improve

zubenkoivan · zubenkoivan · commit 9abf7b6d348f · 2025-12-11T11:05:03.000+01:00
diff --git a/charts/platform/templates/_helpers.tpl b/charts/platform/templates/_helpers.tpl
@@ -123,6 +123,10 @@ release: {{ .Release.Name | quote }}
 {{ printf "registry.%s" (include "platform.clusterDnsName" .) }}
 {{- end -}}
 
+{{- define "platform.priorityClassName" -}}
+{{- default (printf "%s-services" .Release.Namespace) .Values.priorityClassName -}}
+{{- end -}}
+
 {{- define "platform.argocd.application" -}}
 {{- $root := .root -}}
 {{- $project := default "default" $root.Values.argocd.project -}}
diff --git a/charts/platform/templates/argocd-applications/alloy-application.yaml b/charts/platform/templates/argocd-applications/alloy-application.yaml
@@ -173,9 +173,7 @@ controller:
     - key: amd.com/gpu
       effect: NoSchedule
       operator: Exists
-  {{- with .Values.priorityClassName }}
-  priorityClassName: {{ . }}
-  {{- end }}
+  priorityClassName: {{ include "platform.priorityClassName" . }}
 configReloader:
   securityContext:
     runAsUser: 65534
diff --git a/charts/platform/templates/argocd-applications/docker-registry-application.yaml b/charts/platform/templates/argocd-applications/docker-registry-application.yaml
@@ -13,9 +13,7 @@ podLabels:
   service: docker-registry
 secrets:
   haSharedSecret: {{ sha256sum (include "platform.clusterName" .) }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- end }}
 
 {{- if .Values.applications.dockerRegistry.enabled }}
diff --git a/charts/platform/templates/argocd-applications/external-secrets-application.yaml b/charts/platform/templates/argocd-applications/external-secrets-application.yaml
@@ -4,9 +4,7 @@ replicaCount: 1
 podLabels:
   service: external-secrets
   platform.apolo.us/component: external-secrets
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- end }}
 
 {{- if .Values.applications.externalSecrets.enabled }}
diff --git a/charts/platform/templates/argocd-applications/grafana-application.yaml b/charts/platform/templates/argocd-applications/grafana-application.yaml
@@ -82,9 +82,7 @@ grafana.ini:
   log:
     mode: console
     level: error
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- end }}
 
 {{- if .Values.applications.grafana.enabled }}
diff --git a/charts/platform/templates/argocd-applications/kube-prometheus-stack-application.yaml b/charts/platform/templates/argocd-applications/kube-prometheus-stack-application.yaml
@@ -71,9 +71,7 @@ kube-state-metrics:
           targetLabel: label_node_kubernetes_io_instance_type
       additionalLabels:
         platform.apolo.us/scrape-metrics: "true"
-  {{- with .Values.priorityClassName }}
-  priorityClassName: {{ . }}
-  {{- end }}
+  priorityClassName: {{ include "platform.priorityClassName" . }}
 nodeExporter:
   enabled: true
 prometheus-node-exporter:
@@ -129,9 +127,7 @@ prometheusOperator:
       platform.apolo.us/scrape-metrics: "true"
   kubeletService:
     namespace: {{ .Release.Namespace }}
-  {{- with .Values.priorityClassName }}
-  priorityClassName: {{ . }}
-  {{- end }}
+  priorityClassName: {{ include "platform.priorityClassName" . }}
 prometheus:
   prometheusSpec:
     image:
@@ -169,9 +165,7 @@ prometheus:
         platform.apolo.us/scrape-metrics: "true"
     externalLabels:
       cluster: {{ include "platform.clusterName" . }}
-    {{- with .Values.priorityClassName }}
-    priorityClassName: {{ . }}
-    {{- end }}
+    priorityClassName: {{ include "platform.priorityClassName" . }}
   serviceMonitor:
     additionalLabels:
       platform.apolo.us/scrape-metrics: "true"
diff --git a/charts/platform/templates/argocd-applications/minio-application.yaml b/charts/platform/templates/argocd-applications/minio-application.yaml
@@ -24,9 +24,7 @@ persistence:
 imagePullSecrets:
   {{- toYaml . | nindent 2 }}
 {{- end }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 ingress:
   enabled: true
   {{- with .Values.ingress.className }}
diff --git a/charts/platform/templates/argocd-applications/platform-api-poller-application.yaml b/charts/platform/templates/argocd-applications/platform-api-poller-application.yaml
@@ -39,9 +39,7 @@ ingress:
   {{- end }}
   hosts:
   - {{ include "platform.clusterDnsName" . }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-buckets-application.yaml b/charts/platform/templates/argocd-applications/platform-buckets-application.yaml
@@ -21,9 +21,7 @@ ingress:
   {{- end }}
   hosts:
   - {{ include "platform.clusterDnsName" . }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-container-runtime-application.yaml b/charts/platform/templates/argocd-applications/platform-container-runtime-application.yaml
@@ -8,9 +8,7 @@ affinity:
       - matchExpressions:
         - key: {{ .Values.nodeLabels.job | default .Values.jobs.label }}
           operator: Exists
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-disks-application.yaml b/charts/platform/templates/argocd-applications/platform-disks-application.yaml
@@ -23,9 +23,7 @@ ingress:
   {{- end }}
   hosts:
   - {{ include "platform.clusterDnsName" . }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- end -}}
 
 {{- if .Values.applications.platformDisks.enabled }}
diff --git a/charts/platform/templates/argocd-applications/platform-metadata-application.yaml b/charts/platform/templates/argocd-applications/platform-metadata-application.yaml
@@ -8,9 +8,7 @@ platform:
   appsUrl: {{ get $platformUrls "appsUrl" }}
   token:
     {{- include "platform.token" . | nindent 4 }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-monitoring-application.yaml b/charts/platform/templates/argocd-applications/platform-monitoring-application.yaml
@@ -36,9 +36,7 @@ service:
     traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
     traefik.ingress.kubernetes.io/service.sticky.cookie.name: NEURO_MONITORINGAPI_SESSION
 kubeletPort: 10250
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-registry-application.yaml b/charts/platform/templates/argocd-applications/platform-registry-application.yaml
@@ -21,9 +21,7 @@ ingress:
   {{- end }}
   hosts:
   - {{ $registryUrl.host }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-reports-application.yaml b/charts/platform/templates/argocd-applications/platform-reports-application.yaml
@@ -44,9 +44,7 @@ grafanaProxy:
     - {{ printf "metrics.%s" (include "platform.clusterDnsName" .) }}
     annotations:
       traefik.ingress.kubernetes.io/router.middlewares: {{ printf "%s-%s-ingress-auth@kubernetescrd" .Release.Namespace .Release.Name }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-secrets-application.yaml b/charts/platform/templates/argocd-applications/platform-secrets-application.yaml
@@ -22,9 +22,7 @@ service:
   annotations:
     traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
     traefik.ingress.kubernetes.io/service.sticky.cookie.name: NEURO_SECRETS_SESSION
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/platform-storage-application.yaml b/charts/platform/templates/argocd-applications/platform-storage-application.yaml
@@ -37,9 +37,7 @@ ingress:
   {{- end }}
   hosts:
   - {{ include "platform.clusterDnsName" . }}
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- with .Values.sentry }}
 sentry:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/platform/templates/argocd-applications/thanos-application.yaml b/charts/platform/templates/argocd-applications/thanos-application.yaml
@@ -64,9 +64,7 @@ sidecar:
   selector:
     app: null
     app.kubernetes.io/name: prometheus
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- end }}
 
 {{- if .Values.applications.thanos.enabled }}
diff --git a/charts/platform/templates/argocd-applications/traefik-application.yaml b/charts/platform/templates/argocd-applications/traefik-application.yaml
@@ -59,9 +59,7 @@ metrics:
         platform.apolo.us/scrape-metrics: "true"
 ingressClass:
   enabled: true
-{{- with .Values.priorityClassName }}
-priorityClassName: {{ . }}
-{{- end }}
+priorityClassName: {{ include "platform.priorityClassName" . }}
 {{- end }}
 
 {{- if .Values.applications.traefik.enabled }}
diff --git a/charts/platform/templates/external-secrets.yaml b/charts/platform/templates/external-secrets.yaml
@@ -2,19 +2,23 @@
 {{- $syncWave := add 2 (int (required "applications.externalSecrets.syncWave is required" .Values.applications.externalSecrets.syncWave)) -}}
 {{- range .Values.externalSecrets }}
 {{- $externalSecret := deepCopy . -}}
-{{- $_ := unset $externalSecret "secretStoreRef" -}}
+{{- $_ := unset $externalSecret.spec "secretStoreRef" -}}
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: {{ $externalSecret.name | quote }}
-  labels: {{ include "platform.labels.standard" $ | nindent 4 }}
+  name: {{ $externalSecret.metadata.name | quote }}
+  labels:
+    {{- include "platform.labels.standard" $ | nindent 4 }}
   annotations:
     argocd.argoproj.io/sync-wave: {{ $syncWave | quote }}
 spec:
   secretStoreRef:
     name: {{ $.Release.Name }}-vault-secret-store
     kind: ClusterSecretStore
-  {{- toYaml $externalSecret | nindent 2 }}
-{{- end }}
+  {{- if not $externalSecret.spec.refreshInterval }}
+  refreshInterval: '15s'
+  {{- end }}
+  {{- toYaml $externalSecret.spec | nindent 2 }}
+{{ end }}
 {{- end }}
diff --git a/charts/platform/tests/__snapshot__/alloy-application_test.yaml.snap b/charts/platform/tests/__snapshot__/alloy-application_test.yaml.snap
@@ -178,7 +178,7 @@ should match snapshot:
                 runAsGroup: 65534
                 runAsUser: 65534
             controller:
-              priorityClassName: platform-service
+              priorityClassName: platform-services
               tolerations:
                 - effect: NoSchedule
                   key: platform.apolo.us/worker
diff --git a/charts/platform/tests/__snapshot__/docker-registry-application_test.yaml.snap b/charts/platform/tests/__snapshot__/docker-registry-application_test.yaml.snap
@@ -30,7 +30,7 @@ should match snapshot:
             nameOverride: platform-docker-registry
             podLabels:
               service: docker-registry
-            priorityClassName: platform-service
+            priorityClassName: platform-services
             secrets:
               haSharedSecret: f069097ced1b3fc738e80c852c5a26267ef4504b7658044bb9fd1636ff545dcd
         repoURL: https://neuro-inc.github.io/helm-charts
diff --git a/charts/platform/tests/__snapshot__/external-secrets-application_test.yaml.snap b/charts/platform/tests/__snapshot__/external-secrets-application_test.yaml.snap
@@ -24,7 +24,7 @@ should match snapshot:
             podLabels:
               platform.apolo.us/component: external-secrets
               service: external-secrets
-            priorityClassName: platform-service
+            priorityClassName: platform-services
             replicaCount: 1
         repoURL: https://charts.external-secrets.io
         targetRevision: 0.20.3
diff --git a/charts/platform/tests/__snapshot__/external-secrets_test.yaml.snap b/charts/platform/tests/__snapshot__/external-secrets_test.yaml.snap
@@ -0,0 +1,43 @@
+should render external secrets:
+  1: |
+    apiVersion: external-secrets.io/v1
+    kind: ExternalSecret
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-wave: "-28"
+      labels:
+        app: platform
+        chart: platform-1.0.0
+        heritage: Helm
+        release: platform
+      name: platform-secrets
+    spec:
+      data:
+        - remoteRef:
+            key: clusters/test-cluster/platform
+            property: token
+          secretKey: platform-token
+      refreshInterval: 1h
+      secretStoreRef:
+        kind: ClusterSecretStore
+        name: platform-vault-secret-store
+  2: |
+    apiVersion: external-secrets.io/v1
+    kind: ExternalSecret
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-wave: "-28"
+      labels:
+        app: platform
+        chart: platform-1.0.0
+        heritage: Helm
+        release: platform
+      name: registry-credentials
+    spec:
+      dataFrom:
+        - extract:
+            key: clusters/test-cluster/registry
+      refreshInterval: 15s
+      secretStoreRef:
+        kind: ClusterSecretStore
+        name: platform-vault-secret-store
diff --git a/charts/platform/tests/__snapshot__/grafana-application_test.yaml.snap b/charts/platform/tests/__snapshot__/grafana-application_test.yaml.snap
@@ -77,7 +77,7 @@ should match snapshot:
               enabled: false
             podLabels:
               service: grafana
-            priorityClassName: platform-service
+            priorityClassName: platform-services
             sidecar:
               dashboards:
                 SCProvider: false
diff --git a/charts/platform/tests/__snapshot__/kube-prometheus-stack-application_test.yaml.snap b/charts/platform/tests/__snapshot__/kube-prometheus-stack-application_test.yaml.snap
@@ -62,7 +62,7 @@ should match snapshot:
                 - nodes=[platform.neuromation.io/nodepool,platform.neuromation.io/job,platform.neuromation.io/accelerator]
                 - pods=[service,platform.neuromation.io/user,platform.neuromation.io/job,platform.apolo.us/org,platform.apolo.us/project,platform.apolo.us/preset,platform.apolo.us/app-instance-name,platform.apolo.us/user]
               nameOverride: kube-state-metrics
-              priorityClassName: platform-service
+              priorityClassName: platform-services
               prometheus:
                 monitor:
                   additionalLabels:
@@ -124,7 +124,7 @@ should match snapshot:
                 podMetadata:
                   labels:
                     service: prometheus
-                priorityClassName: platform-service
+                priorityClassName: platform-services
                 replicas: 1
                 resources:
                   requests:
@@ -188,7 +188,7 @@ should match snapshot:
                 namespace: platform
               podLabels:
                 service: prometheus-operator
-              priorityClassName: platform-service
+              priorityClassName: platform-services
               prometheusConfigReloader:
                 image:
                   registry: ghcr.io
diff --git a/charts/platform/tests/__snapshot__/minio-application_test.yaml.snap b/charts/platform/tests/__snapshot__/minio-application_test.yaml.snap
@@ -40,7 +40,7 @@ should match snapshot:
               storageClass: standard
             podLabels:
               service: minio
-            priorityClassName: platform-service
+            priorityClassName: platform-services
             resources:
               requests:
                 cpu: "1"
diff --git a/charts/platform/tests/__snapshot__/platform-api-poller-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-api-poller-application_test.yaml.snap
@@ -48,7 +48,7 @@ should match snapshot:
                   secretKeyRef:
                     key: token
                     name: platform-token
-            priorityClassName: platform-service
+            priorityClassName: platform-services
             sentry:
               clusterName: test-cluster
               dsn: https://sentry-dsn
diff --git a/charts/platform/tests/__snapshot__/platform-buckets-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-buckets-application_test.yaml.snap
@@ -34,7 +34,7 @@ should match snapshot:
                   secretKeyRef:
                     key: token
                     name: platform-token
-            priorityClassName: platform-service
+            priorityClassName: platform-services
             securityContext:
               enabled: true
             sentry:
diff --git a/charts/platform/tests/__snapshot__/platform-container-runtime-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-container-runtime-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/platform-disks-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-disks-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/platform-metadata-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-metadata-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/platform-monitoring-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-monitoring-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/platform-registry-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-registry-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/platform-reports-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-reports-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/platform-secrets-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-secrets-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/platform-storage-application_test.yaml.snap b/charts/platform/tests/__snapshot__/platform-storage-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/thanos-application_test.yaml.snap b/charts/platform/tests/__snapshot__/thanos-application_test.yaml.snap
diff --git a/charts/platform/tests/__snapshot__/traefik-application_test.yaml.snap b/charts/platform/tests/__snapshot__/traefik-application_test.yaml.snap
diff --git a/charts/platform/tests/common-values.yaml b/charts/platform/tests/common-values.yaml
diff --git a/charts/platform/tests/external-secrets_test.yaml b/charts/platform/tests/external-secrets_test.yaml
