@leverege/build-tools 2.65.0 → 2.66.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.65.0",
+  "version": "2.66.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -83,10 +83,10 @@
     "semver": "^7.7.1",
     "simple-git": "^3.27.0",
     "toml": "^3.0.0",
-    "zx": "^8.5.0"
+    "zx": "^8.5.2"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.0.1",
-    "npm": "^11.2.0"
+    "npm": "^11.3.0"
   }
 }

package/src/Utils.mjs

@@ -90,11 +90,12 @@ export const shellCmd = async ( cmdstr, opts = {} ) => {
   }
 }
 
-export const mkdirSafe = async ( dir ) => {
+export const mkdirSafe = ( dir ) => {
   try {
-    await fs.mkdir( dir, { recursive : true } ) // eslint-disable-line security/detect-non-literal-fs-filename
-  } catch ( e ) {
-    warning( `Could not create output dir: ${dir}` )
+    fs.mkdirSync( dir, { recursive : true } ) // eslint-disable-line security/detect-non-literal-fs-filename
+  } catch ( error ) {
+    condir( { error }, '<==fs.mkdir failed?' )
+    warning( { error }, `Could not create output dir: ${dir}` )
   }
 }
 

package/src/clone-cnpg-from-snapshot.mjs

@@ -25,8 +25,7 @@ program
   .requiredOption( '--source-project <project>', 'Source GCP project ID' )
   .requiredOption( '--dest-project <project>', 'Destination GCP project ID' )
   .requiredOption( '--dest-region <region>', 'Destination region, e.g. us-east4' )
-  .option( '--only-k8s-yaml', 'Only generate the volume snapshot YAML files' )
-  .option( '--emit-yaml-dir <dir>', 'Directory to emit VolumeSnapshot YAMLs', './out' )
+  .option( '--artifacts-only', 'Only generate the volume snapshot YAML, script and readme' )
   .option( '--dry-run', 'Show commands but don\'t run them' )
   .option( '--execute', 'Perform real actions (required to run gcloud commands)' )
   .option( '--cleanup', 'Remove temporary GCP resources after snapshot creation' )
@@ -42,7 +41,6 @@ const {
   destProject,
   destRegion,
   dryRun,
-  emitYamlDir,
   snapshot,
   sourceProject,
 } = options
@@ -55,6 +53,10 @@ const destSnapshot = `snapshot-${sourceProject}-${snapshot}`
 const tempDiskFromImage = `temp-from-img-${snapshot}`
 const destZone = `${destRegion}-a` // infer from region - implies "-a" zone always available
 
+// directory for receiving the YAML necessary for defining the snapshot class,
+// content and volume
+const emitYamlDir = `cnpg-clone-${snapshot}`
+
 let sourceZone // set and used in main(), also needed by cleanupResouces
 
 const getPrettyTimeNow = () => {
@@ -71,6 +73,61 @@ const getElapsedTime = ( startMs ) => {
   return `${minutes}:${seconds}`
 }
 
+// equivalent to Unix touch command to create an empty file
+const touchFile = async ( filename ) => {
+  if ( filename ) {
+    const handle = await fs.open( filename, 'w' ) // eslint-disable-line security/detect-non-literal-fs-filename
+    await handle.close()
+  }
+}
+
+// generates an executable script to use for defining the volume on k8s
+const writeApplyScript = async ( dir ) => {
+  const applyScript = `#!/usr/bin/env bash
+#
+# Apply VolumeSnapshot resources prior to deploying the CNPG cluster
+#
+kubectl apply -f ${dir}/volumesnapshotclass.yaml
+kubectl apply -f ${dir}/volumesnapshotcontent.yaml
+kubectl apply -f ${dir}/volumesnapshot.yaml
+`
+
+  const scriptPath = path.join( dir, 'apply-volumesnapshots.sh' )
+  await fs.writeFile( scriptPath, applyScript, { mode : 0o755 } ) // eslint-disable-line security/detect-non-literal-fs-filename
+  log( chalk.green( '  [✓] Helper script written:' ), scriptPath )
+}
+
+const writeReadme = async ( dir ) => {
+  const readmePath = path.join( dir, 'readme.txt' )
+  const content = `This directory contains the Kubernetes manifests needed to bootstrap a new CNPG cluster
+using a cloned volume snapshot from another GCP project.
+
+Files:
+  - volumesnapshotclass.yaml         (optional, use if the class doesn't already exist)
+  - volumesnapshotcontent.yaml       (refers to the GCE snapshot copied into this project)
+  - volumesnapshot.yaml              (used by CNPG to bootstrap from the volume snapshot)
+  - apply-volumesnapshots.sh         (helper script to apply these manifests in correct order)
+  - .nohelm                          (marker file for overwhelm to skip values.yaml generation)
+
+To deploy the volume snapshots to your Kubernetes cluster:
+  
+  $ ./apply-volumesnapshots.sh
+
+Once applied, reference the following VolumeSnapshot in your CNPG cluster bootstrap config:
+
+  spec.bootstrap.recovery.volumeSnapshot.volumeSnapshotName: ${k8sSnapshotName}
+
+Then deploy your CNPG cluster normally. Validate the cluster startup:
+
+  $ kubectl get pods -n cnpg-operands
+
+Enjoy your cloned cluster ✨
+`
+
+  await fs.writeFile( readmePath, content ) // eslint-disable-line security/detect-non-literal-fs-filename
+  log( chalk.green( '  [✓] README written:' ), readmePath )
+}
+
 const writeYaml = async ( filename, data ) => {
   const fullPath = path.join( emitYamlDir, filename )
   const yaml = YAML.dump( data )
@@ -98,7 +155,9 @@ const getVolumeHandle = async ( vscName ) => {
   return handle
 }
 
-const generateK8sYaml = async () => {
+// this function is responsible for emitting all of the artifacts for the creation
+// of the k8s volume that will then be used to bootstrap the cnpg cluster
+const emitCloningArtifacts = async () => {
   try {
     const snapshotYamlRaw = await shellCmd(
       `kubectl get volumesnapshot ${snapshot} -n cnpg-operands -o json`
@@ -120,6 +179,14 @@ const generateK8sYaml = async () => {
       )
     )
 
+    const snapshotClass = {
+      apiVersion : 'snapshot.storage.k8s.io/v1',
+      kind : 'VolumeSnapshotClass',
+      metadata : { name : 'cnpg-preprovisioned' },
+      driver : 'pd.csi.storage.gke.io',
+      deletionPolicy : 'Retain'
+    }
+
     const snapshotContent = {
       apiVersion : 'snapshot.storage.k8s.io/v1',
       kind : 'VolumeSnapshotContent',
@@ -155,16 +222,18 @@ const generateK8sYaml = async () => {
       },
     }
 
-    await mkdirSafe( emitYamlDir )
+    mkdirSafe( emitYamlDir )
+
+    await writeYaml( 'volumesnapshotclass.yaml', snapshotClass )
     await writeYaml( 'volumesnapshotcontent.yaml', snapshotContent )
     await writeYaml( 'volumesnapshot.yaml', snapshotYaml )
+    await touchFile( path.join( emitYamlDir, '.nohelm' ) )
+    await writeApplyScript( emitYamlDir )
+    await writeReadme( emitYamlDir )
+
   } catch ( err ) {
     errorExit( `Unable to generate VolumeSnapshot YAML: ${err.message}` )
   }
-
-  if ( options.onlyK8sYaml ) {
-    process.exit( 0 )
-  }
 }
 
 // runs a CLI command with a silly little spinner in an attempt to convince
@@ -246,7 +315,11 @@ const main = async () => {
   log( `        from handle: ${chalk.cyan( volumeHandle )}` )
   log( `            in zone: ${chalk.cyan( sourceZone )}\n` )
 
-  await generateK8sYaml()
+  // if all we want are the artifacts
+  if ( options.artifactsOnly ) {
+    await emitCloningArtifacts()
+    process.exit( 0 )
+  }
 
   log( `\n[STEP 2] 📸 Creating GCE snapshot from source disk [${diskName}]` )
   await runCommand( [
@@ -309,50 +382,59 @@ const main = async () => {
     `--project=${destProject}`,
   ] )
 
-  log( `\n✅ Done. Snapshot: ${destSnapshot} and recovery YAMLs ready.` )
+  await emitCloningArtifacts()
+
+  log( `
+  ✅ Done. Snapshot: ${chalk.cyan( destSnapshot )}
+           Recovery YAMLs written to: ${chalk.cyan( emitYamlDir )}
+           Run '${chalk.yellow( './apply-volumesnapshots.sh' )}' to prep the cluster for recovery.
+  ` )
 }
 
 const cleanupResources = async () => {
   log( '\n[STEP 9] 🧹 Cleaning up temporary resources (unwinding the stack)...' )
 
-  // STEP 7: Remove temp disk from image in destination project
-  await runCommand( [
-    `gcloud compute disks delete ${tempDiskFromImage}`,
-    `--zone=${destZone}`,
-    `--project=${destProject}`,
-    '--quiet'
-  ] )
-
-  // STEP 6: Remove copied image from destination project
-  await runCommand( [
-    `gcloud compute images delete ${tempImage}`,
-    `--project=${destProject}`,
-    '--quiet'
-  ] )
-
-  // STEP 4: Remove image from source project
-  await runCommand( [
-    `gcloud compute images delete ${tempImage}`,
-    `--project=${sourceProject}`,
-    '--quiet'
-  ] )
-
-  // STEP 3: Remove temp disk from source project
-  await runCommand( [
-    `gcloud compute disks delete ${tempDisk}`,
-    `--zone=${sourceZone}`,
-    `--project=${sourceProject}`,
-    '--quiet'
-  ] )
-
-  // STEP 2: Remove source snapshot
-  await runCommand( [
-    `gcloud compute snapshots delete ${intermediateSnapshot}`,
-    `--project=${sourceProject}`,
-    '--quiet'
-  ] )
+  const commands = [
+    [ // STEP 7: Remove temp disk from image in destination project
+      `gcloud compute disks delete ${tempDiskFromImage}`,
+      `--zone=${destZone}`,
+      `--project=${destProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 6: Remove copied image from destination project
+      `gcloud compute images delete ${tempImage}`,
+      `--project=${destProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 4: Remove image from source project
+      `gcloud compute images delete ${tempImage}`,
+      `--project=${sourceProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 3: Remove temp disk from source project
+      `gcloud compute disks delete ${tempDisk}`,
+      `--zone=${sourceZone}`,
+      `--project=${sourceProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 2: Remove source snapshot
+      `gcloud compute snapshots delete ${intermediateSnapshot}`,
+      `--project=${sourceProject}`,
+      '--quiet'
+    ],
+  ]
+
+  await Promise.all(
+    commands.map( cmdParts => runCommand( cmdParts ).catch( ( err ) => {
+      warning( `Non-fatal error during cleanup: ${err.message}` )
+    } ) )
+  )
 
-  log( chalk.green( '  [✓] Cleanup complete. Final GCE snapshot retained for CNPG bootstrapping.' ) )
+  log( chalk.green( '\n  [✓] Parallel cleanup complete - final GCE snapshot retained for CNPG bootstrapping\n' ) )
 }
 
 if ( cleanupOnly ) {
@@ -365,3 +447,5 @@ await main().catch( err => errorExit( err.message || err ) )
 if ( cleanup ) {
   await cleanupResources()
 }
+
+log( chalk.green( `  [✓] Cloning complete - recovery image name is => ${chalk.bold.yellow( k8sSnapshotName )}\n` ) )

package/src/helm-charts/cnpg-operator/cnpg-cleanup-cronjob.yaml.ovh

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cnpg-cleanup-sa
+  namespace: cnpg-operands
+  annotations:
+    # wire up this KSA to the GSA to hook into IAM for workload identity
+    iam.gke.io/gcp-service-account: cnpg-cleanup-sa@${PROJECT_ID}.iam.gserviceaccount.com
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cnpg-cleanup-role
+  namespace: cnpg-operands
+rules:
+  - apiGroups: ["postgresql.cnpg.io"]
+    resources: ["backups"]
+    verbs: ["get", "list", "delete"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cnpg-cleanup-rolebinding
+  namespace: cnpg-operands
+subjects:
+  - kind: ServiceAccount
+    name: cnpg-cleanup-sa
+    namespace: cnpg-operands
+roleRef:
+  kind: Role
+  name: cnpg-cleanup-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: cnpg-cleanup-snapshot
+  namespace: cnpg-operands
+spec:
+  schedule: "0 11 * * *" # 11 UTC is ~7AM EST
+# schedule: "*/5 * * * *" # every 5 minutes for testing
+  successfulJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          serviceAccountName: cnpg-cleanup-sa
+          containers:
+            - name: cnpg-cleanup
+              image: gcr.io/google.com/cloudsdktool/cloud-sdk:latest
+              env:
+                - name: DRY_RUN
+                  value: "false"
+                - name: RETENTION_DAYS
+                  value: "21"
+              command:
+                - /bin/bash
+                - -c
+                - |
+                  echo "🚀 Fetching cleanup script from GCS..."
+                  apt-get update -qq
+                  apt-get install -y jq libjq1 libonig5 --no-install-recommends -o=Dpkg::Use-Pty=0 -o=APT::Get::Assume-Yes=1 -o=Debug::pkgProblemResolver=1
+                  gsutil cat gs://${PROJECT_ID}-k8s-cronjobs/cnpg-cleanup-script.sh | bash

package/src/helm-charts/cnpg-operator/cnpg-cleanup-script.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+set -euo pipefail
+
+KUBECTL_DELETE_ARGS=""
+[[ "$DRY_RUN" == "true" ]] && KUBECTL_DELETE_ARGS="--dry-run=server"
+
+# volumesnapshots namespace can be set here but if we need more than just the
+# cnpg-operands then we'll need to the Role with a ClusterRole and bind it
+# differently as well.
+VSNAPS_NS="-n cnpg-operands"
+
+# Default retention period (can override with env)
+RETENTION_DAYS="${RETENTION_DAYS:-21}"
+CURRENT_DATE=$(date +%s)
+
+log() {
+  echo "[$(date -u '+%Y-%m-%dT%H:%M:%SZ')] $*"
+}
+
+should_delete() {
+  local creation_ts="$1"
+  local age_days
+  local created_secs
+  created_secs=$(date -d "$creation_ts" +%s)
+  age_days=$(( (CURRENT_DATE - created_secs) / 86400 ))
+  if (( age_days > RETENTION_DAYS )); then
+    echo "$age_days"
+    return 0
+  fi
+  return 1
+}
+
+cleanup_cnpg_backups() {
+  log "🔍 Cleaning CNPG backups older than $RETENTION_DAYS days"
+  kubectl get backups.postgresql.cnpg.io -n cnpg-operands -o json | jq -c '.items[]' | while read -r item; do
+    name=$(echo "$item" | jq -r '.metadata.name')
+    created=$(echo "$item" | jq -r '.metadata.creationTimestamp')
+    [[ "$name" != *"-backup-"* ]] && log "Skipping manual backup: $name" && continue
+
+    if age=$(should_delete "$created"); then
+      log "🗑 Deleting CNPG backup: $name (Age: $age days)"
+      kubectl delete backups.postgresql.cnpg.io "$name" -n cnpg-operands --ignore-not-found --wait=false $KUBECTL_DELETE_ARGS
+    fi
+  done
+  log "✅ CNPG backup cleanup complete"
+}
+
+cleanup_volume_snapshots() {
+  log "🔍 Cleaning VolumeSnapshots older than $RETENTION_DAYS days"
+  kubectl get volumesnapshots $VSNAPS_NS -o json | jq -c '.items[]' | while read -r item; do
+    ns=$(echo "$item" | jq -r '.metadata.namespace')
+    name=$(echo "$item" | jq -r '.metadata.name')
+    created=$(echo "$item" | jq -r '.metadata.creationTimestamp')
+    ready=$(echo "$item" | jq -r '.status.readyToUse // false')
+
+    [[ "$ready" != "true" ]] && continue
+
+    if age=$(should_delete "$created"); then
+      log "🗑 Deleting VolumeSnapshot: $ns/$name (Age: $age days)"
+      kubectl delete volumesnapshot -n "$ns" "$name" --ignore-not-found --wait=false $KUBECTL_DELETE_ARGS
+    fi
+  done
+  log "✅ VolumeSnapshot cleanup complete"
+}
+
+main() {
+  log "🚀 Starting cleanup job (retention: $RETENTION_DAYS days)"
+  cleanup_cnpg_backups
+  cleanup_volume_snapshots
+  log "🏁 All cleanup tasks complete"
+}
+
+main

package/src/helm-charts/cnpg-operator/gitignore

@@ -0,0 +1 @@
+cnpg-cleanup-cronjob.yaml

package/src/helm-charts/cnpg-operator/helmup-1.26.0-rc1.plugin

@@ -0,0 +1,28 @@
+#!/bin/bash
+#
+# See => https://cloudnative-pg.io/documentation/current/installation_upgrade/
+#
+# OPVER="1.25.1"
+OPVER="1.26.0-rc1" # 03/28/2025
+
+createNamespaceIfNeeded cnpg-system
+
+kubectl apply --server-side -f \
+    https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-${OPVER}.yaml $K8S_WHAT
+
+# Legacy terraformed clusters (like sandbox) may need a special firewall rule
+# added to the network layer on k8s. It should look like this:
+#
+# Name   : cnpg-operator
+# Ports  : 8000,9443     <= kubectl cnpg status and webhooks
+# Filters: 172.16.0.0/28 <= k8s control plane
+#
+# Old approach used the helm chart.
+#
+#addHelmRepo cnpg https://cloudnative-pg.github.io/charts
+#
+#helm upgrade --install cnpg cnpg/cloudnative-pg \
+#  --namespace cnpg-system --create-namespace \
+#  --set webhook.port="10250" $HELM_WHAT
+#
+#removeHelmRepo cnpg

package/src/helm-charts/cnpg-operator/helmup.plugin

@@ -2,13 +2,12 @@
 #
 # See => https://cloudnative-pg.io/documentation/current/installation_upgrade/
 #
-# OPVER="1.25.1"
-OPVER="1.26.0-rc1" # 03/28/2025
+OPVER="1.25.1"
 
 createNamespaceIfNeeded cnpg-system
 
 kubectl apply --server-side -f \
-    https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-${OPVER}.yaml $K8S_WHAT
+    https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${OPVER%.*}/releases/cnpg-${OPVER}.yaml $K8S_WHAT
 
 # Legacy terraformed clusters (like sandbox) may need a special firewall rule
 # added to the network layer on k8s. It should look like this:

package/src/helm-charts/elasticsearch8/helmup.plugin

@@ -2,7 +2,7 @@
 #
 showInstalling "Elastic Search 8"
 
-[ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.4.8"
+[ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.5.0"
 
 OCI_CHART="oci://registry-1.docker.io/bitnamicharts/elasticsearch"
 

package/src/helm-charts/prom-operator/helmup.plugin

@@ -4,7 +4,7 @@ showInstalling "The Prometheus Operator and Components"
 addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
 
 showInstalling "The Prometheus Operator (kube-prometheus-stack)"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="69"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="70"
 
 NS="--namespace prometheus"
 

package/src/helm-charts/prom-operator/stackdriver-exporter.yaml.ovh

@@ -7,7 +7,25 @@ fullnameOverride: "prometheus-stack-stackdriver-metrics"
 stackdriver:
   projectId: "${PROJECT_NAME}"
   metrics:
-    typePrefixes: "pubsub.googleapis.com/subscription/oldest_unacked_message_age,pubsub.googleapis.com/subscription/num_undelivered_messages,pubsub.googleapis.com/subscription/pull_ack_request_count,pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,pubsub.googleapis.com/topic/message_sizes,pubsub.googleapis.com/topic/send_request_count,firebasedatabase.googleapis.com/io/database_load,firebasedatabase.googleapis.com/network/sent_bytes_count,firebasedatabase.googleapis.com/network/active_connections"
+    typePrefixes:  >
+      pubsub.googleapis.com/subscription/oldest_unacked_message_age,
+      pubsub.googleapis.com/subscription/num_undelivered_messages,
+      pubsub.googleapis.com/subscription/pull_ack_request_count,
+      pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,
+      pubsub.googleapis.com/topic/message_sizes,
+      pubsub.googleapis.com/topic/send_request_count,
+      firebasedatabase.googleapis.com/io/database_load,
+      firebasedatabase.googleapis.com/network/sent_bytes_count,
+      firebasedatabase.googleapis.com/network/active_connections,
+      container.googleapis.com/accelerator/duty_cycle,
+      container.googleapis.com/accelerator/memory_usage,
+      container.googleapis.com/accelerator/request_count,
+      agent.googleapis.com/memory/bytes_used,
+      agent.googleapis.com/cpu/utilization,
+      storage.googleapis.com/network/received_bytes_count,
+      storage.googleapis.com/network/sent_bytes_count,
+      monitoring.googleapis.com/uptime_check/check_passed,
+      quota.googleapis.com/allocation/usage
 
 # https://artifacthub.io/packages/helm/prometheus-community/prometheus-stackdriver-exporter?modal=values&path=serviceMonitor
 serviceMonitor:
@@ -15,6 +33,8 @@ serviceMonitor:
   namespace: prometheus
   interval: "30s"
   relabelings:
+    # Legacy labelmap used to preserve compatibility with pre-operator Grafana dashboards
+    # Can be removed once legacy Prometheus stack is deprecated
     - action: labelmap
       regex: __meta_kubernetes_pod_label_(.+)
     - action: labelmap

package/src/helm-charts/redis/helmup.plugin

@@ -4,7 +4,7 @@ showInstalling "Redis"
 
 OCI_CHART="oci://registry-1.docker.io/bitnamicharts/redis"
 
-[ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.11.3"
+[ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.11.5"
 
 helm upgrade --install redis $OCI_CHART       \
              --values  redis/values.yaml \

package/src/helm-charts/traefik/helmup.plugin

@@ -17,7 +17,7 @@ TRAEFIK_NAMESPACE="traefik"
 
 addHelmRepo traefik https://helm.traefik.io/traefik
 
-[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="34"
+[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="35"
 helm upgrade --install traefik traefik/traefik \
              --namespace $TRAEFIK_NAMESPACE --create-namespace \
              --values  traefik/values.yaml \

package/src/helm-charts/velero/helmup.plugin

@@ -25,7 +25,7 @@ velero schedule delete --all --confirm &> /dev/null
 helm upgrade \
      --install velero vmware-tanzu/velero \
      --namespace velero --create-namespace \
-     --values velero/velero-local.yaml \
+     --values velero/values-local.yaml \
      --version $VELERO_CHART_VERSION $HELM_WHAT \
      --set configuration.backupStorageLocation[0].bucket="$GCE_BUCKET" \
      --set configuration.backupStorageLocation[0].config.serviceAccount="$GCE_SA_EMAIL" \

package/src/helm-charts/velero/{velero-local.yaml → values-local.yaml}

@@ -71,7 +71,7 @@ resources:
     cpu: 250m
     memory: 128Mi
   limits:
-    cpu: 300m
+    cpu: 500m
     memory: 256Mi
 
 # Annotations to add to the Velero deployment's. Optional.

package/src/helmup.sh

@@ -702,7 +702,11 @@ EOSNAPSC
   sleep 2 # hold up processing for a moment to allow IAM mods to propagate
 }
 
-function installCronCnpgCleanupSnapshot() {
+# this function is a little convoluted in the way it attempts to install the
+# scripts and yaml necessary for the CNPG cleanup activities - the idea is to
+# be able to update the scripts without touching anything else since the target
+# directory is the cnpg-operator setup
+function installCnpgCleanupCronjob() {
   CNPG_OPERATOR_DIR="cnpg-operator"
   if [ ! -d "$CNPG_OPERATOR_DIR" ];
   then
@@ -713,23 +717,52 @@ CNPG_OPERATOR_MISSING
     exit 1
   fi
 
-  CNPG_CLEANUP_CRONJOB_YAML="cnpg-cleanup-snapshot-cronjob.yaml"
-  CNPG_CLEANUP_CRONJOB="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_CRONJOB_YAML"
-  if [ ! -f "$CNPG_CLEANUP_CRONJOB" ];
+  # create the destination bucket for k8s cronjob scripts
+  BUCKET_SUFFIX="k8s-cronjobs"
+  makeUniformBucketWithCors $BUCKET_SUFFIX
+
+  CNPG_CLEANUP_CRONJOB_OVH="cnpg-cleanup-cronjob.yaml.ovh"
+  CNPG_CLEANUP_CRONJOB="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_CRONJOB_OVH"
+  CNPG_CLEANUP_SCRIPT_BASH="cnpg-cleanup-script.sh"
+  CNPG_CLEANUP_SCRIPT="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_SCRIPT_BASH"
+  if [ ! -f "$CNPG_CLEANUP_SCRIPT" ];
   then
     cat<<CNPG_FETCH_CLEANUP_CRONJOB_YAML
-  `color y "Missing $CNPG_CLEANUP_CRONJOB_YAML - grabbing a copy from build-tools"`
+  `color y "Missing $CNPG_CLEANUP_SCRIPT_BASH - updating local cron setup scripts"`
 
 CNPG_FETCH_CLEANUP_CRONJOB_YAML
     CNPG_OP_ROOT="$(build-tools --reporoot)/src/helm-charts/cnpg-operator"
-    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_CRONJOB_YAML $CNPG_CLEANUP_CRONJOB
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_CRONJOB_OVH $CNPG_CLEANUP_CRONJOB
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_SCRIPT_BASH $CNPG_CLEANUP_SCRIPT
   fi
 
+  # copy / update the script in the bucket referenced in the cronjob
+  printf "\ngsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX\n"
+  gsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX
+
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_CLEANUP_SA="cnpg-cleanup-sa"
+
+  gcloud iam service-accounts create "$CNPG_CLEANUP_SA" \
+    --project="$GCP_PROJECT_ID" \
+    --description="Used for cronjob cleanup with Workload Identity" \
+    --display-name="CNPG Cleanup SA" &> $DEVNULL
+    warnOnError $? "the GCP SA $CNPG_CLEANUP_SA may already exist"
+
+  gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
+    --project="$GCP_PROJECT_ID" \
+    --member="serviceAccount:$CNPG_CLEANUP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+    --role="roles/storage.objectViewer"
+
+  bindWorkloadIdentity "$CNPG_CLEANUP_SA" "$CNPG_NAMESPACE"
+
+  CNPG_CLEANUP_CRONJOB_YAML="$CNPG_OPERATOR_DIR/$(basename $CNPG_CLEANUP_CRONJOB_OVH .ovh)"
+  overwhelm -g # allow ovh -> yaml to occur
   cat<<CNPG_CLEANUP_CRONJOB_APPLY
-  `color g "Creating cronjob =>"``color y " kubectl apply -f $CNPG_CLEANUP_CRONJOB"`
+  `color g "Creating cronjob =>"``color y " kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML"`
 
 CNPG_CLEANUP_CRONJOB_APPLY
-  kubectl apply -f $CNPG_CLEANUP_CRONJOB
+  kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML
 }
 
 function ensureCnpgSecret() {
@@ -1001,7 +1034,7 @@ CATBACKUP
         ;;
 
       "cnpg-cronjob")
-        installCronCnpgCleanupSnapshot
+        installCnpgCleanupCronjob
         ;;
 
       "cronZombieKiller"|"zombie-killer")

package/src/templates/cloudBuildSteps.hbs

@@ -1,4 +1,8 @@
 steps:
+  - name: 'gcr.io/cloud-builders/docker'
+    entrypoint: 'bash'
+    args: ['-c', 'docker pull {{imageName}}:latest || exit 0']
+
   - name: 'gcr.io/cloud-builders/docker'
     args:
       - 'build' 
@@ -6,8 +10,8 @@ steps:
       - '-t'
       - '{{imageName}}:{{imageVersion}}'
       - '--cache-from'
-      - '{{imageName}}:{{imageVersion}}'
+      - '{{imageName}}:latest'
       - '.'
     
 images:
-  - '{{imageName}}:{{imageVersion}}'
+  - '{{imageName}}:{{imageVersion}}'

package/src/templates/dockerfileTemplatePy.hbs

@@ -9,13 +9,11 @@ RUN useradd -ms /bin/bash {{runuser}} && \
     mkdir -p /usr/src/app && \
     chown {{runuser}} /usr/src/app && \
     apt-get update && apt-get install -y \
-    wget git \
+    wget git libgl1 libglib2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
 #    gcc \
 #    git \
-#    libgl1 \
-#    libglib2.0-0 \
 #    && rm -rf /var/lib/apt/lists/*
 
 # Copy uv binary from the official distroless Docker image.

package/src/helm-charts/cnpg-operator/cnpg-cleanup-snapshot-cronjob.yaml

@@ -1,73 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cnpg-cleanup-sa
-  namespace: cnpg-operands
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: cnpg-cleanup-role
-  namespace: cnpg-operands
-rules:
-  - apiGroups: ["postgresql.cnpg.io"]
-    resources: ["backups"]
-    verbs: ["get", "list", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: cnpg-cleanup-rolebinding
-  namespace: cnpg-operands
-subjects:
-  - kind: ServiceAccount
-    name: cnpg-cleanup-sa
-    namespace: cnpg-operands
-roleRef:
-  kind: Role
-  name: cnpg-cleanup-role
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: cnpg-cleanup-snapshot
-  namespace: cnpg-operands
-spec:
-  schedule: "0 13 * * *" # 13 UTC is ~8AM EST
-  successfulJobsHistoryLimit: 2
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          serviceAccountName: cnpg-cleanup-sa
-          restartPolicy: Never
-          containers:
-            - name: cnpg-cleanup-snapshots
-              image: bitnami/kubectl:latest
-              command:
-                - "/bin/bash"
-                - "-c"
-                - |
-                  echo "Starting CNPG Cleanup"
-                  CURRENT_DATE=$(date +%s)
-                  RETENTION_DAYS=21
-                  SNAPSHOTS_JSON=$(kubectl get backups.postgresql.cnpg.io -n cnpg-operands -o json)
-                  echo "$SNAPSHOTS_JSON" | jq -c '.items[]' | while read -r snapshot
-                  do
-                    NAME=$(echo "$snapshot" | jq -r '.metadata.name')
-                    CREATION_TIMESTAMP=$(echo "$snapshot" | jq -r '.metadata.creationTimestamp')
-                    if [[ "$NAME" != *"-backup-"* ]];
-                    then
-                      echo "Skipping manual snapshot: $NAME"
-                      continue
-                    fi
-                    SNAPSHOT_DATE=$(date -d "$CREATION_TIMESTAMP" +%s)
-                    AGE=$(( (CURRENT_DATE - SNAPSHOT_DATE) / 86400 ))
-                    if [ "$AGE" -gt "$RETENTION_DAYS" ];
-                    then
-                      echo "Deleting snapshot: $NAME (Age: $AGE days)"
-                      kubectl delete backups.postgresql.cnpg.io "$NAME" -n cnpg-operands 2> /dev/null
-                    fi
-                  done
-                  echo "Cleanup complete."