Compare commits
1 Commits
60f5f8e6f0
...
codex/spri
| Author | SHA1 | Date | |
|---|---|---|---|
|
266b9cb8be |
@@ -1,26 +0,0 @@
|
|||||||
# Runtime secrets for FlowerCore.DeviceManagement.
|
|
||||||
#
|
|
||||||
# OnePasswordItem operator syncs this item into a Kubernetes Secret with the
|
|
||||||
# same name. Expected fields:
|
|
||||||
# DB-Password
|
|
||||||
# mtls-ca.pem
|
|
||||||
# mtls-client.crt
|
|
||||||
# mtls-client.key
|
|
||||||
# mtls-chain.pem
|
|
||||||
#
|
|
||||||
# Do not add literal secret values to this repo. Runtime pods consume the
|
|
||||||
# synced Secret through env vars and read-only mounts.
|
|
||||||
apiVersion: onepassword.com/v1
|
|
||||||
kind: OnePasswordItem
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-runtime
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt
|
|
||||||
app.kubernetes.io/component: secrets
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
spec:
|
|
||||||
itemPath: "vaults/IAmWorkin/items/FlowerCore DeviceManagement Runtime"
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
# Explicit ArgoCD Application shape for bootstrap/review.
|
|
||||||
#
|
|
||||||
# The live bluejay-infra ApplicationSet already discovers apps/* directories
|
|
||||||
# and creates this same Application name (`infra-fc-devicemgmt`) automatically.
|
|
||||||
# Keep repoURL on the internal Gitea ClusterIP URL; ArgoCD does not trust the
|
|
||||||
# external step-ca HTTPS endpoint.
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: infra-fc-devicemgmt
|
|
||||||
namespace: argocd
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: http://gitea-clusterip.gitea.svc.cluster.local:3000/bluejay/bluejay-infra.git
|
|
||||||
targetRevision: main
|
|
||||||
path: apps/fc-devicemgmt
|
|
||||||
destination:
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# Certificate for devices.iamworkin.lan.
|
|
||||||
#
|
|
||||||
# Preflight gate: FlowerCore.DNS / pfSense must contain an explicit A record:
|
|
||||||
# devices.iamworkin.lan -> 10.0.56.200
|
|
||||||
# before this Certificate is synced. step-ca ACME cannot see the CoreDNS
|
|
||||||
# wildcard, so missing pfSense DNS produces cert-manager HTTP-01 backoff
|
|
||||||
# (feedback_pfsense_dns_required_for_acme).
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-web-tls
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/component: web
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
annotations:
|
|
||||||
flowercore.io/dns-preflight: "devices.iamworkin.lan must resolve to 10.0.56.200 before ACME sync"
|
|
||||||
spec:
|
|
||||||
secretName: fc-devicemgmt-web-tls
|
|
||||||
issuerRef:
|
|
||||||
name: step-ca-acme
|
|
||||||
kind: ClusterIssuer
|
|
||||||
dnsNames:
|
|
||||||
- devices.iamworkin.lan
|
|
||||||
duration: 720h
|
|
||||||
renewBefore: 240h
|
|
||||||
@@ -1,81 +0,0 @@
|
|||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-operator
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/component: operator
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- devices.flowercore.io
|
|
||||||
resources:
|
|
||||||
- '*'
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- devices.flowercore.io
|
|
||||||
resources:
|
|
||||||
- devices/status
|
|
||||||
- devices/finalizers
|
|
||||||
- devicegroups/status
|
|
||||||
- devicegroups/finalizers
|
|
||||||
- devicepolicies/status
|
|
||||||
- devicepolicies/finalizers
|
|
||||||
- remotecommands/status
|
|
||||||
- remotecommands/finalizers
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- apps
|
|
||||||
resources:
|
|
||||||
- deployments
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- pods
|
|
||||||
- services
|
|
||||||
- configmaps
|
|
||||||
- secrets
|
|
||||||
- events
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- batch
|
|
||||||
resources:
|
|
||||||
- jobs
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
resources:
|
|
||||||
- networkpolicies
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-operator
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/component: operator
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: fc-devicemgmt-operator
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: fc-devicemgmt-operator
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
@@ -1,109 +0,0 @@
|
|||||||
# FlowerCore.DeviceManagement Operator.
|
|
||||||
#
|
|
||||||
# KubeOps controller for devices.flowercore.io resources. Operator-created
|
|
||||||
# children must set OwnerReferences + traceability labels/annotations per
|
|
||||||
# k8s-pod-ownership-and-traceability-standard.md. RBAC below grants
|
|
||||||
# apps/deployments/get so the process can resolve its own Deployment UID.
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-operator
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/component: operator
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
annotations:
|
|
||||||
flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
revisionHistoryLimit: 3
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: fc-devicemgmt-operator
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/component: operator
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
annotations:
|
|
||||||
prometheus.io/scrape: "true"
|
|
||||||
prometheus.io/port: "8080"
|
|
||||||
prometheus.io/path: "/metrics"
|
|
||||||
flowercore.io/audit-trace-id: "runtime-activity-trace"
|
|
||||||
spec:
|
|
||||||
serviceAccountName: fc-devicemgmt-operator
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1654
|
|
||||||
fsGroupChangePolicy: OnRootMismatch
|
|
||||||
containers:
|
|
||||||
- name: operator
|
|
||||||
image: localhost/fc-devicemgmt-operator:v20260512-cx5
|
|
||||||
imagePullPolicy: Never
|
|
||||||
ports:
|
|
||||||
- name: metrics
|
|
||||||
containerPort: 8080
|
|
||||||
env:
|
|
||||||
- name: ASPNETCORE_ENVIRONMENT
|
|
||||||
value: "Production"
|
|
||||||
- name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
|
|
||||||
value: "false"
|
|
||||||
- name: POD_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.name
|
|
||||||
- name: POD_NAMESPACE
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.namespace
|
|
||||||
- name: FLOWERCORE_KUBERNETES_OWNER_DEPLOYMENT
|
|
||||||
value: "fc-devicemgmt-operator"
|
|
||||||
- name: FlowerCore__Service__Name
|
|
||||||
value: "FlowerCore.DeviceManagement.Operator"
|
|
||||||
- name: FlowerCore__DeviceManagement__DefaultTenantId
|
|
||||||
value: "system"
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 50m
|
|
||||||
memory: 128Mi
|
|
||||||
limits:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 512Mi
|
|
||||||
readinessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: 8080
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
livenessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: 8080
|
|
||||||
initialDelaySeconds: 20
|
|
||||||
periodSeconds: 30
|
|
||||||
securityContext:
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1654
|
|
||||||
runAsGroup: 1654
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
volumeMounts:
|
|
||||||
- name: tmp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: logs
|
|
||||||
mountPath: /app/logs
|
|
||||||
volumes:
|
|
||||||
- name: tmp
|
|
||||||
emptyDir: {}
|
|
||||||
- name: logs
|
|
||||||
emptyDir: {}
|
|
||||||
@@ -1,135 +0,0 @@
|
|||||||
# FlowerCore.DeviceManagement Web.
|
|
||||||
#
|
|
||||||
# Source repo is expected to ship FlowerCore.DeviceManagement.Web in a later
|
|
||||||
# Sprint 9+ lane. This manifest is static-valid without requiring the image to
|
|
||||||
# exist yet; import localhost/fc-devicemgmt-web:<tag> to all schedulable RKE2
|
|
||||||
# nodes before letting ArgoCD sync a live rollout.
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-web
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/component: web
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
annotations:
|
|
||||||
flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
|
|
||||||
spec:
|
|
||||||
replicas: 2
|
|
||||||
revisionHistoryLimit: 3
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: fc-devicemgmt-web
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/component: web
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
annotations:
|
|
||||||
prometheus.io/scrape: "true"
|
|
||||||
prometheus.io/port: "8080"
|
|
||||||
prometheus.io/path: "/metrics"
|
|
||||||
flowercore.io/audit-trace-id: "runtime-activity-trace"
|
|
||||||
spec:
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1654
|
|
||||||
fsGroupChangePolicy: OnRootMismatch
|
|
||||||
containers:
|
|
||||||
- name: web
|
|
||||||
image: localhost/fc-devicemgmt-web:v20260512-cx5
|
|
||||||
imagePullPolicy: Never
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
containerPort: 8080
|
|
||||||
env:
|
|
||||||
- name: ASPNETCORE_URLS
|
|
||||||
value: "http://+:8080"
|
|
||||||
- name: ASPNETCORE_ENVIRONMENT
|
|
||||||
value: "Production"
|
|
||||||
- name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
|
|
||||||
value: "false"
|
|
||||||
- name: FlowerCore__Service__Name
|
|
||||||
value: "FlowerCore.DeviceManagement.Web"
|
|
||||||
- name: FlowerCore__DeviceManagement__DefaultTenantId
|
|
||||||
value: "system"
|
|
||||||
- name: FlowerCore__Database__Provider
|
|
||||||
value: "MySql"
|
|
||||||
- name: FlowerCore__Database__Host
|
|
||||||
value: "mysql.fc-mysql.svc"
|
|
||||||
- name: FlowerCore__Database__Database
|
|
||||||
value: "flowercore_devicemgmt"
|
|
||||||
- name: FlowerCore__Database__User
|
|
||||||
value: "fc_devicemgmt"
|
|
||||||
- name: FlowerCore__Database__Password
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: fc-devicemgmt-runtime
|
|
||||||
key: DB-Password
|
|
||||||
- name: FlowerCore__DeviceManagement__AgentMtls__CaPath
|
|
||||||
value: "/secrets/devicemgmt-mtls/mtls-ca.pem"
|
|
||||||
- name: FlowerCore__DeviceManagement__AgentMtls__ClientCertificatePath
|
|
||||||
value: "/secrets/devicemgmt-mtls/mtls-client.crt"
|
|
||||||
- name: FlowerCore__DeviceManagement__AgentMtls__ClientKeyPath
|
|
||||||
value: "/secrets/devicemgmt-mtls/mtls-client.key"
|
|
||||||
- name: FlowerCore__EventBus__Redis__Configuration
|
|
||||||
value: "redis.fc-redis.svc:6379"
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 256Mi
|
|
||||||
limits:
|
|
||||||
cpu: 1000m
|
|
||||||
memory: 768Mi
|
|
||||||
startupProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: 8080
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
failureThreshold: 30
|
|
||||||
readinessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: 8080
|
|
||||||
periodSeconds: 10
|
|
||||||
failureThreshold: 3
|
|
||||||
livenessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: 8080
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 30
|
|
||||||
failureThreshold: 3
|
|
||||||
securityContext:
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1654
|
|
||||||
runAsGroup: 1654
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
volumeMounts:
|
|
||||||
- name: tmp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: logs
|
|
||||||
mountPath: /app/logs
|
|
||||||
- name: devicemgmt-mtls
|
|
||||||
mountPath: /secrets/devicemgmt-mtls
|
|
||||||
readOnly: true
|
|
||||||
volumes:
|
|
||||||
- name: tmp
|
|
||||||
emptyDir: {}
|
|
||||||
- name: logs
|
|
||||||
emptyDir: {}
|
|
||||||
- name: devicemgmt-mtls
|
|
||||||
secret:
|
|
||||||
secretName: fc-devicemgmt-runtime
|
|
||||||
defaultMode: 0400
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
# LAN ingress for FlowerCore.DeviceManagement Web.
|
|
||||||
#
|
|
||||||
# RKE2 Traefik has no built-in ACME resolver configured. Keep TLS certificate
|
|
||||||
# ownership in cert-manager Certificate/fc-devicemgmt-web-tls.
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-web
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/component: web
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`devices.iamworkin.lan`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: fc-devicemgmt-web
|
|
||||||
port: 80
|
|
||||||
tls:
|
|
||||||
secretName: fc-devicemgmt-web-tls
|
|
||||||
|
|
||||||
# Future public agent/update host gate (OFF by default):
|
|
||||||
#
|
|
||||||
# Do not enable `update.flowercore.io` here until Authentik OIDC Q-OIDC-1
|
|
||||||
# resolves the public-device-management auth model and route ownership with
|
|
||||||
# UpdateCenter. When enabled, use a separate public IngressRoute with an
|
|
||||||
# explicit Method allowlist, public-host auth middleware, and public TLS
|
|
||||||
# certificate strategy. Leaving this as comments keeps ArgoCD from stealing
|
|
||||||
# live UpdateCenter traffic.
|
|
||||||
#
|
|
||||||
# apiVersion: traefik.io/v1alpha1
|
|
||||||
# kind: IngressRoute
|
|
||||||
# metadata:
|
|
||||||
# name: fc-devicemgmt-web-public
|
|
||||||
# namespace: fc-devicemgmt
|
|
||||||
# annotations:
|
|
||||||
# flowercore.io/public-host-gate: "disabled-until-Q-OIDC-1"
|
|
||||||
# spec:
|
|
||||||
# entryPoints:
|
|
||||||
# - websecure
|
|
||||||
# routes:
|
|
||||||
# - match: Host(`update.flowercore.io`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
|
|
||||||
# kind: Rule
|
|
||||||
# services:
|
|
||||||
# - name: fc-devicemgmt-web
|
|
||||||
# port: 80
|
|
||||||
# tls:
|
|
||||||
# secretName: fc-devicemgmt-public-tls
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
# FlowerCore.DeviceManagement namespace.
|
|
||||||
#
|
|
||||||
# ArgoCD discovers this directory as Application `infra-fc-devicemgmt`.
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
@@ -1,224 +0,0 @@
|
|||||||
# FlowerCore.DeviceManagement NetworkPolicies.
|
|
||||||
#
|
|
||||||
# NetworkPolicies belong in bluejay-infra so ArgoCD owns rebuild state.
|
|
||||||
# Rules include Traefik post-DNAT backend ports per
|
|
||||||
# feedback_netpol_dnat_backend_port and Synology NFS egress for the requested
|
|
||||||
# cold-tier / future artifact path.
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-web-isolation
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/component: web
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
app: fc-devicemgmt-web
|
|
||||||
policyTypes:
|
|
||||||
- Ingress
|
|
||||||
- Egress
|
|
||||||
ingress:
|
|
||||||
# LAN edge: only cluster Traefik should reach the Web pod for
|
|
||||||
# devices.iamworkin.lan.
|
|
||||||
- from:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: traefik-system
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: traefik
|
|
||||||
ports:
|
|
||||||
- port: 8080
|
|
||||||
protocol: TCP
|
|
||||||
# Direct LAN diagnostics are allowed only from FlowerCore LAN/VPN ranges.
|
|
||||||
- from:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.56.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.57.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.58.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.68.0/27
|
|
||||||
ports:
|
|
||||||
- port: 8080
|
|
||||||
protocol: TCP
|
|
||||||
egress:
|
|
||||||
# CoreDNS.
|
|
||||||
- to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: kube-system
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
k8s-app: kube-dns
|
|
||||||
ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
- port: 53
|
|
||||||
protocol: TCP
|
|
||||||
# Database namespace.
|
|
||||||
- to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: fc-mysql
|
|
||||||
ports:
|
|
||||||
- port: 3306
|
|
||||||
protocol: TCP
|
|
||||||
# Redis backplane for multi-replica SignalR / live-status fan-out.
|
|
||||||
- to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: fc-redis
|
|
||||||
ports:
|
|
||||||
- port: 6379
|
|
||||||
protocol: TCP
|
|
||||||
# Traefik VIP / in-cluster Traefik for self-callbacks and public URL
|
|
||||||
# generation tests. Include post-DNAT backend ports 8443 + 8080.
|
|
||||||
- to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.56.200/32
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: traefik-system
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: traefik
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
protocol: TCP
|
|
||||||
- port: 443
|
|
||||||
protocol: TCP
|
|
||||||
- port: 8080
|
|
||||||
protocol: TCP
|
|
||||||
- port: 8443
|
|
||||||
protocol: TCP
|
|
||||||
# Agent egress: LAN/VPN devices may run DM Agent in Generic, Kiosk, Pi,
|
|
||||||
# ThinClient, or Server mode. Keep this private-range only.
|
|
||||||
- to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.56.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.57.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.58.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.68.0/27
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
protocol: TCP
|
|
||||||
- port: 443
|
|
||||||
protocol: TCP
|
|
||||||
- port: 8080
|
|
||||||
protocol: TCP
|
|
||||||
- port: 8443
|
|
||||||
protocol: TCP
|
|
||||||
- port: 5000
|
|
||||||
protocol: TCP
|
|
||||||
- port: 5001
|
|
||||||
protocol: TCP
|
|
||||||
# Synology NFS cold-tier / artifact mount allowance.
|
|
||||||
- to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.58.3/32
|
|
||||||
ports:
|
|
||||||
- port: 2049
|
|
||||||
protocol: TCP
|
|
||||||
- port: 2049
|
|
||||||
protocol: UDP
|
|
||||||
- port: 111
|
|
||||||
protocol: TCP
|
|
||||||
- port: 111
|
|
||||||
protocol: UDP
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-operator-isolation
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/component: operator
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
app: fc-devicemgmt-operator
|
|
||||||
policyTypes:
|
|
||||||
- Ingress
|
|
||||||
- Egress
|
|
||||||
ingress:
|
|
||||||
- from:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: monitoring
|
|
||||||
ports:
|
|
||||||
- port: 8080
|
|
||||||
protocol: TCP
|
|
||||||
egress:
|
|
||||||
# CoreDNS.
|
|
||||||
- to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: kube-system
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
k8s-app: kube-dns
|
|
||||||
ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
- port: 53
|
|
||||||
protocol: TCP
|
|
||||||
# Kubernetes API for KubeOps reconciliation and Deployment UID lookup.
|
|
||||||
- to: []
|
|
||||||
ports:
|
|
||||||
- port: 443
|
|
||||||
protocol: TCP
|
|
||||||
- port: 6443
|
|
||||||
protocol: TCP
|
|
||||||
# Agent egress for operator-initiated probes / fallback command dispatch.
|
|
||||||
- to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.56.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.57.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.58.0/24
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.68.0/27
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
protocol: TCP
|
|
||||||
- port: 443
|
|
||||||
protocol: TCP
|
|
||||||
- port: 8080
|
|
||||||
protocol: TCP
|
|
||||||
- port: 8443
|
|
||||||
protocol: TCP
|
|
||||||
- port: 5000
|
|
||||||
protocol: TCP
|
|
||||||
- port: 5001
|
|
||||||
protocol: TCP
|
|
||||||
# Synology NFS allowance for future cold-tier/audit archival jobs.
|
|
||||||
- to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.58.3/32
|
|
||||||
ports:
|
|
||||||
- port: 2049
|
|
||||||
protocol: TCP
|
|
||||||
- port: 2049
|
|
||||||
protocol: UDP
|
|
||||||
- port: 111
|
|
||||||
protocol: TCP
|
|
||||||
- port: 111
|
|
||||||
protocol: UDP
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-web
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-web
|
|
||||||
app.kubernetes.io/component: web
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: fc-devicemgmt-web
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
port: 80
|
|
||||||
targetPort: 8080
|
|
||||||
protocol: TCP
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: fc-devicemgmt-operator
|
|
||||||
namespace: fc-devicemgmt
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fc-devicemgmt-operator
|
|
||||||
app.kubernetes.io/component: operator
|
|
||||||
app.kubernetes.io/part-of: flowercore
|
|
||||||
app.kubernetes.io/managed-by: argocd
|
|
||||||
flowercore.io/tenant-id: system
|
|
||||||
flowercore.io/created-by: bluejay-infra
|
|
||||||
@@ -1,2 +1,3 @@
|
|||||||
# Settle DRM for 2s before restarting Chromium, then redeclare capabilities.
|
# Restart kiosk and redeclare capabilities when HDMI connect/disconnect changes DRM state.
|
||||||
SUBSYSTEM=="drm", KERNEL=="card?-HDMI-A-?", ACTION=="change", RUN+="/usr/bin/systemctl start flowercore-signage-player-pi-hdmi.service"
|
SUBSYSTEM=="drm", KERNEL=="card?-HDMI-A-?", ACTION=="change", RUN+="/usr/bin/systemctl restart flowercore-signage-player-pi.service"
|
||||||
|
SUBSYSTEM=="drm", KERNEL=="card?-HDMI-A-?", ACTION=="change", RUN+="/usr/bin/systemctl start flowercore-signage-detect-display.service"
|
||||||
|
|||||||
@@ -1,22 +0,0 @@
|
|||||||
#!/usr/bin/env bats
|
|
||||||
|
|
||||||
setup() {
|
|
||||||
APP_ROOT="$(cd "$BATS_TEST_DIRNAME/.." && pwd)"
|
|
||||||
DETECT="$APP_ROOT/scripts/fc-signage-detect-display"
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "display detection emits graceful disconnected profile when no hdmi connector is present" {
|
|
||||||
script="$(cat "$DETECT")"
|
|
||||||
[[ "$script" == *"displayConnected: false"* ]]
|
|
||||||
[[ "$script" == *"No HDMI display detected"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "display detection parses edid, falls back to kmsprint, and logs endpoint failures locally" {
|
|
||||||
script="$(cat "$DETECT")"
|
|
||||||
[[ "$script" == *"edid-decode"* ]]
|
|
||||||
[[ "$script" == *"HDR (Static|Dynamic) Metadata Block"* ]]
|
|
||||||
[[ "$script" == *"kmsprint"* ]]
|
|
||||||
[[ "$script" == *"/api/v1/nodes/\${NODE_ID}/capabilities"* ]]
|
|
||||||
[[ "$script" == *"/api/v1/displays/\${NODE_ID}/capability-profile"* ]]
|
|
||||||
[[ "$script" == *"capabilities.log"* ]]
|
|
||||||
}
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
#!/usr/bin/env bats
|
|
||||||
|
|
||||||
setup() {
|
|
||||||
APP_ROOT="$(cd "$BATS_TEST_DIRNAME/.." && pwd)"
|
|
||||||
BOOTSTRAP="$APP_ROOT/scripts/flowercore-signage-bootstrap.sh"
|
|
||||||
RENEW="$APP_ROOT/scripts/flowercore-signage-renew-cert.sh"
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "bootstrap is idempotent when node is already enrolled" {
|
|
||||||
script="$(cat "$BOOTSTRAP")"
|
|
||||||
[[ "$script" == *'[[ -s "$NODE_JSON" && -s "$CERT_DIR/client.p12" ]]'* ]]
|
|
||||||
[[ "$script" == *"already enrolled"* ]]
|
|
||||||
[[ "$script" == *"exit 0"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "bootstrap generates a stable node uuid and machine id" {
|
|
||||||
script="$(cat "$BOOTSTRAP")"
|
|
||||||
[[ "$script" == *"uuidgen"* ]]
|
|
||||||
[[ "$script" == *"nodeUuid"* ]]
|
|
||||||
[[ "$script" == *"machineId"* ]]
|
|
||||||
[[ "$script" == *"cut -c1-16"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "bootstrap posts to the canonical register endpoint" {
|
|
||||||
grep -q '/api/v1/nodes/register' "$BOOTSTRAP"
|
|
||||||
grep -q '"linux-arm64-pi"' "$BOOTSTRAP"
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "bootstrap retries registration once for first-call races" {
|
|
||||||
script="$(cat "$BOOTSTRAP")"
|
|
||||||
[[ "$script" == *"for attempt in 1 2"* ]]
|
|
||||||
[[ "$script" == *"register attempt \$attempt returned"* ]]
|
|
||||||
[[ "$script" == *"sleep 5"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "bootstrap supports setup-code approval with manual polling fallback" {
|
|
||||||
script="$(cat "$BOOTSTRAP")"
|
|
||||||
[[ "$script" == *"signage-setup-code"* ]]
|
|
||||||
[[ "$script" == *"approve-via-setup-code"* ]]
|
|
||||||
[[ "$script" == *"+ 1800"* ]]
|
|
||||||
[[ "$script" == *"sleep 15"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "bootstrap generates an ecdsa p256 csr for the signage pi subject" {
|
|
||||||
script="$(cat "$BOOTSTRAP")"
|
|
||||||
[[ "$script" == *"ecparam -genkey -name prime256v1"* ]]
|
|
||||||
[[ "$script" == *'/CN=${NODE_ID}/O=FlowerCore/OU=SignagePlayer-Pi'* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "bootstrap writes pkcs12 bundle with restrictive permissions" {
|
|
||||||
script="$(cat "$BOOTSTRAP")"
|
|
||||||
[[ "$script" == *"openssl pkcs12 -export"* ]]
|
|
||||||
[[ "$script" == *"client.p12.pass"* ]]
|
|
||||||
[[ "$script" == *"chmod 0640"* ]]
|
|
||||||
[[ "$script" == *"chmod 0600"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "renewal only calls renew endpoint inside the thirty-day window and swaps atomically" {
|
|
||||||
script="$(cat "$RENEW")"
|
|
||||||
[[ "$script" == *'-checkend $((30*24*3600))'* ]]
|
|
||||||
[[ "$script" == *"/api/v1/nodes/\${NODE_ID}/renew"* ]]
|
|
||||||
[[ "$script" == *"client.key.new"* ]]
|
|
||||||
[[ "$script" == *'mv "$CERT_DIR/client.p12.new" "$CERT_DIR/client.p12"'* ]]
|
|
||||||
}
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
#!/usr/bin/env bats
|
|
||||||
|
|
||||||
setup() {
|
|
||||||
APP_ROOT="$(cd "$BATS_TEST_DIRNAME/.." && pwd)"
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "player unit exists" {
|
|
||||||
[ -f "$APP_ROOT/systemd/flowercore-signage-player-pi.service" ]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "player unit uses simple chromium service with restart backoff" {
|
|
||||||
unit="$(cat "$APP_ROOT/systemd/flowercore-signage-player-pi.service")"
|
|
||||||
[[ "$unit" == *"Type=simple"* ]]
|
|
||||||
[[ "$unit" == *"Restart=always"* ]]
|
|
||||||
[[ "$unit" == *"RestartSec=10s"* ]]
|
|
||||||
[[ "$unit" == *"StartLimitBurst=5"* ]]
|
|
||||||
[[ "$unit" == *"StartLimitIntervalSec=300s"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "player unit caps chromium memory at two gigabytes" {
|
|
||||||
grep -q '^MemoryMax=2G$' "$APP_ROOT/systemd/flowercore-signage-player-pi.service"
|
|
||||||
grep -q '^MemoryHigh=1500M$' "$APP_ROOT/systemd/flowercore-signage-player-pi.service"
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "player unit condition-gates startup on identity and p12 certificate" {
|
|
||||||
grep -q '^ConditionPathExists=/etc/flowercore/signage-node.json$' "$APP_ROOT/systemd/flowercore-signage-player-pi.service"
|
|
||||||
grep -q '^ConditionPathExists=/etc/fc-signage-player/client.p12$' "$APP_ROOT/systemd/flowercore-signage-player-pi.service"
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "player unit runs prelaunch checks before chromium" {
|
|
||||||
grep -q '^ExecStartPre=/usr/local/bin/flowercore-signage-prelaunch.sh$' "$APP_ROOT/systemd/flowercore-signage-player-pi.service"
|
|
||||||
grep -q '^ExecStart=/usr/local/bin/flowercore-signage-launch.sh$' "$APP_ROOT/systemd/flowercore-signage-player-pi.service"
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "hdmi udev rule routes through the two-second settle service" {
|
|
||||||
rule="$(cat "$APP_ROOT/systemd/99-flowercore-signage-hdmi.rules")"
|
|
||||||
[[ "$rule" == *'KERNEL=="card?-HDMI-A-?"'* ]]
|
|
||||||
[[ "$rule" == *"systemctl start flowercore-signage-player-pi-hdmi.service"* ]]
|
|
||||||
[[ "$rule" != *"systemctl restart flowercore-signage-player-pi.service"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "hdmi responder settles, declares display, then restarts chromium" {
|
|
||||||
responder="$(cat "$APP_ROOT/scripts/flowercore-signage-hdmi-respond.sh")"
|
|
||||||
[[ "$responder" == *"sleep 2"* ]]
|
|
||||||
[[ "$responder" == *"systemctl start flowercore-signage-detect-display.service"* ]]
|
|
||||||
[[ "$responder" == *"systemctl restart flowercore-signage-player-pi.service"* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "chromium policy json is valid and disables credential prompts" {
|
|
||||||
command -v jq >/dev/null || skip "jq not installed"
|
|
||||||
jq -e '.AutofillAddressEnabled == false and .AutofillCreditCardEnabled == false and .PasswordManagerEnabled == false' \
|
|
||||||
"$APP_ROOT/chromium-policies/flowercore-signage.json" >/dev/null
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "launch script tries embed URL and logs bare-player fallback" {
|
|
||||||
launch="$(cat "$APP_ROOT/scripts/flowercore-signage-launch.sh")"
|
|
||||||
[[ "$launch" == *'/player/${NODE_ID}/embed?token=${CERT_THUMB}'* ]]
|
|
||||||
[[ "$launch" == *"url-divergence.log"* ]]
|
|
||||||
[[ "$launch" == *'/player/${NODE_ID}?token=${CERT_THUMB}'* ]]
|
|
||||||
}
|
|
||||||
|
|
||||||
@test "prelaunch script validates required node and cert files" {
|
|
||||||
prelaunch="$(cat "$APP_ROOT/scripts/flowercore-signage-prelaunch.sh")"
|
|
||||||
[[ "$prelaunch" == *"/etc/flowercore/signage-node.json"* ]]
|
|
||||||
[[ "$prelaunch" == *"/etc/fc-signage-player/client.p12"* ]]
|
|
||||||
[[ "$prelaunch" == *"/etc/fc-signage-player/client.p12.pass"* ]]
|
|
||||||
[[ "$prelaunch" == *"exit 1"* ]]
|
|
||||||
}
|
|
||||||
38
apps/github-runner/README.md
Normal file
38
apps/github-runner/README.md
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
# github-runner
|
||||||
|
|
||||||
|
ArgoCD-managed repo-scoped Linux GitHub Actions runners for FlowerCore.
|
||||||
|
|
||||||
|
`astoltz` is a GitHub user account, not an organization, so each repository
|
||||||
|
needs its own runner registration. The existing Common runner remains
|
||||||
|
`Deployment/github-runner`; Sprint 29 adds one single-replica Deployment for
|
||||||
|
each top Linux-cost repo:
|
||||||
|
|
||||||
|
- `FlowerCore.Puppet`
|
||||||
|
- `FlowerCore.Signage`
|
||||||
|
- `FlowerCore.DMS`
|
||||||
|
- `FlowerCore.Telephony`
|
||||||
|
- `FlowerCore.Print.Web`
|
||||||
|
- `FlowerCore.Chat`
|
||||||
|
- `FlowerCore.MySQL`
|
||||||
|
- `FlowerCore.Kiosk.Linux`
|
||||||
|
|
||||||
|
Each runner uses `myoung34/github-runner:latest`, `EPHEMERAL=true`, and labels
|
||||||
|
`self-hosted,linux,fc-build-linux`. The shared `github-runner-token` Secret is
|
||||||
|
synced from the existing 1Password item `GitHub PAT (Runner Registration)` and
|
||||||
|
is consumed as `ACCESS_TOKEN`.
|
||||||
|
|
||||||
|
Do not `kubectl apply` this app over ArgoCD. Merge to `main`, let
|
||||||
|
`infra-github-runner` sync, then verify from `noc1`:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kubectl -n github-runner get deploy,pods,pvc
|
||||||
|
|
||||||
|
for repo in FlowerCore.Puppet FlowerCore.Signage FlowerCore.DMS FlowerCore.Telephony FlowerCore.Print.Web FlowerCore.Chat FlowerCore.MySQL FlowerCore.Kiosk.Linux; do
|
||||||
|
gh api "/repos/astoltz/$repo/actions/runners" \
|
||||||
|
--jq '.runners[] | select((.labels[].name == "fc-build-linux") and (.status == "online")) | {name,status,busy,labels:[.labels[].name]}'
|
||||||
|
done
|
||||||
|
```
|
||||||
|
|
||||||
|
`LinuxRunnerOffline` is declared in `apps/monitoring/noc-monitoring.yaml` and
|
||||||
|
fires when any Common or top-8 Linux runner deployment has no available replica
|
||||||
|
for 10 minutes.
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -75,20 +75,6 @@ data:
|
|||||||
cluster: "rke2"
|
cluster: "rke2"
|
||||||
role: "agent"
|
role: "agent"
|
||||||
|
|
||||||
# Mac mini macOS runner node (INFRA VLAN)
|
|
||||||
- job_name: "macmini-node"
|
|
||||||
scrape_timeout: 15s
|
|
||||||
static_configs:
|
|
||||||
- targets: ["10.0.56.115:9100"]
|
|
||||||
labels:
|
|
||||||
instance: "macmini"
|
|
||||||
host: "macmini.iamworkin.lan"
|
|
||||||
vlan: "infra"
|
|
||||||
arch: "arm64"
|
|
||||||
role: "macos-runner"
|
|
||||||
puppet_managed: "true"
|
|
||||||
puppet_server: "puppet.iamworkin.lan"
|
|
||||||
|
|
||||||
# In-cluster node-exporter DaemonSet
|
# In-cluster node-exporter DaemonSet
|
||||||
- job_name: "k8s-node-exporter"
|
- job_name: "k8s-node-exporter"
|
||||||
kubernetes_sd_configs:
|
kubernetes_sd_configs:
|
||||||
@@ -711,18 +697,6 @@ data:
|
|||||||
summary: "Print.Web Ollama runner held for >10m ({{ $labels.model }})"
|
summary: "Print.Web Ollama runner held for >10m ({{ $labels.model }})"
|
||||||
description: "Print.Web reports model {{ $labels.model }} with {{ $value | printf \"%.0f\" }}s of keep-alive remaining. Check concurrent requests before the Pi 5 Ollama lane thrashes."
|
description: "Print.Web reports model {{ $labels.model }} with {{ $value | printf \"%.0f\" }}s of keep-alive remaining. Check concurrent requests before the Pi 5 Ollama lane thrashes."
|
||||||
|
|
||||||
- name: macmini-runners
|
|
||||||
rules:
|
|
||||||
- alert: MacMiniRunnerOffline
|
|
||||||
expr: (flowercore_github_runner_online{runner=~"macmini-.*"} == 0) or absent(flowercore_github_runner_online{runner=~"macmini-.*"})
|
|
||||||
for: 10m
|
|
||||||
labels:
|
|
||||||
severity: warning
|
|
||||||
service: github-runner
|
|
||||||
annotations:
|
|
||||||
summary: "Mac mini GitHub runner offline ({{ $labels.runner }})"
|
|
||||||
description: "A macmini-* GitHub Actions runner has not reported online for more than 10 minutes. Puppet manages its LaunchDaemon under /Library/LaunchDaemons/io.flowercore.github-runner-<slug>.plist; runners survive reboot and do not require a GUI session."
|
|
||||||
|
|
||||||
- name: remote-desktop
|
- name: remote-desktop
|
||||||
rules:
|
rules:
|
||||||
- alert: RemoteDesktopWebDown
|
- alert: RemoteDesktopWebDown
|
||||||
@@ -1000,6 +974,19 @@ data:
|
|||||||
summary: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} replica mismatch"
|
summary: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} replica mismatch"
|
||||||
description: "Spec wants {{ $labels.spec_replicas }} but only {{ $value }} available. Likely a rollout stuck on probe failure, scheduling, or PVC."
|
description: "Spec wants {{ $labels.spec_replicas }} but only {{ $value }} available. Likely a rollout stuck on probe failure, scheduling, or PVC."
|
||||||
|
|
||||||
|
- alert: LinuxRunnerOffline
|
||||||
|
expr: |
|
||||||
|
kube_deployment_status_replicas_available{namespace="github-runner",deployment=~"github-runner(|-(puppet|signage|dms|telephony|print-web|chat|mysql|kiosk-linux))"} < 1
|
||||||
|
for: 10m
|
||||||
|
labels:
|
||||||
|
severity: warning
|
||||||
|
service: github-runner
|
||||||
|
alert_channel: thermal_print
|
||||||
|
annotations:
|
||||||
|
summary: "Linux GitHub Actions runner offline: {{ $labels.deployment }}"
|
||||||
|
description: "{{ $labels.deployment }} has no available runner pod for 10 minutes. GitHub jobs using [self-hosted, linux, fc-build-linux] for its repo will queue at $0 until the runner returns."
|
||||||
|
runbook_url: "https://gitea.iamworkin.lan/bluejay/FlowerCore.Notes/src/branch/master/docs/infrastructure/self-hosted-runner-fleet.md"
|
||||||
|
|
||||||
# Q-MR-3 (2026-05-11): multus memory pressure — catches the next OOM
|
# Q-MR-3 (2026-05-11): multus memory pressure — catches the next OOM
|
||||||
# cascade BEFORE multus is OOM-killed cluster-wide. The 2026-05-10
|
# cascade BEFORE multus is OOM-killed cluster-wide. The 2026-05-10
|
||||||
# outage (21h) hit because no alert fired on the rising multus working
|
# outage (21h) hit because no alert fired on the rising multus working
|
||||||
@@ -3453,24 +3440,25 @@ data:
|
|||||||
relativeTimeRange: {from: 120, to: 0}
|
relativeTimeRange: {from: 120, to: 0}
|
||||||
datasourceUid: __expr__
|
datasourceUid: __expr__
|
||||||
model: {type: threshold, expression: B, conditions: [{evaluator: {params: [1], type: lt}}], refId: C}
|
model: {type: threshold, expression: B, conditions: [{evaluator: {params: [1], type: lt}}], refId: C}
|
||||||
- uid: macmini-runner-offline
|
- uid: linux-runner-offline
|
||||||
title: MacMiniRunnerOffline
|
title: LinuxRunnerOffline
|
||||||
condition: C
|
condition: C
|
||||||
for: 10m
|
for: 10m
|
||||||
noDataState: Alerting
|
noDataState: Alerting
|
||||||
execErrState: OK
|
execErrState: OK
|
||||||
annotations:
|
annotations:
|
||||||
summary: Mac mini GitHub runner offline
|
summary: Linux GitHub Actions runner offline
|
||||||
description: "One or more macmini-* GitHub Actions runners have not reported online for more than 10 minutes. LaunchDaemons survive reboot and do not require the bluejay GUI session."
|
description: "A repo-scoped fc-build-linux runner deployment has no available pod. Jobs will queue at $0 until ArgoCD/K8s returns the runner."
|
||||||
runbook: "1. ssh fcadmin@macmini.iamworkin.lan 2. launchctl print system/io.flowercore.github-runner-<slug> 3. Check /Users/fcadmin/Library/Logs/github-runners/<slug>/stderr.log 4. Re-register the repo runner if .runner is missing"
|
runbook_url: "https://gitea.iamworkin.lan/bluejay/FlowerCore.Notes/src/branch/master/docs/infrastructure/self-hosted-runner-fleet.md"
|
||||||
labels:
|
labels:
|
||||||
severity: warning
|
severity: warning
|
||||||
service: github-runner
|
service: github-runner
|
||||||
|
alert_channel: thermal_print
|
||||||
data:
|
data:
|
||||||
- refId: A
|
- refId: A
|
||||||
relativeTimeRange: {from: 600, to: 0}
|
relativeTimeRange: {from: 600, to: 0}
|
||||||
datasourceUid: prometheus
|
datasourceUid: prometheus
|
||||||
model: {expr: 'min(flowercore_github_runner_online{runner=~"macmini-.*"} or vector(0))', instant: true, refId: A}
|
model: {expr: 'min by(deployment) (kube_deployment_status_replicas_available{namespace="github-runner",deployment=~"github-runner(|-(puppet|signage|dms|telephony|print-web|chat|mysql|kiosk-linux))"})', instant: true, refId: A}
|
||||||
- refId: B
|
- refId: B
|
||||||
relativeTimeRange: {from: 600, to: 0}
|
relativeTimeRange: {from: 600, to: 0}
|
||||||
datasourceUid: __expr__
|
datasourceUid: __expr__
|
||||||
|
|||||||
@@ -54,6 +54,18 @@ public sealed class FleetManifestLintTests
|
|||||||
"ttsreader-piper",
|
"ttsreader-piper",
|
||||||
};
|
};
|
||||||
|
|
||||||
|
private static readonly IReadOnlyDictionary<string, string> TopLinuxRunnerRepos = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||||
|
{
|
||||||
|
["github-runner-puppet"] = "https://github.com/astoltz/FlowerCore.Puppet",
|
||||||
|
["github-runner-signage"] = "https://github.com/astoltz/FlowerCore.Signage",
|
||||||
|
["github-runner-dms"] = "https://github.com/astoltz/FlowerCore.DMS",
|
||||||
|
["github-runner-telephony"] = "https://github.com/astoltz/FlowerCore.Telephony",
|
||||||
|
["github-runner-print-web"] = "https://github.com/astoltz/FlowerCore.Print.Web",
|
||||||
|
["github-runner-chat"] = "https://github.com/astoltz/FlowerCore.Chat",
|
||||||
|
["github-runner-mysql"] = "https://github.com/astoltz/FlowerCore.MySQL",
|
||||||
|
["github-runner-kiosk-linux"] = "https://github.com/astoltz/FlowerCore.Kiosk.Linux",
|
||||||
|
};
|
||||||
|
|
||||||
[Fact]
|
[Fact]
|
||||||
public void IngressRoutes_MustKeepServiceReferencesInTheSameNamespace()
|
public void IngressRoutes_MustKeepServiceReferencesInTheSameNamespace()
|
||||||
{
|
{
|
||||||
@@ -187,6 +199,76 @@ public sealed class FleetManifestLintTests
|
|||||||
violations.Should().BeEmpty();
|
violations.Should().BeEmpty();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public void GitHubRunnerFleet_MustRegisterTopLinuxReposAsRepoScopedDeployments()
|
||||||
|
{
|
||||||
|
var deployments = Inventory.Documents
|
||||||
|
.Where(document => document.Kind == "Deployment")
|
||||||
|
.Where(document => document.Namespace == "github-runner")
|
||||||
|
.ToDictionary(document => document.Name, StringComparer.Ordinal);
|
||||||
|
|
||||||
|
foreach (var expectedRunner in TopLinuxRunnerRepos)
|
||||||
|
{
|
||||||
|
deployments.Should().ContainKey(expectedRunner.Key);
|
||||||
|
|
||||||
|
var container = deployments[expectedRunner.Key].ContainerMappings().Should().ContainSingle().Subject;
|
||||||
|
EnvValue(container, "REPO_URL").Should().Be(expectedRunner.Value);
|
||||||
|
EnvValue(container, "EPHEMERAL").Should().Be("true");
|
||||||
|
EnvValue(container, "LABELS").Should().Be("self-hosted,linux,fc-build-linux");
|
||||||
|
EnvValue(container, "ACCESS_TOKEN").Should().BeNull("ACCESS_TOKEN must come from github-runner-token Secret, not a literal");
|
||||||
|
EnvSecretName(container, "ACCESS_TOKEN").Should().Be("github-runner-token");
|
||||||
|
EnvSecretKey(container, "ACCESS_TOKEN").Should().Be("credential");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public void GitHubRunnerFleet_MustPreserveExistingCommonRunnerShape()
|
||||||
|
{
|
||||||
|
var common = Inventory.Documents
|
||||||
|
.Single(document => document.Kind == "Deployment"
|
||||||
|
&& document.Namespace == "github-runner"
|
||||||
|
&& document.Name == "github-runner");
|
||||||
|
|
||||||
|
var container = common.ContainerMappings().Should().ContainSingle().Subject;
|
||||||
|
EnvValue(container, "REPO_URL").Should().Be("https://github.com/astoltz/FlowerCore.Common");
|
||||||
|
EnvValue(container, "RUNNER_NAME_PREFIX").Should().Be("rke2-linux");
|
||||||
|
EnvValue(container, "LABELS").Should().Be("self-hosted,linux,fc-build-linux");
|
||||||
|
|
||||||
|
var claimNames = common.MappingSequence("spec", "template", "spec", "volumes")
|
||||||
|
.Select(volume => ManifestNodeExtensions.Scalar(volume, "persistentVolumeClaim", "claimName"))
|
||||||
|
.Where(value => !string.IsNullOrWhiteSpace(value))
|
||||||
|
.ToList();
|
||||||
|
|
||||||
|
claimNames.Should().Contain("github-runner-nuget-cache");
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public void GitHubRunnerFleet_MustUseOneRwoCachePerRepoScopedDeployment()
|
||||||
|
{
|
||||||
|
var pvcNames = Inventory.Documents
|
||||||
|
.Where(document => document.Kind == "PersistentVolumeClaim")
|
||||||
|
.Where(document => document.Namespace == "github-runner")
|
||||||
|
.Select(document => document.Name)
|
||||||
|
.ToHashSet(StringComparer.Ordinal);
|
||||||
|
|
||||||
|
foreach (var deploymentName in TopLinuxRunnerRepos.Keys)
|
||||||
|
{
|
||||||
|
var suffix = deploymentName["github-runner-".Length..];
|
||||||
|
pvcNames.Should().Contain($"github-runner-{suffix}-nuget-cache");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public void Monitoring_MustAlertWhenTopLinuxRunnerDeploymentIsUnavailable()
|
||||||
|
{
|
||||||
|
var monitoring = File.ReadAllText(Path.Combine(Inventory.BluejayRoot, "apps", "monitoring", "noc-monitoring.yaml"));
|
||||||
|
|
||||||
|
monitoring.Should().Contain("LinuxRunnerOffline");
|
||||||
|
monitoring.Should().Contain("kube_deployment_status_replicas_available{namespace=\"github-runner\"");
|
||||||
|
monitoring.Should().Contain("github-runner(|-(puppet|signage|dms|telephony|print-web|chat|mysql|kiosk-linux))");
|
||||||
|
monitoring.Should().Contain("runbook_url: \"https://gitea.iamworkin.lan/bluejay/FlowerCore.Notes/src/branch/master/docs/infrastructure/self-hosted-runner-fleet.md\"");
|
||||||
|
}
|
||||||
|
|
||||||
[Fact]
|
[Fact]
|
||||||
public void StatefulSets_WithVolumeClaimTemplates_MustDeclareFilesystemDefaults()
|
public void StatefulSets_WithVolumeClaimTemplates_MustDeclareFilesystemDefaults()
|
||||||
{
|
{
|
||||||
@@ -291,184 +373,6 @@ public sealed class FleetManifestLintTests
|
|||||||
violations.Should().BeEmpty();
|
violations.Should().BeEmpty();
|
||||||
}
|
}
|
||||||
|
|
||||||
[Fact]
|
|
||||||
public void FcDeviceManagement_MustShipExpectedManifestSet()
|
|
||||||
{
|
|
||||||
var appRoot = Path.Combine(Inventory.BluejayRoot, "apps", "fc-devicemgmt");
|
|
||||||
Directory.Exists(appRoot).Should().BeTrue("Sprint 8 Cx-5 owns apps/fc-devicemgmt.");
|
|
||||||
|
|
||||||
var expectedFiles = new[]
|
|
||||||
{
|
|
||||||
"1password-item.yaml",
|
|
||||||
"argocd-application.yaml",
|
|
||||||
"certificate-web.yaml",
|
|
||||||
"clusterrole-operator.yaml",
|
|
||||||
"clusterrolebinding-operator.yaml",
|
|
||||||
"deployment-operator.yaml",
|
|
||||||
"deployment-web.yaml",
|
|
||||||
"ingressroute-web.yaml",
|
|
||||||
"namespace.yaml",
|
|
||||||
"network-policy.yaml",
|
|
||||||
"service-web.yaml",
|
|
||||||
"serviceaccount-operator.yaml",
|
|
||||||
};
|
|
||||||
|
|
||||||
Directory.GetFiles(appRoot, "*.yaml")
|
|
||||||
.Select(Path.GetFileName)
|
|
||||||
.Should()
|
|
||||||
.BeEquivalentTo(expectedFiles);
|
|
||||||
|
|
||||||
foreach (var expectedFile in expectedFiles)
|
|
||||||
{
|
|
||||||
FcDeviceManagementDocuments()
|
|
||||||
.Should()
|
|
||||||
.Contain(document => document.RelativePath == $"fc-devicemgmt/{expectedFile}");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
[Fact]
|
|
||||||
public void FcDeviceManagement_ObjectsMustCarryStandardTraceabilityLabels()
|
|
||||||
{
|
|
||||||
var requiredLabels = new[]
|
|
||||||
{
|
|
||||||
"app.kubernetes.io/name",
|
|
||||||
"app.kubernetes.io/part-of",
|
|
||||||
"app.kubernetes.io/managed-by",
|
|
||||||
"flowercore.io/tenant-id",
|
|
||||||
"flowercore.io/created-by",
|
|
||||||
};
|
|
||||||
|
|
||||||
var violations = FcDeviceManagementDocuments()
|
|
||||||
.SelectMany(document => requiredLabels
|
|
||||||
.Where(label => string.IsNullOrWhiteSpace(document.Scalar("metadata", "labels", label)))
|
|
||||||
.Select(label => $"{document.Descriptor} is missing metadata.labels['{label}']."))
|
|
||||||
.Concat(FcDeviceManagementDocuments()
|
|
||||||
.Where(document => document.Kind == "Deployment")
|
|
||||||
.SelectMany(document => requiredLabels
|
|
||||||
.Where(label => string.IsNullOrWhiteSpace(document.Scalar("spec", "template", "metadata", "labels", label)))
|
|
||||||
.Select(label => $"{document.Descriptor} pod template is missing metadata.labels['{label}'].")))
|
|
||||||
.Concat(FcDeviceManagementDocuments()
|
|
||||||
.Where(document => document.Kind == "Deployment")
|
|
||||||
.Where(document => string.IsNullOrWhiteSpace(document.Scalar("spec", "template", "metadata", "annotations", "flowercore.io/audit-trace-id")))
|
|
||||||
.Select(document => $"{document.Descriptor} pod template is missing flowercore.io/audit-trace-id."))
|
|
||||||
.ToList();
|
|
||||||
|
|
||||||
violations.Should().BeEmpty();
|
|
||||||
}
|
|
||||||
|
|
||||||
[Fact]
|
|
||||||
public void FcDeviceManagement_IngressMustUseCertManagerAndKeepPublicHostDisabled()
|
|
||||||
{
|
|
||||||
var appText = string.Join(
|
|
||||||
Environment.NewLine,
|
|
||||||
Directory.GetFiles(Path.Combine(Inventory.BluejayRoot, "apps", "fc-devicemgmt"), "*.yaml")
|
|
||||||
.Select(File.ReadAllText));
|
|
||||||
|
|
||||||
appText.Should().NotContain("certResolver");
|
|
||||||
appText.Should().Contain("update.flowercore.io");
|
|
||||||
appText.Should().Contain("disabled-until-Q-OIDC-1");
|
|
||||||
|
|
||||||
FcDeviceManagementDocuments()
|
|
||||||
.Where(document => document.Kind == "IngressRoute")
|
|
||||||
.SelectMany(document => document.MappingSequence("spec", "routes"))
|
|
||||||
.Select(route => ManifestNodeExtensions.Scalar(route, "match") ?? string.Empty)
|
|
||||||
.Should()
|
|
||||||
.Contain(match => match.Contains("Host(`devices.iamworkin.lan`)", StringComparison.Ordinal))
|
|
||||||
.And.NotContain(match => match.Contains("Host(`update.flowercore.io`)", StringComparison.Ordinal));
|
|
||||||
|
|
||||||
var certificate = FcDeviceManagementDocuments()
|
|
||||||
.Single(document => document.Kind == "Certificate" && document.Name == "fc-devicemgmt-web-tls");
|
|
||||||
|
|
||||||
certificate.Scalar("spec", "issuerRef", "name").Should().Be("step-ca-acme");
|
|
||||||
certificate.Scalar("spec", "issuerRef", "kind").Should().Be("ClusterIssuer");
|
|
||||||
ManifestNodeExtensions.ScalarSequence(certificate.Root, "spec", "dnsNames")
|
|
||||||
.Should()
|
|
||||||
.ContainSingle("devices.iamworkin.lan");
|
|
||||||
}
|
|
||||||
|
|
||||||
[Fact]
|
|
||||||
public void FcDeviceManagement_OperatorRbacMustCoverDevicesAndOwnerLookup()
|
|
||||||
{
|
|
||||||
var clusterRole = FcDeviceManagementDocuments()
|
|
||||||
.Single(document => document.Kind == "ClusterRole" && document.Name == "fc-devicemgmt-operator");
|
|
||||||
var allScalars = clusterRole.AllScalars().ToList();
|
|
||||||
|
|
||||||
allScalars.Should().Contain("devices.flowercore.io");
|
|
||||||
allScalars.Should().Contain("*");
|
|
||||||
allScalars.Should().Contain("deployments");
|
|
||||||
allScalars.Should().Contain("get");
|
|
||||||
|
|
||||||
var operatorDeployment = FcDeviceManagementDocuments()
|
|
||||||
.Single(document => document.Kind == "Deployment" && document.Name == "fc-devicemgmt-operator");
|
|
||||||
|
|
||||||
operatorDeployment.AllScalars().Should().Contain("FLOWERCORE_KUBERNETES_OWNER_DEPLOYMENT");
|
|
||||||
operatorDeployment.AllScalars().Should().Contain("fc-devicemgmt-operator");
|
|
||||||
}
|
|
||||||
|
|
||||||
[Fact]
|
|
||||||
public void FcDeviceManagement_RuntimeSecretsMustUseOnePasswordItemPattern()
|
|
||||||
{
|
|
||||||
var item = FcDeviceManagementDocuments()
|
|
||||||
.Single(document => document.Kind == "OnePasswordItem" && document.Name == "fc-devicemgmt-runtime");
|
|
||||||
|
|
||||||
item.Scalar("spec", "itemPath")
|
|
||||||
.Should()
|
|
||||||
.Be("vaults/IAmWorkin/items/FlowerCore DeviceManagement Runtime");
|
|
||||||
|
|
||||||
var appText = string.Join(
|
|
||||||
Environment.NewLine,
|
|
||||||
Directory.GetFiles(Path.Combine(Inventory.BluejayRoot, "apps", "fc-devicemgmt"), "*.yaml")
|
|
||||||
.Select(File.ReadAllText));
|
|
||||||
|
|
||||||
FcDeviceManagementDocuments().Should().NotContain(document => document.Kind == "Secret");
|
|
||||||
appText.Should().Contain("secretKeyRef:");
|
|
||||||
appText.Should().Contain("secretName: fc-devicemgmt-runtime");
|
|
||||||
appText.Should().NotContain("stringData:");
|
|
||||||
appText.Should().NotContain("from-literal");
|
|
||||||
appText.Should().NotContain("tls.key:");
|
|
||||||
}
|
|
||||||
|
|
||||||
[Fact]
|
|
||||||
public void FcDeviceManagement_NetworkPoliciesMustAllowLanAgentsSynologyAndDnatPorts()
|
|
||||||
{
|
|
||||||
var policies = FcDeviceManagementDocuments()
|
|
||||||
.Where(document => document.Kind == "NetworkPolicy")
|
|
||||||
.ToList();
|
|
||||||
|
|
||||||
policies.Should().HaveCount(2);
|
|
||||||
|
|
||||||
var combinedScalars = policies.SelectMany(policy => policy.AllScalars()).ToList();
|
|
||||||
combinedScalars.Should().Contain("10.0.56.0/24");
|
|
||||||
combinedScalars.Should().Contain("10.0.57.0/24");
|
|
||||||
combinedScalars.Should().Contain("10.0.58.0/24");
|
|
||||||
combinedScalars.Should().Contain("10.0.68.0/27");
|
|
||||||
combinedScalars.Should().Contain("10.0.58.3/32");
|
|
||||||
|
|
||||||
var combinedEgressPorts = policies.SelectMany(policy => policy.EgressPorts()).ToHashSet(StringComparer.Ordinal);
|
|
||||||
combinedEgressPorts.Should().Contain(new[] { "80", "443", "8080", "8443", "2049", "111" });
|
|
||||||
|
|
||||||
var traefikVipPolicies = policies
|
|
||||||
.Where(policy => policy.AllScalars().Any(value => value.Contains("10.0.56.200", StringComparison.Ordinal)))
|
|
||||||
.ToList();
|
|
||||||
|
|
||||||
traefikVipPolicies.Should().ContainSingle();
|
|
||||||
traefikVipPolicies[0].EgressPorts().Should().Contain(new[] { "80", "443", "8080", "8443" });
|
|
||||||
}
|
|
||||||
|
|
||||||
[Fact]
|
|
||||||
public void FcDeviceManagement_ArgocdApplicationMustMatchApplicationSetDiscoveryConventions()
|
|
||||||
{
|
|
||||||
var application = FcDeviceManagementDocuments()
|
|
||||||
.Single(document => document.Kind == "Application" && document.Name == "infra-fc-devicemgmt");
|
|
||||||
|
|
||||||
application.Namespace.Should().Be("argocd");
|
|
||||||
application.Scalar("spec", "source", "repoURL")
|
|
||||||
.Should()
|
|
||||||
.Be("http://gitea-clusterip.gitea.svc.cluster.local:3000/bluejay/bluejay-infra.git");
|
|
||||||
application.Scalar("spec", "source", "path").Should().Be("apps/fc-devicemgmt");
|
|
||||||
application.Scalar("spec", "destination", "namespace").Should().Be("fc-devicemgmt");
|
|
||||||
}
|
|
||||||
|
|
||||||
private static IEnumerable<string> ProbeViolations(
|
private static IEnumerable<string> ProbeViolations(
|
||||||
ManifestDocument document,
|
ManifestDocument document,
|
||||||
YamlMappingNode container,
|
YamlMappingNode container,
|
||||||
@@ -493,11 +397,29 @@ public sealed class FleetManifestLintTests
|
|||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
private static IReadOnlyList<ManifestDocument> FcDeviceManagementDocuments()
|
private static string? EnvValue(YamlMappingNode container, string name)
|
||||||
{
|
{
|
||||||
return Inventory.Documents
|
return EnvMapping(container, name) is { } env ? ManifestNodeExtensions.Scalar(env, "value") : null;
|
||||||
.Where(document => document.RelativePath.StartsWith("fc-devicemgmt/", StringComparison.Ordinal))
|
}
|
||||||
.ToList();
|
|
||||||
|
private static string? EnvSecretName(YamlMappingNode container, string name)
|
||||||
|
{
|
||||||
|
return EnvMapping(container, name) is { } env
|
||||||
|
? ManifestNodeExtensions.Scalar(env, "valueFrom", "secretKeyRef", "name")
|
||||||
|
: null;
|
||||||
|
}
|
||||||
|
|
||||||
|
private static string? EnvSecretKey(YamlMappingNode container, string name)
|
||||||
|
{
|
||||||
|
return EnvMapping(container, name) is { } env
|
||||||
|
? ManifestNodeExtensions.Scalar(env, "valueFrom", "secretKeyRef", "key")
|
||||||
|
: null;
|
||||||
|
}
|
||||||
|
|
||||||
|
private static YamlMappingNode? EnvMapping(YamlMappingNode container, string name)
|
||||||
|
{
|
||||||
|
return ManifestNodeExtensions.MappingSequence(container, "env")
|
||||||
|
.SingleOrDefault(env => string.Equals(ManifestNodeExtensions.Scalar(env, "name"), name, StringComparison.Ordinal));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -174,13 +174,10 @@ public sealed class PiSignagePlayerArtifactTests
|
|||||||
public void HdmiRule_RestartsPlayerAndRunsCapabilityDetection()
|
public void HdmiRule_RestartsPlayerAndRunsCapabilityDetection()
|
||||||
{
|
{
|
||||||
var rule = Read("systemd/99-flowercore-signage-hdmi.rules");
|
var rule = Read("systemd/99-flowercore-signage-hdmi.rules");
|
||||||
var responder = Read("scripts/flowercore-signage-hdmi-respond.sh");
|
|
||||||
|
|
||||||
rule.Should().Contain("KERNEL==\"card?-HDMI-A-?\"");
|
rule.Should().Contain("KERNEL==\"card?-HDMI-A-?\"");
|
||||||
rule.Should().Contain("start flowercore-signage-player-pi-hdmi.service");
|
rule.Should().Contain("restart flowercore-signage-player-pi.service");
|
||||||
responder.Should().Contain("sleep 2");
|
rule.Should().Contain("start flowercore-signage-detect-display.service");
|
||||||
responder.Should().Contain("start flowercore-signage-detect-display.service");
|
|
||||||
responder.Should().Contain("restart flowercore-signage-player-pi.service");
|
|
||||||
}
|
}
|
||||||
|
|
||||||
[Fact]
|
[Fact]
|
||||||
|
|||||||
Reference in New Issue
Block a user