☀ projected release-candidate from eeb450a

Source-holobranch: release-candidate
Source-commit: eeb450a
Source: eeb450a

.github/workflows/release-candidate-branch.yml

@@ -0,0 +1,18 @@
+name: release-candidate-branch
+
+on:
+  push:
+    branches:
+      - "*"
+
+jobs:
+  release_candidate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: JarvusInnovations/hologit@actions/projector/v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_ACTION }}
+          HAB_LICENSE: accept
+        with:
+          holobranch: release-candidate
+          commit-to: "candidates/${{github.ref_name}}"

.github/workflows/release-deploy.yml

@@ -0,0 +1,30 @@
+name: release-deploy
+
+on:
+  push:
+    branches:
+      - "releases/*"
+
+jobs:
+  release_deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - id: branch-names
+        uses: tj-actions/branch-names@v2.1
+      - uses: actions/setup-python@v4
+        with:
+          python-version: 3.11
+      - uses: abatilo/actions-poetry@v2
+      - name: "run invoke"
+        working-directory: ci
+        env:
+          KUBECONFIG: /tmp/github-action-kubeconfig.yaml
+          KUBECONFIG_BASE64: ${{ secrets.KUBECONFIG_BASE64 }}
+        run: |
+          echo $KUBECONFIG_BASE64 | base64 -d >> $KUBECONFIG
+          wc $KUBECONFIG
+          poetry install
+          poetry run invoke apply -f ${GITHUB_REF#refs/heads/releases/}.yaml

ci/prod.yaml

@@ -0,0 +1,62 @@
+run:
+  echo_format: "{command}"
+  echo: true
+jarvus:
+  deployments:
+    # applications
+    - name: fetcher
+      namespace: fetcher
+      driver: kustomize
+      directory: kubernetes/overlays/fetcher-prod
+    - name: metabase
+      namespace: metabase
+      driver: helm
+      chart: kubernetes/charts/metabase
+      values:
+        - kubernetes/values/prod-metabase.yml
+    - name: dagster
+      namespace: dagster
+      driver: helm
+      chart: kubernetes/charts/dagster
+      values:
+        - kubernetes/values/prod-dagster.yml
+
+    # base services
+    - name: cert-manager
+      namespace: cert-manager
+      driver: helm
+      chart: kubernetes/charts/cert-manager/helm-chart
+      dependency: false
+      values:
+        - kubernetes/charts/cert-manager/default-values.yaml
+    - name: grafana
+      namespace: grafana
+      driver: helm
+      chart: kubernetes/charts/grafana/helm-chart
+      values:
+        - kubernetes/charts/grafana/default-values.yaml
+        - kubernetes/values/prod-grafana.yml
+    - name: ingress-nginx
+      namespace: ingress-nginx
+      driver: helm
+      chart: kubernetes/charts/ingress-nginx/helm-chart
+      values:
+        - kubernetes/charts/ingress-nginx/default-values.yaml
+    - name: loki
+      namespace: loki
+      driver: helm
+      chart: kubernetes/charts/loki/helm-chart
+      values:
+        - kubernetes/charts/loki/default-values.yaml
+    - name: prometheus
+      namespace: prometheus
+      driver: helm
+      chart: kubernetes/charts/prometheus/helm-chart
+      values:
+        - kubernetes/charts/prometheus/default-values.yaml
+    - name: promtail
+      namespace: promtail
+      driver: helm
+      chart: kubernetes/charts/promtail/helm-chart
+      values:
+        - kubernetes/charts/promtail/default-values.yaml

ci/pyproject.toml

@@ -0,0 +1,20 @@
+[tool.poetry]
+name = "ci"
+version = "0.1.0"
+description = ""
+authors = ["Andrew Vaccaro <andrew.v@jarv.us>"]
+readme = "README.md"
+
+[tool.poetry.dependencies]
+python = "^3.11"
+pydantic = "^2.0.2"
+invoke = "^2.2.0"
+gitpython = "^3.1.32"
+
+
+[tool.poetry.group.dev.dependencies]
+mypy = "^1.4.1"
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"

ci/tasks.py

@@ -0,0 +1,114 @@
+from enum import StrEnum
+from pathlib import Path
+from typing import List, Optional, NoReturn
+
+from invoke import task, Context
+from pydantic import BaseModel, model_validator
+
+
+# TODO: use GitPython to form absolute paths
+# TODO: deploy secrets from Secret Manager
+
+
+def _assert_never(x: NoReturn) -> NoReturn:
+    assert False, "Unhandled type: {}".format(type(x).__name__)
+
+
+class Driver(StrEnum):
+    helm = "helm"
+    kustomize = "kustomize"
+
+
+class Deployment(BaseModel):
+    name: str
+    namespace: str
+    driver: Driver
+
+    # helm specific
+    chart: Optional[Path] = None
+    dependency: bool = True
+    values: List[Path] = []
+
+    # kustomize specific
+    directory: Optional[Path] = None
+
+    @property
+    def namespace_cli(self) -> str:
+        return f"-n {self.namespace}" if self.namespace else ""
+
+    @property
+    def values_cli(self) -> str:
+        return " ".join(f"-f ../{values}" for values in self.values)
+
+    @model_validator(mode="after")
+    def check_fields_for_driver(self):
+        if self.driver == Driver.helm:
+            assert self.chart is not None
+        elif self.driver == Driver.kustomize:
+            assert self.directory is not None
+        else:
+            raise _assert_never(self.driver)
+        return self
+
+
+class JarvusConfig(BaseModel):
+    deployments: List[Deployment]
+
+
+@task
+def helm_plugins(c):
+    c.run("helm plugin install https://github.com/databus23/helm-diff", warn=True)
+
+
+@task
+def parse_jarvus_config(c: Context):
+    c.update({"jarvus_config": JarvusConfig(**c.config["jarvus"]._config)})
+
+
+@task(helm_plugins, parse_jarvus_config)
+def diff(c, name=None):
+    for deployment in c.config.jarvus_config.deployments:
+        if not name or name == deployment.name:
+            if deployment.driver == Driver.helm:
+                if deployment.dependency:
+                    c.run(f"helm dependency build ../{deployment.chart}")
+                args = [
+                    "helm",
+                    "diff",
+                    "upgrade",
+                    deployment.name,
+                    f"../{deployment.chart}",
+                    deployment.namespace_cli,
+                    deployment.values_cli,
+                    "-allow-unreleased",
+                ]
+                c.run(" ".join(args))
+            elif deployment.driver == Driver.kustomize:
+                pass
+            else:
+                raise _assert_never(deployment.driver)
+
+
+@task(helm_plugins, parse_jarvus_config)
+def apply(c, name=None):
+    deployment: Deployment
+    for deployment in c.config.jarvus_config.deployments:
+        if not name or name == deployment.name:
+            if deployment.driver == Driver.helm:
+                if deployment.dependency:
+                    c.run(f"helm dependency build ../{deployment.chart}")
+                args = [
+                    "helm",
+                    "upgrade",
+                    "--install",
+                    "--create-namespace",
+                    deployment.name,
+                    f"../{deployment.chart}",
+                    deployment.namespace_cli,
+                    deployment.values_cli,
+                ]
+                c.run(" ".join(args))
+            elif deployment.driver == Driver.kustomize:
+                c.run(f"kubectl apply -k ../{deployment.directory}")
+            else:
+                raise _assert_never(deployment.driver)

ci/test.yaml

@@ -0,0 +1,10 @@
+run:
+  echo_format: "{command}"
+  echo: true
+jarvus:
+  deployments:
+    # applications
+    - name: fetcher
+      namespace: fetcher-test
+      driver: kustomize
+      directory: kubernetes/overlays/fetcher-test

kubernetes/charts/cert-manager/default-values.yaml

@@ -0,0 +1,4 @@
+# These values as applied first as template-provided defaults
+
+startupapicheck:
+  enabled: false

kubernetes/charts/cert-manager/helm-chart/.gitignore

@@ -0,0 +1,3 @@
+*.tgz
+charts/*
+requirements.lock

kubernetes/charts/cert-manager/helm-chart/.helmignore

@@ -0,0 +1,27 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+
+BUILD.bazel
+Chart.template.yaml
+README.template.md
+OWNERS
+cert-manager*.tgz

kubernetes/charts/cert-manager/helm-chart/Chart.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+name: cert-manager
+# The version and appVersion fields are set automatically by the release tool
+version: v1.10.1
+appVersion: v1.10.1
+kubeVersion: ">= 1.20.0-0"
+description: A Helm chart for cert-manager
+home: https://github.com/cert-manager/cert-manager
+icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png
+keywords:
+  - cert-manager
+  - kube-lego
+  - letsencrypt
+  - tls
+sources:
+  - https://github.com/cert-manager/cert-manager
+maintainers:
+  - name: cert-manager-maintainers
+    email: cert-manager-maintainers@googlegroups.com
+    url: https://cert-manager.io
+annotations:
+  artifacthub.io/prerelease: "{{IS_PRERELEASE}}"