@leverege/build-tools 2.86.2 → 2.87.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.86.2",
+  "version": "2.87.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -77,14 +77,14 @@
     "ignore": "^7.0.5",
     "inquirer": "^12.9.6",
     "js-yaml": "^4.1.0",
-    "jsdoc": "^4.0.4",
+    "jsdoc": "^4.0.5",
     "ms": "^2.1.3",
     "npm-registry-fetch": "^19.0.0",
     "ora": "^9.0.0",
     "p-limit": "^7.1.1",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
-    "semver": "^7.7.2",
+    "semver": "^7.7.3",
     "shell-quote": "^1.8.3",
     "simple-git": "^3.28.0",
     "sloc": "^0.3.2",

package/src/bash-funcs

@@ -150,6 +150,55 @@ REPOADD
   helm repo update &> $DEVNULL
 }
 
+# waitForSA SVC_ACCT PROJECT [TIMEOUT_SECONDS]
+function waitForSA() {
+  local svcAcct="$1" project="$2" timeout="${3:-120}"
+  local svcAcctEmail="$svcAcct@$project.iam.gserviceaccount.com"
+  local start=$(date +%s) delay=2
+
+  echo "⏳ waiting for SA ${svcAcct} in project ${project} (timeout ${timeout}s)..." >&2
+  while true; do
+    if gcloud iam service-accounts describe "$svcAcctEmail" --project "$project" &> "$DEVNULL";
+    then
+      echo "✅ SA is visible: ${svcAcct}" >&2
+      return 0
+    fi
+    if (( $(date +%s) - start >= timeout ));
+    then
+      echo "❌ timed out waiting for SA ${svcAcct}" >&2
+      return 1
+    fi
+    sleep "$delay"; (( delay = delay < 20 ? delay * 2 : 20 ))
+  done
+}
+
+# waitForIAM SVC_ACCT PROJECT ROLE [TIMEOUT_SECONDS]
+# Example MEMBER: "serviceAccount:my-sa@proj.iam.gserviceaccount.com"
+function waitForIAM() {
+  local svcAcct="$1" project="$2" role="$3" timeout="${4:-120}"
+  local svcAcctEmail="serviceAccount:${svcAcct}@${project}.iam.gserviceaccount.com"
+  local start=$(date +%s) delay=2
+
+  echo "⏳ waiting for IAM binding ${role} → ${svcAcct} on project ${project} (timeout ${timeout}s)..." >&2
+  while true; do
+    # If the binding exists, the formatted value will be non-empty.
+    local found
+    found="$(gcloud projects get-iam-policy "${project}" \
+              --flatten="bindings[].members" \
+              --filter="bindings.role=${role} AND bindings.members=${svcAcctEmail}" \
+              --format="value(bindings.role)" 2> "$DEVNULL")"
+    if [[ -n "$found" ]]; then
+      echo "✅ IAM binding active: ${role} → ${svcAcct}" >&2
+      return 0
+    fi
+    if (( $(date +%s) - start >= timeout )); then
+      echo "❌ timed out waiting for IAM binding ${role} → ${svcAcct}" >&2
+      return 1
+    fi
+    sleep "$delay"; (( delay = delay < 20 ? delay * 2 : 20 ))
+  done
+}
+
 # *** DEPRECATED *** REMOVE AFTER BITNAMI ERADICATED ***
 # *** DEPRECATED *** REMOVE AFTER BITNAMI ERADICATED ***
 # *** DEPRECATED *** REMOVE AFTER BITNAMI ERADICATED ***

package/src/custom-images/bitnami-audits/bitnami-audit.mjs

@@ -13,12 +13,9 @@ import {
   debug,
   log,  
   shellCmd,
-} from '../../Utils.mjs'
-const auditProjects = [
-  'leverege-cnpg-20240729',
-]
+} from '../Utils.mjs'
 
-const ALLauditProjects = [
+const auditProjects = [
   'dev-controltek',
   'dev-cox-health',
   'dev-pitcrew',
@@ -94,7 +91,6 @@ const filterBitnamiImages = ( project, imagesJSON ) => {
       let img = c.image
 
       // Only keep bitnami images
-      log( { img }, '<==IMAGE' )
       if ( !/bitnami/.test( img ) ) continue
 
       // Registry decluttering

package/src/helm-charts/api-server/values-local.yaml

@@ -5,7 +5,7 @@
 #     - node tools/UpdateESMappingV2.js
 #
 image:
-  tag: # v5.26.0
+  tag: # v5.26.10
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'

package/src/helm-charts/authz-server/values-local.yaml

@@ -4,7 +4,7 @@
 #     - npm run sequelizeRunMigrations
 #
 image:
-  tag: # v2.6.0
+  tag: # v2.6.1
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'

package/src/helm-charts/cnpg-operator/helmup.bootstrap

@@ -52,6 +52,7 @@ SKIP_CNPG_SA_CREATION
     --description "CNPG Operands SA" \
     --display-name "CNPG Operands SA" &> $DEVNULL
   warnOnError $? "the GCP SA `color y $CNPG_SVC_ACCT` may already exist"
+  waitForSA "$CNPG_SVC_ACCT" "$GCP_PROJECT_ID" 60
 
   CNPG_OPS_ROLE="cnpg.operands"
   printf "\nCreating the `color g $CNPG_OPS_ROLE` IAM role\n"
@@ -96,15 +97,19 @@ SKIP_CNPG_SA_CREATION
   printf "\nBinding IAM role to the SA `color g $CNPG_SVC_EMAIL`\n"
   gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
     --member="serviceAccount:$CNPG_SVC_EMAIL" \
-    --role "roles/storage.admin" &> $DEVNULL
+    --role "roles/storage.admin" \
+    --condition=None &> $DEVNULL
 #   --role projects/$GCP_PROJECT_ID/roles/$CNPG_OPS_ROLE &> $DEVNULL
 #   --role "roles/storage.admin" &> $DEVNULL
   warnOnError $? "gcloud problem binding IAM policy"
+  waitForIAM "$CNPG_SVC_ACCT" "$GCP_PROJECT_ID" "roles/storage.admin" 60
 
   printf "\nBinding IAM the Token Creator role to the SA `color g $CNPG_SVC_EMAIL`\n"
   gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
     --member="serviceAccount:$CNPG_SVC_EMAIL" \
-    --role="roles/iam.serviceAccountTokenCreator"
+    --role="roles/iam.serviceAccountTokenCreator" \
+    --condition=None
+  waitForIAM "$CNPG_SVC_ACCT" "$GCP_PROJECT_ID" "roles/iam.serviceAccountTokenCreator" 60
 
   # workload binding will be performed by each cnpg operand on startup
 
@@ -180,11 +185,14 @@ CNPG_FETCH_CLEANUP_CRONJOB_YAML
     --description="Used for cronjob cleanup with Workload Identity" \
     --display-name="CNPG Cleanup SA" &> $DEVNULL
     warnOnError $? "the GCP SA $CNPG_CLEANUP_SA may already exist"
+  waitForSA "$CNPG_CLEANUP_SA" "$GCP_PROJECT_ID" 60
 
   gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
     --project="$GCP_PROJECT_ID" \
     --member="serviceAccount:$CNPG_CLEANUP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
-    --role="roles/storage.objectViewer"
+    --role="roles/storage.objectViewer" \
+    --condition=None
+  waitForIAM "$CNPG_CLEANUP_SA" "$GCP_PROJECT_ID" "roles/storage.objectViewer" 60
 
   bindWorkloadIdentity "$CNPG_CLEANUP_SA" "$CNPG_NAMESPACE"
 
@@ -198,4 +206,4 @@ CNPG_CLEANUP_CRONJOB_APPLY
 }
 # Run it!
 installCnpgOperatorEnvironment
-installCnpgCleanupCronjob
+installCnpgCleanupCronjob

package/src/helm-charts/db-curator/values-local.yaml

@@ -1,5 +1,5 @@
 image:
-  tag: # v6.0.0
+  tag: # v6.2.0
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'

package/src/helm-charts/elasticsearch8/elasticsearch-local-dev.yaml

@@ -15,6 +15,13 @@ image:
   repository: leverege-registry/bitnami-mirror/images/elasticsearch
 # tag: 8.18.0
 
+sysctlImage:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/os-shell
+volumePermissions:
+  image:
+    repository: leverege-registry/bitnami-mirror/images/os-shell
+
 global:
   security:
     allowInsecureImages: true

package/src/helm-charts/elasticsearch8/elasticsearch-local-prd.yaml

@@ -15,6 +15,13 @@ image:
   repository: leverege-registry/bitnami-mirror/images/elasticsearch
 # tag: 8.18.0
 
+sysctlImage:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/os-shell
+volumePermissions:
+  image:
+    repository: leverege-registry/bitnami-mirror/images/os-shell
+
 global:
   security:
     allowInsecureImages: true

package/src/helm-charts/fota-server/values-local.yaml

@@ -1,5 +1,5 @@
 image:
-  tag: # v2.1.3
+  tag: # v2.1.4
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'

package/src/helm-charts/prom-operator/helmup.bootstrap

@@ -32,12 +32,14 @@ function installStackdriverExporterEnvironment() {
     --project "$GCP_PROJECT_ID" \
     --display-name "Prometheus Stackdriver Exporter" &> $DEVNULL
   warnOnError $? "the GCP SA $SDEXP_SA may already exist"
+  waitForSA "$SDEXP_SA" "$GCP_PROJECT_ID" 60
 
   printf "\n*** Binding IAM role of $SDEXP_NS viewer to $SDEXP_SA in $GCP_PROJECT_ID\n"
   gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
     --role "roles/monitoring.viewer" \
-    --member "serviceAccount:$SDEXP_EM" &> $DEVNULL
-  sleep 2 # give the IAM binding a chance to complete before moving on
+    --member "serviceAccount:$SDEXP_EM" \
+    --condition=None --quiet &> $DEVNULL
+  waitForIAM "$SDEXP_SA" "$GCP_PROJECT_ID" "roles/monitoring.viewer" 60
 
   bindWorkloadIdentity $SDEXP_SA $SDEXP_NS
 

package/src/helm-charts/prom-operator/helmup.plugin

@@ -6,7 +6,7 @@ addHelmRepo prometheus-community https://prometheus-community.github.io/helm-cha
 NS="--namespace prometheus"
 
 showInstalling "The Prometheus Operator (kube-prometheus-stack)"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="75"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="77"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 helm upgrade $NS --install prometheus-stack prometheus-community/kube-prometheus-stack \

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -1,4 +1,51 @@
-enabled: true
+crds:
+  # ─────────────────────────────────────────────────────────────────────────────
+  # CRD MANAGEMENT — kube-prometheus-stack
+  #
+  # Why this exists
+  #   Helm can install CustomResourceDefinitions (CRDs) but will not upgrade them
+  #   when you bump chart versions. This chart ships a CRD upgrade job that uses
+  #   server-side apply (SSA) to reconcile CRDs to the versions bundled with the
+  #   chart.
+  #
+  # Safe operating model
+  #   ✅ Leave the upgrade job ENABLED if this chart is the sole owner of the
+  #      Prometheus Operator CRDs.
+  #   ⚠️  Keep "forceConflicts" DISABLED unless you hit a specific field-manager
+  #      conflict that you’ve reviewed and want this chart to own.
+  #   ❌ If another source manages CRDs (e.g., a separate CRD chart, GitOps
+  #      bootstrap, platform repo), DISABLE the job to avoid ownership fights.
+  #
+  # Settings
+  #   enabled:        runs the SSA job on chart upgrade to reconcile CRDs.
+  #                   Recommended: true if chart owns the CRDs; false if
+  #                   another tool owns them.
+  #
+  #   forceConflicts: adds `--force-conflicts` to SSA, overriding fields owned by
+  #                   another controller. Use only for a one-time conflict
+  #                   resolution. Can overwrite annotations and mask real
+  #                   incompatibilities if left true.
+  #
+  # Recommended defaults
+  #   enabled: true
+  #   forceConflicts: false
+  #
+  # Mini-runbook
+  #   1) Preflight:
+  #      kubectl get crd | grep monitoring.coreos.com
+  #      kubectl apply --server-side --dry-run=server -f <crd-dir/>
+  #   2) Upgrade with enabled: true, forceConflicts: false.
+  #   3) If job fails with conflicts:
+  #        - confirm no other source manages these CRDs
+  #        - temporarily set forceConflicts: true for this upgrade only
+  #        - revert to false afterwards
+  #   4) Post-check: CRDs Established, operator healthy, alerts/rules normal
+  # ─────────────────────────────────────────────────────────────────────────────
+  enabled: true
+  upgradeJob:
+    enabled: true
+    forceConflicts: false # See README-CRD-UPGRADES.md
+
 kubeControllerManager:
   enabled: false
 nodeExporter:
@@ -31,6 +78,16 @@ defaultRules:
     prometheus: false
     prometheusOperator: false
 
+# default is using kube-dns which is usually sufficient for our needs but
+# can be switched over to CoreDNS if the need arises
+coreDns:
+  enabled: false
+
+# managed GKE does not provide direct access to the k8s scheduler so we
+# can safely disable this here - see the Stackdrive Monitoring for more
+kubeScheduler:
+  enabled: false
+
 prometheus:
   prometheusSpec:
 #   image:
@@ -53,16 +110,6 @@ prometheus:
             requests:
               storage: 50Gi  # Adjust size as needed
 
-# default is using kube-dns which is usually sufficient for our needs but
-# can be switched over to CoreDNS if the need arises
-coreDns:
-  enabled: false
-
-# managed GKE does not provide direct access to the k8s scheduler so we
-# can safely disable this here - see the Stackdrive Monitoring for more
-kubeScheduler:
-  enabled: false
-
 grafana:
   enabled: true
   service:

package/src/helm-charts/resource-server/values-local.yaml

@@ -5,7 +5,7 @@
 #     - npm run sequelizeRunMigrations
 #
 image:
-  tag: # v1.16.0
+  tag: # v1.21.0
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'

package/src/helm-charts/rule-engine/values-local.yaml

@@ -1,5 +1,5 @@
 image:
-  tag: # v3.7.1
+  tag: # v3.7.4
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'

package/src/helm-charts/traefik/values-local.yaml

@@ -32,36 +32,16 @@ metrics:
       interval: 30s
       namespace: prometheus
 
-# To enable the trafik dashboard uncomment the --api-secure switch, uncomment
-# the ports statment and the first block that defines the traefik port at 9000.
-# Redploy traefik and once it is stable port-forward:
-#   kubectl port-forward -n traefik deployment/traefik 9000:9000
-# and open the dashboard on a browser:
-#   http://localhost:9000/dashboard/
-# For more info:
-#   https://doc.traefik.io/traefik/operations/api/
+# Enable the traefik dashboard by enabling api.insecure.
+# For more info => https://doc.traefik.io/traefik/operations/api/
+# Dashboard URL => http://localhost:8080/dashboard/
 #
 additionalArguments:
-# - "--api.insecure=true" # uncomment for dashboard
+  - "--api.insecure=true" # uncomment for dashboard
 
   # enable read response timeouts
 # - "--entrypoints.web.transport.respondingTimeouts.readTimeout=300"
 
-# Custom entry points may be added here - the first one is for the traefik
-# dashboard (see comment above)two are port definitions
-# for both unsecured and secured MQTT ports used by connect. Note that the
-# mqtts port has TLS termination performed by traefik and both ports are then
-# forwarded to one open port (1883) on the target service. The vernemq service
-# chart provides the IngressRouteTCP chart to make this happen.
-#
-#ports:
-#  traefik: # dashboard access!
-#    port: 9000
-#    expose:
-#      default: true
-#    eposedPort: 9000
-#    protocol: TCP
-#
 # These port definitions are for both unsecured and secured MQTT ports used by
 # connect. Note that the mqtts port has TLS termination performed by traefik
 # and both ports are then forwarded to one open port (1883) on the target

package/src/helm-charts/transponder-bq/values-local.yaml

@@ -1,7 +1,7 @@
 nameOverride: transponder-bq
 
 image:
-  tag: # v5.6.1
+  tag: # v5.7.0
 
 config:
   TRANSPONDER_RUN_MODE: "bigQueryJson"

package/src/helm-charts/transponder-dh/values-local.yaml

@@ -1,7 +1,7 @@
 nameOverride: transponder-dh
 
 image:
-  tag: # v5.6.0
+  tag: # v5.7.0
 
 config:
   TRANSPONDER_RUN_MODE: "denseHistoryCombined"

package/src/helm-charts/transponder-rt/values-local.yaml

@@ -1,7 +1,7 @@
 nameOverride: transponder-rt
 
 image:
-  tag: # v5.6.1
+  tag: # v5.7.0
 
 config:
   TRANSPONDER_RUN_MODE: "rt"

package/src/helm-charts/transponder-tsdb/values-local.yaml

@@ -7,7 +7,7 @@
 nameOverride: transponder-tsdb
 
 image:
-  tag: # v5.6.0
+  tag: # v5.7.0
 
 config:
   TRANSPONDER_RUN_MODE: "timescale"

package/src/helm-charts/velero/helmup.bootstrap

@@ -10,7 +10,7 @@ function installVeleroEnvironment() {
   gcloud config set project $GCP_PROJECT_ID
 
   ## The major chart version will determine the bucket suffix
-  [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="10"
+  [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="11"
 
   ## Create a bucket
   BUCKET="$GCP_PROJECT_ID-velero-$VELERO_CHART_VERSION"
@@ -27,8 +27,8 @@ function installVeleroEnvironment() {
     --description "Velero service account" &> $DEVNULL
   if [ $? -eq 0 ];
   then
-    # no error means a new SA was created - slight delay to let it update
-    sleep 2
+    # no error means a new SA was created - wait for it to become active
+    waitForSA "velero" "$GCP_PROJECT_ID" 60
   else
     printf "$YELO_WARN Failed to create the service account - does it already exist?"
   fi
@@ -77,6 +77,7 @@ function installVeleroEnvironment() {
     --condition 'None' \
     --role projects/$GCP_PROJECT_ID/roles/velero.server &> $DEVNULL
   warnOnError $? "gcloud problem binding IAM policy"
+  waitForIAM "velero" "$GCP_PROJECT_ID" "projects/$GCP_PROJECT_ID/roles/velero.server" 60
 
   printf "\nBinding workload identity IAM policy to the SA\n"
   gcloud iam service-accounts add-iam-policy-binding \

package/src/helm-charts/velero/helmup.plugin

@@ -4,7 +4,7 @@ showInstalling "Velero Backup System"
 
 addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
 
-[ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="10"
+[ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="11"
 #
 # Build the bucket, region and SA email variables and use --set to mod the
 # chart values as opposed to using an ${label} approach. This eliminates