@leverege/build-tools 2.81.1 → 2.82.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.81.1",
+  "version": "2.82.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -65,7 +65,7 @@
   "license": "SEE LICENSE IN LICENSE.md",
   "dependencies": {
     "@leverege/jsdoc-template": "^1.0.1",
-    "chalk": "^5.4.1",
+    "chalk": "^5.5.0",
     "command-line-args": "^6.0.1",
     "command-line-usage": "^7.0.3",
     "commander": "^14.0.0",
@@ -79,7 +79,7 @@
     "js-yaml": "^4.1.0",
     "jsdoc": "^4.0.4",
     "ms": "^2.1.3",
-    "npm-registry-fetch": "^18.0.2",
+    "npm-registry-fetch": "^19.0.0",
     "ora": "^8.2.0",
     "p-limit": "^6.2.0",
     "package-up": "^5.0.0",
@@ -89,10 +89,10 @@
     "simple-git": "^3.28.0",
     "sloc": "^0.3.2",
     "toml": "^3.0.0",
-    "zx": "^8.7.2"
+    "zx": "^8.8.0"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.0.1",
-    "npm": "^11.5.1"
+    "npm": "^11.5.2"
   }
 }

package/src/bash-funcs

@@ -149,6 +149,27 @@ REPOADD
   helm repo update &> $DEVNULL
 }
 
+# *** DEPRECATED *** REMOVE AFTER BITNAMI ERADICATED ***
+# *** DEPRECATED *** REMOVE AFTER BITNAMI ERADICATED ***
+# *** DEPRECATED *** REMOVE AFTER BITNAMI ERADICATED ***
+#
+function addBitnamiRepo() {
+  if [ ! -z "$BITNAMI_LATEST" ] || [ "$1" == "latest" ];
+  then
+    BITNAMI_URL="https://charts.bitnami.com/bitnami"
+  else
+    cat<<CATNAMI
+    Using the pre 2022 legacy charts from bitnami. To use latest run:
+
+        `color y "BITNAMI_LATEST=1 $HELMUP_ARGS"`
+
+CATNAMI
+    BITNAMI_URL="https://raw.githubusercontent.com/bitnami/charts/eb5f9a9513d987b519f0ecd732e7031241c50328/bitnami"
+  fi
+
+  addHelmRepo bitnami $BITNAMI_URL
+}
+
 function removeHelmRepo(){
   [ ! -z "$SKIP_RM_HELM_REPO" ] && return
   helm repo remove $1 &> $DEVNULL

package/src/bitnami-audit.mjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+//
+// This script is used to scan all of the projects in the auditProject array
+// to look for any deployments that are still using the bitnami images. The
+// output from this script can then be imported / upload / replace existing in
+// the BitnamiImageRegistry gsheet to show progess on the migration effort.
+//
+import fs from 'node:fs'
+import chalk from 'chalk'
+import semver from 'semver'
+
+import {
+  debug,
+  log,  
+  shellCmd,
+} from './Utils.mjs'
+
+const auditProjects = [
+  'dev-controltek',
+  'dev-cox-health',
+  'dev-pitcrew',
+  'xxx-bogus', // expect warning
+  'dev-recovr-auto',
+  'dev-schnucks',
+  'dev-tpi',
+  'discount-tire-prd',
+  'discount-tire-stg',
+  'leverege-cnpg-20240729',
+  'leverege-ops-20250730',
+  'leverege-demo', // expect warning
+  'leverege-elastic',
+  'leverege-onboarding',
+  'leverege-sandbox',
+  'nimbelink-demo',
+  'prd-controltek',
+  'prd-cox-health',
+  'prd-generic-kudelski',
+  'prd-les-schwab',
+  'prd-recovr-auto',
+  'prd-skymirr',
+  'prd-tpi',
+  'prd-valvoline',
+  'qa-cox-health', // expect warning
+  'siren-marine-dev',
+  'siren-marine-prd',
+  'siren-marine-staging',
+  'siren-marine-test',
+  'stg-cox-health',
+  'stg-generic-kudelski',
+  'stg-recovr-auto',
+  'stg-recovr-perf',
+]
+
+const gitCheckoutCleanBranch = async ( branch = 'bootstrap-k8s' ) => {
+  // find and remove cruft, like generated values.yaml files
+  await shellCmd( 'find . -not \\( -path \\*junk -prune -o -path \\*helm-elasticsearch -prune \\) -name values.yaml -exec rm {} \\;' )
+
+  // start with a clean baseline
+  await shellCmd( 'git checkout bootstrap-k8s' )
+  await shellCmd( 'git clean -d --force' )
+
+  // checkout the target branch
+  await shellCmd( `git checkout ${branch}` )
+}
+
+const setK8sContext = async ( project ) => {
+  await shellCmd( 'overwhelm --fetchctx' )
+  await shellCmd( 'overwhelm --matchk8s' )
+}
+
+const prepareContext = async ( project ) => {
+  await gitCheckoutCleanBranch( project )
+  await setK8sContext( project )
+}
+
+const filterBitnamiImages = ( project, imagesJSON ) => {
+  const data = JSON.parse( imagesJSON )
+  const seen = new Set()
+
+  for ( const item of data.items ) {
+    const ns = item.metadata.namespace
+    let service = item.metadata.name
+
+    // Collapse services
+    service = service.replace( /elasticsearch8-(coordinating|data|master|ingest)/, 'elasticsearch' )
+    service = service.replace( /redis-(master|replicas)/, 'redis' )
+    service = service.replace( /valkey-(primary|replicas)/, 'valkey' )
+
+    const containers = item.spec?.template?.spec?.containers || []
+    for ( const c of containers ) {
+      let img = c.image
+
+      // Only keep bitnami images
+      if ( !/bitnami/.test( img ) ) continue
+
+      // Registry decluttering
+      img = img.replace( /^docker\.io\/bitnami/, 'bitnami' )
+      img = img.replace( /^us-docker\.pkg\.dev\/leverege-registry\/bitnami-mirror\/images/, 'leverege' )
+      img = img.replace( /^us-docker\.pkg\.dev\/leverege-registry\/system\/images/, 'leverege/system' )
+
+      const [ image, fullVersion = 'latest' ] = img.split( ':' )
+      const displayVersion = fullVersion.replace( /-debian-.*$/, '' )
+
+      const row = [ project, ns, service, image, displayVersion, fullVersion ].join( ',' )
+      if ( !seen.has( row ) ) {
+        debug( row )
+        seen.add( row )
+      }
+    }
+  }
+  return seen
+}
+
+const imageSummary = new Map()
+
+const runner = async ( projects ) => {
+  const CSV_FILE = '../BitnamiImageRegistry.csv'
+  const fd = fs.openSync( CSV_FILE, 'w' )
+  fs.writeSync( fd, 'Project,Namespace,Service,Image,Version,Tag\n' )
+
+  for ( const project of projects ) {
+    log( `Project [${project}]` )
+    try {
+      await prepareContext( project ) // eslint-disable-line no-await-in-loop
+    } catch ( error ) {
+      log( `Project or context is invalid, skipping [${chalk.redBright( project )}]` )
+      continue
+    }
+
+    // eslint-disable-next-line no-await-in-loop
+    const k8sImageDump = await shellCmd( 'kubectl get deploy,statefulset -A -o json' )
+    const bitnamiImages = filterBitnamiImages( project, k8sImageDump )
+    
+    for ( const line of bitnamiImages ) {
+      fs.writeSync( fd, `${line}\n` )
+
+      const [ , , , image, version, tag ] = line.split( ',' )
+      if ( /^leverege/.test( image ) ) continue // we don't need leverege in the summary
+
+      if ( !imageSummary.has( image ) ) {
+        imageSummary.set( image, { version : new Set(), tag : new Set() } )
+      }
+      imageSummary.get( image ).version.add( version )
+      imageSummary.get( image ).tag.add( tag )
+    }
+  }
+  fs.closeSync( fd )
+
+  log( '\n==== Bitnami Image Summary ====\n' )
+
+  log( 'IMAGES=(' )
+
+  for ( const [ image, { tag, version } ] of imageSummary.entries() ) {
+    const sortedTags = Array.from( tag ).sort( semver.rcompare )
+    for ( const t of sortedTags.slice( 0, 15 ) ) {
+      log( `  "${image}:${t}"` )
+    }
+
+    // Optional: also log a human-friendly display version list
+    const sortedVersions = Array.from( version ).sort( semver.rcompare )
+    log( `  # Display versions: ${sortedVersions.join( ', ' )}` )
+  }
+
+  log( ')' )
+
+  gitCheckoutCleanBranch() // back to clean bootstrap-k8s
+}
+
+await runner( auditProjects )

package/src/bitnami-audit.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+
+BITNAMI_CTX=(
+  dev-controltek
+  dev-cox-health
+  dev-pitcrew
+  dev-recovr-auto
+  dev-schnucks
+  dev-tpi
+  discount-tire-prd
+  discount-tire-stg
+  leverege-cnpg-20240729
+  leverege-ops-20250730
+  leverege-demo
+  leverege-elastic
+  leverege-onboarding
+  leverege-sandbox
+  nimbelink-demo
+  prd-controltek
+  prd-cox-health
+  prd-generic-kudelski
+  prd-les-schwab
+  prd-recovr-auto
+  prd-skymirr
+  prd-tpi
+  prd-valvoline
+  qa-cox-health
+  siren-marine-dev
+  siren-marine-prd
+  siren-marine-staging
+  siren-marine-test
+  stg-cox-health
+  stg-generic-kudelski
+  stg-recovr-auto
+  stg-recovr-perf
+)
+
+function gitCheckoutCleanBranch() {
+  # find the cruft, namely any values.yaml files which tend to block the
+  # cleaning of subdirs that contain them (values.yaml aren't tracked in git)
+  find . -not \( -path \*junk -prune -o -path \*helm-elasticsearch -prune \) -name values.yaml -exec rm {} \;
+  git ko bootstrap-k8s &> /dev/null
+  git clean -d --force &> /dev/null
+
+  local branch=${1:bootstrap-k8s}
+  git ko "$branch" &> /dev/null
+}
+
+# create a clean sheet with headers
+CSV_FILE="../BitnamiImageRegistry.csv"
+rm -f $CSV_FILE
+echo 'project,namespace,service,image,version' > $CSV_FILE
+
+gitCheckoutCleanBranch # start clean
+
+for CTX in "${BITNAMI_CTX[@]}";
+do
+  gitCheckoutCleanBranch $CTX
+
+  if [[ $? -eq 0 ]];
+  then
+    overwhelm -f
+    overwhelm -m
+    if [[ $? -ne 0 ]];
+    then
+      echo "Project [${CTX}] is valid, but the k8s context is not - skipping..."
+      continue
+    fi
+    echo "Context GOOD [$CTX]"
+    kubectl get deploy,statefulset -A -o json | bitnami-k8s-parse $CTX >> $CSV_FILE
+  fi
+  find . -not \( -path \*junk -prune -o -path \*helm-elasticsearch -prune \) -name values.yaml -exec rm {} \;
+done
+
+gitCheckoutCleanBranch # end clean

package/src/bitnami-to-leverege-artifacts.sh

@@ -0,0 +1,140 @@
+#!/bin/bash
+#
+# This script was used to bootstrap the leverege-registry bitnmai-mirror
+# folder with initial images and charts needed for the migration away from
+# bitnami. I left it here as an artifact and can be deleted once the entire
+# migration is complete.
+#
+# CONFIGURATION
+PROJECT_ID="leverege-registry"
+REGION="us" # adjust if needed
+MIRROR_ROOT="${REGION}-docker.pkg.dev/${PROJECT_ID}/bitnami-mirror"
+DOCKER_PREFIX="${MIRROR_ROOT}/images"
+CHARTS_PREFIX="oci://${MIRROR_ROOT}/charts"
+
+# Images to mirror
+IMAGES=(
+  "bitnami/postgresql:11.14.0-debian-10-r28"
+  "bitnami/postgresql:11.7.0-debian-10-r99"
+  # Display versions: 11.14.0, 11.7.0
+  "bitnami/postgres-exporter:0.10.0-debian-10-r172"
+  "bitnami/postgres-exporter:0.8.0-debian-10-r106"
+  # Display versions: 0.10.0, 0.8.0
+  "bitnami/redis:7.4.3-debian-12-r0"
+  "bitnami/redis:7.4.2-debian-12-r2"
+  "bitnami/redis:7.4.1-debian-12-r0"
+  "bitnami/redis:7.2.5-debian-12-r2"
+  "bitnami/redis:7.2.5-debian-12-r0"
+  "bitnami/redis:7.2.4-debian-12-r12"
+  "bitnami/redis:7.2.3-debian-11-r1"
+  "bitnami/redis:7.0.12-debian-11-r34"
+  "bitnami/redis:7.0.11-debian-11-r12"
+  "bitnami/redis:7.0.8-debian-11-r0"
+  "bitnami/redis:6.2.1-debian-10-r36"
+  "bitnami/redis:6.0.3-debian-10-r2"
+  # Display versions: 7.4.3, 7.4.2, 7.4.1, 7.2.5, 7.2.4, 7.2.3, 7.0.12, 7.0.11, 7.0.8, 6.2.1, 6.0.3
+  "bitnami/redis-exporter:1.70.0-debian-12-r2"
+  "bitnami/redis-exporter:1.67.0-debian-12-r7"
+  "bitnami/redis-exporter:1.63.0-debian-12-r1"
+  "bitnami/redis-exporter:1.61.0-debian-12-r2"
+  "bitnami/redis-exporter:1.61.0-debian-12-r0"
+  "bitnami/redis-exporter:1.58.0-debian-12-r7"
+  "bitnami/redis-exporter:1.55.0-debian-11-r2"
+  "bitnami/redis-exporter:1.52.0-debian-11-r25"
+  "bitnami/redis-exporter:1.50.0-debian-11-r13"
+  "bitnami/redis-exporter:1.45.0-debian-11-r26"
+  "bitnami/redis-exporter:1.20.0-debian-10-r16"
+  "bitnami/redis-exporter:1.6.1-debian-10-r7"
+  # Display versions: 1.70.0, 1.67.0, 1.63.0, 1.61.0, 1.58.0, 1.55.0, 1.52.0, 1.50.0, 1.45.0, 1.20.0, 1.6.1
+  "bitnami/elasticsearch:8.18.0-debian-12-r2"
+  "bitnami/elasticsearch:8.17.3-debian-12-r0"
+  "bitnami/elasticsearch:8.16.1-debian-12-r0"
+  "bitnami/elasticsearch:8.15.2-debian-12-r2"
+  "bitnami/elasticsearch:8.12.2-debian-12-r0"
+  "bitnami/elasticsearch:8.12.1-debian-11-r2"
+  "bitnami/elasticsearch:8.12.1-debian-11-r1"
+  "bitnami/elasticsearch:8.12.0-debian-11-r1"
+  "bitnami/elasticsearch:8.11.1-debian-11-r0"
+  "bitnami/elasticsearch:8.10.3-debian-11-r1"
+  "bitnami/elasticsearch:8.9.1-debian-11-r2"
+  # Display versions: 8.18.0, 8.17.3, 8.16.1, 8.15.2, 8.12.2, 8.12.1, 8.12.0, 8.11.1, 8.10.3, 8.9.1
+  "bitnami/sealed-secrets-controller:0.29.0-debian-12-r1"
+  "bitnami/valkey:8.1.3-debian-12-r1"
+  # Display versions: 8.1.30
+)
+
+# Charts to mirror (chart:version)
+CHARTS=(
+  "bitnamicharts/elasticsearch:22.1.0"
+  "bitnamicharts/elasticsearch:21.6.3"
+  "bitnamicharts/elasticsearch:21.3.20"
+  "bitnamicharts/elasticsearch:19.17.6"
+# "bitnamicharts/postgresql:10.16.2" # pulled manually from ancient bitnami source
+  "bitnamicharts/redis:20.13.4"
+  "bitnamicharts/valkey:3.0.22"
+)
+
+echo "🔑 Authenticating to Artifact Registry..."
+gcloud auth configure-docker ${REGION}-docker.pkg.dev -q &> /dev/null
+gcloud auth application-default print-access-token | helm registry login \
+  -u oauth2accesstoken --password-stdin ${REGION}-docker.pkg.dev
+
+echo "📦 Ensuring Artifact Registry repos exist..."
+gcloud artifacts repositories create bitnami-mirror \
+  --repository-format=docker \
+  --location=${REGION} \
+  --project=${PROJECT_ID} \
+  --description="Mirror of Bitnami images/charts" &> /dev/null \
+  || echo "✅ Docker repo already exists."
+
+# Check if crane is available (brew install crane)
+if command -v crane &>/dev/null;
+then
+  echo "🚀 Using crane for image copies (fast + multi-arch safe)"
+  USE_CRANE=true
+else
+  echo "🐳 crane not found, falling back to Docker CLI"
+  USE_CRANE=false
+fi
+
+echo "⬇️ Pulling & pushing container images..."
+for IMAGE in "${IMAGES[@]}"; do
+  SRC_IMAGE="docker.io/${IMAGE}"
+  NAME=$(echo "${IMAGE}" | cut -d: -f1 | awk -F/ '{print $NF}')
+  TAG=$(echo "${IMAGE}" | cut -d: -f2)
+  DEST_IMAGE="${DOCKER_PREFIX}/${NAME}:${TAG}"
+
+  echo "Mirroring ${SRC_IMAGE} → ${DEST_IMAGE}"
+
+  if [ "$USE_CRANE" = true ];
+  then
+    # crane copies the whole manifest list (multi-arch safe)
+    cat<<CRANE_CAT
+    crane copy "${SRC_IMAGE}" "${DEST_IMAGE}"
+CRANE_CAT
+    crane copy "${SRC_IMAGE}" "${DEST_IMAGE}"
+  else
+    docker pull --platform linux/amd64 "${SRC_IMAGE}"
+    docker tag "${SRC_IMAGE}" "${DEST_IMAGE}"
+    docker push "${DEST_IMAGE}"
+
+    # clean up local docker - the || true ensures the script won’t fail if the
+    # image was already removed or the tag isn’t present
+    docker rmi -f "${SRC_IMAGE}" "${DEST_IMAGE}" || true
+  fi
+done
+
+echo "⬇️ Pulling & pushing Helm charts..."
+for ENTRY in "${CHARTS[@]}"; do
+  CHART=$(echo $ENTRY | cut -d: -f1)
+  VERSION=$(echo $ENTRY | cut -d: -f2)
+  echo "Mirroring chart ${CHART}:${VERSION}"
+  #cat<<CHART_MOVER
+  helm pull oci://registry-1.docker.io/${CHART} --version ${VERSION}
+  CHART_TARBALL=$(basename ${CHART})-${VERSION}.tgz
+  helm push "${CHART_TARBALL}" ${CHARTS_PREFIX}
+  rm -f "${CHART_TARBALL}"
+#CHART_MOVER
+done
+
+echo "✅ Mirror complete."

package/src/count-lines-of-code.mjs

@@ -2,6 +2,8 @@
 import path from 'node:path'
 import { $, fs, chalk, argv } from 'zx'
 
+import { log } from './Utils.mjs'
+
 const srcOnly = argv.srcOnly
 
 const $$ = $( {
@@ -21,10 +23,10 @@ if ( !hasWorkspace ) {
     for ( let i = 0; i < dirs.length; i++ ) {
       const dir = dirs[i]
 
-      await getLinesOfCodeForDirectory( path.join( rootDir, 'packages', dir ) )
+      await getLinesOfCodeForDirectory( path.join( rootDir, 'packages', dir ) ) // eslint-disable-line no-await-in-loop
     }
   } else {
-    console.log( chalk.redBright( 'No workspace directories for which to count code' ) )
+    log( chalk.redBright( 'No workspace directories for which to count code' ) )
   }
 }
 
@@ -33,13 +35,13 @@ async function getLinesOfCodeForDirectory( directory ) {
   const hasSrc = await fs.exists( srcDir )
   
   if ( hasSrc ) {
-    console.log( `${chalk.greenBright( srcOnly ? srcDir : directory )}:` )
+    log( `${chalk.greenBright( srcOnly ? srcDir : directory )}:` )
     if ( srcOnly ) {
       await $$`sloc ${srcDir} --format cli-table`
     } else {
       await $$`sloc ${directory} --format cli-table -i '^(src|test)/.*' -e node_modules`
     }
   } else {
-    console.log( chalk.redBright( `No src directory at ${directory}` ) )
+    log( chalk.redBright( `No src directory at ${directory}` ) )
   }
 }

package/src/crane-lift.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+#
+# just a simple wrapper round crane docker lifter
+#
+IMAGE_WITH_TAG="${1}" # like valkey:8.1.3-debian-12-r1
+
+REGISTRY_LEVEREGE="us-docker.pkg.dev/leverege-registry/bitnami-mirror/images"
+REGISTRY_BITNAMI="docker.io/bitnami"
+
+crane copy "${REGISTRY_BITNAMI}/${IMAGE_WITH_TAG}" \
+           "${REGISTRY_LEVEREGE}"/${IMAGE_WITH_TAG}"

package/src/helm-charts/elasticsearch8/elasticsearch-local-dev.yaml

@@ -8,7 +8,16 @@
 # for each of the 4 ES node types in the cluster. See prd-recovr-auto for an
 # example of a big beefy system.
 #
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/elasticsearch
+# tag: 8.18.0
+
 global:
+  security:
+    allowInsecureImages: true
   storageClass: "ssd"
 
 fullnameOverride: "elasticsearch8"

package/src/helm-charts/elasticsearch8/elasticsearch-local-prd.yaml

@@ -8,7 +8,16 @@
 # for each of the 4 ES node types in the cluster. See prd-recovr-auto for an
 # example of a big beefy system.
 #
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/elasticsearch
+# tag: 8.18.0
+
 global:
+  security:
+    allowInsecureImages: true
   storageClass: "ssd"
 
 fullnameOverride: "elasticsearch8"

package/src/helm-charts/elasticsearch8/helmup.plugin

@@ -2,11 +2,11 @@
 #
 showInstalling "Elastic Search 8"
 
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/elasticsearch"
+
 # *** WARNING TO FUTURE SELF *** v22 of the chart is ES v9!!!
 [ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.6.3"
 
-OCI_CHART="oci://registry-1.docker.io/bitnamicharts/elasticsearch"
-
 LOCAL_ES_VALUES="elasticsearch8/elasticsearch-local-dev.yaml"
 #LOCAL_ES_VALUES="elasticsearch8/elasticsearch-local-prd.yaml"
 [ ! -f "$LOCAL_ES_VALUES" ] && exitOnError 1 "Missing the local ES config file => `color y $LOCAL_ES_VALUES`"
@@ -14,4 +14,4 @@ LOCAL_ES_VALUES="elasticsearch8/elasticsearch-local-dev.yaml"
 helm upgrade --install elasticsearch8 $OCI_CHART \
              --namespace elastic --create-namespace \
              --values $LOCAL_ES_VALUES \
-             --version $ELASTIC_CHART_VERSION $HELM_WHAT
+             --version $ELASTIC_CHART_VERSION $HELM_WHAT

package/src/helm-charts/postgres/README.md

@@ -0,0 +1,6 @@
+## Legacy PostgreSQL 11
+
+This configuration was temporarily resurrected for supporting the bitnami
+migrations. There are still quite a few legacy deployments using this
+ancient psql approach. We use this config to point the servers at the Leverege
+artifact registry for the mirrored bitnami images.

package/src/helm-charts/postgres/helmdn.plugin

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo 'NO!'

package/src/helm-charts/postgres/helmup.plugin

@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+showInstalling "PostgreSQL Database (legacy)"
+
+errorIfMissingSecret authz-postgres
+
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/postgresql"
+
+[ -z "$PSQL_CHART_VERSION" ] && PSQL_CHART_VERSION="10.16.2"
+
+helm upgrade --install postgres $OCI_CHART          \
+             --values  postgres/postgres-local.yaml \
+             --version $PSQL_CHART_VERSION $HELM_WHAT
+
+#
+# legacy
+#helm upgrade --install postgres bitnami/postgresql  \
+#             --values  postgres/postgres-local.yaml \
+#             --version 10 $HELM_WHAT
+#
+#removeHelmRepo bitnami

package/src/helm-charts/postgres/postgres-local.yaml

@@ -0,0 +1,51 @@
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/postgresql
+# tag: 11.14.0-debian-10-r28
+
+postgresqlExtendedConf:
+  maxWorkerProcesses: 4
+  maxParallelWorkers: 4
+  maxConnections: 500
+  shared_buffers: 1GB
+  effectiveCacheSize: 4GB
+  maintenanceWorkMem: 1GB
+  workMem: 10MB
+
+persistence:
+  storageClass: "ssd"
+# size: 16Gi # default 8Gi
+
+resources:
+  requests:
+    memory: 1Gi
+    cpu: 750m
+
+postgresqlDatabase: authz
+existingSecret: authz-postgres
+
+metrics:
+  enabled: true
+  image:
+    registry: us-docker.pkg.dev
+    repository: leverege-registry/bitnami-mirror/images/postgres-exporter
+#   tag: 0.10.0-debian-10-r172
+
+master:
+  tolerations:
+  - key: "database"
+    operator: "Equal"
+    value: "true"
+    effect: "NoSchedule"
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: target-env
+            operator: In
+            values:
+            - database

package/src/helm-charts/prom-operator/stackdriver-exporter.yaml.ovh

@@ -34,7 +34,8 @@ stackdriver:
 serviceMonitor:
   enabled: true
   namespace: prometheus
-  interval: "30s"
+  interval: "60s"        # Align with Stackdriver's 60s data resolution
+# honorTimestamps: false # Avoid duplicate timestamp conflicts (eliminates dup timestamps?)
   relabelings:
     # Legacy labelmap used to preserve compatibility with pre-operator Grafana dashboards
     # Can be removed once legacy Prometheus stack is deprecated

package/src/helm-charts/redis/helmup.plugin

@@ -2,10 +2,10 @@
 
 showInstalling "Redis"
 
-OCI_CHART="oci://registry-1.docker.io/bitnamicharts/redis"
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/redis"
 
 [ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.13.4"
 
-helm upgrade --install redis $OCI_CHART       \
+helm upgrade --install redis $OCI_CHART        \
              --values  redis/values-local.yaml \
              --version $REDIS_CHART_VERSION $HELM_WHAT

package/src/helm-charts/redis/values-local.yaml

@@ -1,4 +1,14 @@
+#
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/redis
+# tag: 7.4.3-debian-12-r0
+
 global:
+  security: # this allows us to use local images
+    allowInsecureImages: true
   storageClass: ssd
 
 auth:
@@ -70,6 +80,10 @@ networkPolicy:
 
 metrics:
   enabled: true
+  image:
+    registry: us-docker.pkg.dev
+    repository: leverege-registry/bitnami-mirror/images/redis-exporter
+#   tag: 1.74.0-debian-12-r2
   serviceMonitor:
     enabled: true # set to true for prometheus operator
     namespace: "prometheus"

package/src/helm-charts/traefik/helmup.plugin

@@ -17,7 +17,7 @@ TRAEFIK_NAMESPACE="traefik"
 
 addHelmRepo traefik https://helm.traefik.io/traefik
 
-[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="36"
+[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="37"
 helm upgrade --install traefik traefik/traefik \
              --namespace $TRAEFIK_NAMESPACE --create-namespace \
              --values  traefik/values.yaml \

package/src/helm-charts/valkey/helmup.plugin

@@ -2,10 +2,10 @@
 
 showInstalling "Valkey"
 
-OCI_CHART="oci://registry-1.docker.io/bitnamicharts/valkey"
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/valkey"
 
-[ -z "$VALKEY_CHART_VERSION" ] && VALKEY_CHART_VERSION="2.2.4"
+[ -z "$VALKEY_CHART_VERSION" ] && VALKEY_CHART_VERSION="3.0.22"
 
-helm upgrade --install valkey $OCI_CHART       \
+helm upgrade --install valkey $OCI_CHART        \
              --values  valkey/valkey-local.yaml \
              --version $VALKEY_CHART_VERSION $HELM_WHAT

package/src/helm-charts/valkey/valkey-local.yaml

@@ -1,5 +1,11 @@
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/valkey
+# tag: 8.1.3-devian-12-r1
 
 global:
+  security:
+    allowInsecureImages: true
   storageClass: "ssd"
 
 architecture: replication
@@ -11,7 +17,7 @@ auth:
 primary:
   replicaCount: 1
 
-  resourcesPreset: "nano"
+  resourcesPreset: "small"
   resources:
     requests:
       cpu: 250m
@@ -77,6 +83,10 @@ sentinel:
 
 metrics:
   enabled: true
+  image:
+    registry: us-docker.pkg.dev
+    repository: leverege-registry/bitnami-mirror/images/redis-exporter
+#   tag: 1.74.0-debian-12-r2
   serviceMonitor:
     enabled: true
     namespace: "prometheus"

package/src/helm-charts/velero/helmup.plugin

@@ -7,7 +7,7 @@ addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
 [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="10"
 #
 # Build the bucket, region and SA email variables and use --set to mod the
-# chart values as opposed to using an OVH:<label> approach. This eliminates
+# chart values as opposed to using an ${label} approach. This eliminates
 # the need for an overwhelm generated values.yaml file which also contains
 # all of the contamination from the default-values.yaml file.
 #

package/src/helmup.sh

@@ -83,25 +83,6 @@ function isLeveregeService() {
   echo $answer
 }
 
-# audit trail via slack
-# support for legacy bitnami charts
-function addBitnamiRepo() {
-  if [ ! -z "$BITNAMI_LATEST" ] || [ "$1" == "latest" ];
-  then
-    BITNAMI_URL="https://charts.bitnami.com/bitnami"
-  else
-    cat<<CATNAMI
-    Using the pre 2022 legacy charts from bitnami. To use latest run:
-
-        `color y "BITNAMI_LATEST=1 $HELMUP_ARGS"`
-
-CATNAMI
-    BITNAMI_URL="https://raw.githubusercontent.com/bitnami/charts/eb5f9a9513d987b519f0ecd732e7031241c50328/bitnami"
-  fi
-
-  addHelmRepo bitnami $BITNAMI_URL
-}
-
 # Accepts 3 paramaters - 1 mandatory.
 #   bindWorkloadIdentity <Service Account> <Namespace> <Target Service Account>
 # where:
@@ -265,6 +246,34 @@ SERVICE_BOOTSTRAP
   ifPluggedIn $SERVICE
 }
 
+# some initial installs may be performed from the local setups in the
+# build-tools helm-charts directory
+function ifCanBootstrap() {
+  local bootstrap_targets=(
+    argocd
+    cnpg-operator
+    cnpg-db-psql-stack
+    cnpg-db-tsdb-basic
+    elasticsearch8
+    pgbouncer
+    prom-operator
+    redis
+    valkey
+    traefik
+    traefik-canary
+    velero
+  )
+  local svc_name="$1"
+
+  if [[ " ${bootstrap_targets[*]} " == *" $svc_name "* ]];
+  then
+    bootstrapLocalSetup $svc_name
+    return 0
+  else
+    return 1
+  fi
+}
+
 function installDefaultConfigs() {
   showInstalling "Default Configs"
 
@@ -584,6 +593,9 @@ CATBACKUP
     # If we're referencing a plugin then execute it and continue
     ifPluggedIn $SERVICE && continue
 
+    # If we can bootstrap a service on a new setup
+    ifCanBootstrap $SERVICE && continue
+
     case "$SERVICE" in
       "platform")
         doPlatormPreInstallChecks
@@ -594,18 +606,6 @@ CATBACKUP
         doInstall "${SYSTEM[@]}"
         ;;
 
-      "argocd")
-        bootstrapLocalSetup $SERVICE
-        ;;
-
-      cnpg-db-*)
-        bootstrapLocalSetup $SERVICE
-        ;;
-
-      "cnpg-operator")
-        bootstrapLocalSetup $SERVICE
-        ;;
-
       "cronZombieKiller"|"zombie-killer")
         installCronZombieKiller # eradicate the gke 1.20+ zombies
         ;;
@@ -614,10 +614,6 @@ CATBACKUP
         installDefaultConfigs
         ;;
 
-      "elasticsearch8")
-        bootstrapLocalSetup $SERVICE
-        ;;
-
       "estafette"|"preemptible-killer")
         installPreemptibleKiller # the gke preemptible node spreader outer
         ;;
@@ -626,18 +622,6 @@ CATBACKUP
         setupStackBuckets && exit 0
         ;;
 
-      "pgbouncer")
-        bootstrapLocalSetup $SERVICE
-        ;;
-
-      "prom-operator")
-        bootstrapLocalSetup $SERVICE
-        ;;
-
-      "redis"|"valkey")
-        bootstrapLocalSetup $SERVICE
-        ;;
-
       "reflector")
         showInstalling "Secrets/ConfigMap Namespace Reflector"
         addHelmRepo emberstack https://emberstack.github.io/helm-charts
@@ -658,22 +642,7 @@ CATBACKUP
         HELMUP="helm upgrade --install $SERVICE leverege/transponder --values $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
         doHelmup "$HELMUP"
         ;;
-
-      "traefik")
-        # installTraefikEnvironment
-        bootstrapLocalSetup $SERVICE
-        ;;
-
-      "traefik-canary")
-        # only valid if traefik is already installed
-        bootstrapLocalSetup $SERVICE
-        ;;
-
-      "velero")
-        # installVeleroEnvironment
-        bootstrapLocalSetup $SERVICE
-        ;;
-
+        
       *)
         # if the service dir is missing then check to see if it's a platform
         # service and if it is then try to bootstrap from charts in build-tools
@@ -750,7 +719,7 @@ NOTRUNNING
 }
 
 # ---------- helmup MAIN ----------
-GITTOP=`git rev-parse --show-toplevel` # `&& cd $GITTOP
+GITTOP=`git rev-parse --show-toplevel`
 K8S_UTILS="${GITTOP}/k8s-utils"
 
 overwhelm
@@ -764,5 +733,3 @@ GCE_REGION=`overwhelm -k GCE_REGION`
 doInstall $@
 
 displayBanner
-
-cd - &> $DEVNULL

package/src/k8x.sh

@@ -47,6 +47,10 @@ K8X_HELP
     FZFQ="--query=grafana" && ns="prometheus" && cmd="bash"
     ;;
 
+  "grafold")
+    FZFQ="--query=grafana" && ns="monitoring" && cmd="bash"
+    ;;
+
   "prom-operator"|"prometheus")
     ns="prometheus" && cmd="bash"
     ;;

package/src/overwhelm.mjs

@@ -79,7 +79,7 @@ if ( !fs.existsSync( 'overwhelm.yaml' ) ) {
   process.exit( 1 )
 }
 
-if ( !args.key && fs.existsSync( 'values-default.yaml' ) ) {
+if ( !args.key && !args.fetchctx && !args.matchk8s && fs.existsSync( 'values-default.yaml' ) ) {
   log( chalk.red.bold( `
 
 ***ERROR overwhelm => values-default.yaml is no longer used/supported and will