [ ! -z "$FROM_VERSIONS" ] && from="`color y \"<= from Versions.json\"`"
   printf "$doing $from\n"
+  if [[ $MUTATE_DEPLOYMENT -eq 1 ]];
+  then
+    cat<<MUTATION_MSG
+
+  `color y "WARNING: About to delete the $SERVICE k8s deployment object!
+           This will cause brief downtime while helm recreates it. The service
+           and any LoadBalancer/static IP will be unaffected."`
+
+MUTATION_MSG
+    yesToContinue "to delete the $SERVICE deployment and proceed with upgrade"
+    kubectl delete deployments.apps $SERVICE
+    cat<<DELETE_WAIT
+    
+    `color y "  Waiting for $SERVICE deployment to be fully removed..."`
+
+DELETE_WAIT
+    kubectl wait --for=delete deployment/$SERVICE --timeout=120s
+  fi
+
   # plugins pass HELMUP as a single quoted string - split it into args without using eval
   [[ $# -eq 1 ]] && set -- $1
   "$@" --set "helmup.culprit=$culprit" --set "helmup.deployT=$deployT"
@@ -811,7 +834,7 @@ REBOOTSTRAP
 }
 
 # ---------- helmup MAIN ----------
-helm repo update &>/dev/null & # see comments in the doInstall function for rationale
+helm repo update leverege &>/dev/null & # see comments in the doInstall function for rationale
 
 overwhelm $OVERWHELM_ARGS
 [ $? -ne 0 ] && printf "\n\n***Aborting helmup...\n\n" && exit 1
@@ -821,6 +844,10 @@ export GCP_PROJECT_ID="$(getProjectIdFromK8sContext)"
 # Same for the region, but not as prevalent
 export GCE_REGION=`overwhelm -k GCE_REGION`
 
+# TODO: Temporary, until ESO is widely deployed, then the ESO_ENABLED logic
+# can be removed from the configs entirely.
+export ESO_ENABLED=`overwhelm -k ESO_ENABLED`
+
 doInstall "${SERVICES[@]}"
 
 displayBanner

package/src/init-my-chart/Chartwright.mjs

@@ -13,11 +13,11 @@ const hbsContext = {
   hbsChartName : '',
   hbsChartVersion : '1.0.0',
   hbsChartAppVersion : 'v1.0.0',
-  hbsArtifactRegistry : 'us-docker.pkg.dev/leverege-registry/FOOLDER/images',
+  hbsArtifactRegistry : 'us-docker.pkg.dev/leverege-registry/FOLDER/images',
   hbsPartOf : '',
   hbsServicePreemptible : true,
   hbsRedisEnabled : true,
-  hbsAutoScalingEnabled : true
+  hbsAutoscalingEnabled : true,
 }
 
 const PRESERVE_SECTIONS = new Set( [

package/src/init-my-chart/leaf-chart-templates/templates/extraobjects.yaml

@@ -0,0 +1 @@
+{{ include "leverege.extraObjects" . }}

package/src/init-my-chart/leaf-chart-templates/templates/ingressroute.yaml

@@ -0,0 +1 @@
+{{ include "leverege.ingressroute" . }}

package/src/overwhelm.mjs

@@ -250,14 +250,14 @@ const buildYaml = ( yamls, replacements ) => {
 const values = buildYaml( yams, over )
 
 // Check to see if someone is requesting a value from the yaml.
+// Uses the fully merged+resolved `over` object so context-specific keys are found.
 if ( args.key ) {
-  const section = args.section || 'default'
-  const keys = yaml[section]
-  debug( { keys }, '<==Replacements' )
+  const val = over[args.key] ?? ''
+  debug( { over }, '<==Replacements' )
   if ( args.export ) {
-    log( `export ${args.key}=${keys[args.key]}` )
+    log( `export ${args.key}=${val}` )
   } else {
-    log( keys[args.key] )
+    log( val )
   }
   if ( !args.continue ) process.exit()
 }

package/src/service-man/config/secrets/npmrc.json

@@ -0,0 +1,14 @@
+{
+  "type": "managed",
+  "name": "NPMRC",
+  "source": "leverege-registry:DEPRECATED_NPMRC",
+  "k8s": { "secret": "npmrc", "key": "key" },
+  "labels": {
+    "env-type": "string"
+  },
+  "annotations": {
+    "description": "a deprecated npmrc key",
+    "owner": "platform-team",
+    "source": "service-man"
+  }
+}

package/src/service-man/config/secrets/tsdb-dense-password.json

@@ -0,0 +1,13 @@
+{
+  "type": "random",
+  "width": 48,
+  "immutable": true,
+  "labels": {
+    "env-type": "string"
+  },
+  "annotations": {
+    "description": "dense timescale db postgres password",
+    "owner": "platform-team",
+    "source": "service-man"
+  }
+}