diff --git a/infra/argo/cockpit-build-deploy.yaml b/infra/argo/cockpit-build-deploy.yaml deleted file mode 100644 index 5906600..0000000 --- a/infra/argo/cockpit-build-deploy.yaml +++ /dev/null @@ -1,135 +0,0 @@ -# Argo WorkflowTemplate — build + deploy the fxhnt cockpit, fully in-cluster. -# -# Reuses cluster primitives: the `argo-workflow` ServiceAccount, the `argo-git-ssh-key` deploy key (clone -# the fxhnt repo over in-cluster Gitea SSH, gitea-sshd:22), and the `scw-registry` dockerconfig (push to -# the external Scaleway Container Registry rg.fr-par.scw.cloud/bizworx). Build runs in-cluster. -# (Phase 2B: migrated off the in-cluster GitLab shell + registry.) -# -# Submit: argo submit -n foxhunt --from=wftmpl/fxhnt-cockpit -p commit-sha= --watch -# (or use scripts/argo-deploy-cockpit.sh) -apiVersion: argoproj.io/v1alpha1 -kind: WorkflowTemplate -metadata: - name: fxhnt-cockpit - namespace: foxhunt - labels: { app.kubernetes.io/name: fxhnt-cockpit, app.kubernetes.io/part-of: foxhunt } -spec: - serviceAccountName: argo-workflow - entrypoint: pipeline - archiveLogs: true # archive build/deploy logs to MinIO (argo-logs bucket). Reachable now that the - # pods carry app.kubernetes.io/part-of: argo-workflows (MinIO ingress netpol allow). - activeDeadlineSeconds: 1800 - ttlStrategy: { secondsAfterCompletion: 3600 } - podGC: { strategy: OnPodCompletion } - arguments: - parameters: - - { name: commit-sha, value: HEAD } - - { name: mode, value: build } # "build" = kaniko rebuild + deploy; "deploy" = skip build, just apply + rollout restart (git-sync re-pulls code). The sensor routes src-only pushes to "deploy". - templates: - - name: pipeline - dag: - tasks: - # Skip the ~5min kaniko build for code-only pushes (mode=deploy) — git-sync re-pulls src/ on the - # rollout restart, so only dep/Dockerfile changes need a new image (mode=build). - - { name: build, template: kaniko-build, when: "{{workflow.parameters.mode}} == build" } - - { name: deploy, template: kubectl-deploy, depends: "build.Succeeded || build.Skipped" } - - # --- build: Kaniko builds infra/docker/fxhnt.Dockerfile -> internal registry --- - - name: kaniko-build - metadata: - labels: { app.kubernetes.io/part-of: argo-workflows } # MinIO ingress allows part-of in {foxhunt,foxhunt-ci,argo-workflows} → log archival works. NOT 'foxhunt' (that adds argo-base-egress which blocks registry:5000/git:2222). - nodeSelector: { k8s.scaleway.com/pool-name: ci-compile-cpu, topology.kubernetes.io/zone: fr-par-2 } - tolerations: [{ effect: NoSchedule, key: node.cilium.io/agent-not-ready, operator: Exists }] - initContainers: - - name: git-clone - image: alpine/git:latest - command: [/bin/sh, -c] - args: - - | - set -ex - mkdir -p /root/.ssh - cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519 - chmod 600 /root/.ssh/id_ed25519 - printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config - git clone --no-checkout --filter=blob:none \ - "ssh://git@gitea-sshd.foxhunt.svc.cluster.local:22/gitadmin/fxhnt.git" /workspace/src - cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}" - echo "checked out $(git rev-parse --short HEAD)" - volumeMounts: - - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true } - - { name: workspace, mountPath: /workspace } - container: - image: gcr.io/kaniko-project/executor:debug - command: [/busybox/sh, -c] - args: - - | - /kaniko/executor \ - --context=/workspace/src \ - --dockerfile=/workspace/src/infra/docker/fxhnt.Dockerfile \ - --destination=rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest \ - --cache=true \ - --cache-repo=rg.fr-par.scw.cloud/bizworx/cache \ - --snapshot-mode=redo - env: - - { name: DOCKER_CONFIG, value: /kaniko/.docker } - resources: { requests: { cpu: "2", memory: 4Gi }, limits: { cpu: "6", memory: 12Gi } } - volumeMounts: - - { name: registry-auth, mountPath: /kaniko/.docker, readOnly: true } - - { name: workspace, mountPath: /workspace } - volumes: - - { name: workspace, emptyDir: {} } - - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } } - - name: registry-auth - secret: - secretName: scw-registry - items: [{ key: .dockerconfigjson, path: config.json }] - - # --- deploy: apply manifests from the repo + roll the dashboard to the fresh image --- - - name: kubectl-deploy - metadata: - labels: { app.kubernetes.io/part-of: argo-workflows } # MinIO ingress allow → log archival works (see kaniko-build note) - nodeSelector: { k8s.scaleway.com/pool-name: platform, topology.kubernetes.io/zone: fr-par-2 } - serviceAccountName: argo-workflow - initContainers: - - name: git-clone - image: alpine/git:latest - command: [/bin/sh, -c] - args: - - | - set -ex - mkdir -p /root/.ssh - cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519 - chmod 600 /root/.ssh/id_ed25519 - printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config - git clone --no-checkout --filter=blob:none \ - "ssh://git@gitea-sshd.foxhunt.svc.cluster.local:22/gitadmin/fxhnt.git" /workspace/src - cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}" - volumeMounts: - - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true } - - { name: workspace, mountPath: /workspace } - container: - image: alpine/k8s:1.31.0 # Alpine-based (has /bin/sh + kubectl). NOT registry.k8s.io/kubectl — that's distroless (no shell) and the deploy runs a shell script. bitnami/kubectl was removed from Docker Hub (2025). - command: [/bin/sh, -c] - args: - - | - set -e - cd /workspace/src - kubectl apply -f infra/k8s/services/fxhnt-dashboard.yaml - kubectl apply -f infra/k8s/orchestration/dagster.yaml - kubectl apply -f infra/k8s/network-policies/fxhnt-cockpit.yaml - # Dashboard: scale 0 -> 1, NOT `rollout restart`. Its tailscale sidecar serves dashboard.fxhnt.ai; - # a rolling restart briefly overlaps two tailscale sessions on the same identity -> session race -> - # the external proxy link goes stale and the cockpit reads "down" post-deploy. Scaling to 0 cleanly - # terminates the session before a fresh, non-overlapping one comes up; the git-sync initContainer - # re-pulls src the same way, so code still updates. See reference_fxhnt_dashboard_proxy. - kubectl -n foxhunt scale deploy/fxhnt-dashboard --replicas=0 - kubectl -n foxhunt wait --for=delete pod -l app.kubernetes.io/name=fxhnt-dashboard --timeout=90s || true - kubectl -n foxhunt scale deploy/fxhnt-dashboard --replicas=1 - kubectl -n foxhunt rollout restart deploy/dagster # dagster has no external-proxy race - kubectl -n foxhunt rollout status deploy/fxhnt-dashboard --timeout=180s - kubectl -n foxhunt rollout status deploy/dagster --timeout=300s - volumeMounts: - - { name: workspace, mountPath: /workspace } - volumes: - - { name: workspace, emptyDir: {} } - - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } } diff --git a/scripts/argo-deploy-cockpit.sh b/scripts/argo-deploy-cockpit.sh deleted file mode 100755 index d7eaff5..0000000 --- a/scripts/argo-deploy-cockpit.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/usr/bin/env bash -# Build + deploy the fxhnt cockpit via Argo Workflows (in-cluster Kaniko build, no laptop push). -# -# Prereqs (one-time): the `fxhnt-cockpit` WorkflowTemplate is registered -# (kubectl -n foxhunt apply -f infra/argo/cockpit-build-deploy.yaml) -# and this repo is pushed to the in-cluster GitLab as root/fxhnt.git. -# -# Usage: -# ./scripts/argo-deploy-cockpit.sh # build+deploy HEAD of root/fxhnt master -# ./scripts/argo-deploy-cockpit.sh # a specific commit -set -euo pipefail - -SHA="${1:-HEAD}" -NS="foxhunt" - -# Resolve HEAD to the real master sha so the in-cluster clone checks out exactly what was pushed. -if [ "$SHA" = "HEAD" ]; then - SHA="$(git rev-parse HEAD)" -fi - -echo "Submitting fxhnt-cockpit build+deploy for ${SHA} ..." -argo submit -n "$NS" --from=wftmpl/fxhnt-cockpit \ - -p commit-sha="$SHA" \ - --watch