@leverege/build-tools 2.43.12 → 2.44.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.43.12",
+  "version": "2.44.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -67,11 +67,11 @@
     "read-pkg": "^9.0.1",
     "readline-sync": "^1.4.10",
     "semver": "^7.5.4",
-    "simple-git": "^3.21.0",
+    "simple-git": "^3.22.0",
     "zx": "^7.2.3"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^4.2.0",
-    "npm": "^10.2.5"
+    "npm": "^10.3.0"
   }
 }

package/src/Utils.mjs

@@ -126,8 +126,8 @@ export const parsePackageJson = async ( packageFileName ) => {
 export const parseHelmChart = async ( helmroot ) => {
   /* eslint-disable security/detect-non-literal-fs-filename */
   const chartFiles = readdirSync( helmroot, { encoding : 'utf8', recursive : true } )
-  const chartYaml = YAML.load( readFileSync( `${helmroot}/Chart.yaml`, 'utf-8' ) )
-  const valuesYaml = YAML.load( readFileSync( `${helmroot}/values.yaml`, 'utf-8' ) )
+  const chartYaml = YAML.load( readFileSync( `${helmroot}/Chart.yaml`, 'utf8' ) )
+  const valuesYaml = YAML.load( readFileSync( `${helmroot}/values.yaml`, 'utf8' ) )
   /* eslint-enable security/detect-non-literal-fs-filename */
   return ( {
     files : chartFiles,

package/src/bash-funcs

@@ -79,6 +79,12 @@ function setOrUnset() {
   echo "$setting"
 }
 
+function generatePassword() {
+  local length=${1:-48}
+  local randompw=`openssl rand -base64 $length`
+  echo $randompw
+}
+
 function getManagedSecret() {
   local SECNAME=$1
   local PROJECT="${2:-leverege-registry}" # was leverege-docker-images

package/src/helm-charts/cnpg-operator/helmdn.plugin

@@ -1,3 +1,12 @@
 #!/bin/bash
+#
+clearlyWarn DO_NOT_CLEAR
+
+cat<<OPERATOR_SHUTDOWN
+  You are about to shutdown the `color r cnpg-operator` - are you certain that is what
+  you really intended to do?
+OPERATOR_SHUTDOWN
+
+yesToContinue "to delete the CNPG Operator"
 
 helm uninstall --namespace cnpg-system cnpg # cnpg-cloudnative-pg

package/src/helm-charts/db-timescale-dense/db-timescale-dense.yaml.ovh

@@ -0,0 +1,120 @@
+# Artifact Chart  => https://artifacthub.io/packages/helm/cloudnative-pg/cloudnative-pg
+# Examples Charts => https://cloudnative-pg.io/documentation/current/samples/
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db-timescale-dense
+  namespace: cnpg-operands
+spec:
+  instances: 1
+  logLevel: debug
+
+  description: "Leverege Dense Timescale DB"
+  imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:16.1-cnpg-tsdb2-beta.6
+  bootstrap:
+    initdb:
+      postInitTemplateSQL:
+        - CREATE EXTENSION timescaledb;
+        - CREATE EXTENSION jsquery;
+      database: imagine
+      owner: imagine
+      secret:
+        name: db-timescale-dense-imagine-pw # imagine db pw
+
+  enableSuperuserAccess: true
+  superuserSecret:
+    name: db-timescale-dense-postgres-pw # postgres db pw
+
+  affinity:
+#   enablePodAntiAffinity: true
+#   topologyKey: failure-domain.beta.kubernetes.io/zone
+    tolerations:
+      - key: "database"
+        operator: "Equal"
+        value: "true"
+        effect: "NoSchedule"
+
+  # Parameters and pg_hba configuration will be append
+  # to the default ones to make the cluster work
+  postgresql:
+    shared_preload_libraries:
+      - timescaledb
+      - jsquery
+    parameters:
+#     max_worker_processes: "60"
+      max_worker_processes: "8"
+      max_parallel_workers: "8"
+      shared_buffers: 2GB
+      effective_cache_size: 6GB
+      maintenance_work_mem: 1GB
+      work_mem: 20MB
+    pg_hba:
+      # To access through TCP/IP you will need to get username
+      # and password from the secret cluster-example-custom-app
+      - host all all all md5
+
+
+  # Example of rolling update strategy:
+  # - unsupervised: automated update of the primary once all
+  #                 replicas have been upgraded (default)
+  # - supervised: requires manual supervision to perform
+  #               the switchover of the primary
+  primaryUpdateStrategy: unsupervised
+
+  serviceAccountTemplate:
+    metadata:
+      annotations:
+        iam.gke.io/gcp-service-account: cnpg-operands-sa@OVH:<PROJECT_ID>.iam.gserviceaccount.com
+
+  # Require 50Gi of space per instance using ssd storage class
+  storage:
+    storageClass: premium-rwo
+    size: 50Gi
+  walStorage:
+    storageClass: premium-rwo
+    size: 1Gi
+
+  backup:
+    volumeSnapshot:
+      labels:
+        snapshotOf: db-timescale-dense
+      className: cnpg-snapshotclass
+    barmanObjectStore:
+      destinationPath: gs://OVH:<PROJECT_ID>-barman
+      googleCredentials:
+        gkeEnvironment: true
+      tags:
+        cnpgCluster: db-timescale-dense
+      wal:
+        compression: gzip
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: db-timescale-dense-pool-rw
+  namespace: cnpg-operands
+spec:
+  cluster:
+    name: db-timescale-dense
+
+  instances: 1
+  type: rw
+  pgbouncer:
+    poolMode: session
+    parameters:
+      max_client_conn: "500"
+      default_pool_size: "10"
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: db-timescale-dense-backup
+  namespace: cnpg-operands
+spec:
+  # https://pkg.go.dev/github.com/robfig/cron#hdr-CRON_Expression_Format
+  schedule: "0 0 * * * *"
+  cluster:
+    name: db-timescale-dense
+  method: volumeSnapshot
+  backupOwnerReference: self
+  immediate: true

package/src/helm-charts/db-timescale-dense/gitignore

@@ -0,0 +1 @@
+db-timescale-dense.yaml

package/src/helm-charts/db-timescale-dense/helmdn.plugin

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+kubectl delete -f db-timescale-dense/db-timescale-dense.yaml $K8S_WHAT

package/src/helm-charts/db-timescale-dense/helmup.plugin

@@ -0,0 +1,5 @@
+#!/bin/bash
+#
+#bindWorkloadIdentity cnpg-operands-sa cnpg-operands db-timescale-dense
+
+kubectl apply -f db-timescale-dense/db-timescale-dense.yaml $K8S_WHAT

package/src/helm-charts/transponder-dh/values-local.yaml

@@ -0,0 +1,62 @@
+nameOverride: transponder-dh
+
+image:
+  tag: # v4.3.3
+
+config:
+  TRANSPONDER_RUN_MODE: "denseHistoryCombined"
+  LOG_CONFIG: '{"type":"pino","level":"info"}'
+
+  DENSE_HISTORY_TDB_CACHE_KEY_PREFIX: "timescale-dh"
+  DENSE_HISTORY_MIGRATE_PAGE_SIZE_LIMIT: "50"
+
+# PG_HOST: "db-timescale-dense-rw"
+  PG_HOST: "db-timescale-dense-pool-rw.cnpg-operands"
+
+  # password from secret
+  PG_PASSWORD_SECRET: "db-timescale-dense-postgres-pw"
+  PG_PASSWORD_KEY: "password"
+
+  TRANSPORT_CONFIG: '{
+    "type": "pubsub",
+    "projectId": "OVH:<PROJECT_NAME>",
+    "publisher": {
+        "batching": {
+          "maxMilliseconds": 0,
+          "maxMessages": 999
+        }
+    },
+    "subscriptionOptions": {
+      "flowControl": {
+        "allowExcessMessages": false,
+        "maxMessages": 25
+      },
+      "streamingOptions": {
+        "maxStreams": 5
+      }
+    },
+    "channel": "writer-dh"
+  }'
+
+# mode: "denseHistoryCombined"
+# autoAck: "afterProcess"
+# ackOnError: "false"
+# allowForwarding: "true"
+# denseHistoryMigratePageSizeLimit: "50"
+
+autoscaling:
+  minReplicas: 3
+  maxReplicas: 16
+  maxCPU: 80
+
+resources:
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  limits:
+    cpu: 500m
+    memory: 1200Mi
+  requests:
+    cpu: 250m
+    memory: 600Mi

package/src/helmdn.sh

@@ -89,7 +89,7 @@ function helmDown() {
   if [ -f "$1/.nohelmdn" ];
   then
   cat<<NOHELMDN
-  `color r "***ERROR: $1/.nohelmdn blocker detect - helmdn blocked"`
+  `color r "***ERROR: $1/.nohelmdn blocker present - helmdn blocked"`
 
   Somebody really doesn't want you to helmdn $1
 

package/src/helmup.sh

@@ -33,6 +33,7 @@ PLATFORM=(
   rule-engine
   scheduler
   transponder-bq
+  transponder-dh
   transponder-rt
   transponder-tsdb
 )
@@ -53,6 +54,7 @@ SYSTEM=(
   postgres
   timescale-db
   preemptible-killer
+  reflector
   reloader
   traefik
   velero
@@ -84,14 +86,31 @@ CATNAMI
   addHelmRepo bitnami $BITNAMI_URL
 }
 
+# Accepts 3 paramaters - 1 mandatory.
+#   bindWorkloadIdentity <Service Account> <Namespace> <Target Service Account>
+# where:
+#   Service Account = SA to receive the binding
+#   Namespace = optional - uses the default namespace if unspecified
+#   Target Service Account = SA to receive the workload binding
+#
+# We typically have a one to one binding for SA and target SA (and target seems
+# like a poor choice of word), so for api-server running in the default namespace:
+#   bindWorkloadIdentity api-server
+#
+# but in the case of services like transponder which has various flavors but
+# only the single trandponder services account we woul do:
+#   bindWorkloadIdentity transponder default tranponder-rt
+#
 function bindWorkloadIdentity() {
   SVC_ACCT=$1
   NAMESPACE=${2:-default}
+  BOUND_SVC_ACCT=${3:-$SVC_ACCT}
   SVC_ACCT_EMAIL="${SVC_ACCT}@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
 
   cat<<WORKLOAD_ID
 Binding workload identity IAM policy
-  Service Account : `color g $SVC_ACCT`
+  Target Svc Acct : `color g $SVC_ACCT`
+  Bound Svc Acct  : `color g $BOUND_SVC_ACCT`
   Project         : `color g $GCP_PROJECT_ID`
   Namespace       : `color g $NAMESPACE`
   Service Email   : `color g $SVC_ACCT_EMAIL`
@@ -100,38 +119,40 @@ WORKLOAD_ID
 
   gcloud iam service-accounts add-iam-policy-binding \
       --project $GCP_PROJECT_ID \
-      --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[${NAMESPACE}/${SVC_ACCT}]" \
+      --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[${NAMESPACE}/${BOUND_SVC_ACCT}]" \
       --role roles/iam.workloadIdentityUser $SVC_ACCT_EMAIL
   warnOnError $? "gcloud workload identity binding may have failed"
+
+  sleep 2 # give the policy a chance to propagate
  
   # Verify the Kubernetes SA and create it if necessary
-  printf "\nChecking for the $NAMESPACE/$SVC_ACCT k8s SA\n"
+  printf "\nChecking for the `color g $NAMESPACE/$SVC_ACCT` k8s SA\n"
   kubectl get sa -n $NAMESPACE $SVC_ACCT &> $DEVNULL
   if [[ $? -eq 1 ]];
   then
-    printf "Creating the k8s $SVC_ACCT SA in $NAMESPACE\n"
+    printf "Creating the k8s `color g $SVC_ACCT` SA in `color g $NAMESPACE`\n"
     kubectl create sa $SVC_ACCT -n $NAMESPACE
   fi
 
-  printf "\nAnnotating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
+  printf "\nAnnotating the k8s SA `color g $NAMESPACE/@$SVC_ACCT`\n"
   kubectl annotate serviceaccount $SVC_ACCT \
       --namespace $NAMESPACE --overwrite \
       "iam.gke.io/gcp-service-account=$SVC_ACCT_EMAIL"
   warnOnError $? "Failed to annotate service account $NAMESPACE/$SVC_ACCT - things may fail"
-}
 
-function generatePassword() {
-  RANDOMPW=`openssl rand -base64 12`
-  echo $RANDOMPW
+  sleep 2 # give the annotation a chance to propagate before exiting
 }
 
 function createNamespaceIfNeeded() {
   # Check the namespace exists in kubernetes
-  kubectl get namespace $1 &> $DEVNULL
+  local NS=$1
+  kubectl get namespace $NS &> $DEVNULL
   if [[ $? -eq 1 ]];
   then
-    printf "\n*** Creating $1 namespace ***\n\n"
-    kubectl create namespace $1
+    printf "\n*** Creating $NS namespace ***\n\n"
+    kubectl create namespace $NS
+    # annotate to tell the network policy to allow redis access from NS
+    kubectl label namespaces $NS redis=external
   fi
 }
 
@@ -456,6 +477,65 @@ NEED_MANAGED_SECRET
   fi
 }
 
+# See => https://github.com/emberstack/kubernetes-reflector
+function reflectSecretIntoNamespaces() {
+  local SECRET="$1"
+  local SOURCE_NS="$2"
+  local REFLECT_INTO_NS="$3"
+
+  printf "\nReflecting secret `color y "$SOURCE_NS/$SECRET"` into `color g "$REFLECT_INTO_NS"` namespace\n"
+
+  kubectl annotate secrets $SECRET -n $SOURCE_NS \
+    reflector.v1.k8s.emberstack.com/reflection-allowed="true" &> $DEVNULL
+  kubectl annotate secrets $SECRET -n $SOURCE_NS \
+    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="$REFLECT_INTO_NS" &> $DEVNULL
+
+  cat<<REFLECTED_SECRET | kubectl apply -f -
+apiVersion: v1
+kind: Secret
+metadata:
+ name: $SECRET
+ namespace: "$REFLECT_INTO_NS"
+ annotations:
+   reflector.v1.k8s.emberstack.com/reflects: "$SOURCE_NS/$SECRET"
+REFLECTED_SECRET
+}
+
+# This function is used to randomly generate the postgresql database passwords
+# for the postgres and imagine users in a cnpg operator configuration. Since
+# the resultant passwords will live in the cnpg-operands namespace they will
+# be mirrored to the default namespace via the reflector service. Lastly, the
+# service account will have workload identity bound to it in the cnpg-operands
+# namespace.
+function initializeCnpgOperand() {
+  local CNPG_SERVICE="$1"
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_SVC_ACCT="$CNPG_NAMESPACE-sa"
+  local IMAGINE_PW_NAME="$CNPG_SERVICE-imagine-pw"
+  local POSTGRES_PW_NAME="$CNPG_SERVICE-postgres-pw"
+
+  printf "\nCreating imagine db password for `color g $CNPG_SERVICE`\n"
+  kubectl create secret generic -n $CNPG_NAMESPACE "$IMAGINE_PW_NAME" \
+        --from-literal=username="imagine" \
+        --from-literal=password="$(generatePassword)" &> $DEVNULL
+  warnOnError $? "the `color y $IMAGINE_PW_NAME` secret may already exist"
+
+  # reflect the secret to default namespace
+  reflectSecretIntoNamespaces $IMAGINE_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nCreating postgres db password for `color g $CNPG_SERVICE`\n"
+  kubectl create secret generic -n $CNPG_NAMESPACE "$POSTGRES_PW_NAME" \
+        --from-literal=username="postgres" \
+        --from-literal=password="$(generatePassword)" &> $DEVNULL
+  warnOnError $? "the `color y $POSTGRES_PW_NAME` secret may already exist"
+
+  # reflect the secret to default namespace
+  reflectSecretIntoNamespaces $POSTGRES_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nBinding `color g $CNPG_SERVICE` to the `color y "$CNPG_SVC_ACCT"` SA\n"
+  bindWorkloadIdentity $CNPG_SVC_ACCT $CNPG_NAMESPACE $CNPG_SERVICE
+}
+
 function installCnpgOperatorEnvironment() {
   # See => https://github.com/cloudnative-pg/charts
 
@@ -469,24 +549,29 @@ function installCnpgOperatorEnvironment() {
   kubectl delete serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
   gcloud --quiet iam service-accounts delete $CNPG_SVC_EMAIL  --project $GCP_PROJECT_ID&> $DEVNULL
 
+  # Create the operands namespace and annotate to allow redis access
   createNamespaceIfNeeded $CNPG_NAMESPACE
 
   # Create GCP SA and bind policies
-  printf "\nCreating the gcloud $CNPG_SVC_ACCT service account (SA)\n"
+  printf "\nCreating the gcloud `color g $CNPG_SVC_ACCT` service account (SA)\n"
   gcloud iam service-accounts create $CNPG_SVC_ACCT \
     --project "$GCP_PROJECT_ID" \
     --description "CNPG Operands SA" \
     --display-name "CNPG Operands SA" &> $DEVNULL
-  warnOnError $? "the GCP SA $CNPG_SVC_ACCT may already exist"
+  warnOnError $? "the GCP SA `color y $CNPG_SVC_ACCT` may already exist"
 
   CNPG_OPS_ROLE="cnpg.operands"
-  printf "\nCreating the $CNPG_OPS_ROLE IAM role\n"
+  printf "\nCreating the `color g $CNPG_OPS_ROLE` IAM role\n"
   ## Attach roles
   ROLE_PERMISSIONS=(
     iam.serviceAccounts.actAs
+    iam.serviceAccounts.get
     iam.serviceAccounts.getAccessToken
+    iam.serviceAccounts.getOpenIdToken
+    iam.serviceAccounts.implicitDelegation
+    iam.serviceAccounts.list
     iam.serviceAccounts.signBlob
-    orgpolicy.policy.get
+    iam.serviceAccounts.signJwt
     resourcemanager.projects.get
     storage.buckets.create
     storage.buckets.get
@@ -507,7 +592,7 @@ function installCnpgOperatorEnvironment() {
   if [ $? -ne 0 ];
   then
     # assume error is that role exists so try updating instead
-    printf "\nUpdating roles on the SA\n"
+    printf "\nUpdating the permissions on the `color g $CNPG_OPS_ROLE` IAM role\n"
     gcloud iam roles update $CNPG_OPS_ROLE \
       --project $GCP_PROJECT_ID \
       --title "CNPG Operands" \
@@ -515,22 +600,45 @@ function installCnpgOperatorEnvironment() {
   fi
   warnOnError $? "Failed to add roles to $CNPG_OPS_ROLE - perhaps they already exist?"
 
-  printf "\nBinding IAM role to the SA\n"
+  printf "\nBinding IAM role to the SA `color g $CNPG_SVC_EMAIL`\n"
   gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
-    --project $GCP_PROJECT_ID \
-    --member serviceAccount:$CNPG_SVC_EMAIL \
-    --condition 'None' \
-    --role "roles/owner" &> $DEVNULL # temp bind to Owner
-#   --role "roles/storage.admin" &> $DEVNULL
-#   --role "roles/owner" &> $DEVNULL
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role "roles/storage.admin" &> $DEVNULL
 #   --role projects/$GCP_PROJECT_ID/roles/$CNPG_OPS_ROLE &> $DEVNULL
+#   --role "roles/storage.admin" &> $DEVNULL
   warnOnError $? "gcloud problem binding IAM policy"
 
-  sleep 2 # give the IAM binding a chance to complete before moving on
+  printf "\nBinding IAM the Token Creator role to the SA `color g $CNPG_SVC_EMAIL`\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role="roles/iam.serviceAccountTokenCreator"
+
+  # workload binding will be performed by each cnpg operand on startup
+
+  BARMAN_BUCKET="gs://$GCP_PROJECT_ID-barman"
+  gsutil ls -p $GCP_PROJECT_ID -b $BARMAN_BUCKET &> $DEVNULL
+  if [ "$?" -eq 0 ];
+  then
+    printf "\nBarman bucket `color g "$BARMAN_BUCKET"` already exists - skipping recreation\n"
+  else
+    printf "\nCreating a bucket for barman backups: `color g $BARMAN_BUCKET`\n"
+    gsutil mb -l $GCE_REGION $BARMAN_BUCKET &> $DEVNULL
+    gsutil iam ch serviceAccount:$CNPG_SVC_EMAIL:objectAdmin $BARMAN_BUCKET
+    gsutil ubla set on $BARMAN_BUCKET # uniform bucket access
+  fi
 
-  bindWorkloadIdentity $CNPG_SVC_ACCT $CNPG_NAMESPACE
+  # define the snapshot storage class
+  printf "\nApplying the CNPG VolumeSnapshotClass `color g cnpg-snapshotclass` definition\n"
+  cat<<EOSNAPSC | kubectl apply -f -
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: cnpg-snapshotclass
+driver: pd.csi.storage.gke.io
+deletionPolicy: Delete
+EOSNAPSC
 
-  gsutil iam ch serviceAccount:$CNPG_SVC_EMAIL:objectAdmin gs://$GCP_PROJECT_ID-barman
+  sleep 2 # hold up processing for a moment to allow IAM mods to propagate
 }
 
 function installVeleroEnvironment() {
@@ -546,10 +654,10 @@ function installVeleroEnvironment() {
 
   ## Create a bucket
   BUCKET="$GCP_PROJECT_ID-velero-$VELERO_HELM_CHART"
-  GCE_REGION=`overwhelm -k GCE_REGION`
   printf "\nCreating storage bucket `color g $BUCKET` in `color g $GCE_REGION`\n"
   gsutil mb -l $GCE_REGION gs://$BUCKET/ &> $DEVNULL
   warnOnError $? "Bucket failed to create or already exists - go check it\n"
+  gsutil ubla set on gs://$BUCKET &> $DEVNULL
 
   ## Create a service account
   printf "\nCreating the service account\n"
@@ -692,7 +800,7 @@ function doInstall() {
 
     local INVOKED_AS=`basename $0`
     # set the dry-run flag on what
-    [ "$INVOKED_AS" == "helmwhat" ] && HELM_WHAT="--dry-run --debug"
+    [ "$INVOKED_AS" == "helmwhat" ] && HELM_WHAT="--dry-run --debug" && K8S_WHAT="--dry-run=server -o yaml"
 
     # helminit is used to redeploy an existing service
     if [ "$INVOKED_AS" == "helminit" ] && [[ $(isLeveregeService $SERVICE) -eq 1 ]];
@@ -754,6 +862,16 @@ CATBACKUP
         installDefaultConfigs
         ;;
 
+      db-postgres-*|db-timescale-*)
+        if [ ! -d $SERVICE ];
+        then
+          # this code only executes on the first deployment
+          initializeCnpgOperand $SERVICE
+          bootstrapLocalSetup $SERVICE
+          kubectl apply -f $SERVICE/$SERVICE.yaml $K8S_WHAT
+        fi
+        ;;
+
       db-curator-dh)
         # db-curator-dh is a variant of db-curator with diff controlled in values-local.yaml
         HELMUP="helm upgrade --install $SERVICE leverege/db-curator --values $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
@@ -806,6 +924,13 @@ CATBACKUP
         bootstrapLocalSetup $SERVICE
         ;;
 
+      "reflector")
+        showInstalling "Secrets/ConfigMap Namespace Reflector"
+        addHelmRepo emberstack https://emberstack.github.io/helm-charts
+        helm upgrade --install reflector emberstack/reflector
+        removeHelmRepo emberstack
+        ;;
+
       "reloader")
         showInstalling "Stakater ConfigMap Reloader"
         addHelmRepo stakater https://stakater.github.io/stakater-charts
@@ -924,6 +1049,8 @@ overwhelm
 
 # The project id is used in a lot of places so just set it here
 GCP_PROJECT_ID="$(getProjectIdFromK8sContext)"
+# Same for the region, but not as prevalent
+GCE_REGION=`overwhelm -k GCE_REGION`
 
 doInstall $@
 cd - &> $DEVNULL