Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
77 commits
Select commit Hold shift + click to select a range
ecf1bdb
feat: Add EKS capabilities integration with Identity Center and deplo…
allamand Jan 23, 2026
c720054
chore: Update Renovate base branch from riv25 to main
allamand Jan 29, 2026
eed8e29
feat: Add EKS capabilities integration with Identity Center and deplo…
Jan 29, 2026
921a499
feat: Update Keycloak configuration for EKS Capabilities
allamand Jan 29, 2026
99727d0
fix: Use dynamic server in fleet-secrets ApplicationSet
allamand Jan 29, 2026
1830fc1
fix: Update Backstage external secret for EKS managed ArgoCD
allamand Jan 29, 2026
b7ff9c4
remove dublicate secretstore
Jan 29, 2026
dd543e9
fix: comment out ArgoCD auth token in Backstage external secret
Jan 29, 2026
7ab13e4
fix: improve ArgoCD revision conflict recovery
Jan 30, 2026
bb176a6
fix: improve stuck app detection in ArgoCD sync wave monitoring
Jan 30, 2026
42f41b6
revert: restore original stuck app detection logic
Jan 30, 2026
3c007d9
fix: improve ArgoCD recovery script to handle stale finished operations
Feb 2, 2026
775e3db
feat: add HuggingFace model download support and update platform mani…
Feb 2, 2026
b77d09c
feat: update platform configurations and HuggingFace model support
Feb 2, 2026
33bb588
fix: update Argo Workflows installation template
Feb 2, 2026
6fe703e
chore: update addons configuration
Feb 2, 2026
5c4efb0
feat: switch from Auto Mode default nodepools to custom Karpenter nod…
allamand Feb 2, 2026
b5966c3
feat: add automatic recovery for stuck Argo Workflows
allamand Feb 2, 2026
1cfc929
fix: add EKS cluster security group to RDS ingress rules
allamand Feb 2, 2026
0362371
don't use Auto mode nodepools
Feb 2, 2026
072995a
feat: Add EKS capabilities integration with Identity Center and deplo…
allamand Jan 23, 2026
2edd546
chore: Update Renovate base branch from riv25 to main
allamand Jan 29, 2026
a8afc59
feat: Add EKS capabilities integration with Identity Center and deplo…
Jan 29, 2026
863d4fe
feat: Update Keycloak configuration for EKS Capabilities
allamand Jan 29, 2026
a2953af
fix: Use dynamic server in fleet-secrets ApplicationSet
allamand Jan 29, 2026
802225a
fix: Update Backstage external secret for EKS managed ArgoCD
allamand Jan 29, 2026
b3b66a1
remove dublicate secretstore
Jan 29, 2026
d689cb3
fix: comment out ArgoCD auth token in Backstage external secret
Jan 29, 2026
9d2bde6
fix: improve ArgoCD revision conflict recovery
Jan 30, 2026
6f2f282
fix: improve stuck app detection in ArgoCD sync wave monitoring
Jan 30, 2026
b372114
revert: restore original stuck app detection logic
Jan 30, 2026
db91342
fix: improve ArgoCD recovery script to handle stale finished operations
Feb 2, 2026
10c6be1
feat: add HuggingFace model download support and update platform mani…
Feb 2, 2026
944cb98
feat: update platform configurations and HuggingFace model support
Feb 2, 2026
93fa53b
fix: update Argo Workflows installation template
Feb 2, 2026
9f909b8
chore: update addons configuration
Feb 2, 2026
0f66785
feat: switch from Auto Mode default nodepools to custom Karpenter nod…
allamand Feb 2, 2026
9027470
feat: add automatic recovery for stuck Argo Workflows
allamand Feb 2, 2026
cfb65ef
fix: add EKS cluster security group to RDS ingress rules
allamand Feb 2, 2026
cfb9760
don't use Auto mode nodepools
Feb 2, 2026
14f2640
fix: Add jupyterhub, spark-operator, and image-prepuller to best effo…
allamand Feb 3, 2026
9f5a1ab
Merge remote-tracking branch 'origin/feat/eks-capabilities-integratio…
allamand Feb 3, 2026
a04f7c2
fix: add lifecycle rule to prevent CloudFront VPC origin update confl…
allamand Feb 4, 2026
a1e1202
keep gitlab deploy on eks auto mode system nodepool
Feb 4, 2026
1af9216
feat: migrate to EKS Auto Mode and enhance HA configuration
Feb 5, 2026
9ebf491
chore: remove test files and update addon configurations
Feb 5, 2026
03746fb
populate few history
Feb 5, 2026
c7b48db
fix: update Backstage templates and utility scripts
Feb 5, 2026
8b40b90
populate few history
Feb 5, 2026
dfb7fa6
new init
Feb 5, 2026
1619be7
optimize check time
Feb 5, 2026
5e8f0fd
fix: retrieve GITLAB_DOMAIN from CloudFront before Git remote setup
Feb 6, 2026
5b437eb
fix: preserve GitHub remote and handle non-existent GitLab repo grace…
Feb 6, 2026
bd2f938
fix: update 2-gitlab-init.sh to use origin remote instead of gitlab
Feb 6, 2026
a22610f
add default ressources
Feb 6, 2026
ce9f48f
clean changelog
allamand Feb 6, 2026
2a82535
remove unused doc
allamand Feb 6, 2026
2df9dc5
add missing pdbs
Feb 6, 2026
2b58c05
zdd ssm command
allamand Feb 6, 2026
dcf6f3f
tweak syncwaves
Feb 7, 2026
a6716bf
fix project name in cicd
Feb 7, 2026
f6736d3
fix project name in cicd
Feb 8, 2026
b736807
fix project name in cicd
Feb 8, 2026
73e5ed6
create old folder for legacy backstage templates
Feb 9, 2026
2d1cbe4
update manifest with kro
Feb 9, 2026
d745528
update ACK to use EKS capabilities
Feb 9, 2026
559c3b5
add kro for s3 template
Feb 9, 2026
9636aad
update to use appmod kro service
Feb 10, 2026
fb4825d
Merge main into feat/eks-capabilities-integration
Feb 11, 2026
c2fb6ab
update cicd
Feb 11, 2026
00ba5b5
update cluster configuration
Feb 11, 2026
41820d2
rewrite appmod kro manifest
Feb 11, 2026
4798e12
update appmod with different rewrite rules
Feb 11, 2026
e30f1b3
update appmod with different rewrite rules
Feb 12, 2026
68e3f4a
update do use Appmod kro
Feb 12, 2026
ed2e476
activate cross-zone load balancing to ensure it will still work even …
Feb 12, 2026
d37dea5
update do use Appmod kro
Feb 12, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
270 changes: 270 additions & 0 deletions RELEASE_NOTES.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,270 @@
# Release Notes

---

## Performance Optimizations (2026-02-07)

### Sync Wave Optimizations

Reduced ArgoCD sync wave dependencies to improve initial setup time by ~6-7 minutes.

**Changes:**
- **Backstage**: Wave 10 → 4 (only depends on Keycloak wave 3)
- **Devlake**: Wave 10 → 7 (only depends on Crossplane-AWS wave 6)
- **Argo Workflows**: Wave 6 → 4 (only depends on Keycloak wave 3)
- **Kargo**: Wave 6 → 4 (only depends on Keycloak wave 3)

**Revert Instructions (if needed):**
```bash
# In gitops/addons/bootstrap/default/addons.yaml
# Backstage: sync-wave: '4' → '10'
# Devlake: sync-wave: '7' → '10'
# Argo Workflows: sync-wave: '4' → '6'
# Kargo: sync-wave: '4' → '6'
```

**Impact:** These addons now deploy in parallel with other wave 4-7 services instead of waiting for all previous waves to complete.

---

## EKS Capabilities Integration (feat/eks-capabilities-integration)

### Overview

This release integrates Amazon EKS Capabilities - fully managed versions of Argo CD, ACK, and kro that run in AWS-managed infrastructure, eliminating the need to self-manage these components.

### Major Features

#### EKS Managed Capabilities

- **Managed Argo CD**: Replaced self-hosted Argo CD with EKS Capability for GitOps
- **Managed ACK Controllers**: AWS Controllers for Kubernetes as managed capability
- **Managed kro**: Kubernetes Resource Orchestrator as managed capability
- **Identity Center Integration**: RBAC via AWS Identity Center groups (`eks-argocd-admins`, `eks-argocd-developers`)

#### Infrastructure Changes

- **EKS Module Upgrade**: Updated from `~> 20.31.6` to `~> 21.10.1` for Capabilities support
- **Custom Karpenter Nodepools**: Switched from Auto Mode default nodepools to custom Karpenter nodepools
- **Identity Center Terraform Module**: New module at `platform/infra/terraform/identity-center/` for IDC group/user management
- **EKS Capabilities RBAC**: Added ClusterRole/ClusterRoleBinding for managed kro capability

#### HuggingFace Model Downloads

- **Kro RGD for Model Downloads**: New ResourceGraphDefinition replacing CodeBuild-based downloads
- **Argo Workflows Integration**: Model downloads run as Kubernetes-native workflows
- **Pod Identity**: Proper IAM integration for S3 uploads

#### Keycloak Improvements

- **Split-Brain Detector**: CronJob to detect and heal Keycloak cluster split-brain scenarios
- **Enhanced Secret Generation**: Improved secret management templates

#### Argo CD Recovery

- **Automatic Workflow Recovery**: Added recovery for stuck Argo Workflows
- **Improved Stuck App Detection**: Better handling of stale finished operations
- **Revision Conflict Recovery**: Enhanced sync wave monitoring

### New Documentation

- `docs/EKS-Capabilities-ArgoCD-Setup.md`: Configuration guide for EKS managed Argo CD
- `docs/huggingface-model-download.md`: Kro-based model download documentation
- `platform/infra/terraform/cluster/EKS_CAPABILITIES_SETUP.md`: EKS Capabilities deployment guide

### Bug Fixes

- Added lifecycle rule to prevent CloudFront VPC origin update conflicts
- Added EKS cluster security group to RDS ingress rules
- Fixed dynamic server in fleet-secrets ApplicationSet
- Removed duplicate ClusterSecretStore
- Updated Backstage external secret for EKS managed Argo CD

### Breaking Changes

- Argo CD now runs as EKS Capability (not self-hosted)
- Requires AWS Identity Center for Argo CD RBAC
- GitOps Bridge cluster secrets use EKS cluster ARN as server

### Migration Notes

- Associate `AmazonEKSClusterAdminPolicy` with `AmazonEKSCapabilityArgoCDRole`
- Update cluster secrets to use EKS cluster ARN instead of `https://kubernetes.default.svc`
- Configure Identity Center groups for Argo CD access

---

**Release Date**: February 2026
**Branch**: feat/eks-capabilities-integration → main

---

## riv25 Branch Merge

### Overview

This release merges the `riv25` branch into `main`, bringing significant platform enhancements, new features, and stability improvements for the EKS application modernization blueprint.

## Major Features

### Platform Architecture

- **Decoupled Deployment Model**: Separated cluster creation from bootstrap process for improved modularity
- **Multi-Cluster Fleet Management**: Enhanced spoke cluster (dev/prod) configuration and secret management
- **High Availability Configuration**: Comprehensive HA setup for critical platform addons including Argo CD, Keycloak, and KubeVela

### GitOps & CI/CD

- **KRO (Kubernetes Resource Orchestrator)**:
- Upgraded to v0.6.1
- Added CI/CD pipeline implementation using KRO Resource Graph Definitions (RGD)
- Integrated KRO with Backstage for streamlined resource management
- **Argo Workflows**: Enabled and configured for workflow orchestration
- **Argo Events**: Added event-driven automation with GitLab webhook integration
- **Kargo**: Enabled progressive delivery and promotion workflows
- **Progressive Delivery**: Extended gate pauses and rollout tracking with Argo Rollouts

### Developer Platform

- **Backstage Enhancements**:
- GitLab integration with custom plugin for improved timeout handling
- Argo CD plugin integration (Roadie's Argo CD Plugin)
- New templates for DynamoDB, S3, and EKS cluster provisioning
- KRO catalog and pipeline templates
- **JupyterHub**: Added addon for ML/data science workloads

### Infrastructure as Code

- **Crossplane**:
- Migrated to EKS Pod Identity
- Separated core Crossplane from AWS provider
- Added compositions and provider configurations
- **Flux CD**:
- Enabled on spoke clusters
- Integrated with GitOps bridge templating
- **ACK (AWS Controllers for Kubernetes)**:
- Enabled S3, DynamoDB, ECR, and IAM controllers
- Configured with EKS Pod Identity

### Observability

- **Grafana Operator**: Added and enabled
- **Rust Metrics Dashboard**: Custom dashboard for Rust application monitoring
- **AWS Observability Accelerator**: Integrated terraform-aws-observability-accelerator module
- **DevLake**: Added DORA metrics tracking and deployment

### Security & Compliance

- **Keycloak**:
- Configured for PKCE authentication
- StatefulSet deployment for HA
- Automated client configuration for Argo CD, Grafana, and GitLab
- **Kyverno**: Configured policies (disabled by default for workshop)
- **External Secrets Operator**: Enhanced with ClusterSecretStore configurations
- **Security Hub**: Added Terraform integration

## Infrastructure Improvements

### Networking

- **GitLab**: Migrated to private NLB with VPC origin
- **CloudFront**: Increased timeout configurations
- **Ingress**: Priority routing for Argo Events webhooks

### Compute

- **EKS Auto Mode**: Optimized nodepool configurations
- **Critical Addons**: Moved to system nodepool with PodDisruptionBudgets
- **Topology Spread**: Configured nginx with zone-aware spreading

### Storage & Data

- **RDS**: Added security group ingress rules for EKS cluster
- **S3**: Force delete configuration for ECR repositories

## Application Updates

### Sample Applications

- **Rust Application**: Updated with metrics and dashboard
- **Java Application**: Fixed timeouts for rollout checks, updated components
- **HuggingFace Models**: Added download support and platform manifest updates

## Developer Experience

### Scripts & Automation

- **Idempotent Operations**: GitLab repository setup and webhook configuration
- **Retry Logic**: Added to deployment scripts for improved reliability
- **Cleanup Scripts**: Argo CD app deletion and webhook cleanup
- **Init Process**: Enhanced stability with proper sourcing and wait logic

### Docs Updates

- **README**: Comprehensive updates with architecture diagrams
- **CloudFormation**: Fixed instructions and template links
- **On Your Own**: Updated deployment instructions

## Bug Fixes

### Argo CD

- Improved stuck app detection and recovery
- Fixed operation termination checks
- Enhanced sync wave monitoring
- Resolved revision conflict recovery

### GitLab

- Fixed personal access token expiration (2026-12-31)
- Resolved git tag handling issues
- Fixed push stale info errors
- HTTPS token configuration

### Terraform

- Fixed EKS access entry ARN format conversion
- Resolved circular dependencies
- Added explicit dependencies for access policies
- Fixed timeout and retry logic

### Templates

- Fixed YAML syntax errors across Backstage templates
- Corrected API versions and resource references
- Updated action names (argocd:create-resources, kube:apply)
- Fixed variable references and hostname configurations

## Breaking Changes

- Crossplane now uses EKS Pod Identity instead of IRSA
- GitLab moved to private NLB (requires VPC access)
- Backstage templates updated to use `kube:apply` instead of `argocd:create-app`

## Migration Notes

- Existing clusters should review Pod Identity configurations
- Update any custom Backstage templates to use new action names
- Review and update GitLab access patterns for private NLB

## Dependencies

- KRO: v0.6.1
- KubeVela: v1.10.0
- External Secrets Operator: v0.19.2
- Flux: v2 with updated CRD APIs
- Observability Accelerator: v2.13.1

## New Documentation

- **GitOps Bridge Architecture**: Added comprehensive documentation explaining the GitOps Bridge pattern, three-tier configuration system, cluster secrets, ApplicationSets, and External Secrets integration (`docs/platform/gitops-bridge-architecture.md`)

## Contributors

Special thanks to all contributors who made this release possible through extensive testing, bug fixes, and feature development.

---

**Release Date**: February 2026
**Branch**: riv25 → main
**Commits**: 800+ commits merged
20 changes: 6 additions & 14 deletions amazon-q-target-file.md
Original file line number Diff line number Diff line change
Expand Up @@ -1462,7 +1462,7 @@ This platform assumes the following infrastructure has been created by the Cloud
- **CodeBuild Projects**: Automated deployment pipelines for Terraform modules
- **S3 Terraform State Bucket**: Backend storage for Terraform state
- **IAM Roles**: Cross-account access and service permissions
- **VSCode IDE Environment**: Browser-based development environment with Gitea
- **VSCode IDE Environment**: Browser-based development environment
- **Environment Variables**: `GIT_PASSWORD`, cluster configurations, domain settings

### AWS Service Limits
Expand All @@ -1476,7 +1476,6 @@ This platform assumes the following infrastructure has been created by the Cloud
```

### Development Environment
- **Gitea Service**: Local Git repository hosting with SSH access
- **Docker Support**: Container development capabilities
- **Git Configuration**: Automated SSH key management and repository access

Expand Down Expand Up @@ -1634,14 +1633,11 @@ platform/backstage/

### Git Repository Management

#### Gitea Service (from Bootstrap)
- **Local Git Hosting**: Repository management within the platform
- **SSH Access**: Automated key management for Git operations
- **API Integration**: RESTful API for repository automation
- **User Management**: Workshop user with platform access
#### Gitlab deployed in peeks-hub EKS cluster
- exposed on cloudfront

#### GitHub Integration (Optional)
- **External Repositories**: GitHub as alternative to local Gitea
- **External Repositories**: GitHub as alternative to local Gitlab
- **Terraform Provider**: Automated repository creation
- **Authentication**: Personal access tokens via `git_password`

Expand All @@ -1658,7 +1654,7 @@ variable "git_password" {
type = string
}

variable "gitea_user" {
variable "git_user" {
description = "Git service username"
type = string
default = "user1"
Expand Down Expand Up @@ -1781,10 +1777,6 @@ Git Commit → ArgoCD Sync → Kubernetes Apply → Application Running

### Environment Variables (from Bootstrap)
```bash
# Git service configuration
GIT_PASSWORD=${GIT_PASSWORD} # From IDE_PASSWORD
GITEA_USERNAME=workshop-user # Git service user
GITEA_EXTERNAL_URL=https://domain/gitea # Git service URL

# Deployment configuration
WORKSHOP_GIT_URL=https://github.com/aws-samples/appmod-blueprints
Expand Down Expand Up @@ -1916,7 +1908,7 @@ variable "create_github_repos" {
### Cross-Service Dependencies
1. **Identity Federation**: Keycloak provides SSO for all services
2. **Secret Management**: External Secrets Operator for credential sharing
3. **Git Integration**: Gitea/GitHub for source control
3. **Git Integration**: Gitlab/GitHub for source control
4. **Monitoring Integration**: Unified observability across services

### External Integrations
Expand Down
4 changes: 2 additions & 2 deletions applications/java/deployment/application-kro.yaml
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# apiVersion: kro.run/v1alpha1
# kind: AppmodService
# metadata:
# name: java-application
# namespace: default
# name: java-webservice
# namespace: java
# spec:
# image: 096337013420.dkr.ecr.us-west-2.amazonaws.com/peeks/java:20251114-3fedf668-d619-4ad0-910f-8add258e2372
# image_name: java-app
Expand Down
Loading