Skip to content

Deploy releases/k8s-manifests aa5d242 - #181

Merged
themightychris merged 3 commits into
deploys/k8s-manifestsfrom
releases/k8s-manifests
Jul 15, 2026
Merged

Deploy releases/k8s-manifests aa5d242#181
themightychris merged 3 commits into
deploys/k8s-manifestsfrom
releases/k8s-manifests

Conversation

@github-actions

Copy link
Copy Markdown

kubectl diff reports that applying aa5d242 will change:

diff -uN /tmp/LIVE-1538517589/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen /tmp/MERGED-3774425933/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen
--- /tmp/LIVE-1538517589/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen	2026-07-15 02:17:15.880588800 +0000
+++ /tmp/MERGED-3774425933/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen	2026-07-15 02:17:15.891588912 +0000
@@ -1 +1,69 @@
-{}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    helm.sh/hook: pre-install, pre-upgrade
+  labels:
+    app.kubernetes.io/instance: envoy-gateway
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: gateway-helm
+    app.kubernetes.io/version: v1.7.3
+    helm.sh/chart: gateway-helm-v1.7.3
+  name: envoy-gateway-gateway-helm-certgen
+  namespace: envoy-gateway-system
+spec:
+  backoffLimit: 1
+  completionMode: NonIndexed
+  completions: 1
+  manualSelector: false
+  parallelism: 1
+  podReplacementPolicy: TerminatingOrFailed
+  selector:
+    matchLabels:
+      batch.kubernetes.io/controller-uid: be35f1d0-d4af-46f5-acf5-b268fd4bbaeb
+  suspend: false
+  template:
+    metadata:
+      labels:
+        app: certgen
+        batch.kubernetes.io/controller-uid: be35f1d0-d4af-46f5-acf5-b268fd4bbaeb
+        batch.kubernetes.io/job-name: envoy-gateway-gateway-helm-certgen
+        controller-uid: be35f1d0-d4af-46f5-acf5-b268fd4bbaeb
+        job-name: envoy-gateway-gateway-helm-certgen
+    spec:
+      containers:
+      - command:
+        - envoy-gateway
+        - certgen
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: KUBERNETES_CLUSTER_DOMAIN
+          value: cluster.local
+        image: docker.io/envoyproxy/gateway:v1.7.3
+        imagePullPolicy: IfNotPresent
+        name: envoy-gateway-certgen
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      schedulerName: default-scheduler
+      serviceAccount: envoy-gateway-gateway-helm-certgen
+      serviceAccountName: envoy-gateway-gateway-helm-certgen
+      terminationGracePeriodSeconds: 30
+  ttlSecondsAfterFinished: 30
diff -uN /tmp/LIVE-55156074/apps.v1.Deployment.grafana.grafana /tmp/MERGED-15171828/apps.v1.Deployment.grafana.grafana
--- /tmp/LIVE-55156074/apps.v1.Deployment.grafana.grafana	2026-07-15 02:17:18.216612653 +0000
+++ /tmp/MERGED-15171828/apps.v1.Deployment.grafana.grafana	2026-07-15 02:17:18.227612765 +0000
@@ -24,7 +24,7 @@
   template:
     metadata:
       annotations:
-        checksum/config: 22dd3d1e146daf71250e2b773d7bc4a06eb63f0161d8209890d34b7539d4ced3
+        checksum/config: d228cac8c1c5f868320615ff62fecedd6be2152e1afa4096c9571df394d5e768
         checksum/dashboards-json-config: 4f1a6849aba728c6f66b9b27a78f020f7f74b2cb327597cec42eedc8ab62986a
         checksum/sc-dashboard-provider-config: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
       labels:
@@ -55,18 +55,33 @@
         - name: ALERT_EMAIL_TO
           valueFrom:
             secretKeyRef:
-              key: alert-recipients
-              name: smtp-postmark
+              key: recipients
+              name: grafana-smtp
+              optional: true
+        - name: GF_SMTP_FROM_ADDRESS
+          valueFrom:
+            secretKeyRef:
+              key: from-address
+              name: grafana-smtp
+              optional: true
+        - name: GF_SMTP_FROM_NAME
+          valueFrom:
+            secretKeyRef:
+              key: from-name
+              name: grafana-smtp
+              optional: true
         - name: GF_SMTP_PASSWORD
           valueFrom:
             secretKeyRef:
-              key: smtp-password
-              name: smtp-postmark
+              key: password
+              name: grafana-smtp
+              optional: true
         - name: GF_SMTP_USER
           valueFrom:
             secretKeyRef:
-              key: smtp-user
-              name: smtp-postmark
+              key: user
+              name: grafana-smtp
+              optional: true
         image: grafana/grafana:9.2.5
         imagePullPolicy: IfNotPresent
         livenessProbe:
diff -uN /tmp/LIVE-55156074/bitnami.com.v1alpha1.SealedSecret.grafana.grafana-smtp /tmp/MERGED-15171828/bitnami.com.v1alpha1.SealedSecret.grafana.grafana-smtp
--- /tmp/LIVE-55156074/bitnami.com.v1alpha1.SealedSecret.grafana.grafana-smtp	2026-07-15 02:17:18.216612653 +0000
+++ /tmp/MERGED-15171828/bitnami.com.v1alpha1.SealedSecret.grafana.grafana-smtp	2026-07-15 02:17:18.227612765 +0000
@@ -1 +1,17 @@
-{}
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-smtp
+  namespace: grafana
+spec:
+  encryptedData:
+    from-address: AgA/XfKGwE9Yn/q0p1UBJ+gtSvhYorgPRsjUPR26iM2I3EWvSI+1vK/Rtv1auKofVQfTIPAUwK5LLl07Ptf36VmpK7lSZFfj4R/2UfDXVazvxbJvz8Nh8x9bmVDSCdYxeB2EmhURsyRXDYEpuXmHHqfLVksNBLYaF+3SxhLLHPnX0R9bWRVGQBIDBkFITER3FYJUVLaiqjQrykJvGtpL/cq+OhBZmCa81ynl2sL8pTwj1J8r+cRyGW1xfJtleo2szurhitLbvUM1jo1Af5pOxBSB9XbX2eIqQapjHzrOc3/sCBPDUQWF0fbMl3AWKOnkhD3OYU/KYu/tdeQvsJdt/kyEg+ms7AbPPM4VI1+hdu+3HFSfM3CG1FRVw6Rp65SgQl6wz6yPRHDDHz8zWG0WNnaUkRzqd4J38W3+GNAFouBcDVdr5mB+uyayUE9Q88drRug50e+jKZ8GE3CgaaHfRFQY4iATsT2vmYGF7tVFf+KgI78kcKHcHgNNKPI96vP6Y/v+HSfTlLsJ6P+N8vnOXj36yherzqJwFOgh8FLjGpXH+lpZI1xZfofeoW2YrcRHmkqxGOzWAn8uLiigX/TSlYYfHa296x2EiB8KnQCnUDe7pZ9It2+aNf0KndLV7JwPjf4uuOdtjBMYc75uM11aFBbHbs/MGfcGE03p0Ivy+rjuele0alwRcB7RkIdL17gp+87QmFunssfNoCDTJDGJrVaKZPZ4QitL6LNEAQ==
+    from-name: AgDuNudaQBqIjS8fvLjbLhzlvUE//xd8Q1S5fq+r8irNI7Nn7aMdJmnHLvnKYhY2pa4puIKAxOMJZarPZONgHMeAYTLqiX/dwxiFGZkclxI4x8E8W4e7v0VE3y10gldxRCrctGO6BPQ7e4H5mXkF3EglVaca9M/rta57d1+ratSBYnpd0L2ns3HS4nyO84pbQDwRR9Yr0H/WiZyCCQpURPrUx3YKCNYogtvU3RJZLkKpkb3xYjacb/1DPJ7oaScbfPsYn4XmmTFHSxr8obn38VhlXLeyBj0y4duM1SL5+IdB6lz7tL7Omdt34b76O3rAWzVr5ym7ziNB9jdmtSpxsPbPH7+m+CGAgzRzqdu42tB00icfc2e4DS+xYzKjGBXp2TbAL9FxBPhY7cAhXwmWD2F9msTzixNij95pxWUwNk7F7WLNMlJ+a6BYR4QW5cR6CE9kui0wTt+rTedaLra6Y0G440Uh5N5CKSsDP2QdmkWM7yKg/lbUOu52oXGG3D+L6KrFuOHq3tqmTU0QWI1Al4kH+heJExK1JB+lW9WmEMxs5mtha9y5Yu4uZN1Ww2tbU6a5Y/TRTNAYutzha7ZvStD5uF7PCcVzsPTpSIUKV7igNXcscazVIaSOs5BY/kEqZlQGW25L95u105iIq+gxPWWXkZpMEsOa/j0Rj2/f43ILvcSBQNXskAoxCtBq5XYI4AlD6VfXWHOZe4F7Rm77Pclf
+    password: AgDhuTAnil4keuT9V0gE9Dp/ayvZUJMlWXxUNUzCODy5dmABqbJErHf9QVRASHC58CdkJ06xpHLpYKroKB5VHM7jKibAfY1/Jjs8U/89cpiToAqs65S6w9ujrCAIqJZWXB5qw/piaWt15ojsh2M1uIgTvi3aWSju1qKDU0JpwM38gbY6HOTNryPNOsK1I3T06ILLGYn18pU8RdeELPCDbJ73rN4xFp3QJHQ5FOJg7zuaqWFjk3jrEuEyxNXgkbQdIXJw35ISlG0RL0a7qbIr/6504xdMN1FVedxmVy+XnWKVQ5gNNmdlE8Eb+1Dfg8boG7xs5V92AjwZvbRPo1qKtNmTS+5yIyE1dseLt+HERs8OiBLbBSwJADrfjQi8MNyVyxZ2MSgbev4VyRo3Fj/a39oKIAC1xW9iXsCDnCsxRJYAG3m4hdwGuHyVEvezVaX3aGq4ZeMErI7jXGMmyvBt0J+4nW0cYDV4m6sLqBkf1Mc7y0u2L+vSbFDVsl4OVx0KP1Lyjhz+Q6tmQNseGhgOESJnMdrxGh4JCw3T/Pnmx37oNEef58mnx1qsN5WnmUUt7UwaNOJyY7STdiNNv//zRH6Jk2WmxIBTIjg1Ul5B4VAWC498/P/Qt+AvO8ghrjYK492qZCdkL7X5xCxZZ78U4I4p++lZDl9hitNqQ9TNWKxt+/AnGhpflqXhItMK/1JhesbE/xu9bmBZ0eo2duseph6U9oMqo/B4HM5TyratTrghB3CH0bc=
+    recipients: AgAQSiH7VA/jTQu7TJT+Ol00NM163Rf3+jZWT9V0U3lz/H3PYk80/+umVjnVUxzfPaoOhTdmhD1mncMdGHL+XBZDRycRSN7ZlMuFKeBumFTDtj3Ez1VAaj8vVcykONzsrgLbCtmXiarZNAHf1DtdHhmwXHlsKl/nV4k6cqJoKUC2tEsQj1TFt8BrtBNaDPxXYy5YjYZwaZlVoxukhZUBht3FvRT16HhVcKpcz77scEKSUU3OilEHtYVORhgVKtulP/4SERd9yd//7Rm+cvCw0FwMgKP3cao2cZUS/GsMGpH4XMTTkZXHDuH3aJVaBYdT2FRW7GO82Ks6KuZX66OvTI8YYKYEsnmUZNCYR479cLHK6D9aZ3xPweedOBecMwnWfKE0ERliRVCKe1hkZdcza6Uu70WDkCd4vB2JRLUg3X23MrmtRzcFqtLT1i9vjrinhFrkpu8tHqMvBnRMIWnojUGQckU+jtM7k7glfuYJp5ZxP1hRp2Rb6ONZOHc07sDzW+z80bOt2o1iHS7HB1knRWaQ8qPlw51HcwVEjEuYOerztVynE11jlG/xXEGu42I6wROoGU5npYls81MgJiYH8/sby0C3wT7KaT67P4GIpzVUSY2kBk/kffmc2ZuWMm4VRrm5GzQB5flgc58LNcblYHrXgEIdITbDA2w4JWyvlvKb+O6PBntBFUNAcGUdw1Sql41fOeWlQwCxWAVs4smIJPDnnN6Q2Cs+2WO1e5IJh9SsZdc8XjGYh4PS7W397AZ7FmDO9siYiC59aQokE5MVzGe5qggT+A==
+    user: AgD2XMwnf9z5QEWU8ihuprCsLUJXlI+oM4NX4B8J+iNrpc3p6OGpM3zrj0gS56VoaeZkhKsE3pLRMBjsUCM4YwVqDUJp+J/TUO4BbmRLni3YnZORuCisjFMiY86r0y5Lx27q47bfm1940JDiN5wRi9/m3rDWkifoic8bVkIkrTUu0ELCXYJ2EcLQh2Gg9M2bDrZV6rSGyjVWGDf4piZ52SPimJZTc+ecqQVNyVL7v5oj1bDRYhZ8e6ejVyv0cUc/jm1mk65SJog3CzDyg3Px696+oSgtrsMexkqbpdL44AAe/Ujfg1bY75yjCgD7zEQm9ETFGYOcYP1LqULD8xoHQzVmY4QtyyJWtLGpI0a3elASIk3dbp5em8A/yIncSgAhG3oOAOsGX32ogQqY3OKVMbXe/c2Yq8+ajy2cMuxoGP/KbYlCZjtr5bEt7mGnF/Pc2R2Y7nMegqqE/mHnRNywsh0tTq+3twwmCVmvlbhvBzMTldhpQ52MfG+8usP4aNPCkL/Igy/1JE0BHnYvUoY8jG1d2m6qIovmi77Q1IpY6ogPlKIcPfwxsg+1nVp34UGGnQwrjsB+yQQs0Oom4gouyRK5qb8aqBcuXyMDqLxwiOcSbtTyy1cMnQ9daGubPC7CXW5YsnP8FGmqvSQOn+GmU+JUUnTvonZPMY6s/cS/3ShT6H1s4WVTLZkpG1zRaEQI/JMNtT2nPhlKj9A3pUcIOX2FG8O3AR0AVFBcxuvJ/QWeQObOmEk=
+  template:
+    metadata:
+      name: grafana-smtp
+      namespace: grafana
+    type: Opaque
diff -uN /tmp/LIVE-55156074/v1.ConfigMap.grafana.grafana /tmp/MERGED-15171828/v1.ConfigMap.grafana.grafana
--- /tmp/LIVE-55156074/v1.ConfigMap.grafana.grafana	2026-07-15 02:17:18.219612683 +0000
+++ /tmp/MERGED-15171828/v1.ConfigMap.grafana.grafana	2026-07-15 02:17:18.231612806 +0000
@@ -3,14 +3,14 @@
   contactpoints.yaml: |
     apiVersion: 1
     contactPoints:
-    - name: cert-ops-email
+    - name: cluster-alerts-email
       orgId: 1
       receivers:
       - settings:
           addresses: ${ALERT_EMAIL_TO}
           singleEmail: false
         type: email
-        uid: cert-ops-email
+        uid: cluster-alerts-email
   dashboardproviders.yaml: |
     apiVersion: 1
     providers:
@@ -74,8 +74,7 @@
     root_url = https://metrics.live.k8s.phl.io
     [smtp]
     enabled = true
-    from_address = services@codeforphilly.org
-    from_name = CFP Live Cluster
+    from_name = Cluster Monitoring
     host = smtp.postmarkapp.com:587
   policies.yaml: |
     apiVersion: 1
@@ -87,7 +86,7 @@
       group_interval: 5m
       group_wait: 30s
       orgId: 1
-      receiver: cert-ops-email
+      receiver: cluster-alerts-email
       repeat_interval: 12h
   rules.yaml: |
     apiVersion: 1
@@ -99,9 +98,9 @@
       rules:
       - annotations:
           description: renewalTime is over a day in the past and renewal hasn't happened.
-            The cert is probably still valid, so nothing looks broken yet — that's exactly
-            how the July 2026 outage stayed invisible for 56 days. Check `kubectl get
-            challenges -A` for a stuck challenge.
+            The cert is probably still valid, so nothing looks broken yet — which is exactly
+            how this failure mode hides. Check `kubectl get challenges -A` for a stuck
+            challenge.
           summary: 'Certificate {{ $labels.namespace }}/{{ $labels.name }} is overdue
             for renewal'
         condition: C
@@ -135,8 +134,8 @@
         uid: cert-renewal-overdue
       - annotations:
           description: Challenge in flight for over an hour. Healthy ones resolve in seconds.
-            If its Order is gone, the Challenge is a half-orphan that GC won't reap and
-            must be deleted by name, or it starves every future renewal for this hostname.
+            If its Order is gone it must be deleted by name, or it starves every future
+            renewal for this hostname.
           summary: 'ACME challenge stuck for {{ $labels.namespace }}/{{ $labels.name
             }}'
         condition: C

…-blueprint

feat(grafana): move cert alerting onto the upstream blueprint
Source-holobranch: k8s-manifests-github
Source-commit: a00a2b3
Source: a00a2b3
@themightychris
themightychris merged commit a5c7a6a into deploys/k8s-manifests Jul 15, 2026
1 check passed
@github-actions

Copy link
Copy Markdown
Author

kubectl apply output (excluding unchanged) for a5c7a6a was:

customresourcedefinition.apiextensions.k8s.io/backends.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/backendtlspolicies.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/backendtrafficpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clienttrafficpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoyextensionpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoypatchpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoyproxies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/httproutefilters.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/httproutes.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/listenersets.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/sealedsecrets.bitnami.com serverside-applied
customresourcedefinition.apiextensions.k8s.io/securitypolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/tlsroutes.gateway.networking.k8s.io serverside-applied
clusterrole.rbac.authorization.k8s.io/envoy-gateway-gateway-helm-envoy-gateway-role configured
clusterrole.rbac.authorization.k8s.io/grafana-clusterrole configured
clusterrole.rbac.authorization.k8s.io/prometheus-alertmanager configured
clusterrole.rbac.authorization.k8s.io/prometheus-pushgateway configured
clusterrolebinding.rbac.authorization.k8s.io/sealed-secrets configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/envoy-gateway-topology-injector.envoy-gateway-system configured
validatingadmissionpolicy.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io configured
validatingadmissionpolicybinding.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io configured
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
gateway.gateway.networking.k8s.io/balancer configured
httproute.gateway.networking.k8s.io/balancer configured
gateway.gateway.networking.k8s.io/chime configured
httproute.gateway.networking.k8s.io/chime configured
gateway.gateway.networking.k8s.io/choose-native-plants configured
httproute.gateway.networking.k8s.io/choose-native-plants configured
deployment.apps/code-for-philly configured
gateway.gateway.networking.k8s.io/code-for-philly configured
httproute.gateway.networking.k8s.io/code-for-philly configured
gateway.gateway.networking.k8s.io/echo-http configured
httproute.gateway.networking.k8s.io/echo-http configured
deployment.apps/envoy-gateway configured
httproute.gateway.networking.k8s.io/http-redirect configured
job.batch/envoy-gateway-gateway-helm-certgen created
configmap/grafana-dashboards-default configured
configmap/grafana configured
deployment.apps/grafana configured
gateway.gateway.networking.k8s.io/grafana configured
httproute.gateway.networking.k8s.io/grafana configured
sealedsecret.bitnami.com/grafana-smtp created
deployment.apps/metrics-server configured
secret/promtail configured
statefulset.apps/loki configured
deployment.apps/prometheus-alertmanager configured
deployment.apps/prometheus-kube-state-metrics configured
deployment.apps/prometheus-pushgateway configured
deployment.apps/prometheus-server configured
serviceaccount/prometheus-kube-state-metrics configured
deployment.apps/sealed-secrets configured
gateway.gateway.networking.k8s.io/sealed-secrets configured
httproute.gateway.networking.k8s.io/sealed-secrets configured
rolebinding.rbac.authorization.k8s.io/sealed-secrets-key-admin configured
service/sealed-secrets configured
gateway.gateway.networking.k8s.io/third-places configured
httproute.gateway.networking.k8s.io/third-places configured
statefulset.apps/third-places-postgresql configured
gateway.gateway.networking.k8s.io/vaultwarden configured
httproute.gateway.networking.k8s.io/bitwarden-redirect configured
httproute.gateway.networking.k8s.io/vaultwarden configured
statefulset.apps/vaultwarden-postgresql configured
sealedsecret.bitnami.com "smtp-postmark" deleted from grafana namespace

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant