@leverege/build-tools 2.110.0 → 2.111.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.110.0",
+  "version": "2.111.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -98,7 +98,7 @@
     "googleapis": "^173.0.0",
     "handlebars": "^4.7.9",
     "ignore": "^7.0.5",
-    "inquirer": "14.0.2",
+    "inquirer": "^14.0.2",
     "js-yaml": "^4.2.0",
     "jsdoc": "^4.0.5",
     "ms": "^2.1.3",
@@ -107,7 +107,7 @@
     "p-limit": "^7.3.0",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
-    "semver": "7.8.4",
+    "semver": "^7.8.4",
     "shell-quote": "^1.8.4",
     "simple-git": "^3.36.0",
     "sloc": "^0.3.2",

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="85.3.3"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="86.2.3"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -342,7 +342,7 @@ alertmanager:
           - alertname="GKEMaintenanceInProgress"
           - maintenance="true"
         target_matchers:
-          - alertname=~"KubernetesNodeNotReady|KubernetesPodNotHealthy|KubernetesPodCrashLooping|frequent_app_restarts"
+          - alertname=~"KubernetesNodeNotReady|KubernetesPodNotHealthy|KubernetesPodCrashLooping|frequent_app_restarts|KubernetesStatefulsetDown|KubernetesDaemonsetMisscheduled"
 
     route:
       receiver: slack # default for everything

package/src/helm-charts/prom-operator/rules/cnpg-rules.yaml

@@ -68,7 +68,7 @@ spec:
         summary: Checks the number of database conflicts
       expr: |-
         rate(cnpg_pg_stat_database_deadlocks[5m]) > 0
-      for: 1m
+      for: 3m
       labels:
         severity: warning
     - alert: ReplicaFailingReplication
@@ -77,7 +77,7 @@ spec:
         summary: Checks if the replica is failing to replicate
       expr: |-
         cnpg_pg_replication_in_recovery > cnpg_pg_replication_is_wal_receiver_up
-      for: 1m
+      for: 3m
       labels:
         severity: warning
 #
@@ -85,7 +85,7 @@ spec:
 #
     - alert: PostgresqlDown
       expr: cnpg_collector_up == 0
-      for: 1m
+      for: 3m
       labels:
         severity: critical
       annotations:
@@ -94,9 +94,9 @@ spec:
 
     - alert: PostgresqlRestarted
       expr: time() - cnpg_pg_postmaster_start_time < 60
-      for: 2m
+      for: 0m
       labels:
-        severity: critical
+        severity: warning
       annotations:
         summary: Postgresql restarted (instance {{ $labels.instance }})
         description: "Postgresql restarted\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

package/src/helm-charts/prom-operator/rules/elasticsearch-rules.yaml

@@ -76,7 +76,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: ElasticsearchHealthyNodes
           expr: elasticsearch_cluster_health_number_of_nodes < 3
-          for: 0m
+          for: 5m
           labels:
             severity: critical
           annotations:
@@ -87,7 +87,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: ElasticsearchHealthyDataNodes
           expr: elasticsearch_cluster_health_number_of_data_nodes < 3
-          for: 0m
+          for: 5m
           labels:
             severity: critical
           annotations:
@@ -142,7 +142,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: ElasticsearchUnassignedShards
           expr: elasticsearch_cluster_health_unassigned_shards > 0
-          for: 0m
+          for: 5m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/prom-operator/rules/kubestate-rules.yaml

@@ -154,7 +154,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: KubernetesStatefulsetDown
           expr: kube_statefulset_replicas != kube_statefulset_status_replicas_ready > 0
-          for: 3m # awesome was 1m
+          for: 5m # awesome was 1m; bumped to 3m, then 5m for GKE rolling updates
           labels:
             severity: critical
           annotations:
@@ -228,8 +228,11 @@ spec:
                 VALUE = {{ $value }}
                 LABELS = {{ $labels }}
         - alert: KubernetesReplicasetReplicasMismatch
-          expr: kube_replicaset_spec_replicas != kube_replicaset_status_ready_replicas
-          for: 15m # awesome was => 10m
+          expr: |
+            (kube_replicaset_spec_replicas != kube_replicaset_status_ready_replicas)
+            * on (namespace, replicaset) group_left()
+            kube_replicaset_owner{owner_kind!="Deployment"}
+          for: 15m # awesome was => 10m; Deployment-owned RSes excluded (covered by KubernetesDeploymentReplicasMismatch)
           labels:
             severity: warning
           annotations:
@@ -306,7 +309,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: KubernetesDaemonsetMisscheduled
           expr: kube_daemonset_status_number_misscheduled > 0
-          for: 1m
+          for: 5m
           labels:
             severity: critical
           annotations:
@@ -339,7 +342,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: KubernetesApiServerErrors
           expr: sum(rate(apiserver_request_total{job="apiserver",code=~"(?:5..)"}[1m])) by (instance, job) / sum(rate(apiserver_request_total{job="apiserver"}[1m])) by (instance, job) * 100 > 3
-          for: 2m
+          for: 5m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/prom-operator/rules/redis-rules.yaml

@@ -10,7 +10,7 @@ spec:
       rules:
         - alert: RedisDown
           expr: redis_up == 0
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:
@@ -21,7 +21,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: RedisMissingMaster
           expr: (count(redis_instance_info{role="master"}) or vector(0)) < 1
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:
@@ -43,7 +43,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: RedisDisconnectedSlaves
           expr: count without (instance, job) (redis_connected_slaves) - sum without (instance, job) (redis_connected_slaves) - 1 > 0
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:
@@ -54,7 +54,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: RedisReplicationBroken
           expr: delta(redis_connected_slaves[1m]) < 0
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/prom-operator/rules/traefik-rules.yaml

@@ -10,7 +10,7 @@ spec:
       rules:
         - alert: TraefikServiceDown
           expr: count(traefik_service_server_up) by (service) == 0
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/valkey/helmup.bootstrap

@@ -0,0 +1,12 @@
+#!/bin/bash
+#
+# The network policy sets:
+#
+#   ingressNSMatchLabels: # this is why default ns gets labelled
+#     redis: external
+# 
+# which should be specifically set in redis client service helm charts but
+# for now we set it hear without being forced to upgraed al of the legacy
+# helm charts. This setting will eventually end up in the leverege base chart.
+# 
+kubectl label namespace default redis=external

package/src/helm-charts/valkey/valkey-local.yaml

@@ -1,7 +1,7 @@
 image:
   registry: us-docker.pkg.dev
   repository: leverege-registry/bitnami-mirror/images/valkey
-# tag: 8.1.3-devian-12-r1
+# tag: 8.1.3-debian-12-r1
 
 global:
   security:
@@ -14,6 +14,14 @@ auth:
   enabled: false
   sentinel: true
 
+networkPolicy:
+  enabled: true
+  allowExternal: false
+  ingressNSMatchLabels: # this is why default ns gets labelled
+    redis: external
+  ingressNSPodMatchLabels:
+    redis-client: true
+
 primary:
   replicaCount: 1
 

package/src/helm-charts/velero/helmup.bootstrap

@@ -11,7 +11,7 @@ function installVeleroEnvironment() {
   gcloud config set project $GCP_PROJECT_ID
 
   ## The major chart version will determine the bucket suffix
-  [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="11"
+  [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="12"
 
   ## Create a bucket
   BUCKET="$GCP_PROJECT_ID-velero-$VELERO_CHART_VERSION"

package/src/helm-charts/velero/helmup.plugin

@@ -5,8 +5,8 @@ showInstalling "Velero Backup System"
 # We use a specific version for the velero chart because we need to control
 # the version of the locally installed velero client application.
 #
-VELERO_CHART_VERSION="11.4.0"
-EXPECTED_CLIENT_VERSION="v1.18.0"
+VELERO_CHART_VERSION="12.0.3"
+EXPECTED_CLIENT_VERSION="v1.18.1"
 
 addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
 

package/src/overwhelm.mjs

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 
-// XXX console.log( `TOP=>[${process.cwd()}] PWD=[${process.env.PWD}]` )
 /* eslint-disable security/detect-non-literal-fs-filename */
 
 import path from 'node:path'
@@ -8,7 +7,6 @@ import fs from 'node:fs'
 
 import chalk from 'chalk'
 import cliArgs from 'command-line-args'
-// const cliHelp = require( 'command-line-usage' )
 import deepmerge from 'deepmerge'
 import { glob } from 'glob'
 import ask from 'readline-sync'

package/src/chart-to-museum.mjs

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-// *** DEPRECATED: this goes away when we move away from the chart museum and
-// push-my-chart already handles this a artifact pushes
-//
-import chalk from 'chalk'
-import commandLineArgs from 'command-line-args'
-import commandLineUsage from 'command-line-usage'
-import { lt as semverLt } from 'semver'
-
-import { log, shellCmd } from './Utils.mjs'
-
-const commandLineOptions = [
-  {
-    name : 'help',
-    type : Boolean,
-    description : '{green display this help screen}',
-  },
-]
-
-const sections = [
-  {
-    header : 'Leverege Helm Chart Museum Pusher',
-    content : `{green This legacy tool acts as a simple method for assembling and storing a local
-helm chart structure on the Leverege Chart Museum using Google Cloud Storage.
-This approach is considered legacy since we have transitioned to using the
-Google Artifact Registry for distributing helm charts.
-}`
-  },
-  { header : 'Options',
-    optionList : commandLineOptions,
-  },
-]
-
-const args = commandLineArgs( commandLineOptions, { camelCase : true, partial : true } )
-const usage = commandLineUsage( sections )
-
-if ( args.help ) {
-  log( usage )
-  process.exit( 0 )
-}
-
-const pushItGood = async () => {
-  const version = await shellCmd( 'helm version --short' )
-  const pusher = ( semverLt( version, '3.7.0' ) ? 'push' : 'cm-push' )
-
-  try {
-    const museum = await shellCmd( `helm ${pusher} helm leverege` )
-    log( chalk.green( museum ) )
-  } catch ( ex ) {
-    log( chalk.red( ex.stderr ) )
-    process.exit( 1 )
-  }
-}
-
-pushItGood()

package/src/fetch-awesome-alerts.mjs

@@ -1,75 +0,0 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs'
-import path from 'node:path'
-
-import yaml from 'js-yaml'
-import { Command } from 'commander'
-import chalk from 'chalk'
-
-import { log, err } from './Utils.mjs'
-
-const program = new Command()
-
-program
-  .name( 'fetch-alerts' )
-  .description( 'Fetch a Prometheus alert YAML file and convert it to a PrometheusRule CRD.' )
-  .argument( '<sourceFile>', 'YAML filename to fetch from awesome-prometheus' )
-  .option( '-o, --output <outputFile>', 'Output file name', 'converted-alerts.yaml' )
-  .option( '-n, --name <customName>', 'Override metadata.name in the PrometheusRule' )
-  .option( '--dry-run', 'Print output to console instead of writing to file' )
-  .parse()
-
-const [ sourceFile ] = program.args
-const { output : outputFile, dryRun, name : customName } = program.opts()
-
-const BASE_URL = 'https://raw.githubusercontent.com/samber/awesome-prometheus-alerts/master/dist/rules'
-const SOURCE_URL = `${BASE_URL}/${sourceFile}`
-
-const defaultName = path.basename( sourceFile ).replace( /\.(yaml|yml)$/, '' )
-const metadataName = customName || defaultName
-
-async function fetchAndConvert() {
-  try {
-    log( chalk.blueBright( `🔍 Fetching YAML from ${SOURCE_URL}...` ) )
-    const response = await fetch( SOURCE_URL )
-    if ( !response.ok ) throw new Error( `Failed to fetch: ${response.statusText}` )
-
-    const rawYaml = await response.text()
-    const parsedYaml = yaml.load( rawYaml )
-    if ( !parsedYaml.groups ) throw new Error( 'Invalid YAML structure, missing "groups"' )
-
-    const prometheusRule = {
-      apiVersion : 'monitoring.coreos.com/v1',
-      kind : 'PrometheusRule',
-      metadata : {
-        name : metadataName,
-        namespace : 'prometheus',
-      },
-      spec : {
-        groups : parsedYaml.groups.map( group => ( {
-          name : `${group.name}-rules`,
-          rules : group.rules,
-        } ) ),
-      },
-    }
-
-    const formattedYaml = yaml.dump( prometheusRule, {
-      noRefs : true,
-      indent : 2,
-      lineWidth : -1,
-    } )
-
-    if ( dryRun ) {
-      log( chalk.green( `\n🟢 Dry Run Output for: ${chalk.yellow( metadataName )}\n` ) )
-      log( formattedYaml )
-    } else {
-      fs.writeFileSync( outputFile, formattedYaml, 'utf8' ) // eslint-disable-line security/detect-non-literal-fs-filename
-      log( chalk.green( `✅ Converted YAML written to ${chalk.cyan( outputFile )}` ) )
-    }
-  } catch ( error ) {
-    err( chalk.red( '❌ Error:' ), error.message )
-  }
-}
-
-fetchAndConvert()

package/src/modify-gcs-access.mjs

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-
-import { Command } from 'commander'
-
-import { shellCmd, log, warning, errorExit } from './Utils.mjs'
-
-const program = new Command()
-
-program
-  .requiredOption( '--project <projectId>', 'GCP project ID of the GSA' )
-  .requiredOption( '--bucket <bucketName>', 'GCS bucket name (no gs:// prefix)' )
-  .requiredOption( '--gsa <gsaName>', 'Service account name, e.g. my-service' )
-  .requiredOption( '--role <roleId>', 'Custom role ID', 'leveregeStorageObjectReader' )
-  .option( '--org', 'Treat as  GCP organizational level role' )
-  .option( '--add', 'Add IAM binding (default)' )
-  .option( '--remove', 'Remove IAM binding' )
-  .option( '--dry-run', 'Show command without executing' )
-
-program.parse( process.argv )
-
-const opts = program.opts()
-
-// Validate mutually exclusive add/remove
-if ( opts.add && opts.remove ) {
-  errorExit( 'You cannot specify both --add and --remove.' )
-}
-
-const action = opts.remove ? 'remove' : 'add'
-
-const {
-  project,
-  org,
-  bucket,
-  gsa,
-  role,
-  dryRun
-} = opts
-
-const orgId = await shellCmd( 'gcloud organizations list --format="value(ID)"' )
-const gsaEmail = `${gsa}@${project}.iam.gserviceaccount.com`
-const fullRole = org ? `organizations/${orgId}/roles/${role}` : `roles/${role}`
-const bucketUri = `gs://${bucket}`
-
-const iamMember = `serviceAccount:${gsaEmail}:${fullRole}`
-
-const command = action === 'add' ?
-  [ 'gsutil', 'iam', 'ch', iamMember, bucketUri ] :
-  [ 'gsutil', 'iam', 'ch', '-d', iamMember, bucketUri ]
-
-log( `🔧 ${action === 'add' ? 'Granting' : 'Removing'} ${fullRole} for ${gsaEmail} on ${bucketUri}...` )
-
-if ( dryRun ) {
-  warning( '💡 DRY RUN mode — no commands executed.' )
-  log( `🔗 Command:\n$ ${command.join( ' ' )}` )
-  process.exit( 0 )
-}
-
-try {
-  const result = await shellCmd( command )
-  log( `✅ IAM ${action} successful:\n${result}` )
-} catch ( err ) {
-  errorExit( `❌ Failed to ${action} IAM binding: ${err.message}` )
-}
-
-// === Post-change audit ===
-log( '🔍 Verifying IAM policy for this GSA on the bucket...\n' )
-
-try {
-  const policyRaw = await shellCmd( [ 'gsutil', 'iam', 'get', bucketUri ] )
-  const policy = JSON.parse( policyRaw )
-
-  const matchingRoles = policy.bindings.filter(
-    b => b.members.includes( `serviceAccount:${gsaEmail}` )
-  )
-
-  if ( matchingRoles.length === 0 ) {
-    log( `ℹ️  No IAM bindings found for ${gsaEmail} on ${bucketUri}.` )
-  } else {
-    for ( const binding of matchingRoles ) {
-      log( `🔐 ${gsaEmail} has role: ${binding.role}` )
-    }
-  }
-} catch ( err ) {
-  warning( `⚠️ Failed to retrieve or parse IAM policy: ${err.message}` )
-}

package/src/test.json

@@ -1,4 +0,0 @@
-{
-  "name": "@leverege/packagename",
-  "main": "lib/index.js"
-}

package/src/testOauthLogic.mjs

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-
-import {
-  establishOauthAccess,
-  log,
-} from './Utils.mjs'
-
-// simple test program for oauth nonsense
-
-const results = await establishOauthAccess()
-
-log( { results }, '<==after establishOauthAccess' )

package/src/unleash.mjs

@@ -1,57 +0,0 @@
-#!/usr/bin/env node
-
-import SimpleGit from 'simple-git'
-
-import { shellCmd } from './Utils.mjs'
-
-const git = new SimpleGit()
-
-const getCurrentBranchName = async () => {
-  const branchInfo = await git.branch()
-
-  // first check to see if there are no branches - new repo?
-  if ( Object.keys( branchInfo.branches ).length === 0 ) { return '' }
-
-  return Object
-    .entries( branchInfo.branches )
-    .find( ( [ name, info ] ) => ( info.current ) )[0]
-}
-
-const isProtected = async () => {
-  const theBranch = await getCurrentBranchName()
-
-  const protectedBranches = [ 'main', 'master', 'development' ]
-  const additionalProtectedBranches = [ ...process.argv.slice( 2 ) ]
-
-  // Check if the current branch starts with any of the additional
-  // protected branch name
-  let matchesAdditionalBranch = false
-  for ( let i = 0; i < additionalProtectedBranches.length; i++ ) {
-    matchesAdditionalBranch = matchesAdditionalBranch ||
-      theBranch.startsWith( additionalProtectedBranches[i] )
-  }
-
-  return protectedBranches.includes( theBranch ) || matchesAdditionalBranch
-}
-
-const npmRunner = async ( script ) => {
-  try {
-    const cmd = `npm run ${script}`
-    const results = await shellCmd( cmd, { stdio : 'inherit' } )
-    return results
-  } catch ( err ) { // eslint-disable-line no-unused-vars
-    process.exit( 1 )
-  }
-  return undefined
-}
-
-( async () => {
-  if ( await isProtected() ) {
-    const script = [ 'test', 'lint' ]
-    for ( let i = 0; i < script.length; i++ ) {
-      await npmRunner( script[i] ) // eslint-disable-line no-await-in-loop
-    }
-  } else {
-    process.exit( 0 )
-  }
-} )()