From 6e9dfec06776099d051925e47580f3550c74a5d9 Mon Sep 17 00:00:00 2001
From: Jeroen Grusewski <jeroen@bizworx.nl>
Date: Tue, 21 Jul 2026 10:09:15 +0000
Subject: [PATCH] ci(fxhnt): reanimate cockpit WorkflowTemplate (node pool
 large, sha7 tag)

---
 .../argo/fxhnt-cockpit-workflowtemplate.yaml  | 136 ++++++++++++++++++
 1 file changed, 136 insertions(+)
 create mode 100644 infra/argo/fxhnt-cockpit-workflowtemplate.yaml

diff --git a/infra/argo/fxhnt-cockpit-workflowtemplate.yaml b/infra/argo/fxhnt-cockpit-workflowtemplate.yaml
new file mode 100644
index 0000000..df5024f
--- /dev/null
+++ b/infra/argo/fxhnt-cockpit-workflowtemplate.yaml
@@ -0,0 +1,136 @@
+# Argo WorkflowTemplate — build + deploy the fxhnt cockpit, fully in-cluster.
+#
+# Reuses cluster primitives: the `argo-workflow` ServiceAccount, the `argo-git-ssh-key` deploy key (clone
+# the fxhnt repo over in-cluster Gitea SSH, gitea-sshd:22), and the `scw-registry` dockerconfig (push to
+# the external Scaleway Container Registry rg.fr-par.scw.cloud/bizworx). Build runs in-cluster.
+# (Phase 2B: migrated off the in-cluster GitLab shell + registry.)
+#
+# Submit:  argo submit -n foxhunt --from=wftmpl/fxhnt-cockpit -p commit-sha=<sha> --watch
+# (or use scripts/argo-deploy-cockpit.sh)
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: fxhnt-cockpit
+  namespace: foxhunt
+  labels: { app.kubernetes.io/name: fxhnt-cockpit, app.kubernetes.io/part-of: foxhunt }
+spec:
+  serviceAccountName: argo-workflow
+  entrypoint: pipeline
+  archiveLogs: true           # archive build/deploy logs to MinIO (argo-logs bucket). Reachable now that the
+                              # pods carry app.kubernetes.io/part-of: argo-workflows (MinIO ingress netpol allow).
+  activeDeadlineSeconds: 1800
+  ttlStrategy: { secondsAfterCompletion: 3600 }
+  podGC: { strategy: OnPodCompletion }
+  arguments:
+    parameters:
+      - { name: commit-sha, value: HEAD }
+      - { name: mode, value: build }   # "build" = kaniko rebuild + deploy; "deploy" = skip build, just apply + rollout restart (git-sync re-pulls code). The sensor routes src-only pushes to "deploy".
+  templates:
+    - name: pipeline
+      dag:
+        tasks:
+          # Skip the ~5min kaniko build for code-only pushes (mode=deploy) — git-sync re-pulls src/ on the
+          # rollout restart, so only dep/Dockerfile changes need a new image (mode=build).
+          - { name: build, template: kaniko-build, when: "{{workflow.parameters.mode}} == build" }
+          - { name: deploy, template: kubectl-deploy, depends: "build.Succeeded || build.Skipped" }
+
+    # --- build: Kaniko builds infra/docker/fxhnt.Dockerfile -> internal registry ---
+    - name: kaniko-build
+      metadata:
+        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allows part-of in {foxhunt,foxhunt-ci,argo-workflows} → log archival works. NOT 'foxhunt' (that adds argo-base-egress which blocks registry:5000/git:2222).
+      nodeSelector: { k8s.scaleway.com/pool-name: large, topology.kubernetes.io/zone: fr-par-2 }
+      tolerations: [{ effect: NoSchedule, key: node.cilium.io/agent-not-ready, operator: Exists }]
+      initContainers:
+        - name: git-clone
+          image: alpine/git:latest
+          command: [/bin/sh, -c]
+          args:
+            - |
+              set -ex
+              mkdir -p /root/.ssh
+              cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
+              chmod 600 /root/.ssh/id_ed25519
+              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
+              git clone --no-checkout --filter=blob:none \
+                "ssh://git@gitea-sshd.foxhunt.svc.cluster.local:22/gitadmin/fxhnt.git" /workspace/src
+              cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}"
+              echo "checked out $(git rev-parse --short HEAD)"
+          volumeMounts:
+            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
+            - { name: workspace, mountPath: /workspace }
+      container:
+        image: gcr.io/kaniko-project/executor:debug
+        command: [/busybox/sh, -c]
+        args:
+          - |
+            /kaniko/executor \
+              --context=/workspace/src \
+              --dockerfile=/workspace/src/infra/docker/fxhnt.Dockerfile \
+              --destination=rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest \
+              --destination=rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:{{=sprig.trunc(7, workflow.parameters.commit-sha)}} \
+              --cache=true \
+              --cache-repo=rg.fr-par.scw.cloud/bizworx/cache \
+              --snapshot-mode=redo
+        env:
+          - { name: DOCKER_CONFIG, value: /kaniko/.docker }
+        resources: { requests: { cpu: "2", memory: 4Gi }, limits: { cpu: "6", memory: 12Gi } }
+        volumeMounts:
+          - { name: registry-auth, mountPath: /kaniko/.docker, readOnly: true }
+          - { name: workspace, mountPath: /workspace }
+      volumes:
+        - { name: workspace, emptyDir: {} }
+        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
+        - name: registry-auth
+          secret:
+            secretName: scw-registry
+            items: [{ key: .dockerconfigjson, path: config.json }]
+
+    # --- deploy: apply manifests from the repo + roll the dashboard to the fresh image ---
+    - name: kubectl-deploy
+      metadata:
+        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allow → log archival works (see kaniko-build note)
+      nodeSelector: { k8s.scaleway.com/pool-name: large, topology.kubernetes.io/zone: fr-par-2 }
+      serviceAccountName: argo-workflow
+      initContainers:
+        - name: git-clone
+          image: alpine/git:latest
+          command: [/bin/sh, -c]
+          args:
+            - |
+              set -ex
+              mkdir -p /root/.ssh
+              cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
+              chmod 600 /root/.ssh/id_ed25519
+              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
+              git clone --no-checkout --filter=blob:none \
+                "ssh://git@gitea-sshd.foxhunt.svc.cluster.local:22/gitadmin/fxhnt.git" /workspace/src
+              cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}"
+          volumeMounts:
+            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
+            - { name: workspace, mountPath: /workspace }
+      container:
+        image: alpine/k8s:1.31.0   # Alpine-based (has /bin/sh + kubectl). NOT registry.k8s.io/kubectl — that's distroless (no shell) and the deploy runs a shell script. bitnami/kubectl was removed from Docker Hub (2025).
+        command: [/bin/sh, -c]
+        args:
+          - |
+            set -e
+            cd /workspace/src
+            kubectl apply -f infra/k8s/services/fxhnt-dashboard.yaml
+            kubectl apply -f infra/k8s/orchestration/dagster.yaml
+            kubectl apply -f infra/k8s/network-policies/fxhnt-cockpit.yaml
+            # Dashboard: scale 0 -> 1, NOT `rollout restart`. Its tailscale sidecar serves dashboard.fxhnt.ai;
+            # a rolling restart briefly overlaps two tailscale sessions on the same identity -> session race ->
+            # the external proxy link goes stale and the cockpit reads "down" post-deploy. Scaling to 0 cleanly
+            # terminates the session before a fresh, non-overlapping one comes up; the git-sync initContainer
+            # re-pulls src the same way, so code still updates. See reference_fxhnt_dashboard_proxy.
+            kubectl -n foxhunt scale deploy/fxhnt-dashboard --replicas=0
+            kubectl -n foxhunt wait --for=delete pod -l app.kubernetes.io/name=fxhnt-dashboard --timeout=90s || true
+            kubectl -n foxhunt scale deploy/fxhnt-dashboard --replicas=1
+            kubectl -n foxhunt rollout restart deploy/dagster        # dagster has no external-proxy race
+            kubectl -n foxhunt rollout status deploy/fxhnt-dashboard --timeout=180s
+            kubectl -n foxhunt rollout status deploy/dagster --timeout=300s
+        volumeMounts:
+          - { name: workspace, mountPath: /workspace }
+      volumes:
+        - { name: workspace, emptyDir: {} }
+        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }