@leverege/build-tools 2.101.2 → 2.102.0

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="83.7.0"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="85.0.2"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -143,9 +143,15 @@ grafana:
   sidecar:
       dashboards:
         enabled: true
+        folderAnnotation: grafana_folder
+        provider:
+          foldersFromFilesStructure: true
   # Credentials are injected from the grafana-google-oauth k8s secret, which is
   # managed by the ExternalSecret in helmup.plugin once ESO is deployed.
   # On first install, the secret is a placeholder created by helmup.bootstrap.
+  grafana.ini:
+    feature_toggles:
+      ssoSettingsApi: false
   envFromSecret: grafana-google-oauth
   env:
     GF_SERVER_ROOT_URL: https://${PROJECT_NAME}-monitoring.${HOST}.com
@@ -310,6 +316,15 @@ alertmanager:
           - namespace
           - alertname
 
+      # GKE node upgrade/maintenance suppresses expected churn alerts.
+      # PVC, disk pressure, and other infrastructure alerts are intentionally
+      # excluded so genuine storage/capacity problems are never silenced.
+      - source_matchers:
+          - alertname="GKEMaintenanceInProgress"
+          - maintenance="true"
+        target_matchers:
+          - alertname=~"KubernetesNodeNotReady|KubernetesPodNotHealthy|KubernetesPodCrashLooping|frequent_app_restarts"
+
     route:
       receiver: slack # default for everything
       group_by: ["alertname", "namespace"]

package/src/helm-charts/prom-operator/rules/gke-maintenance-rules.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: gke-maintenance-rules
+  namespace: prometheus
+
+spec:
+  groups:
+  - name: GKE Maintenance
+    rules:
+    - alert: GKEMaintenanceInProgress
+      expr: sum(kube_node_spec_unschedulable) > 0
+      for: 3m
+      labels:
+        severity: info
+        maintenance: "true"
+      annotations:
+        summary: "GKE node maintenance in progress"
+        description: "{{ $value }} node(s) are currently unschedulable — GKE upgrade or cordon in progress"

package/src/helm-charts/prom-operator/stackdriver-exporter.yaml.ovh

@@ -19,7 +19,8 @@ stackdriver:
       kubernetes.io/container/accelerator/duty_cycle,
       kubernetes.io/container/accelerator/memory_total,
       kubernetes.io/container/accelerator/memory_used,
-      monitoring.googleapis.com/uptime_check/check_passed,
+      pubsub.googleapis.com/subscription/backlog_bytes,
+      pubsub.googleapis.com/subscription/dead_letter_message_count,
       pubsub.googleapis.com/subscription/num_undelivered_messages,
       pubsub.googleapis.com/subscription/oldest_unacked_message_age,
       pubsub.googleapis.com/subscription/pull_ack_request_count,

package/src/helm-charts/valkey/valkey-local.yaml

@@ -85,6 +85,7 @@ sentinel:
 
 metrics:
   enabled: true
+  resourcesPreset: "small"
   image:
     registry: us-docker.pkg.dev
     repository: leverege-registry/bitnami-mirror/images/redis-exporter

package/src/helmup.sh

@@ -20,6 +20,7 @@ function giveHelp() {
       `color g "--k8s-match"` Only proceed if k8s context is correctly set
       `color g "--dry-run"`   Show what helm would do without applying changes
       `color g "--debug"`     Enable verbose debug output
+      `color g "--mutate"`    Forces a deployment mutation
       `color g "--help"`      Show this help message
 
     Invocation Modes:
@@ -48,6 +49,9 @@ for arg in "$@"; do
     --k8s-match)
       export OVERWHELM_ARGS="--matchk8s"
       ;;
+    --mutate)
+      MUTATE_DEPLOYMENT=1
+      ;;
     --help|-h)
       giveHelp && exit 0
       ;;
@@ -622,6 +626,25 @@ function doHelmup() {
   local from=
   [ ! -z "$FROM_VERSIONS" ] && from="`color y \"<= from Versions.json\"`"
   printf "$doing $from\n"
+  if [[ $MUTATE_DEPLOYMENT -eq 1 ]];
+  then
+    cat<<MUTATION_MSG
+
+  `color y "WARNING: About to delete the $SERVICE k8s deployment object!
+           This will cause brief downtime while helm recreates it. The service
+           and any LoadBalancer/static IP will be unaffected."`
+
+MUTATION_MSG
+    yesToContinue "to delete the $SERVICE deployment and proceed with upgrade"
+    kubectl delete deployments.apps $SERVICE
+    cat<<DELETE_WAIT
+    
+    `color y "  Waiting for $SERVICE deployment to be fully removed..."`
+
+DELETE_WAIT
+    kubectl wait --for=delete deployment/$SERVICE --timeout=120s
+  fi
+
   # plugins pass HELMUP as a single quoted string - split it into args without using eval
   [[ $# -eq 1 ]] && set -- $1
   "$@" --set "helmup.culprit=$culprit" --set "helmup.deployT=$deployT"
@@ -811,7 +834,7 @@ REBOOTSTRAP
 }
 
 # ---------- helmup MAIN ----------
-helm repo update &>/dev/null & # see comments in the doInstall function for rationale
+helm repo update leverege &>/dev/null & # see comments in the doInstall function for rationale
 
 overwhelm $OVERWHELM_ARGS
 [ $? -ne 0 ] && printf "\n\n***Aborting helmup...\n\n" && exit 1

package/src/init-my-chart/Chartwright.mjs

@@ -13,7 +13,7 @@ const hbsContext = {
   hbsChartName : '',
   hbsChartVersion : '1.0.0',
   hbsChartAppVersion : 'v1.0.0',
-  hbsArtifactRegistry : 'us-docker.pkg.dev/leverege-registry/FOOLDER/images',
+  hbsArtifactRegistry : 'us-docker.pkg.dev/leverege-registry/FOLDER/images',
   hbsPartOf : '',
   hbsServicePreemptible : true,
   hbsRedisEnabled : true,

package/src/init-my-chart/leaf-chart-templates/templates/extraobjects.yaml

@@ -0,0 +1 @@
+{{ include "leverege.extraObjects" . }}

package/src/overwhelm.mjs

@@ -250,14 +250,14 @@ const buildYaml = ( yamls, replacements ) => {
 const values = buildYaml( yams, over )
 
 // Check to see if someone is requesting a value from the yaml.
+// Uses the fully merged+resolved `over` object so context-specific keys are found.
 if ( args.key ) {
-  const section = args.section || 'default'
-  const keys = yaml[section]
-  debug( { keys }, '<==Replacements' )
+  const val = over[args.key] ?? ''
+  debug( { over }, '<==Replacements' )
   if ( args.export ) {
-    log( `export ${args.key}=${keys[args.key]}` )
+    log( `export ${args.key}=${val}` )
   } else {
-    log( keys[args.key] )
+    log( val )
   }
   if ( !args.continue ) process.exit()
 }

package/src/service-man/config/secrets/npmrc.json

@@ -2,6 +2,7 @@
   "type": "managed",
   "name": "NPMRC",
   "source": "leverege-registry:DEPRECATED_NPMRC",
+  "k8s": { "secret": "npmrc", "key": "key" },
   "labels": {
     "env-type": "string"
   },

package/src/service-man/config/secrets/tsdb-dense-password.json

@@ -0,0 +1,13 @@
+{
+  "type": "random",
+  "width": 48,
+  "immutable": true,
+  "labels": {
+    "env-type": "string"
+  },
+  "annotations": {
+    "description": "dense timescale db postgres password",
+    "owner": "platform-team",
+    "source": "service-man"
+  }
+}