@leverege/build-tools 2.99.1 → 2.100.0

package/src/helm-charts/eso/helmup.bootstrap

@@ -0,0 +1,59 @@
+#!/bin/bash
+#
+# One-time bootstrap for the External Secrets Operator (ESO).
+# Creates the GCP SA, grants Secret Manager access, and binds workload identity
+# to the k8s SA that the ESO Helm chart creates ('external-secrets').
+#
+# See => https://external-secrets.io/latest/provider/google-secrets-manager/
+#
+function installEsoEnvironment() {
+  ESO_NAMESPACE="external-secrets"
+  ESO_SA="eso-sa"
+  ESO_SA_EMAIL="$ESO_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  gcloud config set project $GCP_PROJECT_ID
+
+  # Guard against accidental SA deletion on re-runs (see cnpg-operator for war story)
+  gcloud iam service-accounts describe $ESO_SA_EMAIL --project $GCP_PROJECT_ID &> $DEVNULL
+  if [ $? -eq 0 ];
+  then
+    cat<<SKIP_ESO_SA_CREATION
+
+  $YELO_WARN The ESO SA `color y $ESO_SA` already exists - skipping creation
+
+  To force a clean reinstall, delete both the GCP and k8s SAs for ESO and
+  re-run helmup eso.
+
+SKIP_ESO_SA_CREATION
+  else
+    printf "\nCreating the gcloud `color g $ESO_SA` service account\n"
+    gcloud iam service-accounts create $ESO_SA \
+      --project "$GCP_PROJECT_ID" \
+      --description "External Secrets Operator SA" \
+      --display-name "External Secrets Operator SA" &> $DEVNULL
+    exitOnError $? "Failed to create GCP SA `color y $ESO_SA`"
+    waitForSA "$ESO_SA" "$GCP_PROJECT_ID" 60
+  fi
+
+  printf "\nBinding Secret Manager accessor role to `color g $ESO_SA_EMAIL`\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --member="serviceAccount:$ESO_SA_EMAIL" \
+    --role="roles/secretmanager.secretAccessor" \
+    --condition=None &> $DEVNULL
+  warnOnError $? "gcloud problem binding IAM policy"
+  waitForIAM "$ESO_SA" "$GCP_PROJECT_ID" "roles/secretmanager.secretAccessor" 60
+
+  # The ESO chart creates a k8s SA named 'external-secrets' (not $ESO_SA), so we
+  # bind workload identity manually here rather than using bindWorkloadIdentity
+  # which assumes the k8s SA name matches the GCP SA name.
+  printf "\nBinding workload identity: `color g $GCP_PROJECT_ID.svc.id.goog[$ESO_NAMESPACE/external-secrets]`\n"
+  gcloud iam service-accounts add-iam-policy-binding \
+    --project $GCP_PROJECT_ID \
+    --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[$ESO_NAMESPACE/external-secrets]" \
+    --role roles/iam.workloadIdentityUser $ESO_SA_EMAIL
+  warnOnError $? "gcloud workload identity binding may have failed"
+
+  createNamespaceIfNeeded $ESO_NAMESPACE
+}
+
+installEsoEnvironment

package/src/helm-charts/eso/helmup.plugin

@@ -0,0 +1,34 @@
+#!/bin/bash
+#
+# See => https://external-secrets.io/latest/introduction/getting-started/
+#
+showInstalling "External Secrets Operator"
+
+ESO_VER="2.2.0"    # 03/2026
+ESO_NAMESPACE="external-secrets"
+ESO_SA="eso-sa"
+
+helm upgrade --install external-secrets \
+  oci://ghcr.io/external-secrets/charts/external-secrets \
+  --namespace $ESO_NAMESPACE \
+  --version $ESO_VER \
+  --set serviceAccount.annotations."iam\.gke\.io/gcp-service-account"="$ESO_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+  $HELM_WHAT
+
+kubectl rollout status deployment -n $ESO_NAMESPACE external-secrets
+kubectl rollout status deployment -n $ESO_NAMESPACE external-secrets-webhook
+kubectl rollout status deployment -n $ESO_NAMESPACE external-secrets-cert-controller
+
+# The ClusterSecretStore is a cluster-wide bridge to GCP Secret Manager.
+# Authentication is implicit via the workload identity binding established
+# in helmup.bootstrap - no credentials needed in the store spec itself.
+cat<<CLUSTER_SECRET_STORE | kubectl apply -f -
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: gcp-secret-manager
+spec:
+  provider:
+    gcpsm:
+      projectID: ${GCP_PROJECT_ID}
+CLUSTER_SECRET_STORE

package/src/helm-charts/prom-operator/expand-pvc.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+#
+# Expands the Prometheus PVC without data loss.
+# Pauses Prometheus, resizes the CRD + PVC, orphan-deletes the StatefulSet
+# (so the Operator recreates it), then unpauses.
+
+NAMESPACE="prometheus"
+CRD_NAME="prometheus-stack-kube-prom-prometheus"
+PVC_NAME="prometheus-prometheus-stack-kube-prom-prometheus-db-prometheus-prometheus-stack-kube-prom-prometheus-0"
+DISK_SIZE="96Gi"
+
+# Pause Prometheus
+kubectl patch prometheus "$CRD_NAME" -n "$NAMESPACE" \
+  --type merge -p '{"spec":{"paused":true}}'
+
+# Resize storage in the Prometheus CRD
+kubectl patch prometheus "$CRD_NAME" -n "$NAMESPACE" \
+  --type merge \
+  -p "{\"spec\":{\"storage\":{\"volumeClaimTemplate\":{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"$DISK_SIZE\"}}}}}}}"
+
+# Resize the underlying PVC
+kubectl patch pvc "$PVC_NAME" -n "$NAMESPACE" \
+  --type merge \
+  -p "{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"$DISK_SIZE\"}}}}"
+
+# Orphan-delete the StatefulSet so the Operator recreates it with the new size
+kubectl delete statefulset "prometheus-$CRD_NAME" -n "$NAMESPACE" --cascade=orphan
+
+# Unpause Prometheus
+kubectl patch prometheus "$CRD_NAME" -n "$NAMESPACE" \
+  --type merge \
+  -p '{"spec":{"paused":false}}'
+
+cat <<EOF
+
+PVC resize complete.
+
+Don't forget: update the storage size in prometheus-stack.yaml.ovh
+
+  (prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage)
+
+   retention: 30d
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 96Gi
+                       ^^^^
+                Adjust size as needed
+ 
+to match DISK_SIZE=$DISK_SIZE, then run helm upgrade to keep the release in sync.
+EOF

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="82.10.3"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="82.15.0"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -57,8 +57,9 @@ kubelet:
       # prober_probe_duration_seconds is high-cardinality (1 histogram per
       # container probe × node) and not referenced by any alerts or dashboards
       - sourceLabels: [__name__]
-        regex: prober_probe_duration_seconds.*
+        regex: prober_probe_duration_seconds.*|kubelet_runtime_operations_duration_seconds.*
         action: drop
+
 defaultRules:
   create: true
   rules:
@@ -118,7 +119,7 @@ prometheus:
           accessModes: ["ReadWriteOnce"]
           resources:
             requests:
-              storage: 64Gi  # Adjust size as needed
+              storage: 50Gi  # Adjust size as needed
 
 # External access to prometheus may be enabled by creating an htpasswd secret
 # by running this example command:
@@ -168,7 +169,7 @@ grafana:
   enabled: true
   service:
     port: 3000
-  # -- the grafana admin password
+  # -- the grafana admin password 1st time
   adminPassword: leverege-monitoring
   defaultDashboardsEnabled: false
   persistence:
@@ -179,6 +180,8 @@ grafana:
   sidecar:
       dashboards:
         enabled: true
+  env:
+    GF_SERVER_ROOT_URL: https://${PROJECT_NAME}-monitoring.${HOST}.com
   extraObjects:
     - apiVersion: traefik.io/v1alpha1
       kind: IngressRoute

package/src/helm-charts/prom-operator/rules/prometheus-rules.yaml

@@ -306,8 +306,8 @@ spec:
                 VALUE = {{ $value }}
                 LABELS = {{ $labels }}
         - alert: PrometheusTimeseriesCardinality
-          expr: label_replace(count by(__name__) ({__name__=~".+"}), "name", "$1", "__name__", "(.+)") > 10000
-          for: 0m
+          expr: label_replace(count by(__name__) ({__name__=~".+"}), "name", "$1", "__name__", "(.+)") > 15000
+          for: 10m
           labels:
             severity: warning
           annotations:

package/src/circle-orb/circle-orb.mjs

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-/* eslint-disable */ // for now, we can relax this rule since ...
-/* eslint-disable security/detect-non-literal-fs-filename */
-import fs from 'node:fs'
-
-import { program } from 'commander'
-import chalk from 'chalk'
-
-import {
-  analyzeRepository,
-  condir,
-  enableDebug,
-  errorExit,
-  log, 
-} from '../Utils.mjs'
-
-program
-  .name( 'circle-orb' )
-  .description( 'updates a .circle/circle.yml to use the leverge orb' )
-  .option( '--debug', 'Enable debug logging - use BUILD_TOOLS_DEBUG=1 for global' )
-  .parse()
-  
-const options = program.opts()
-if ( options.debug ) {
-  enableDebug() // enables debugging in the Utils functions
-}
-
-const repo = await analyzeRepository()
-if ( !repo.isGitRepo ) {
-  errorExit( '***ERROR: This command must be run inside a git repository - run "git init" to proceed' )
-}
-const Container = repo.containerName
-const chartwright = new Chartwright( { Container, debug : options.debug } )
-
-// If there isn't an existing helm chart then we just bootstrap the new chart structure
-// from the current helm template and we're done. This will most likely be the case after
-// a new service has been bootstrapped with ignition.
-if ( !repo.helmChart ) {
-  await chartwright.bootstrap( { Container } )
-  process.exit( 0 )
-}
-
-// Safety First: if there is already an older helm chart, we don't want to overwrite it - we
-// want the user to review / intervene before proceeding.
-const packageRoot = repo.currentDir
-if ( fs.existsSync( `${packageRoot}/helm-old` ) ) {
-  errorExit( '***ERROR: An old helm chart structure already exists - cannot proceed' )
-}
-
-const {
-  Chart,
-  Values,
-  valuesText : ValuesText,
-  imageRegistry : Registry,
-} = repo.helmChart

package/src/circle-orb/circle-orb.yml

@@ -1,24 +0,0 @@
-# See => https://bitbucket.org/leverege/circle-nodejs-ci/src/development/
-version: 2.1
-
-orbs:
-  leverege: leverege/circle-nodejs-ci@0.3.0
-
-workflows:
-  build-and-verify:
-    jobs:
-      - leverege/install-dependencies:
-          context: npm
-      - leverege/code-analysis:
-          requires:
-            - leverege/install-dependencies
-      - leverege/code-coverage:
-          coverage-threshold: 70
-          context: leverege-gcp  # 👈 attaches the secure secrets access to GCP_SA_KEY_JSON
-          enable-redis: false
-          cache-config: '{"type":"inMemory"}' # '{"type":"redis"}'
-          requires:
-            - leverege/install-dependencies
-      - leverege/generate-docs:
-          requires:
-            - leverege/install-dependencies