@leverege/build-tools 2.96.8 → 2.97.0

package/src/helm-charts/cnpg-operator/helmup.plugin

@@ -2,12 +2,37 @@
 #
 # See => https://cloudnative-pg.io/documentation/current/installation_upgrade/
 #
-OPVER="1.26.1" # 07/29/2025
-
-createNamespaceIfNeeded cnpg-system
+OPVER="1.26.1"      # 10/08/2025
+BARMAN_VER="0.11.0"
 
+# --- CNPG operator ---
 kubectl apply --server-side -f \
-    https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${OPVER%.*}/releases/cnpg-${OPVER}.yaml $K8S_WHAT
+  "https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${OPVER%.*}/releases/cnpg-${OPVER}.yaml" \
+  ${K8S_WHAT:-}
+
+kubectl rollout status deployment -n cnpg-system cnpg-controller-manager
+
+# --- barman plugin ---
+kubectl apply -f \
+  "https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v${BARMAN_VER}/manifest.yaml"
+
+kubectl rollout status deployment -n cnpg-system barman-cloud
+
+cat<<BARMAN_OBJECT_STORE | kubectl apply -f -
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: cnpg-stack-gcs
+  namespace: cnpg-operands
+spec:
+  configuration:
+    destinationPath: gs://${GCP_PROJECT_ID}-barman
+    googleCredentials:
+      gkeEnvironment: true
+    wal:
+      compression: gzip
+      maxParallel: 4
+BARMAN_OBJECT_STORE
 
 # NOTE: installing release candidates may reference something that looks like:
 #

package/src/helm-charts/db-curator/values-local.yaml

@@ -4,4 +4,12 @@ image:
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
   FIREBASE_CLEANUP_ENABLED: "true"
-  TSDB_CLEANUP_ENABLED: "false"
+  TSDB_CLEANUP_ENABLED: "false" # no need on cnpg
+
+resources:
+  limits:
+    cpu: 1500m
+    memory: 4Gi
+  requests:
+    cpu: 250m
+    memory: 1Gi

package/src/helm-charts/elasticsearch8/elasticsearch-local.yaml

@@ -30,13 +30,31 @@ global:
 fullnameOverride: "elasticsearch8"
 namespaceOverride: "elastic"
 
-coordinating:
-  replicaCount: 3
-# resources: # default from bitnami chart
-#   limits: {}
-#   requests:
-#     cpu: 25m
-#     memory: 256Mi
+# This initScript is used for modifying the log settings of the ES pods. The
+# default setting logs at trace with 64M log files via this line in th JVM
+# options file:
+#
+# -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,level,pid,tags:filecount=32,filesize=64m
+#
+# The two sed commands will morph the log settings to disable trace and reduce
+# the number and size of logs kept by a pod. These settings apply to all ES
+# node flavors (data,coord,ingest,master).
+#
+initScripts:
+  01-fix-gc-logging.sh: |
+    #!/bin/bash
+    set -euo pipefail
+    JVM="/opt/bitnami/elasticsearch/config/jvm.options"
+    if [ -w "$JVM" ]; then
+      # remove the noisy trace age logging, keep rotation
+      sed -i 's/gc+age=trace,//' "$JVM"
+      # optionally reduce retention
+      sed -i 's/filecount=32,filesize=64m/filecount=8,filesize=32m/' "$JVM"
+    fi
+
+# Lets set affinityt/tolerations in one spot with a YAML anchor
+#
+x-esSchduling: &esScheduling
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
@@ -44,15 +62,30 @@ coordinating:
         - matchExpressions:
           - key: target-env
             operator: In
-            values:
-            - database
+            values: ["database"]
   tolerations:
   - key: "database"
     operator: "Equal"
     value: "true"
     effect: "NoSchedule"
 
+# coord nodes needed a heapSize and memory boost
+coordinating:
+  <<: *esScheduling
+  replicaCount: 3
+  heapSize: 384m
+  resources:
+    limits:
+      cpu: 750m
+      memory: 2Gi
+      ephemeral-storage: 2Gi
+    requests:
+      cpu: 500m
+      memory: 512Mi
+      ephemeral-storage: 50Mi
+
 data:
+  <<: *esScheduling
   replicaCount: 3
   resources:
     limits:
@@ -66,40 +99,24 @@ data:
   persistence:
     enabled: true
     size: 64Gi
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: target-env
-            operator: In
-            values:
-            - database
-  tolerations:
-  - key: "database"
-    operator: "Equal"
-    value: "true"
-    effect: "NoSchedule"
 
 ingest:
+  <<: *esScheduling
   replicaCount: 3
+  #resourcesPreset: "medium"
+  resources:
+    limits:
+      cpu: 750m
+      ephemeral-storage: 4Gi
+      memory: 1536Mi
+    requests:
+      cpu: 500m
+      ephemeral-storage: 100Mi
+      memory: 1024Mi
   # no default resources specified
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: target-env
-            operator: In
-            values:
-            - database
-  tolerations:
-  - key: "database"
-    operator: "Equal"
-    value: "true"
-    effect: "NoSchedule"
 
 master:
+  <<: *esScheduling
   replicaCount: 3
 # resources: # example from the bitnami chart
 #   ## Example:
@@ -112,17 +129,3 @@ master:
 #   ##    cpu: 250m
 #   ##    memory: 256Mi
 #   requests: {}
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: target-env
-            operator: In
-            values:
-            - database
-  tolerations:
-  - key: "database"
-    operator: "Equal"
-    value: "true"
-    effect: "NoSchedule"

package/src/helm-charts/emailer/values-local.yaml

@@ -1,5 +1,8 @@
 image:
-  tag: # v5.1.0
+  tag:
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
+
+  # necessary to expand the overwhelm.yaml setting into the env
+  MAIL_GUN_DOMAIN: "${MAIL_GUN_DOMAIN}"

package/src/helm-charts/messenger/values-local.yaml

@@ -1,9 +1,5 @@
 image:
- tag: # v2.16.0
+  tag:
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
-  API_UI_URL: "${PROJECT_ID}.web.app"
-
-serviceMonitor:
-  enabled: true

package/src/helm-charts/pgbouncer/values-local.yaml

@@ -1,6 +1,6 @@
 # pgbouncer.values.yaml - https://artifacthub.io/packages/helm/icoretech/pgbouncer
 
-replicaCount: 1
+replicaCount: 2
 
 config:
   existingAdminSecret: "pgbouncer-admin"
@@ -23,16 +23,21 @@ config:
     log_disconnections: "0"
     verbose: "0"
   databases:
-    scheduler:
+    authz:
       host: postgres-postgresql
       port: 5432
-      dbname: scheduler
+      dbname: authz
       user: postgres
     models:
       host: postgres-postgresql
       port: 5432
       dbname: models
       user: postgres
+    scheduler:
+      host: postgres-postgresql
+      port: 5432
+      dbname: scheduler
+      user: postgres
 
 service:
   port: 8432

package/src/helm-charts/prom-operator/helmup.bootstrap

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+# DEVNULL="/dev/stdout"
+
 # This function came from the helmup.sh script and is used to install the
 # stackdriver exporter in the prometheus or monitoring (legacy) namespace.
 # This function only needs to execute once, at initial setup / configuration.
@@ -7,7 +9,7 @@ function installStackdriverExporterEnvironment() {
   showInstalling "Stackdriver Exporter Service Account Binding"
 
   # Add necessary helm repositories - note that stable is deprecated
-  addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
+# addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
 
   local SDEXP_NS=${1:-prometheus}
   local SDEXP_SA="stackdriver-exporter"
@@ -17,10 +19,11 @@ function installStackdriverExporterEnvironment() {
 
   # guarantee any previous remnants of the exporter are gone
   printf "\n*** Removing the previous $SDEXP_SA installation...\n"
-  helm uninstall -n $SDEXP_NS $SDEXP_SA                 &> $DEVNULL
+  helm uninstall -n $SDEXP_NS "stackdriver-exporter"    &> $DEVNULL
   kubectl delete serviceaccounts -n $SDEXP_NS $SDEXP_SA &> $DEVNULL
-  printf "!!! Skipping deletion of the gcloud SA $SDEXP_EM\n"
-# gcloud --quiet iam service-accounts delete $SDEXP_EM  &> $DEVNULL
+  printf "*** Deleting the gcloud SA $SDEXP_EM\n"
+# gcloud --quiet iam service-accounts delete $SDEXP_EM  \
+#                            --project $GCP_PROJECT_ID  &> $DEVNULL
 
   # NOTE: The k8s SA != GCP SA - the former is created by the helm chart
   # that installs the stackdriver-exporter, the latter is handled here in
@@ -43,7 +46,7 @@ function installStackdriverExporterEnvironment() {
 
   bindWorkloadIdentity $SDEXP_SA $SDEXP_NS
 
-  removeHelmRepo prometheus-community
+# removeHelmRepo prometheus-community
 }
 
 installStackdriverExporterEnvironment

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="80.11.0"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="82.1.0"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -44,7 +44,7 @@ crds:
   enabled: true
   upgradeJob:
     enabled: true
-    forceConflicts: false # See README-CRD-UPGRADES.md
+    forceConflicts: true # See README-CRD-UPGRADES.md
 
 kubeControllerManager:
   enabled: false
@@ -216,6 +216,9 @@ alertmanager:
     type: Recreate
 
   config:
+    global:
+      resolve_timeout: 5m
+
     receivers:
       - name: slack
         slack_configs:
@@ -273,6 +276,7 @@ alertmanager:
               {{- end }}
               ---
               {{ end }}
+
       - name: slack-watchdog
         slack_configs:
           - channel: "#dead-mans-snitch_notifications"
@@ -287,6 +291,7 @@ alertmanager:
                 *Description:* {{ .Annotations.description }}
                 *Dashboard:* {{ .Annotations.dashboard }}
               {{ end }}
+
       - name: opsgenie
         opsgenie_configs:
           - api_key: "${OPSGENIE_APIKEY}"
@@ -298,27 +303,62 @@ alertmanager:
                 *Description:* {{ .Annotations.description }}
                 *Dashboard:* {{ .Annotations.dashboard }}
               {{ end }}
+
       - name: discard
 
+    inhibit_rules:
+      # Any warning/critical/page suppresses info in the same namespace
+      - source_matchers:
+          - severity=~"warning|critical|page"
+        target_matchers:
+          - severity="info"
+        equal:
+          - namespace
+
+      # critical/page suppresses warning for the same alert in the same namespace
+      - source_matchers:
+          - severity=~"critical|page"
+        target_matchers:
+          - severity="warning"
+        equal:
+          - namespace
+          - alertname
+
     route:
+      receiver: slack # default for everything
+      group_by: ["alertname", "namespace"]
       group_wait: 30s
       group_interval: 5m
-      group_by:
-        - alertname
-        - namespace
-      receiver: slack # default for everything
+      repeat_interval: 6h
+
       routes:
-        - matchers:
-            - severity="page" # 📢 paging DevOps
-          receiver: opsgenie
-          continue: true # 👈 KEEP GOING after this match
 
+        # ─────────────────────────────────────────────
+        # INTERNAL / MECHANISM ALERTS
+        # ─────────────────────────────────────────────
         - matchers:
-            - namespace=~"kube-system|gmp-system" # 🙈 ignore these alerts - GKE will handle them
+            - alertname="InfoInhibitor"
           receiver: discard
 
         - matchers:
             - alertname="Watchdog"
           receiver: slack-watchdog
 
-      repeat_interval: 6h
+        - matchers:
+            - severity="info"
+          receiver: discard
+
+        # ─────────────────────────────────────────────
+        # 🙈 IGNORE SYSTEM NAMESPACES - GKE will handle
+        # ─────────────────────────────────────────────
+        - matchers:
+            - namespace=~"kube-system|gmp-system"
+          receiver: discard
+
+        # ─────────────────────────────────────────────
+        # PAGE-LEVEL ALERTS
+        # ─────────────────────────────────────────────
+        - matchers:
+            - severity="page" # 📢 paging DevOps
+          receiver: opsgenie
+          continue: true # 👈 KEEP GOING to slack

package/src/helm-charts/prom-operator/rules/elasticsearch-rules.yaml

@@ -203,7 +203,7 @@ spec:
                 VALUE = {{ $value }}
                 LABELS = {{ $labels }}
         - alert: ElasticsearchHighQueryRate
-          expr: sum(rate(elasticsearch_indices_search_query_total[1m])) > 100
+          expr: sum(rate(elasticsearch_indices_search_query_total[1m])) > 150
           for: 5m
           labels:
             severity: warning

package/src/helm-charts/prom-operator/rules/kubestate-rules.yaml

@@ -43,7 +43,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: KubernetesNodeNetworkUnavailable
           expr: kube_node_status_condition{condition="NetworkUnavailable",status="true"} == 1
-          for: 5m # awesome was => 2m
+          for: 10m # awesome was => 2m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/push-notifier/values-local.yaml

@@ -0,0 +1,8 @@
+image:
+  tag:
+
+config:
+  LOG_CONFIG: '{"type":"pino","level":"debug"}'
+
+serviceMonitor:
+  enabled: true

package/src/helm-charts/redis/values-local.yaml

@@ -42,6 +42,8 @@ master:
 #     cpu: 250m
 #     memory: 500Mi
 
+architecture: standalone # replication or standalone
+
 replica:
   replicaCount: 1
   affinity:
@@ -69,7 +71,6 @@ replica:
 #   requests:
 #     cpu: 250m
 #     memory: 500Mi
-architecture: replication
 
 sentinel:
   enabled: false

package/src/helm-charts/traefik/values-local.yaml

@@ -28,7 +28,7 @@ resources:
 metrics:
   prometheus:
     serviceMonitor:
-      enabled: false # initially disabled until prometheus operator is installed
+      enabled: true # initially disabled until prometheus operator is installed
       interval: 30s
       namespace: prometheus
 

package/src/helm-charts/transponder-dh/values-local.yaml

@@ -12,6 +12,7 @@ config:
 
   PG_HOST: "cnpg-db-tsdb-dense-rw.cnpg-operands"
 # PG_HOST: "cnpg-db-tsdb-dense-pool-rw.cnpg-operands"
+# PG_DATABASE: "timescale" # "imagine" is legacy and default
 
   # password from secret
   PG_PASSWORD_SECRET: "cnpg-db-tsdb-dense-postgres-pw"

package/src/helm-charts/transponder-tsdb/values-local.yaml

@@ -15,6 +15,7 @@ config:
 
 # CNPG override
   PG_HOST: "cnpg-db-tsdb-basic-rw.cnpg-operands"
+# PG_DATABASE: "timescale" # "imagine" is legacy and default
 
   PG_PASSWORD_SECRET: "cnpg-db-tsdb-basic-postgres-pw"
   PG_PASSWORD_KEY: "password"

package/src/helm-charts/velero/helmup.plugin

@@ -5,8 +5,8 @@ showInstalling "Velero Backup System"
 # We use a specific version for the velero chart because we need to control
 # the version of the locally installed velero client application.
 #
-VELERO_CHART_VERSION="11.3.1"
-EXPECTED_CLIENT_VERSION="v1.17.1"
+VELERO_CHART_VERSION="11.3.2"
+EXPECTED_CLIENT_VERSION="v1.17.2"
 
 addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
 

package/src/helm-charts/velero/values-local.yaml

@@ -2,6 +2,7 @@
 # Backup schedules to create.
 #
 schedules:
+  # CNPG base clusters
   cnpg-psql:
     disabled: true
     schedule: "0 7 * * *"
@@ -35,6 +36,7 @@ schedules:
           cnpg.io/cluster: "cnpg-db-tsdb-dense"
           cnpg.io/instanceRole: "primary"
 
+  # Legacy PSQL databases
   psql: # legacy non-cnpg
     disabled: false
     schedule: "0 7 * * *"
@@ -47,6 +49,17 @@ schedules:
           app.kubernetes.io/name: "postgresql"
           role: "primary"
 
+  tsdb: # legacy non-cnpg
+    disabled: false
+    schedule: "0 8 * * *"
+    template:
+      ttl: "720h"
+      snapshotVolumes: true
+      labelSelector:
+        matchLabels:
+          release: "timescale-db"
+          app: "postgresql"
+
   psql-scheduler: # legacy non-cnpg
     disabled: true # enable on recovr
     schedule: "0 7 * * *"
@@ -69,17 +82,6 @@ schedules:
         matchLabels:
           app.kubernetes.io/name: elasticsearch
 
-  tsdb: # legacy non-cnpg
-    disabled: false
-    schedule: "0 8 * * *"
-    template:
-      ttl: "720h"
-      snapshotVolumes: true
-      labelSelector:
-        matchLabels:
-          release: "timescale-db"
-          app: "postgresql"
-
   full:
     disabled: false
     schedule: "0 11 * * *"
@@ -102,12 +104,12 @@ schedules:
 # Resource requests/limits to specify for the Velero deployment.
 # https://velero.io/docs/v1.6/customize-installation/#customize-resource-requests-and-limits
 resources:
-  requests:
-    cpu: 250m
-    memory: 128Mi
   limits:
-    cpu: 750m
+    cpu: 900m
     memory: 256Mi
+  requests:
+    cpu: 500m
+    memory: 128Mi
 
 # Annotations to add to the Velero deployment's. Optional.
 #

package/src/helmdn.sh

@@ -65,7 +65,7 @@ function annihilateMonitoring() {
   # gcloud iam service-accounts delete stackdriver-exporter@${GCP_PROJECT_ID}.iam.gserviceaccount.com --quiet
 
   # kube-state-metrics?
-  helm uninstall -n monitoring grafana prometheus stackdriver-exporter elasticsearch-exporter
+  helm uninstall -n monitoring grafana prometheus stackdriver-exporter elasticsearch-exporter elasticsearch8-exporter
 # helm ls --all-namespaces
 }
 

package/src/helmup.sh

@@ -586,6 +586,7 @@ SERVICE=
 CHARTLOC=
 CHARTVER=
 FROM_VERSIONS=
+
 function doInstall() {
 
   helm repo update &> $DEVNULL
@@ -758,15 +759,14 @@ NOTRUNNING
 
 # ---------- helmup MAIN ----------
 GITTOP=`git rev-parse --show-toplevel`
-K8S_UTILS="${GITTOP}/k8s-utils"
 
 overwhelm
 [ $? -ne 0 ] && printf "\n\n***Aborting helmup...\n\n" && exit 1
 
 # The project id is used in a lot of places so just set it here
-GCP_PROJECT_ID="$(getProjectIdFromK8sContext)"
+export GCP_PROJECT_ID="$(getProjectIdFromK8sContext)"
 # Same for the region, but not as prevalent
-GCE_REGION=`overwhelm -k GCE_REGION`
+export GCE_REGION=`overwhelm -k GCE_REGION`
 
 doInstall $@
 

package/src/init-my-chart/Chartwright.mjs

@@ -0,0 +1,69 @@
+// Chartwright.mjs
+import * as Utils from '../Utils.mjs'
+
+import {
+  BUILD_TOOLS_ROOT,
+} from '../Utils.mjs'
+
+const DEFAULT_LIVENESS = {
+  httpGet : {
+    path : '/livenessProbe',
+    port : 'http'
+  },
+  initialDelaySeconds : 30,
+  periodSeconds : 60
+} 
+const DEFAULT_READINESS = {
+  httpGet : {
+    path : '/healthz',
+    port : 'http'
+  },
+  initialDelaySeconds : 30,
+  periodSeconds : 10
+}
+
+export class Chartwright {
+  constructor( { cwd = process.cwd(), debug = false } = {} ) {
+    this.cwd = cwd
+    this.chartTemplate = `${BUILD_TOOLS_ROOT}/init-my-chart/leaf-chart-templates`
+    this.debug = debug
+
+    this.pkg = null
+    this.existingChart = null
+  }
+
+  async init() {
+    this.pkg = await Utils.parsePackageJson( { cwd : this.cwd } )
+    this.existingChart = await Utils.parseHelmChart( )
+    return this
+  }
+
+  analyze() {
+    return {
+      serviceName : this.pkg?.name,
+      hasExistingChart : !!this.existingChart,
+      templateLoaded : !!this.templateChart
+    }
+  }
+
+  bootstrap() {
+    // TODO: create new chart from template
+  }
+
+  morph() {
+    // TODO: transform existing chart to new base structure
+  }
+
+  async scribe() {
+    // TODO: write resulting chart to disk
+  }
+
+  dump() {
+    if ( !this.debug ) return
+    console.dir( {
+      pkg : this.pkg,
+      existingChart : this.existingChart,
+      templateChart : this.templateChart
+    }, { depth : 4 } )
+  }
+}