@leverege/build-tools 2.80.1-beta.2 → 2.81.1

package/.vscode/launch.json

@@ -0,0 +1,22 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Test",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": [
+        "run",
+        "testNoTimeout"
+      ],
+      "resolveSourceMapLocations": [
+        "${workspaceFolder}/**",
+        "!**/node_modules/**"
+      ],
+      "env": {
+      },
+      "outputCapture": "std"
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.80.1-beta.2",
+  "version": "2.81.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -42,6 +42,7 @@
     "helminit": "src/helmup.sh",
     "helmwhat": "src/helmup.sh",
     "hook-and-release": "src/hook-and-release.mjs",
+    "init-my-chart": "src/init-my-chart.mjs",
     "k8scale": "src/k8scale.sh",
     "k8x": "src/k8x.sh",
     "klog": "src/klog.sh",
@@ -74,7 +75,7 @@
     "glob": "^11.0.3",
     "handlebars": "^4.7.8",
     "ignore": "^7.0.5",
-    "inquirer": "^12.7.0",
+    "inquirer": "^12.9.0",
     "js-yaml": "^4.1.0",
     "jsdoc": "^4.0.4",
     "ms": "^2.1.3",
@@ -88,10 +89,10 @@
     "simple-git": "^3.28.0",
     "sloc": "^0.3.2",
     "toml": "^3.0.0",
-    "zx": "^8.7.1"
+    "zx": "^8.7.2"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.0.1",
-    "npm": "^11.4.2"
+    "npm": "^11.5.1"
   }
 }

package/src/Utils.mjs

@@ -14,7 +14,7 @@ import YAML from 'js-yaml'
 
 // __dirname goes away with ESM so we take this approach instead and
 // this assumes this file lives in the src dir of the build-tools repo
-export const BUILD_TOOLS_ROOT = path.dirname( url.fileURLToPath( import.meta.url ) )
+export const BUILD_TOOLS_ROOT = process.env.BUILD_TOOLS_ROOT || path.dirname( url.fileURLToPath( import.meta.url ) )
 
 let debugEnabled = process.env.BUILD_TOOLS_DEBUG === '1'
 
@@ -565,7 +565,7 @@ export const analyzeRepository = async ( giveGuidance ) => {
   // if the build tools version is still undefined then assume we are using a globally installed bt
   if ( buildToolsVersion === undefined ) {
     const fromBuildTools = await shellCmd( 'build-tools --version' )
-    buildToolsVersion = fromBuildTools.match( /\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/ )[0]
+    buildToolsVersion = fromBuildTools.match( /\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/ )[0] // eslint-disable-line security/detect-unsafe-regex
   }
  
   const containerName = closestPackageJson?.name.replace( /^@[^/]+\//, '' ) || rootPyProjectToml?.project.name

package/src/helm-charts/argocd/helmup.bootstrap

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "--- BOOT ME BABY! $SERVICE"

package/src/helm-charts/argocd/helmup.plugin

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "---->>> helmup.plugin"

package/src/helm-charts/cnpg-db-pgbench/helmup.bootstrap

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+BOOTSTRAP="cnpg-operator/operand.bootstrap"
+
+if [ ! -f "$BOOTSTRAP" ];
+then
+  printf "\n  `color r '***ERROR:'` the cnpg-operator must be installed first\n\n"
+  return 1
+fi
+
+. "$BOOTSTRAP" "$SERVICE"

package/src/helm-charts/cnpg-db-psql-stack/helmup.bootstrap

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+BOOTSTRAP="cnpg-operator/operand.bootstrap"
+
+if [ ! -f "$BOOTSTRAP" ];
+then
+  printf "\n  `color r '***ERROR:'` the cnpg-operator must be installed first\n\n"
+  return 1
+fi
+
+. "$BOOTSTRAP" "$SERVICE"

package/src/helm-charts/cnpg-db-psql-stack/helmup.plugin

@@ -1,6 +1,6 @@
 #!/bin/bash
 
 # ensures the PG_PASSWORD secret exists and correct
-ensureCnpgSecret PG_PASSWORD $SERVICE-postgres-pw
+synchronizeSecrets PG_PASSWORD $SERVICE-postgres-pw
 
 kubectl apply -f cnpg-db-psql-stack/cluster.yaml $K8S_WHAT

package/src/helm-charts/cnpg-db-recovery/helmup.bootstrap

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+BOOTSTRAP="cnpg-operator/operand.bootstrap"
+
+if [ ! -f "$BOOTSTRAP" ];
+then
+  printf "\n  `color r '***ERROR:'` the cnpg-operator must be installed first\n\n"
+  return 1
+fi
+
+. "$BOOTSTRAP" "$SERVICE"

package/src/helm-charts/cnpg-db-recovery/helmup.plugin

@@ -1,6 +1,6 @@
 #!/bin/bash
 
 # ensures the PG_PASSWORD secret exists and correct
-# ensureCnpgSecret PG_PASSWORD $SERVICE-postgres-pw
+# synchronizeSecrets PG_PASSWORD $SERVICE-postgres-pw
 
 kubectl apply -f cnpg-db-recovery/cluster.yaml $K8S_WHAT

package/src/helm-charts/cnpg-db-tsdb-basic/helmup.bootstrap

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+BOOTSTRAP="cnpg-operator/operand.bootstrap"
+
+if [ ! -f "$BOOTSTRAP" ];
+then
+  printf "\n  `color r '***ERROR:'` the cnpg-operator must be installed first\n\n"
+  return 1
+fi
+
+. "$BOOTSTRAP" "$SERVICE"

package/src/helm-charts/cnpg-db-tsdb-basic/helmup.plugin

@@ -1,6 +1,6 @@
 #!/bin/bash
 
 # ensures the TSDB_PASSWORD secret exists and correct
-ensureCnpgSecret TSDB_PASSWORD $SERVICE-postgres-pw
+synchronizeSecrets TSDB_PASSWORD $SERVICE-postgres-pw
 
 kubectl apply -f cnpg-db-tsdb-basic/cluster.yaml $K8S_WHAT

package/src/helm-charts/cnpg-db-tsdb-dense/helmup.bootstrap

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+BOOTSTRAP="cnpg-operator/operand.bootstrap"
+
+if [ ! -f "$BOOTSTRAP" ];
+then
+  printf "\n  `color r '***ERROR:'` the cnpg-operator must be installed first\n\n"
+  return 1
+fi
+
+. "$BOOTSTRAP" "$SERVICE"

package/src/helm-charts/cnpg-db-tsdb-dense/helmup.plugin

@@ -1,6 +1,6 @@
 #!/bin/bash
 
 # ensures the TSDB_DENSE_PASSWORD secret exists and correct
-ensureCnpgSecret TSDB_DENSE_PASSWORD $SERVICE-postgres-pw
+synchronizeSecrets TSDB_DENSE_PASSWORD $SERVICE-postgres-pw
 
 kubectl apply -f cnpg-db-tsdb-dense/cluster.yaml $K8S_WHAT

package/src/helm-charts/cnpg-operator/helmdn.plugin

@@ -9,7 +9,7 @@ OPERATOR_SHUTDOWN
 
 yesToContinue "to delete the CNPG Operator"
 
-OPVER="1.24.0"
+OPVER="1.26.0"
 
 clearlyWarn DO_NOT_CLEAR
 

package/src/helm-charts/cnpg-operator/helmup.bootstrap

@@ -0,0 +1,201 @@
+#!/bin/bash
+#
+# lifted from helmup.sh
+#
+function installCnpgOperatorEnvironment() {
+  # See => https://github.com/cloudnative-pg/charts
+
+  gcloud config set project $GCP_PROJECT_ID
+
+  # create an SA in the cnpg namespace for the operands to bind to
+  CNPG_NAMESPACE="cnpg-operands"
+  CNPG_SVC_ACCT="$CNPG_NAMESPACE-sa"
+  CNPG_SVC_EMAIL="$CNPG_SVC_ACCT@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  # We used to delete the SA when we were doing clean installs but that bit
+  # me in the ass the time I moved the operator dir out of the way to run
+  # helmwhat to populate with latest operator version. The result? The SA
+  # was deleted and recreated and the existing system lost the ability to
+  # write to GCS which resulted in WAL failures. The deletion / recreation
+  # logic was only useful in the early days of creating / deleting for
+  # initial development.
+  #
+  # Synopsis: deleting an SA from an actual non-test system is BAD NEWS
+  #           and if it happens then you will need to rebind the SA to
+  #           workload identity by hand.
+  #
+  # kubectl delete serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
+  # gcloud --quiet iam service-accounts delete $CNPG_SVC_EMAIL  --project $GCP_PROJECT_ID&> $DEVNULL
+  kubectl describe serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
+  if [ $? -eq 0 ];
+  then
+    cat<<SKIP_CNPG_SA_CREATION
+
+  $YELO_WARN The CNPG SA $CNPG_SVC_ACCT already exists
+
+  Deleting the SA for the purposes of upgrading the operator is going to
+  wreck someone's day (probably yours) if the desire is to simply upgrade
+  in place. To force a clean reinstall, delete both the k8s and gcp SA for
+  CNPG and try again. (see comments in helmup for more info)
+
+SKIP_CNPG_SA_CREATION
+    return
+  fi
+
+  # Create the operands namespace and annotate to allow redis access
+  createNamespaceIfNeeded $CNPG_NAMESPACE
+
+  # Create GCP SA and bind policies
+  printf "\nCreating the gcloud `color g $CNPG_SVC_ACCT` service account (SA)\n"
+  gcloud iam service-accounts create $CNPG_SVC_ACCT \
+    --project "$GCP_PROJECT_ID" \
+    --description "CNPG Operands SA" \
+    --display-name "CNPG Operands SA" &> $DEVNULL
+  warnOnError $? "the GCP SA `color y $CNPG_SVC_ACCT` may already exist"
+
+  CNPG_OPS_ROLE="cnpg.operands"
+  printf "\nCreating the `color g $CNPG_OPS_ROLE` IAM role\n"
+  ## Attach roles
+  ROLE_PERMISSIONS=(
+    iam.serviceAccounts.actAs
+    iam.serviceAccounts.get
+    iam.serviceAccounts.getAccessToken
+    iam.serviceAccounts.getOpenIdToken
+    iam.serviceAccounts.implicitDelegation
+    iam.serviceAccounts.list
+    iam.serviceAccounts.signBlob
+    iam.serviceAccounts.signJwt
+    resourcemanager.projects.get
+    storage.buckets.create
+    storage.buckets.get
+    storage.buckets.getIamPolicy
+    storage.buckets.list
+    storage.buckets.update
+    storage.objects.create
+    storage.objects.delete
+    storage.objects.get
+    storage.objects.getIamPolicy
+    storage.objects.list
+  )
+  gcloud iam roles create $CNPG_OPS_ROLE \
+    --project $GCP_PROJECT_ID \
+    --title "CNPG Operands" \
+    --description "CNPG Operands" \
+    --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  if [ $? -ne 0 ];
+  then
+    # assume error is that role exists so try updating instead
+    printf "\nUpdating the permissions on the `color g $CNPG_OPS_ROLE` IAM role\n"
+    gcloud iam roles update $CNPG_OPS_ROLE \
+      --project $GCP_PROJECT_ID \
+      --title "CNPG Operands" \
+      --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  fi
+  warnOnError $? "Failed to add roles to $CNPG_OPS_ROLE - perhaps they already exist?"
+
+  printf "\nBinding IAM role to the SA `color g $CNPG_SVC_EMAIL`\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role "roles/storage.admin" &> $DEVNULL
+#   --role projects/$GCP_PROJECT_ID/roles/$CNPG_OPS_ROLE &> $DEVNULL
+#   --role "roles/storage.admin" &> $DEVNULL
+  warnOnError $? "gcloud problem binding IAM policy"
+
+  printf "\nBinding IAM the Token Creator role to the SA `color g $CNPG_SVC_EMAIL`\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role="roles/iam.serviceAccountTokenCreator"
+
+  # workload binding will be performed by each cnpg operand on startup
+
+  BARMAN_BUCKET="gs://$GCP_PROJECT_ID-barman"
+  gsutil ls -p $GCP_PROJECT_ID -b $BARMAN_BUCKET &> $DEVNULL
+  if [ "$?" -eq 0 ];
+  then
+    printf "\nBarman bucket `color g "$BARMAN_BUCKET"` already exists - skipping recreation\n"
+  else
+    printf "\nCreating a bucket for barman backups: `color g $BARMAN_BUCKET`\n"
+    gsutil mb -l $GCE_REGION $BARMAN_BUCKET &> $DEVNULL
+    gsutil iam ch serviceAccount:$CNPG_SVC_EMAIL:objectAdmin $BARMAN_BUCKET
+    gsutil ubla set on $BARMAN_BUCKET # uniform bucket access
+  fi
+
+  # define the snapshot storage class
+  printf "\nApplying the CNPG VolumeSnapshotClass `color g cnpg-snapshotclass` definition\n"
+  cat<<EOSNAPSC | kubectl apply -f -
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: cnpg-snapshotclass
+driver: pd.csi.storage.gke.io
+deletionPolicy: Retain
+EOSNAPSC
+
+  sleep 2 # hold up processing for a moment to allow IAM mods to propagate
+}
+
+# this function is a little convoluted in the way it attempts to install the
+# scripts and yaml necessary for the CNPG cleanup activities - the idea is to
+# be able to update the scripts without touching anything else since the target
+# directory is the cnpg-operator setup
+function installCnpgCleanupCronjob() {
+  CNPG_OPERATOR_DIR="cnpg-operator"
+  if [ ! -d "$CNPG_OPERATOR_DIR" ];
+  then
+    cat<<CNPG_OPERATOR_MISSING
+  `color r "The cnpg-operator must be installed before proceeding"`
+
+CNPG_OPERATOR_MISSING
+    exit 1
+  fi
+
+  # create the destination bucket for k8s cronjob scripts
+  BUCKET_SUFFIX="k8s-cronjobs"
+  makeUniformBucketWithCors $BUCKET_SUFFIX
+
+  CNPG_CLEANUP_CRONJOB_OVH="cnpg-cleanup-cronjob.yaml.ovh"
+  CNPG_CLEANUP_CRONJOB="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_CRONJOB_OVH"
+  CNPG_CLEANUP_SCRIPT_BASH="cnpg-cleanup-script.sh"
+  CNPG_CLEANUP_SCRIPT="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_SCRIPT_BASH"
+  if [ ! -f "$CNPG_CLEANUP_SCRIPT" ];
+  then
+    cat<<CNPG_FETCH_CLEANUP_CRONJOB_YAML
+  `color y "Missing $CNPG_CLEANUP_SCRIPT_BASH - updating local cron setup scripts"`
+
+CNPG_FETCH_CLEANUP_CRONJOB_YAML
+    CNPG_OP_ROOT="$(build-tools --reporoot)/src/helm-charts/cnpg-operator"
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_CRONJOB_OVH $CNPG_CLEANUP_CRONJOB
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_SCRIPT_BASH $CNPG_CLEANUP_SCRIPT
+  fi
+
+  # copy / update the script in the bucket referenced in the cronjob
+  printf "\ngsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX\n"
+  gsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX
+
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_CLEANUP_SA="cnpg-cleanup-sa"
+
+  gcloud iam service-accounts create "$CNPG_CLEANUP_SA" \
+    --project="$GCP_PROJECT_ID" \
+    --description="Used for cronjob cleanup with Workload Identity" \
+    --display-name="CNPG Cleanup SA" &> $DEVNULL
+    warnOnError $? "the GCP SA $CNPG_CLEANUP_SA may already exist"
+
+  gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
+    --project="$GCP_PROJECT_ID" \
+    --member="serviceAccount:$CNPG_CLEANUP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+    --role="roles/storage.objectViewer"
+
+  bindWorkloadIdentity "$CNPG_CLEANUP_SA" "$CNPG_NAMESPACE"
+
+  CNPG_CLEANUP_CRONJOB_YAML="$CNPG_OPERATOR_DIR/$(basename $CNPG_CLEANUP_CRONJOB_OVH .ovh)"
+  overwhelm -g # allow ovh -> yaml to occur
+  cat<<CNPG_CLEANUP_CRONJOB_APPLY
+  `color g "Creating cronjob =>"``color y " kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML"`
+
+CNPG_CLEANUP_CRONJOB_APPLY
+  kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML
+}
+# Run it!
+installCnpgOperatorEnvironment
+installCnpgCleanupCronjob

package/src/helm-charts/cnpg-operator/helmup.plugin

@@ -2,7 +2,7 @@
 #
 # See => https://cloudnative-pg.io/documentation/current/installation_upgrade/
 #
-OPVER="1.26.0" # 05/23/2025
+OPVER="1.26.1" # 07/29/2025
 
 createNamespaceIfNeeded cnpg-system
 

package/src/helm-charts/cnpg-operator/operand.bootstrap

@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Lifted from helmup.sh
+#
+# This function is used to randomly generate the postgresql database passwords
+# for the postgres and imagine users in a cnpg operator configuration. Since
+# the resultant passwords will live in the cnpg-operands namespace they will
+# be mirrored to the default namespace via the reflector service. Lastly, the
+# service account will have workload identity bound to it in the cnpg-operands
+# namespace.
+function initializeCnpgOperand() {
+  local CNPG_SERVICE="$1"
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_SVC_ACCT="$CNPG_NAMESPACE-sa"
+  local IMAGINE_PW_NAME="$CNPG_SERVICE-imagine-pw"
+  local POSTGRES_PW_NAME="$CNPG_SERVICE-postgres-pw"
+
+# TODO: we use postgres root password for access - that is bad - fix it?
+# printf "\nCreating imagine db password for `color g $CNPG_SERVICE`\n"
+# kubectl create secret generic -n $CNPG_NAMESPACE "$IMAGINE_PW_NAME" \
+#       --from-literal=username="imagine" \
+#       --from-literal=password="$(generatePassword)" &> $DEVNULL
+# warnOnError $? "the `color y $IMAGINE_PW_NAME` secret may already exist"
+
+# # reflect the secret to default namespace
+# reflectSecretIntoNamespaces $IMAGINE_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nCreating postgres db password for `color g $CNPG_SERVICE`\n"
+  kubectl create secret generic -n $CNPG_NAMESPACE "$POSTGRES_PW_NAME" \
+        --from-literal=username="postgres" \
+        --from-literal=password="$(generatePassword)" &> $DEVNULL
+  warnOnError $? "the `color y $POSTGRES_PW_NAME` secret may already exist"
+
+  # reflect the secret to default namespace
+  reflectSecretIntoNamespaces $POSTGRES_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nBinding `color g $CNPG_SERVICE` to the `color y "$CNPG_SVC_ACCT"` SA\n"
+  bindWorkloadIdentity $CNPG_SVC_ACCT $CNPG_NAMESPACE $CNPG_SERVICE
+}
+# Run It!
+initializeCnpgOperand "$SERVICE" # $SERVICE from helmup.sh

package/src/helm-charts/pgbouncer/helmup.bootstrap

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+function setupPgbouncerSecret() {
+  # pgbouncer uses a k8s secret for the user access list which is in the form
+  # of => "user" "password" - this function will create the pgbouncer secret
+  # if it does not exist by pulling the password from the PG_PASSWORD secret
+  # managed by the Google Secret Manager service.
+  USERLIST_SECRET='pgbouncer-userlist-secret'
+  kubectl get secret $USERLIST_SECRET &> $DEVNULL
+  [[ $? -eq 0 ]] && return # already exists - bail
+
+  cat<<PGB_SECRET
+
+  `color y "Creatng $USERLIST_SECRET k8s secret from secret manager PG_PASSWORD secret..."`
+
+PGB_SECRET
+  DECODED_PSQL_PASSWORD=$(gcloud secrets versions access latest --secret=PG_PASSWORD --project $GCP_PROJECT_ID)
+  exitOnError $? "Failed to fetch PG_PASSWORD from the secret manager"
+
+  kubectl create secret generic $USERLIST_SECRET --from-literal=userlist.txt="\"postgres\" \"$DECODED_PSQL_PASSWORD\""
+  exitOnError $? "Failed to create the $USERLIST_SECRET k8s secret"
+}
+
+setupPgbouncerSecret

package/src/helm-charts/prom-operator/helmup.bootstrap

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# This function came from the helmup.sh script and is used to install the
+# stackdriver exporter in the prometheus or monitoring (legacy) namespace.
+# This function only needs to execute once, at initial setup / configuration.
+function installStackdriverExporterEnvironment() {
+  showInstalling "Stackdriver Exporter Service Account Binding"
+
+  # Add necessary helm repositories - note that stable is deprecated
+  addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
+
+  local SDEXP_NS=${1:-prometheus}
+  local SDEXP_SA="stackdriver-exporter"
+  local SDEXP_EM="$SDEXP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  createNamespaceIfNeeded $SDEXP_NS
+
+  # guarantee any previous remnants of the exporter are gone
+  printf "\n*** Removing the previous $SDEXP_SA installation...\n"
+  helm uninstall -n $SDEXP_NS $SDEXP_SA                 &> $DEVNULL
+  kubectl delete serviceaccounts -n $SDEXP_NS $SDEXP_SA &> $DEVNULL
+  printf "!!! Skipping deletion of the gcloud SA $SDEXP_EM\n"
+# gcloud --quiet iam service-accounts delete $SDEXP_EM  &> $DEVNULL
+
+  # NOTE: The k8s SA != GCP SA - the former is created by the helm chart
+  # that installs the stackdriver-exporter, the latter is handled here in
+  # order to provide the proper IAM permissions to the exporter.
+
+  # Create GCP SA and bind policies
+  printf "\n*** Creating GCP SA with $SDEXP_NS/viewer ***\n"
+  gcloud iam service-accounts create $SDEXP_SA \
+    --project "$GCP_PROJECT_ID" \
+    --display-name "Prometheus Stackdriver Exporter" &> $DEVNULL
+  warnOnError $? "the GCP SA $SDEXP_SA may already exist"
+
+  printf "\n*** Binding IAM role of $SDEXP_NS viewer to $SDEXP_SA in $GCP_PROJECT_ID\n"
+  gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
+    --role "roles/monitoring.viewer" \
+    --member "serviceAccount:$SDEXP_EM" &> $DEVNULL
+  sleep 2 # give the IAM binding a chance to complete before moving on
+
+  bindWorkloadIdentity $SDEXP_SA $SDEXP_NS
+
+  removeHelmRepo prometheus-community
+}
+
+installStackdriverExporterEnvironment

package/src/helm-charts/prom-operator/rules/traefik-rules.yaml

@@ -31,8 +31,8 @@ spec:
 #               VALUE = {{ $value }}
 #               LABELS = {{ $labels }}
         - alert: TraefikHighHttp5xxErrorRateService
-          expr: sum(rate(traefik_service_requests_total{code=~"5.*"}[3m])) by (service) / sum(rate(traefik_service_requests_total[3m])) by (service) * 100 > 5
-          for: 1m
+          expr: sum(rate(traefik_service_requests_total{code=~"5.*"}[5m])) by (service) / sum(rate(traefik_service_requests_total[5m])) by (service) * 100 > 5
+          for: 5m # awesome was => 1m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/traefik/values-local.yaml

@@ -28,7 +28,7 @@ resources:
 metrics:
   prometheus:
     serviceMonitor:
-      enabled: true
+      enabled: false # initially disabled until prometheus operator is installed
       interval: 30s
       namespace: prometheus
 

package/src/helm-charts/velero/helmup.bootstrap

@@ -0,0 +1,104 @@
+#!/bin/bash
+#
+# lifted from helmup.sh
+function installVeleroEnvironment() {
+  # Follows instructions => https://github.com/vmware-tanzu/velero-plugin-for-gcp
+  showInstalling "Velero Backup Management"
+  createNamespaceIfNeeded velero
+
+  # Do we need to => gcloud auth application-default
+  gcloud config set project $GCP_PROJECT_ID
+
+  ## The major chart version will determine the bucket suffix
+  [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="10"
+
+  ## Create a bucket
+  BUCKET="$GCP_PROJECT_ID-velero-$VELERO_CHART_VERSION"
+  printf "\nCreating storage bucket `color g $BUCKET` in `color g $GCE_REGION`\n"
+  gsutil mb -l $GCE_REGION gs://$BUCKET/ &> $DEVNULL
+  warnOnError $? "Bucket failed to create or already exists - go check it\n"
+  gsutil ubla set on gs://$BUCKET &> $DEVNULL
+
+  ## Create a service account
+  printf "\nCreating the service account\n"
+  gcloud iam service-accounts create velero \
+    --project $GCP_PROJECT_ID \
+    --display-name "Velero service account" \
+    --description "Velero service account" &> $DEVNULL
+  if [ $? -eq 0 ];
+  then
+    # no error means a new SA was created - slight delay to let it update
+    sleep 2
+  else
+    printf "$YELO_WARN Failed to create the service account - does it already exist?"
+  fi
+
+  SERVICE_ACCOUNT_EMAIL="velero@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
+
+  ## Attach roles
+  ROLE_PERMISSIONS=(
+    compute.disks.get
+    compute.disks.create
+    compute.disks.createSnapshot
+    compute.projects.get
+    compute.snapshots.get
+    compute.snapshots.create
+    compute.snapshots.useReadOnly
+    compute.snapshots.delete
+    compute.zones.get
+    iam.serviceAccounts.actAs
+    iam.serviceAccounts.signBlob
+    storage.objects.create
+    storage.objects.delete
+    storage.objects.get
+    storage.objects.list
+  )
+
+  printf "\nAssigning roles to the SA\n"
+  gcloud iam roles create velero.server \
+    --project $GCP_PROJECT_ID \
+    --title "Velero Server" \
+    --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  if [ $? -ne 0 ];
+  then
+    # assume error is that role exists so try updating instead
+    printf "\nUpdating roles on the SA\n"
+    gcloud iam roles update velero.server \
+      --project $GCP_PROJECT_ID \
+      --title "Velero Server" \
+      --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  fi
+  warnOnError $? "Failed to add roles to velero.server - perhaps they already exist?"
+
+  printf "\nBinding IAM policy to the SA\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --project $GCP_PROJECT_ID \
+    --member serviceAccount:$SERVICE_ACCOUNT_EMAIL \
+    --condition 'None' \
+    --role projects/$GCP_PROJECT_ID/roles/velero.server &> $DEVNULL
+  warnOnError $? "gcloud problem binding IAM policy"
+
+  printf "\nBinding workload identity IAM policy to the SA\n"
+  gcloud iam service-accounts add-iam-policy-binding \
+      --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[velero/velero]" \
+      --role roles/iam.workloadIdentityUser \
+      $SERVICE_ACCOUNT_EMAIL
+  warnOnError $? "gcloud workload identity binding may have failed"
+
+  printf "\nCreate and annotate the k8s SA\n"
+  kubectl create serviceaccount velero --namespace velero
+  warnOnError $? "Failed to create k8s SA - perhaps it already exists?"
+  
+  kubectl annotate serviceaccount velero \
+    --namespace velero \
+    "iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL"
+  warnOnError $? "Failed to annotate k8s SA - things may fail"
+
+  gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
+
+  ## Clean up from previous failed install
+  # kubectl delete volumesnapshotlocation.velero.io -n velero gcp &> $DEVNULL
+}
+
+# Run It!
+installVeleroEnvironment