@leverege/build-tools 2.66.2 → 2.66.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.66.2",
+  "version": "2.66.3",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -69,10 +69,10 @@
     "deepmerge": "^4.3.1",
     "enquirer": "^2.4.1",
     "execa": "^9.5.2",
-    "glob": "^11.0.1",
+    "glob": "^11.0.2",
     "handlebars": "^4.7.8",
-    "ignore": "^7.0.3",
-    "inquirer": "^12.5.2",
+    "ignore": "^7.0.4",
+    "inquirer": "^12.6.0",
     "js-yaml": "^4.1.0",
     "jsdoc": "^4.0.4",
     "ms": "^2.1.3",

package/src/bash-funcs

@@ -215,3 +215,13 @@ PLUGIN_NOEXEC
   sendToSlack "$PLUGIN"
   return 0
 }
+
+# simple enforcement of necessary tools that need to be installed
+function commandChecker() {
+  for cmd in "$@"; do
+    command -v "$cmd" &> $DEVNULL
+    exitOnError $? "the `color g $cmd` command is required but not installed please install it and try again"
+  done
+}
+
+commandChecker git helm kubectl service-man

package/src/helm-audit.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+
+// helm-audit.mjs
+// Node.js version of helm-audit.sh to display deployed chart/image/audit info
+
+import { shellCmd, log, debug } from './Utils.mjs'
+import ora from 'ora'
+import pLimit from 'p-limit'
+import chalk from 'chalk'
+
+const spinner = ora('Gathering Helm release info...').start()
+const limit = pLimit(5) // limit concurrent shellCmds to avoid API overload
+const OMIT_NAMESPACES = new Set(['estafette'])
+
+async function getHelmReleases() {
+  const json = await shellCmd('helm list -A -o json')
+  return JSON.parse(json).filter(r => !OMIT_NAMESPACES.has(r.namespace))
+}
+
+async function getDeployedImageTag(ns, release) {
+  try {
+    const image = await shellCmd(`kubectl get deployment -n ${ns} -l app.kubernetes.io/instance=${release} -o jsonpath={.items[0].spec.template.spec.containers[0].image}`)
+    const tag = image.trim().split(':')[1]
+    return tag && tag !== 'not found' ? tag : ''
+  } catch {
+    return ''
+  }
+}
+
+async function getChartAppVersion(ns, release) {
+  try {
+    const metadata = await shellCmd(`helm get metadata ${release} -n ${ns}`)
+    const match = metadata.match(/^APP_VERSION:\s*(.*?)\s*$/m)
+    return match ? match[1].trim() : '(unknown)'
+  } catch {
+    return '(unknown)'
+  }
+}
+
+async function getHelmValue(ns, release, key) {
+  try {
+    const values = await shellCmd(`helm get values ${release} -n ${ns} -o json`)
+    const parsed = JSON.parse(values)
+    return parsed.helmup?.[key] || ''
+  } catch {
+    return ''
+  }
+}
+
+function normalizeTag(tag) {
+  return tag?.replace(/^v/, '').toLowerCase() || ''
+}
+
+function formatRow(name, chartVersion, appVersion, imageTag, deployT, culprit) {
+  const release = chalk.green(name.slice(0, 25).padEnd(32))
+  const chartVer = chalk.cyan(chartVersion.padEnd(18))
+  const appVer = chalk.cyan(appVersion.padEnd(18))
+  const normApp = normalizeTag(appVersion)
+  const normImage = normalizeTag(imageTag)
+
+  let imageFormatted = imageTag.padEnd(20)
+  if (normImage && normApp && normImage === normApp) {
+    imageFormatted = chalk.green(imageFormatted)
+  } else if (imageTag) {
+    imageFormatted = chalk.red(imageFormatted)
+  }
+
+  const deployInfo = deployT ? chalk.gray(`${deployT} by ${culprit || '(unknown)'}`) : ''
+  return `  ${release}${chartVer}${appVer}${imageFormatted}${deployInfo}`
+}
+
+async function audit() {
+  spinner.text = 'Fetching release metadata...'
+  const releases = await getHelmReleases()
+
+  // sort by namespace, then release name
+  releases.sort((a, b) => {
+    const nsCompare = a.namespace.localeCompare(b.namespace)
+    return nsCompare !== 0 ? nsCompare : a.name.localeCompare(b.name)
+  })
+
+  spinner.text = 'Gathering chart, image, and audit metadata...'
+
+  const rows = await Promise.all(releases.map(({ name, namespace, chart }) => limit(async () => {
+    const chartVersion = chart?.split('-').pop() || '(unknown)'
+    const [appVersion, imageTag, deployT, culprit] = await Promise.all([
+      getChartAppVersion(namespace, name),
+      getDeployedImageTag(namespace, name),
+      getHelmValue(namespace, name, 'deployT'),
+      getHelmValue(namespace, name, 'culprit'),
+    ])
+    return {
+      row: formatRow(name, chartVersion, appVersion, imageTag, deployT, culprit),
+      namespace
+    }
+  })))
+
+  spinner.stop()
+  log(`${'RELEASE'.padEnd(34)}${'CHART VERSION'.padEnd(18)}${'APP VERSION'.padEnd(18)}${'IMAGE TAG'.padEnd(20)}DEPLOY INFO`)
+
+  let lastNamespace = ''
+  for (const { row, namespace } of rows) {
+    if (namespace !== lastNamespace) {
+      if (lastNamespace !== '') log('')
+      log(chalk.bold.green(namespace))
+      lastNamespace = namespace
+    }
+    log(row)
+  }
+}
+
+audit().catch(err => {
+  spinner.stop()
+  console.error(err)
+  process.exit(1)
+})

package/src/helm-charts/api-server/values-local.yaml

@@ -28,10 +28,13 @@ psqlSecurity:
   TSDB_DENSE_SECRET_NAME: "cnpg-db-tsdb-dense-postgres-pw"
   TSDB_DENSE_SECRET_KEY: "password"
 
+serviceMonitor:
+  enabled: true
+
 autoscaling:
   minReplicas: 3
   maxReplicas: 12
   maxCPU: 80
 
 ingressRoute:
-  host: OVH:<PROJECT_ID>-imagine-api.OVH:<HOST>.com
+  host: ${PROJECT_ID}-imagine-api.${HOST}.com

package/src/helm-charts/authz-server/values-local.yaml

@@ -11,3 +11,6 @@ config:
 
   # CNPG override
   SQL_HOST: "cnpg-db-psql-stack-rw.cnpg-operands" # vs postgres-postgresql
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/elasticsearch8/helmup.plugin

@@ -2,7 +2,7 @@
 #
 showInstalling "Elastic Search 8"
 
-[ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.6.0"
+[ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.6.2"
 
 OCI_CHART="oci://registry-1.docker.io/bitnamicharts/elasticsearch"
 

package/src/helm-charts/emailer/values-local.yaml

@@ -4,6 +4,9 @@ image:
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
 
-  API_UI_URL: "OVH:<PROJECT_ID>.web.app"
-  MAIL_GUN_DOMAIN: "OVH:<MAIL_GUN_DOMAIN>"
-  MAIL_GUN_DEFAULT_SENDER: "no-reply@OVH:<MAIL_GUN_DOMAIN>"
+  API_UI_URL: "${PROJECT_ID}.web.app"
+  MAIL_GUN_DOMAIN: "${MAIL_GUN_DOMAIN}"
+  MAIL_GUN_DEFAULT_SENDER: "no-reply@${MAIL_GUN_DOMAIN}"
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/geotile-server/values-local.yaml

@@ -2,6 +2,9 @@ image:
   tag: # v2.3.0
 
 config:
-  UPLOADER_TYPE: "OVH:<BUCKET_TYPE>"
-  UPLOADER_PROJECT_ID: "OVH:<PROJECT_ID>"
-  UPLOADER_BUCKET: "OVH:<PROJECT_ID>-geotile-server"
+  UPLOADER_TYPE: "${BUCKET_TYPE}"
+  UPLOADER_PROJECT_ID: "${PROJECT_ID}"
+  UPLOADER_BUCKET: "${PROJECT_ID}-geotile-server"
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/imagine/values-local.yaml

@@ -3,3 +3,6 @@ mage:
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/message-processor/values-local.yaml

@@ -5,4 +5,4 @@ config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
 
 serviceMonitor:
-  enabled: false
+  enabled: true

package/src/helm-charts/messenger/values-local.yaml

@@ -3,4 +3,7 @@ image:
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
-  API_UI_URL: "OVH:<PROJECT_ID>.web.app"
+  API_UI_URL: "${PROJECT_ID}.web.app"
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/overdose/values-local.yaml

@@ -17,3 +17,6 @@ autoscaling:
   minReplicas: 6
   maxReplicas: 16
   averageCPU: 75
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/prom-operator/rules/elasticsearch-rules.yaml

@@ -174,7 +174,7 @@ spec:
                 VALUE = {{ $value }}
                 LABELS = {{ $labels }}
         - alert: ElasticsearchHighIndexingLatency
-          expr: elasticsearch_indices_indexing_index_time_seconds_total / elasticsearch_indices_indexing_index_total > 0.0005
+          expr: elasticsearch_indices_indexing_index_time_seconds_total / elasticsearch_indices_indexing_index_total > 0.002 # awesome was 0.0005
           for: 10m
           labels:
             severity: warning

package/src/helm-charts/prom-operator/rules/kubestate-rules.yaml

@@ -385,7 +385,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: KubernetesApiServerLatency
           expr: histogram_quantile(0.99, sum(rate(apiserver_request_duration_seconds_bucket{verb!~"(?:CONNECT|WATCHLIST|WATCH|PROXY)"} [10m])) WITHOUT (subresource)) > 1
-          for: 2m
+          for: 15m
           labels:
             severity: warning
           annotations:

package/src/helm-charts/prom-operator/rules/prometheus-rules.yaml

@@ -21,7 +21,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: PrometheusTargetMissing
           expr: up{"namespace"!~"kube-system"} == 0 # awesome was => up == 0
-          for: 1m # awesome was => 0m
+          for: 3m # awesome was => 0m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/pubsub-pulse/values-local.yaml

@@ -5,4 +5,7 @@ image:
 config:
   pulseDelay: "1000"
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
-  IMAGINE_API_URL: "https://OVH:<PROJECT_ID>-imagine-api.OVH:<HOST>.com"
+  IMAGINE_API_URL: "https://${PROJECT_ID}-imagine-api.${HOST}.com"
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/pusher/values-local.yaml

@@ -23,3 +23,6 @@ config:
         }
       }
     }
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/reason/values-local.yaml

@@ -4,7 +4,7 @@ image:
 config:
   CF_TRANSPORT_CONFIG: '{
       "type": "pubsub",
-      "projectId": "OVH:<PROJECT_NAME>" ,
+      "projectId": "${PROJECT_NAME}" ,
       "keyFilename": "/home/node/unused/key.json" ,
       "publisher": {
           "batching": {
@@ -12,3 +12,6 @@ config:
           }
       }
   }'
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/redis/helmup.plugin

@@ -4,8 +4,8 @@ showInstalling "Redis"
 
 OCI_CHART="oci://registry-1.docker.io/bitnamicharts/redis"
 
-[ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.12.1"
+[ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.13.0"
 
 helm upgrade --install redis $OCI_CHART       \
-             --values  redis/values.yaml \
+             --values  redis/values-local.yaml \
              --version $REDIS_CHART_VERSION $HELM_WHAT

package/src/helm-charts/resource-server/values-local.yaml

@@ -4,14 +4,19 @@
 #     - npm run sequelizeRunMigrations
 #
 image:
-  tag: # v1.7.0
+  tag: # v1.14.0
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
 
-  UPLOADER_PROJECT_ID: "OVH:<PROJECT_ID>"
-  UPLOADER_BUCKET: "OVH:<PROJECT_ID>-resource-server"
-  UPLOADER_LOCATION: "OVH:<GCE_REGION>"
+  UPLOADER_PROJECT_ID: "${PROJECT_ID}"
+  UPLOADER_BUCKET: "${PROJECT_ID}-resource-server"
+  UPLOADER_LOCATION: "${GCE_REGION}"
 
   # CNPG override
   SQL_HOST: "cnpg-db-psql-stack-rw.cnpg-operands" # vs postgres-postgresql
+# SQL_READ_REPLICATION_CONFIG: '[ { "host": "cnpg-db-psql-stack-r.cnpg-operands" } ]'
+# TRANSACTION_MAX_RETRIES: "5"
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/rule-engine/values-local.yaml

@@ -6,3 +6,6 @@ config:
 
   # CNPG override
   MODELS_SEQUELIZE_HOST: "cnpg-db-psql-stack-rw.cnpg-operands" # vs postgres-postgresql
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/traefik/helmup.plugin

@@ -20,7 +20,7 @@ addHelmRepo traefik https://helm.traefik.io/traefik
 [ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="35"
 helm upgrade --install traefik traefik/traefik \
              --namespace $TRAEFIK_NAMESPACE --create-namespace \
-             --values  traefik/values.yaml \
+             --values  traefik/values-local.yaml \
              --version $TRAEFIK_CHART_VERSION $HELM_WHAT
 
 removeHelmRepo traefik

package/src/helm-charts/transponder-bq/values-local.yaml

@@ -9,7 +9,7 @@ config:
 
   TRANSPORT_CONFIG: '{
     "type": "pubsub",
-    "projectId": "OVH:<PROJECT_ID>",
+    "projectId": "${PROJECT_ID}",
     "publisher": {
         "batching": {
           "maxMilliseconds": 0,
@@ -27,3 +27,6 @@ config:
     },
     "channel": "writer-bq"
   }'
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/transponder-dh/values-local.yaml

@@ -19,7 +19,7 @@ config:
 
   TRANSPORT_CONFIG: '{
     "type": "pubsub",
-    "projectId": "OVH:<PROJECT_NAME>",
+    "projectId": "${PROJECT_NAME}",
     "publisher": {
         "batching": {
           "maxMilliseconds": 0,
@@ -60,3 +60,6 @@ resources:
   requests:
     cpu: 250m
     memory: 600Mi
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/transponder-rt/values-local.yaml

@@ -10,7 +10,7 @@ config:
   ELASTICSEARCH_DATA_METADATA_ENABLED: "false"
   TRANSPORT_CONFIG: '{
     "type": "pubsub",
-    "projectId": "OVH:<PROJECT_ID>",
+    "projectId": "${PROJECT_ID}",
     "publisher": {
         "batching": {
           "maxMilliseconds": 0,
@@ -28,3 +28,6 @@ config:
     },
     "channel": "writer-rt"
   }'
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/transponder-tsdb/values-local.yaml

@@ -21,7 +21,7 @@ config:
 
   TRANSPORT_CONFIG: '{
     "type": "pubsub",
-    "projectId": "OVH:<PROJECT_ID>",
+    "projectId": "${PROJECT_ID}",
     "publisher": {
         "batching": {
           "maxMilliseconds": 0,
@@ -39,3 +39,6 @@ config:
     },
     "channel": "writer-tsdb"
   }'
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/vin-decoder-server/values-local.yaml

@@ -5,3 +5,6 @@ config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
   PROJECT_ID: "set-in-values-local"
   SYSTEM_ID: "set-in-values-local"
+
+serviceMonitor:
+  enabled: true

package/src/helmup.sh

@@ -113,7 +113,7 @@ CATNAMI
 #   bindWorkloadIdentity api-server
 #
 # but in the case of services like transponder which has various flavors but
-# only the single trandponder services account we woul do:
+# only the single transponder service account we would do:
 #   bindWorkloadIdentity transponder default tranponder-rt
 #
 function bindWorkloadIdentity() {
@@ -933,13 +933,32 @@ UPGRADES_DONE
   sleep 3
 }
 
+# TODO: DRY this by coalescing with checkUpgradeNotes
+function displayBanner() {
+  BANNER="helmup-banner.txt"
+
+  [ ! -f "$BANNER" ] && return
+  BANNER_TXT=`cat $BANNER`
+
+  cat<<HELMUP_BANNER
+
+`color g "--- From $BANNER ----------------------------------------------------"`
+
+$BANNER_TXT
+
+`color g "-------------------------------------------------------------------------------"`
+HELMUP_BANNER
+}
+
 function doHelmup() {
+  local culprit="--set helmup.culprit=\"$(gcloud config get account)\""
+  local deployT="--set helmup.deployT=\"$(date -u +'%Y-%m-%dT%H:%M:%SZ')\""
   local helmup="$@"
   local doing="Helming => `color g \"$helmup\"`"
   local from=
   [ ! -z "$FROM_VERSIONS" ] && from="`color y \"<= from Versions.json\"`"
   printf "$doing $from\n"
-  eval $helmup
+  eval "$helmup $culprit $deployT"
   case "$INVOKED_AS" in
     "helmup"|"helmdn")
       sendToSlack "$helmup"
@@ -1049,7 +1068,7 @@ CATBACKUP
         installDefaultConfigs
         ;;
 
-      db-curator-dh)
+      "db-curator-dh")
         # db-curator-dh is a variant of db-curator with diff controlled in values-local.yaml
         HELMUP="helm upgrade --install $SERVICE leverege/db-curator --values $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
         doHelmup "$HELMUP"
@@ -1252,4 +1271,7 @@ GCP_PROJECT_ID="$(getProjectIdFromK8sContext)"
 GCE_REGION=`overwhelm -k GCE_REGION`
 
 doInstall $@
+
+displayBanner
+
 cd - &> $DEVNULL

package/src/push-my-chart.mjs

@@ -46,20 +46,29 @@ const pushItGood = async () => {
   const version = await shellCmd( 'helm version --short' )
   const pusher = ( semverLt( version, '3.7.0' ) ? 'push' : 'cm-push' )
 
+  let museumStatus = 0
   try {
     log( chalk.green( 'Pushing chart to the Chartmuseum\n' ) )
     const museum = await shellCmd( `helm ${pusher} helm leverege` )
     debug( { museum }, '<==output from helm push' )
-    if ( args.noRegistry ) {
-      log( `${chalk.bold.yellow( '\nskipping the chart push to the artifact registry' )}` )
-    } else {
-      log( chalk.green( 'Pushing chart to the Artifact Registry\n' ) )
-      const registry = await shellCmd( 'chart-to-registry' )
-      debug( { registry }, '<==chart-to-registry' )
-    }
   } catch ( ex ) {
     log( ex.stderr )
-    process.exit( 1 )
+    museumStatus = 1
+  }
+
+  if ( args.noRegistry ) {
+    log( `${chalk.bold.yellow( '\nskipping the chart push to the artifact registry' )}` )
+    process.exit( museumStatus )
+  }
+
+  try {
+    log( chalk.green( 'Pushing chart to the Artifact Registry\n' ) )
+    const registry = await shellCmd( 'chart-to-registry' )
+    debug( { registry }, '<==chart-to-registry' )
+    process.exit( museumStatus )
+  } catch ( ex ) {
+    log( ex.stderr )
+    process.exit( museumStatus + 1 )
   }
 }