fix(bootstrap-kit): remove bp-netbird + bp-dmz-vcluster (charts never published) (#1289)
* fix(bp-catalyst-platform): switch gitea-token-mint Job image to alpine/k8s (curl + kubectl) bitnamilegacy/kubectl:1.29.3 lacks curl, so the post-install Job catalyst-gitea-token-mint CrashLoops with 'sh: 4: curl: not found'. Without the mint, catalyst-gitea-token Secret has empty token, catalyst-catalog + catalyst-organization-controller + catalyst-useraccess-controller all CrashLoop on 'CATALYST_GITEA_TOKEN is required'. alpine/k8s:1.31.4 bundles both kubectl 1.31.4 (matches k3s) and curl — canonical multi-tool image already used elsewhere in the platform. Caught on omantel provision #6. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(bootstrap-kit): bump bp-guacamole pin 0.1.9 → 0.1.12 (bitnamilegacy/kubectl image) bp-guacamole 0.1.9 still references docker.io/bitnami/kubectl:1.30.4 in the storageclass-migrate pre-install Job. Bitnami removed bitnami/kubectl:* tags from Docker Hub mid-2026 (canonical surface is now bitnamilegacy/*). Job goes ImagePullBackOff → pre-install hook timeout → bp-guacamole HR Failed → bootstrap-kit Kustomization Failed → sovereign-tls Kustomization deps unmet → no Cilium Gateway → console.<sovereign> TLS unreachable. Chart 0.1.12 (already on main, never pinned in bootstrap-kit) ships migrationImage: docker.io/bitnamilegacy/kubectl:1.29.3 — the legacy registry path that resolves. Caught on omantel provision #6. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(bootstrap-kit): remove bp-netbird + bp-dmz-vcluster (charts never published) Both blueprint charts have a chart-internal render test that fails ('empty image.tag did not abort render'); Blueprint Release CI never publishes them; HRs permanently fail with 'chart not found' on every fresh Sovereign provision; bootstrap-kit Kustomization wait: true healthCheck never converges; sovereign-tls Kustomization never gets ready; Cilium Gateway never created; console.<sovereign> TLS unreachable. Both blueprints are leaf nodes (no other HR depends on them). Remove from bootstrap-kit until the chart unit tests get fixed; re-add via follow-up PR with the test fixes shipped together. Caught on omantel provision #6. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: alierenbaysal <alierenbaysal@openova.io> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
e3mrah
GitHub
parent
70208c506e
commit
1492a28e60
@ -1,84 +0,0 @@
|
|||||||
# bp-netbird — Catalyst bootstrap-kit Blueprint slot 53. NetBird
|
|
||||||
# WireGuard-based zero-trust mesh + remote-access overlay.
|
|
||||||
#
|
|
||||||
# Per ADR-0001 §3.2.8 + EPIC-5 leftovers slice NB #1100: NetBird is the
|
|
||||||
# canonical operator/engineer remote-access path into Sovereign workloads.
|
|
||||||
#
|
|
||||||
# qa-loop iter-12 Fix #53C: matrix asserts the netbird namespace +
|
|
||||||
# management/signal/coturn Deployments exist (TC-281, TC-282, TC-283,
|
|
||||||
# TC-284). Without this slot the chart was authored but never installed.
|
|
||||||
#
|
|
||||||
# Wrapper chart: platform/netbird/chart/
|
|
||||||
# Reconciled by: Flux on the new Sovereign's k3s control plane.
|
|
||||||
#
|
|
||||||
# Default-OFF gate: NETBIRD_ENABLED defaults to "false" via envsubst —
|
|
||||||
# Sovereigns that want NetBird flip it to "true" in the bootstrap-kit
|
|
||||||
# Kustomization substitute.
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: netbird
|
|
||||||
labels:
|
|
||||||
catalyst.openova.io/sovereign: ${SOVEREIGN_FQDN}
|
|
||||||
---
|
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
|
||||||
kind: HelmRepository
|
|
||||||
metadata:
|
|
||||||
name: bp-netbird
|
|
||||||
namespace: flux-system
|
|
||||||
spec:
|
|
||||||
type: oci
|
|
||||||
interval: 15m
|
|
||||||
url: oci://ghcr.io/openova-io
|
|
||||||
secretRef:
|
|
||||||
name: ghcr-pull
|
|
||||||
---
|
|
||||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
||||||
kind: HelmRelease
|
|
||||||
metadata:
|
|
||||||
name: bp-netbird
|
|
||||||
namespace: flux-system
|
|
||||||
spec:
|
|
||||||
interval: 15m
|
|
||||||
releaseName: netbird
|
|
||||||
targetNamespace: netbird
|
|
||||||
dependsOn:
|
|
||||||
- name: bp-cilium
|
|
||||||
- name: bp-cert-manager
|
|
||||||
- name: bp-keycloak
|
|
||||||
- name: bp-sealed-secrets
|
|
||||||
- name: bp-nats-jetstream
|
|
||||||
chart:
|
|
||||||
spec:
|
|
||||||
chart: bp-netbird
|
|
||||||
version: 0.1.1
|
|
||||||
sourceRef:
|
|
||||||
kind: HelmRepository
|
|
||||||
name: bp-netbird
|
|
||||||
namespace: flux-system
|
|
||||||
install:
|
|
||||||
disableWait: true
|
|
||||||
remediation:
|
|
||||||
retries: 3
|
|
||||||
upgrade:
|
|
||||||
disableWait: true
|
|
||||||
remediation:
|
|
||||||
retries: 3
|
|
||||||
values:
|
|
||||||
netbird:
|
|
||||||
enabled: ${NETBIRD_ENABLED:=false}
|
|
||||||
management:
|
|
||||||
domain: netbird.${SOVEREIGN_FQDN}
|
|
||||||
coturn:
|
|
||||||
realm: netbird.${SOVEREIGN_FQDN}
|
|
||||||
oidc:
|
|
||||||
issuer: https://keycloak.${SOVEREIGN_FQDN}/realms/${SOVEREIGN_REALM_NAME:=sovereign}
|
|
||||||
redirectURI: https://netbird.${SOVEREIGN_FQDN}/
|
|
||||||
audience: netbird
|
|
||||||
httproute:
|
|
||||||
hostname: netbird.${SOVEREIGN_FQDN}
|
|
||||||
realmConfig:
|
|
||||||
enabled: true
|
|
||||||
realm: ${SOVEREIGN_REALM_NAME:=sovereign}
|
|
||||||
@ -1,71 +0,0 @@
|
|||||||
# bp-dmz-vcluster — Catalyst bootstrap-kit Blueprint slot 54. DMZ
|
|
||||||
# isolated virtual Kubernetes cluster running inside the management
|
|
||||||
# cluster.
|
|
||||||
#
|
|
||||||
# Per ADR-0001 §3.2.8 + EPIC-5 leftovers slice DMZ #1100: every
|
|
||||||
# Sovereign that publishes customer-facing APIs / webhooks gets a
|
|
||||||
# DMZ vCluster.
|
|
||||||
#
|
|
||||||
# qa-loop iter-12 Fix #53C: matrix asserts dmz namespace + vcluster
|
|
||||||
# CRD registered + omantel-dmz kubeconfig context (TC-286, TC-287,
|
|
||||||
# TC-288). Without this slot the chart was authored but never installed.
|
|
||||||
#
|
|
||||||
# Wrapper chart: products/dmz-vcluster/chart/
|
|
||||||
# Reconciled by: Flux on the new Sovereign's k3s control plane.
|
|
||||||
#
|
|
||||||
# Default-OFF gate: DMZ_VCLUSTER_ENABLED defaults to "false" via envsubst.
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: dmz
|
|
||||||
labels:
|
|
||||||
catalyst.openova.io/sovereign: ${SOVEREIGN_FQDN}
|
|
||||||
catalyst.openova.io/isolation: dmz
|
|
||||||
---
|
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
|
||||||
kind: HelmRepository
|
|
||||||
metadata:
|
|
||||||
name: bp-dmz-vcluster
|
|
||||||
namespace: flux-system
|
|
||||||
spec:
|
|
||||||
type: oci
|
|
||||||
interval: 15m
|
|
||||||
url: oci://ghcr.io/openova-io
|
|
||||||
secretRef:
|
|
||||||
name: ghcr-pull
|
|
||||||
---
|
|
||||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
||||||
kind: HelmRelease
|
|
||||||
metadata:
|
|
||||||
name: bp-dmz-vcluster
|
|
||||||
namespace: flux-system
|
|
||||||
spec:
|
|
||||||
interval: 15m
|
|
||||||
releaseName: dmz-vcluster
|
|
||||||
targetNamespace: dmz
|
|
||||||
dependsOn:
|
|
||||||
- name: bp-cilium
|
|
||||||
- name: bp-cert-manager
|
|
||||||
chart:
|
|
||||||
spec:
|
|
||||||
chart: bp-dmz-vcluster
|
|
||||||
version: 0.1.1
|
|
||||||
sourceRef:
|
|
||||||
kind: HelmRepository
|
|
||||||
name: bp-dmz-vcluster
|
|
||||||
namespace: flux-system
|
|
||||||
install:
|
|
||||||
disableWait: true
|
|
||||||
remediation:
|
|
||||||
retries: 3
|
|
||||||
upgrade:
|
|
||||||
disableWait: true
|
|
||||||
remediation:
|
|
||||||
retries: 3
|
|
||||||
values:
|
|
||||||
dmz:
|
|
||||||
enabled: ${DMZ_VCLUSTER_ENABLED:=false}
|
|
||||||
hostNamespace: dmz
|
|
||||||
vclusterName: ${DMZ_VCLUSTER_NAME:=dmz}
|
|
||||||
Loading…
Reference in New Issue
Block a user