Skip to content

Commit 5b52a4a

Browse files
jordigilhjordigilh
committed
Changelog:
- Rename oauth2 to auth in Helm chart configuration - Add ClusterRole/ClusterRoleBinding for insights-ros-ingress - Update deployment templates and API middleware - Enhance test and deployment scripts Signed-off-by: Jordi Gil <jgil@redhat.com>
1 parent 03231b8 commit 5b52a4a

14 files changed

+643
-94
lines changed

‎deployment/docker-compose/test-ros-ocp-dataflow.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -523,7 +523,7 @@ main() {
523523
wait_for_service "PostgreSQL (Sources)" "podman exec db-sources_1 pg_isready -U postgres" 90
524524
wait_for_service "Kafka" "podman exec kafka_1 kafka-broker-api-versions --bootstrap-server localhost:29092" 90
525525
wait_for_service "MinIO" "curl -f http://localhost:9000/minio/health/live" 60
526-
wait_for_service "Redis" "podman exec redis_1 redis-cli ping" 60
526+
wait_for_service "Redis" "podman exec redis_1 valkey-cli ping" 60
527527

528528
# Wait for application services
529529
wait_for_service "Ingress" "curl -f http://localhost:${ACTUAL_INGRESS_PORT}/health" 120

‎deployment/kubernetes/helm/ros-ocp/templates/clusterrole-insights-ros-ingress.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{/* Create ClusterRole for insights-ros-ingress service account */}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "ros-ocp.fullname" . }}-insights-ros-ingress
6+
labels:
7+
{{- include "ros-ocp.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: rbac
9+
rules:
10+
# Token validation permissions - only what's needed for authentication
11+
- apiGroups: ["authentication.k8s.io"]
12+
resources: ["tokenreviews"]
13+
verbs: ["create"]

‎deployment/kubernetes/helm/ros-ocp/templates/clusterrolebinding-insights-ros-ingress.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{/* Create ClusterRoleBinding for insights-ros-ingress service account */}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ include "ros-ocp.fullname" . }}-insights-ros-ingress
6+
labels:
7+
{{- include "ros-ocp.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: rbac
9+
roleRef:
10+
apiGroup: rbac.authorization.k8s.io
11+
kind: ClusterRole
12+
name: {{ include "ros-ocp.fullname" . }}-insights-ros-ingress
13+
subjects:
14+
- kind: ServiceAccount
15+
name: insights-ros-ingress
16+
namespace: {{ .Release.Namespace }}

‎deployment/kubernetes/helm/ros-ocp/templates/deployment-ingress.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ spec:
5151
done
5252
echo "Kafka is ready"
5353
echo "Kafka is ready"
54+
serviceAccountName: insights-ros-ingress
5455
containers:
5556
- name: ingress
5657
image: "{{ .Values.ingress.image.repository }}:{{ .Values.ingress.image.tag }}"
@@ -141,6 +142,21 @@ spec:
141142
value: {{ .Values.ingress.metrics.path | quote }}
142143
- name: METRICS_PORT
143144
value: {{ .Values.ingress.metrics.port | quote }}
145+
146+
# HCCM Validation configuration
147+
# Platform-specific validation settings: disabled for KIND/development, enabled for OpenShift/production
148+
- name: HCCM_VALIDATION_ENABLED
149+
value: {{ if eq (include "ros-ocp.isOpenShift" .) "true" }}"true"{{ else }}"false"{{ end }}
150+
- name: HCCM_VALIDATION_SERVICE_URL
151+
value: {{ if eq (include "ros-ocp.isOpenShift" .) "true" }}{{ .Values.ingress.validation.hccm.serviceUrl | quote }}{{ else }}""{{ end }}
152+
- name: HCCM_VALIDATION_TIMEOUT
153+
value: {{ .Values.ingress.validation.hccm.timeout | quote }}
154+
- name: HCCM_VALIDATION_RETRIES
155+
value: {{ .Values.ingress.validation.hccm.retries | quote }}
156+
- name: PLATFORM_MODE
157+
value: {{ if eq (include "ros-ocp.isOpenShift" .) "true" }}"production"{{ else }}"development"{{ end }}
158+
- name: VALIDATION_BYPASS_MODE
159+
value: {{ if eq (include "ros-ocp.isOpenShift" .) "true" }}"false"{{ else }}"true"{{ end }}
144160
livenessProbe:
145161
httpGet:
146162
path: /health

‎deployment/kubernetes/helm/ros-ocp/templates/deployment-rosocp-api.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,8 @@ spec:
9999
value: {{ include "ros-ocp.databaseUrl" . }}
100100
- name: KAFKA_BOOTSTRAP_SERVERS
101101
value: {{ include "ros-ocp.fullname" . }}-kafka:{{ .Values.kafka.broker.port }}
102+
- name: ID_PROVIDER
103+
value: {{ .Values.auth.provider | quote }}
102104
livenessProbe:
103105
httpGet:
104106
path: /status

‎deployment/kubernetes/helm/ros-ocp/templates/insights-ros-ingress-serviceaccount.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: insights-ros-ingress
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "ros-ocp.labels" . | nindent 4 }}
9+
app.kubernetes.io/component: ingress

‎deployment/kubernetes/helm/ros-ocp/values.yaml‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ serviceAccount:
2020
create: true
2121
name: ros-ocp-backend
2222

23+
# Auth Configuration
24+
auth:
25+
provider: "oauth2"
26+
2327
# Database configurations
2428
database:
2529
ros: # Database configuration for ros-ocp services
@@ -157,6 +161,19 @@ ingress:
157161
path: "/metrics"
158162
port: 8080
159163

164+
# Validation configuration
165+
validation:
166+
hccm:
167+
# Enable hccm validation service (disabled for KIND/development, enabled for OpenShift/production)
168+
# This will be overridden by platform detection in deployment-ingress.yaml
169+
enabled: false
170+
# HCCM validation service URL (empty for development mode)
171+
serviceUrl: ""
172+
# Validation timeout in seconds
173+
timeout: "30"
174+
# Number of retries for validation calls
175+
retries: "3"
176+
160177
# Sources API
161178
sourcesApi:
162179
image:
@@ -227,7 +244,8 @@ kruize:
227244
rosocp:
228245
processor:
229246
image:
230-
repository: quay.io/insights-onprem/ros-ocp-backend
247+
#TODO: Change to quay.io/insights-onprem/ros-ocp-backend when access is granted
248+
repository: quay.io/jordigilh/ros-ocp-backend
231249
tag: "latest"
232250
metricsPort: 9000
233251
kafkaConsumerGroupId: rosocp-processor
@@ -239,7 +257,8 @@ rosocp:
239257

240258
recommendationPoller:
241259
image:
242-
repository: quay.io/insights-onprem/ros-ocp-backend
260+
#TODO: Change to quay.io/insights-onprem/ros-ocp-backend when access is granted
261+
repository: quay.io/jordigilh/ros-ocp-backend
243262
tag: "latest"
244263
metricsPort: 9000
245264
kafkaConsumerGroupId: rosocp-recommendation-poller
@@ -251,7 +270,8 @@ rosocp:
251270

252271
api:
253272
image:
254-
repository: quay.io/insights-onprem/ros-ocp-backend
273+
#TODO: Change to quay.io/insights-onprem/ros-ocp-backend when access is granted
274+
repository: quay.io/jordigilh/ros-ocp-backend
255275
tag: "latest"
256276
port: 8000
257277
metricsPort: 9000
@@ -264,15 +284,17 @@ rosocp:
264284

265285
housekeeper:
266286
image:
267-
repository: quay.io/insights-onprem/ros-ocp-backend
287+
#TODO: Change to quay.io/insights-onprem/ros-ocp-backend when access is granted
288+
repository: quay.io/jordigilh/ros-ocp-backend
268289
tag: "latest"
269290
serviceName: rosocp-housekeeper-sources
270291
logLevel: INFO
271292

272293
partitionCleaner:
273294
schedule: "0 0 */15 * *" # Runs at 12:00 AM, every 15 days
274295
image:
275-
repository: quay.io/insights-onprem/ros-ocp-backend
296+
#TODO: Change to quay.io/insights-onprem/ros-ocp-backend when access is granted
297+
repository: quay.io/jordigilh/ros-ocp-backend
276298
tag: "latest"
277299
serviceName: rosocp-housekeeper-partition
278300
logLevel: INFO

‎deployment/kubernetes/scripts/cleanup-kind-artifacts.sh‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
#!/bin/bash
2+
3+
# KIND Artifacts Cleanup Script
4+
# This script cleans up KIND clusters, containers, and related images
5+
# Can be used standalone or called from other scripts
6+
7+
set -e # Exit on any error
8+
9+
# Color codes for output
10+
RED='\033[0;31m'
11+
GREEN='\033[0;32m'
12+
YELLOW='\033[1;33m'
13+
BLUE='\033[0;34m'
14+
NC='\033[0m' # No Color
15+
16+
# Configuration
17+
KIND_CLUSTER_NAME=${KIND_CLUSTER_NAME:-ros-ocp-cluster}
18+
CONTAINER_RUNTIME=${CONTAINER_RUNTIME:-podman}
19+
20+
echo_info() {
21+
echo -e "${BLUE}[INFO]${NC} $1"
22+
}
23+
24+
echo_success() {
25+
echo -e "${GREEN}[SUCCESS]${NC} $1"
26+
}
27+
28+
echo_warning() {
29+
echo -e "${YELLOW}[WARNING]${NC} $1"
30+
}
31+
32+
echo_error() {
33+
echo -e "${RED}[ERROR]${NC} $1"
34+
}
35+
36+
# Function to check if a command exists
37+
command_exists() {
38+
command -v "$1" >/dev/null 2>&1
39+
}
40+
41+
# Function to detect container runtime
42+
detect_container_runtime() {
43+
local runtime="${CONTAINER_RUNTIME:-podman}"
44+
45+
if [ "$runtime" = "auto" ]; then
46+
if command_exists podman; then
47+
runtime="podman"
48+
elif command_exists docker; then
49+
runtime="docker"
50+
else
51+
echo_error "No supported container runtime found. Please install Docker or Podman."
52+
return 1
53+
fi
54+
fi
55+
56+
if ! command_exists "$runtime"; then
57+
echo_error "$runtime specified but not found. Please install $runtime."
58+
return 1
59+
fi
60+
61+
export DETECTED_RUNTIME="$runtime"
62+
echo_info "Using $runtime as container runtime"
63+
return 0
64+
}
65+
66+
# Function to clean up existing KIND containers and project images
67+
cleanup_kind_artifacts() {
68+
echo_info "Performing cleanup of KIND artifacts..."
69+
70+
# Remove KIND cluster if it exists
71+
if command_exists kind; then
72+
if kind get clusters | grep -q "^${KIND_CLUSTER_NAME}$"; then
73+
echo_info "Removing existing KIND cluster: $KIND_CLUSTER_NAME"
74+
kind delete cluster --name "$KIND_CLUSTER_NAME" || echo_warning "Failed to delete KIND cluster (may not exist)"
75+
else
76+
echo_info "No KIND cluster '$KIND_CLUSTER_NAME' found to remove"
77+
fi
78+
else
79+
echo_warning "kind command not found, skipping cluster cleanup"
80+
fi
81+
82+
# Detect container runtime for cleanup
83+
if ! detect_container_runtime; then
84+
echo_warning "Could not detect container runtime, skipping container cleanup"
85+
return 0
86+
fi
87+
88+
# Remove KIND containers that might be lingering
89+
echo_info "Cleaning up lingering KIND containers..."
90+
if command_exists "$DETECTED_RUNTIME"; then
91+
# Stop and remove KIND control plane containers
92+
"$DETECTED_RUNTIME" ps -a --format "{{.Names}}" | grep -E "kind|ros-ocp" | while read -r container; do
93+
if [ -n "$container" ]; then
94+
echo_info "Stopping and removing container: $container"
95+
"$DETECTED_RUNTIME" stop "$container" 2>/dev/null || true
96+
"$DETECTED_RUNTIME" rm "$container" 2>/dev/null || true
97+
fi
98+
done
99+
100+
# Remove project-related images
101+
echo_info "Cleaning up project-related images..."
102+
"$DETECTED_RUNTIME" images --format "{{.Repository}}:{{.Tag}}" | grep -E "ros-ocp-backend|jordigilh" | while read -r image; do
103+
if [ -n "$image" ]; then
104+
echo_info "Removing image: $image"
105+
"$DETECTED_RUNTIME" rmi -f "$image" 2>/dev/null || true
106+
fi
107+
done
108+
109+
# Remove dangling images
110+
echo_info "Cleaning up dangling images..."
111+
"$DETECTED_RUNTIME" image prune -f 2>/dev/null || true
112+
fi
113+
114+
echo_success "Cleanup completed"
115+
}
116+
117+
# Function to show help
118+
show_help() {
119+
echo "Usage: $0 [options]"
120+
echo ""
121+
echo "Clean up KIND clusters, containers, and related images"
122+
echo ""
123+
echo "Options:"
124+
echo " --cluster-name NAME KIND cluster name to clean up (default: ros-ocp-cluster)"
125+
echo " --container-runtime Container runtime to use (default: podman, supports: podman, docker, auto)"
126+
echo " --help, -h Show this help message"
127+
echo ""
128+
echo "Environment Variables:"
129+
echo " KIND_CLUSTER_NAME Name of KIND cluster (default: ros-ocp-cluster)"
130+
echo " CONTAINER_RUNTIME Container runtime to use (default: podman)"
131+
echo ""
132+
echo "Examples:"
133+
echo " $0 # Clean up default cluster"
134+
echo " $0 --cluster-name my-cluster # Clean up specific cluster"
135+
echo " CONTAINER_RUNTIME=docker $0 # Use Docker instead of Podman"
136+
}
137+
138+
# Parse command line arguments
139+
while [[ $# -gt 0 ]]; do
140+
case $1 in
141+
--cluster-name)
142+
KIND_CLUSTER_NAME="$2"
143+
shift 2
144+
;;
145+
--container-runtime)
146+
CONTAINER_RUNTIME="$2"
147+
shift 2
148+
;;
149+
--help|-h)
150+
show_help
151+
exit 0
152+
;;
153+
*)
154+
echo_error "Unknown option: $1"
155+
show_help
156+
exit 1
157+
;;
158+
esac
159+
done
160+
161+
# Main execution
162+
echo_info "Starting KIND artifacts cleanup..."
163+
echo_info "Cluster name: $KIND_CLUSTER_NAME"
164+
echo_info "Container runtime: $CONTAINER_RUNTIME"
165+
166+
cleanup_kind_artifacts
167+
168+
echo_success "KIND artifacts cleanup completed successfully!"

0 commit comments

Comments
 (0)