diff --git a/.github/workflows/kustomize-check.yml b/.github/workflows/kustomize-check.yml index 49b67a18e..5f24322c0 100644 --- a/.github/workflows/kustomize-check.yml +++ b/.github/workflows/kustomize-check.yml @@ -32,7 +32,7 @@ jobs: - name: Build all overlays run: | failed=0 - for overlay in production e2e kind kind-local local-dev; do + for overlay in production e2e kind crc hcmai; do echo "=== $overlay ===" if oc kustomize "components/manifests/overlays/$overlay" > /dev/null; then echo "OK" diff --git a/Makefile b/Makefile index 25ffe26f4..1e1d56a7f 100755 --- a/Makefile +++ b/Makefile @@ -79,7 +79,7 @@ RUNNER_QUAY_TAG ?= latest RUNNER_PRELOAD_TAG ?= kind-preloaded RUNNER_PRELOAD_REF := localhost/acp_runner_openshell:$(RUNNER_PRELOAD_TAG) -# kind-local overlay always references localhost/acp_* images. +# kind overlay with LOCAL_IMAGES=true references localhost/acp_* images. # Podman produces this prefix natively; for Docker we tag before loading. KIND_IMAGE_PREFIX := localhost/ @@ -626,7 +626,7 @@ clean: ## Clean up Kubernetes resources # reload, guaranteeing a rollout even with imagePullPolicy: IfNotPresent. # # IMPORTANT: kind clusters do NOT run a container registry. Images are loaded directly -# into the node's containerd via `ctr images import`. The kustomize kind-local overlay +# into the node's containerd via `ctr images import`. The kustomize kind overlay # sets imagePullPolicy: IfNotPresent so kubelet uses the pre-loaded image instead of # trying to pull from a registry. If imagePullPolicy is set to Always, pods will fail # with ErrImagePull because there is no registry at localhost:443. @@ -910,14 +910,15 @@ kind-up: preflight-cluster build-cli ## Start kind cluster and deploy the platfo $(MAKE) --no-print-directory build-all; \ $(MAKE) --no-print-directory _kind-load-images; \ echo "$(COLOR_BLUE)▶$(COLOR_RESET) Deploying with locally-built images..."; \ - kubectl apply --validate=false -k components/manifests/overlays/kind-local/; \ + kubectl apply --validate=false -k components/manifests/overlays/kind/; \ + echo "$(COLOR_BLUE)▶$(COLOR_RESET) Patching images to use localhost references..."; \ + for img in acp_api_server acp_ambient_ui acp_control_plane acp_claude_runner acp_runner_openshell acp_mcp acp_credential_github acp_credential_jira acp_credential_k8s acp_credential_google; do \ + kubectl set image deployment -n $(NAMESPACE) --all --containers="*" \ + "quay.io/ambient_code/$$img:latest=localhost/$$img:latest" 2>/dev/null || true; \ + done; \ echo "$(COLOR_BLUE)▶$(COLOR_RESET) Restarting deployments to pick up freshly built images..."; \ kubectl rollout restart deployment -n $(NAMESPACE); \ - echo "$(COLOR_BLUE)▶$(COLOR_RESET) Patching agent registry for local images..."; \ - REGISTRY=$$(kubectl get configmap ambient-agent-registry -n $(NAMESPACE) -o jsonpath='{.data.agent-registry\.json}'); \ - kubectl patch configmap ambient-agent-registry -n $(NAMESPACE) --type=merge \ - -p "{\"data\":{\"agent-registry.json\":$$(echo "$$UPDATED" | jq -Rs .)}}"; \ - echo "$(COLOR_GREEN)✓$(COLOR_RESET) Agent registry patched for local images"; \ + echo "$(COLOR_GREEN)✓$(COLOR_RESET) Local images applied"; \ else \ echo "$(COLOR_BLUE)▶$(COLOR_RESET) Deploying with Quay.io images..."; \ kubectl apply --validate=false -k components/manifests/overlays/kind/; \ @@ -1856,7 +1857,7 @@ local-stop-port-forward: ## Stop background port forwarding # ─── CRC (OpenShift Local) targets ─────────────────────────────────────────── CRC_NAMESPACE ?= ambient-code -CRC_OVERLAY ?= components/manifests/overlays/openshift-local +CRC_OVERLAY ?= components/manifests/overlays/crc crc-up: build-cli ## Deploy the platform to CRC (OpenShift Local). LOCAL_IMAGES=true builds from source. Requires 'crc start' and 'oc login' beforehand @echo "$(COLOR_BLUE)▶$(COLOR_RESET) Deploying to CRC (OpenShift Local)..." diff --git a/components/ambient-control-plane/internal/gateway/manifests.go b/components/ambient-control-plane/internal/gateway/manifests.go index 8c0378c8f..8e3617e9d 100644 --- a/components/ambient-control-plane/internal/gateway/manifests.go +++ b/components/ambient-control-plane/internal/gateway/manifests.go @@ -230,7 +230,7 @@ func ApplyConfigOverrides(obj *unstructured.Unstructured, config GatewayConfig) } } - // Add image_pull_policy for LOCAL_IMAGES=true (kind-local development) + // Add image_pull_policy for LOCAL_IMAGES=true (kind local development) if kind == "ConfigMap" && obj.GetName() == "openshell-gateway-config" && os.Getenv("LOCAL_IMAGES") == "true" && config.Config == "" { data, found, err := unstructured.NestedMap(obj.Object, "data") if err != nil || !found { diff --git a/components/manifests/README.md b/components/manifests/README.md index f65d2644f..50165c67c 100644 --- a/components/manifests/README.md +++ b/components/manifests/README.md @@ -35,10 +35,10 @@ manifests/ │ ├── overlays/ │ ├── production/ # OpenShift production (ROSA / on-prem) -│ ├── kind/ # Local kind cluster (Quay images) -│ ├── kind-local/ # Local kind cluster (locally built images) +│ ├── kind/ # Local kind cluster development │ ├── e2e/ # Cypress E2E test environment (kind) -│ └── local-dev/ # CRC / OpenShift Local developer environment +│ ├── crc/ # CRC (OpenShift Local) development +│ └── hcmai/ # HCMAI ROSA cluster deployment │ └── observability/ # Grafana dashboards, OTel collector, ServiceMonitors ``` @@ -51,9 +51,9 @@ The base manifests assume full TLS and JWT authentication. Overlays strip these |---|---|---|---| | `base` | enabled (HTTPS + gRPC TLS) | enabled (Red Hat SSO) | enabled | | `production` | enabled (OpenShift service-ca) | enabled (Red Hat SSO) | enabled | -| `local-dev` | enabled (OpenShift service-ca) | enabled | enabled | +| `crc` | disabled | OIDC (Keycloak) | enabled | +| `hcmai` | enabled (OpenShift service-ca) | OIDC (Keycloak) | enabled | | `kind` | disabled | disabled | disabled | -| `kind-local` | disabled | disabled | disabled | | `e2e` | disabled | disabled | disabled | ## Overlays @@ -69,8 +69,8 @@ The base manifests assume full TLS and JWT authentication. Overlays strip these oc apply -k overlays/production/ ``` -### `kind/` — Local kind cluster (Quay images) -- **Images**: `quay.io/ambient_code/*` pulled directly +### `kind/` — Local kind cluster +- **Images**: `quay.io/ambient_code/*` pulled directly (or locally built with `LOCAL_IMAGES=true`) - **Networking**: NodePort services - **Auth**: JWT disabled, no-TLS patches applied - **Database**: Vanilla postgres with init scripts (`components/postgresql-init-scripts`) @@ -80,13 +80,6 @@ make kind-up kubectl apply -k overlays/kind/ ``` -### `kind-local/` — Local kind cluster (locally built images) -Extends `kind/` — overrides image refs to locally loaded images (`imagePullPolicy: Never`). - -```bash -make local-reload-api-server KIND_CLUSTER_NAME= -``` - ### `e2e/` — Cypress E2E test environment Kind-based environment used by `make test-e2e-local`. Adds test users, ingress, and Cypress-compatible service configuration on top of the kind overlay. @@ -95,13 +88,23 @@ Cypress-compatible service configuration on top of the kind overlay. make test-e2e-local ``` -### `local-dev/` — OpenShift Local development -- **Namespace**: Configurable (uses `namePrefix`) -- **Auth**: OpenShift service-ca TLS, JWKS enabled -- **Database**: RHEL PostgreSQL with init containers +### `crc/` — CRC (OpenShift Local) +- **Namespace**: `ambient-code` +- **Auth**: Keycloak OIDC, Routes for browser access +- **Database**: Uses external database (minio/postgresql scaled to 0) + +```bash +make crc-up +``` + +### `hcmai/` — HCMAI ROSA cluster +- **Namespace**: `ambient-api` +- **Auth**: Keycloak OIDC with full client credentials +- **Database**: RHEL PostgreSQL (`components/postgresql-rhel`, `components/ambient-api-server-db`) +- **Removes**: minio, shared postgresql, LimitRange, NetworkPolicy ```bash -oc apply -k overlays/local-dev/ +kustomize build overlays/hcmai | oc apply -n ambient-api -f - ``` ## Reusable Components @@ -112,8 +115,8 @@ Components are opt-in kustomize modules included via the `components:` block in | Component | Purpose | Used by | |---|---|---| | `oauth-proxy` | Adds OpenShift OAuth proxy sidecar to frontend | `production` | -| `postgresql-rhel` | Patches PostgreSQL to use `registry.redhat.io/rhel10/postgresql-16` | `production`, `local-dev` | -| `ambient-api-server-db` | Same RHEL patch for the ambient-api-server's dedicated DB | `production`, `local-dev` | +| `postgresql-rhel` | Patches PostgreSQL to use `registry.redhat.io/rhel10/postgresql-16` | `production`, `hcmai` | +| `ambient-api-server-db` | Same RHEL patch for the ambient-api-server's dedicated DB | `production`, `hcmai` | | `postgresql-init-scripts` | ConfigMap + volume for DB init SQL (vanilla postgres only) | `kind`, `e2e` | ## Prerequisites for New Deployments diff --git a/components/manifests/overlays/openshift-local/ambient-api-server-dev-patch.yaml b/components/manifests/overlays/crc/ambient-api-server-dev-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/ambient-api-server-dev-patch.yaml rename to components/manifests/overlays/crc/ambient-api-server-dev-patch.yaml diff --git a/components/manifests/overlays/openshift-local/api-server-db-security-patch.yaml b/components/manifests/overlays/crc/api-server-db-security-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/api-server-db-security-patch.yaml rename to components/manifests/overlays/crc/api-server-db-security-patch.yaml diff --git a/components/manifests/overlays/openshift-local/api-server-resources-patch.yaml b/components/manifests/overlays/crc/api-server-resources-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/api-server-resources-patch.yaml rename to components/manifests/overlays/crc/api-server-resources-patch.yaml diff --git a/components/manifests/overlays/openshift-local/api-server-route.yaml b/components/manifests/overlays/crc/api-server-route.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/api-server-route.yaml rename to components/manifests/overlays/crc/api-server-route.yaml diff --git a/components/manifests/overlays/openshift-local/api-server-security-patch.yaml b/components/manifests/overlays/crc/api-server-security-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/api-server-security-patch.yaml rename to components/manifests/overlays/crc/api-server-security-patch.yaml diff --git a/components/manifests/overlays/openshift-local/control-plane-env-patch.yaml b/components/manifests/overlays/crc/control-plane-env-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/control-plane-env-patch.yaml rename to components/manifests/overlays/crc/control-plane-env-patch.yaml diff --git a/components/manifests/overlays/openshift-local/control-plane-resources-patch.yaml b/components/manifests/overlays/crc/control-plane-resources-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/control-plane-resources-patch.yaml rename to components/manifests/overlays/crc/control-plane-resources-patch.yaml diff --git a/components/manifests/overlays/openshift-local/keycloak-deployment.yaml b/components/manifests/overlays/crc/keycloak-deployment.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/keycloak-deployment.yaml rename to components/manifests/overlays/crc/keycloak-deployment.yaml diff --git a/components/manifests/overlays/openshift-local/keycloak-realm.json b/components/manifests/overlays/crc/keycloak-realm.json similarity index 100% rename from components/manifests/overlays/openshift-local/keycloak-realm.json rename to components/manifests/overlays/crc/keycloak-realm.json diff --git a/components/manifests/overlays/openshift-local/keycloak-theme/acp-logo.svg b/components/manifests/overlays/crc/keycloak-theme/acp-logo.svg similarity index 100% rename from components/manifests/overlays/openshift-local/keycloak-theme/acp-logo.svg rename to components/manifests/overlays/crc/keycloak-theme/acp-logo.svg diff --git a/components/manifests/overlays/openshift-local/keycloak-theme/login.css b/components/manifests/overlays/crc/keycloak-theme/login.css similarity index 100% rename from components/manifests/overlays/openshift-local/keycloak-theme/login.css rename to components/manifests/overlays/crc/keycloak-theme/login.css diff --git a/components/manifests/overlays/openshift-local/keycloak-theme/messages_en.properties b/components/manifests/overlays/crc/keycloak-theme/messages_en.properties similarity index 100% rename from components/manifests/overlays/openshift-local/keycloak-theme/messages_en.properties rename to components/manifests/overlays/crc/keycloak-theme/messages_en.properties diff --git a/components/manifests/overlays/openshift-local/keycloak-theme/theme.properties b/components/manifests/overlays/crc/keycloak-theme/theme.properties similarity index 100% rename from components/manifests/overlays/openshift-local/keycloak-theme/theme.properties rename to components/manifests/overlays/crc/keycloak-theme/theme.properties diff --git a/components/manifests/overlays/openshift-local/kustomization.yaml b/components/manifests/overlays/crc/kustomization.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/kustomization.yaml rename to components/manifests/overlays/crc/kustomization.yaml diff --git a/components/manifests/overlays/openshift-local/ldap-config.yaml b/components/manifests/overlays/crc/ldap-config.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/ldap-config.yaml rename to components/manifests/overlays/crc/ldap-config.yaml diff --git a/components/manifests/overlays/local-dev/ldap-credentials.yaml b/components/manifests/overlays/crc/ldap-credentials.yaml similarity index 100% rename from components/manifests/overlays/local-dev/ldap-credentials.yaml rename to components/manifests/overlays/crc/ldap-credentials.yaml diff --git a/components/manifests/overlays/openshift-local/limitrange-patch.yaml b/components/manifests/overlays/crc/limitrange-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/limitrange-patch.yaml rename to components/manifests/overlays/crc/limitrange-patch.yaml diff --git a/components/manifests/overlays/openshift-local/minio-credentials.yaml b/components/manifests/overlays/crc/minio-credentials.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/minio-credentials.yaml rename to components/manifests/overlays/crc/minio-credentials.yaml diff --git a/components/manifests/overlays/openshift-local/minio-pvc-patch.yaml b/components/manifests/overlays/crc/minio-pvc-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/minio-pvc-patch.yaml rename to components/manifests/overlays/crc/minio-pvc-patch.yaml diff --git a/components/manifests/overlays/openshift-local/mlflow-db-credentials.yaml b/components/manifests/overlays/crc/mlflow-db-credentials.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/mlflow-db-credentials.yaml rename to components/manifests/overlays/crc/mlflow-db-credentials.yaml diff --git a/components/manifests/overlays/openshift-local/namespace-patch.yaml b/components/manifests/overlays/crc/namespace-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/namespace-patch.yaml rename to components/manifests/overlays/crc/namespace-patch.yaml diff --git a/components/manifests/overlays/openshift-local/postgresql-credentials.yaml b/components/manifests/overlays/crc/postgresql-credentials.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/postgresql-credentials.yaml rename to components/manifests/overlays/crc/postgresql-credentials.yaml diff --git a/components/manifests/overlays/openshift-local/postgresql-init-scripts-patch.yaml b/components/manifests/overlays/crc/postgresql-init-scripts-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/postgresql-init-scripts-patch.yaml rename to components/manifests/overlays/crc/postgresql-init-scripts-patch.yaml diff --git a/components/manifests/overlays/openshift-local/postgresql-init-scripts.yaml b/components/manifests/overlays/crc/postgresql-init-scripts.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/postgresql-init-scripts.yaml rename to components/manifests/overlays/crc/postgresql-init-scripts.yaml diff --git a/components/manifests/overlays/openshift-local/postgresql-pvc-patch.yaml b/components/manifests/overlays/crc/postgresql-pvc-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/postgresql-pvc-patch.yaml rename to components/manifests/overlays/crc/postgresql-pvc-patch.yaml diff --git a/components/manifests/overlays/openshift-local/secrets.yaml b/components/manifests/overlays/crc/secrets.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/secrets.yaml rename to components/manifests/overlays/crc/secrets.yaml diff --git a/components/manifests/overlays/openshift-local/sso-credentials.yaml b/components/manifests/overlays/crc/sso-credentials.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/sso-credentials.yaml rename to components/manifests/overlays/crc/sso-credentials.yaml diff --git a/components/manifests/overlays/openshift-local/test-user.yaml b/components/manifests/overlays/crc/test-user.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/test-user.yaml rename to components/manifests/overlays/crc/test-user.yaml diff --git a/components/manifests/overlays/openshift-local/ui-resources-patch.yaml b/components/manifests/overlays/crc/ui-resources-patch.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/ui-resources-patch.yaml rename to components/manifests/overlays/crc/ui-resources-patch.yaml diff --git a/components/manifests/overlays/openshift-local/ui-route.yaml b/components/manifests/overlays/crc/ui-route.yaml similarity index 100% rename from components/manifests/overlays/openshift-local/ui-route.yaml rename to components/manifests/overlays/crc/ui-route.yaml diff --git a/components/manifests/overlays/hcmais/ambient-api-server-env-patch.yaml b/components/manifests/overlays/hcmai/ambient-api-server-env-patch.yaml similarity index 100% rename from components/manifests/overlays/hcmais/ambient-api-server-env-patch.yaml rename to components/manifests/overlays/hcmai/ambient-api-server-env-patch.yaml diff --git a/components/manifests/overlays/hcmais-dev/ambient-ui-env-patch.yaml b/components/manifests/overlays/hcmai/ambient-ui-env-patch.yaml similarity index 100% rename from components/manifests/overlays/hcmais-dev/ambient-ui-env-patch.yaml rename to components/manifests/overlays/hcmai/ambient-ui-env-patch.yaml diff --git a/components/manifests/overlays/hcmais/ambient-ui-route.yaml b/components/manifests/overlays/hcmai/ambient-ui-route.yaml similarity index 100% rename from components/manifests/overlays/hcmais/ambient-ui-route.yaml rename to components/manifests/overlays/hcmai/ambient-ui-route.yaml diff --git a/components/manifests/overlays/hcmais/api-server-route.yaml b/components/manifests/overlays/hcmai/api-server-route.yaml similarity index 100% rename from components/manifests/overlays/hcmais/api-server-route.yaml rename to components/manifests/overlays/hcmai/api-server-route.yaml diff --git a/components/manifests/overlays/hcmais/control-plane-env-patch.yaml b/components/manifests/overlays/hcmai/control-plane-env-patch.yaml similarity index 100% rename from components/manifests/overlays/hcmais/control-plane-env-patch.yaml rename to components/manifests/overlays/hcmai/control-plane-env-patch.yaml diff --git a/components/manifests/overlays/hcmais/keycloak/keycloak-admin-secret.yaml b/components/manifests/overlays/hcmai/keycloak/keycloak-admin-secret.yaml similarity index 100% rename from components/manifests/overlays/hcmais/keycloak/keycloak-admin-secret.yaml rename to components/manifests/overlays/hcmai/keycloak/keycloak-admin-secret.yaml diff --git a/components/manifests/overlays/hcmais/keycloak/keycloak-db.yaml b/components/manifests/overlays/hcmai/keycloak/keycloak-db.yaml similarity index 100% rename from components/manifests/overlays/hcmais/keycloak/keycloak-db.yaml rename to components/manifests/overlays/hcmai/keycloak/keycloak-db.yaml diff --git a/components/manifests/overlays/hcmais/keycloak/keycloak-deployment.yaml b/components/manifests/overlays/hcmai/keycloak/keycloak-deployment.yaml similarity index 100% rename from components/manifests/overlays/hcmais/keycloak/keycloak-deployment.yaml rename to components/manifests/overlays/hcmai/keycloak/keycloak-deployment.yaml diff --git a/components/manifests/overlays/hcmais/keycloak/keycloak-realm.json b/components/manifests/overlays/hcmai/keycloak/keycloak-realm.json similarity index 100% rename from components/manifests/overlays/hcmais/keycloak/keycloak-realm.json rename to components/manifests/overlays/hcmai/keycloak/keycloak-realm.json diff --git a/components/manifests/overlays/hcmais/keycloak/kustomization.yaml b/components/manifests/overlays/hcmai/keycloak/kustomization.yaml similarity index 100% rename from components/manifests/overlays/hcmais/keycloak/kustomization.yaml rename to components/manifests/overlays/hcmai/keycloak/kustomization.yaml diff --git a/components/manifests/overlays/hcmais/keycloak/namespace.yaml b/components/manifests/overlays/hcmai/keycloak/namespace.yaml similarity index 100% rename from components/manifests/overlays/hcmais/keycloak/namespace.yaml rename to components/manifests/overlays/hcmai/keycloak/namespace.yaml diff --git a/components/manifests/overlays/hcmais/kustomization.yaml b/components/manifests/overlays/hcmai/kustomization.yaml similarity index 99% rename from components/manifests/overlays/hcmais/kustomization.yaml rename to components/manifests/overlays/hcmai/kustomization.yaml index e0cc4904b..a052f36d7 100644 --- a/components/manifests/overlays/hcmais/kustomization.yaml +++ b/components/manifests/overlays/hcmai/kustomization.yaml @@ -34,7 +34,7 @@ patches: apiVersion: v1 kind: PersistentVolumeClaim metadata: { name: minio-data } -# --- Delete unwanted PostgreSQL (shared instance, not used by hcmais) --- +# --- Delete unwanted PostgreSQL (shared instance, not used by hcmai) --- - target: { group: apps, version: v1, kind: Deployment, name: postgresql } patch: | $patch: delete diff --git a/components/manifests/overlays/hcmais-dev/ambient-api-server-env-patch.yaml b/components/manifests/overlays/hcmais-dev/ambient-api-server-env-patch.yaml deleted file mode 100644 index eb5b2cffc..000000000 --- a/components/manifests/overlays/hcmais-dev/ambient-api-server-env-patch.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server -spec: - template: - spec: - containers: - - name: api-server - env: - - name: AMBIENT_ENV - value: production - - name: JWK_CERT_URL - value: "https://keycloak-ambient-keycloak.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com/realms/ambient-code/protocol/openid-connect/certs" - - name: CREDENTIAL_ENCRYPTION_KEYRING - valueFrom: - secretKeyRef: - name: credential-encryption-key - key: keyring - optional: true - - name: CREDENTIAL_ENCRYPTION_KEY_VERSION - valueFrom: - secretKeyRef: - name: credential-encryption-key - key: version - optional: true - - name: CREDENTIAL_ENCRYPTION_ALLOW_PLAINTEXT - value: "false" - - name: GRPC_SERVICE_ACCOUNT - value: "ambient-control-plane-hcmais" - valueFrom: null - - name: OPENSHELL_USE_GATEWAY - value: "true" - - name: OPENSHELL_ENABLED - value: "true" - - name: GATEWAY_IMAGE - value: "ghcr.io/nvidia/openshell/gateway:0.0.83" - - name: OIDC_ISSUER_URL - value: "https://keycloak-ambient-code.apps-crc.testing/realms/ambient-code" diff --git a/components/manifests/overlays/hcmais-dev/ambient-ui-route.yaml b/components/manifests/overlays/hcmais-dev/ambient-ui-route.yaml deleted file mode 100644 index 881b03bd5..000000000 --- a/components/manifests/overlays/hcmais-dev/ambient-ui-route.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: ambient-ui -spec: - host: ambient-ui-ambient-dev.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com - to: - kind: Service - name: ambient-ui-service - port: - targetPort: http - tls: - termination: edge - insecureEdgeTerminationPolicy: Redirect diff --git a/components/manifests/overlays/hcmais-dev/api-server-route.yaml b/components/manifests/overlays/hcmais-dev/api-server-route.yaml deleted file mode 100644 index 9723ceab5..000000000 --- a/components/manifests/overlays/hcmais-dev/api-server-route.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: ambient-api-server -spec: - host: ambient-api-server-ambient-dev.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com - to: - kind: Service - name: ambient-api-server - port: - targetPort: api - tls: - termination: edge - insecureEdgeTerminationPolicy: Redirect diff --git a/components/manifests/overlays/hcmais-dev/control-plane-env-patch.yaml b/components/manifests/overlays/hcmais-dev/control-plane-env-patch.yaml deleted file mode 100644 index 8fe9b687a..000000000 --- a/components/manifests/overlays/hcmais-dev/control-plane-env-patch.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-control-plane -spec: - template: - spec: - containers: - - name: ambient-control-plane - env: - - name: AMBIENT_API_SERVER_URL - value: "http://ambient-api-server.ambient-dev.svc:8000" - - name: AMBIENT_GRPC_SERVER_ADDR - value: "ambient-api-server.ambient-dev.svc:9000" - - name: AMBIENT_GRPC_USE_TLS - value: "false" - - name: CP_TOKEN_URL - value: "http://ambient-control-plane.ambient-dev.svc:8080/token" - - name: OIDC_TOKEN_URL - value: "https://keycloak-ambient-keycloak.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com/realms/ambient-code/protocol/openid-connect/token" - - name: OIDC_CLIENT_ID - valueFrom: - secretKeyRef: - name: ambient-control-plane-oidc - key: client-id - - name: OIDC_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: ambient-control-plane-oidc - key: client-secret - - name: PLATFORM_MODE - value: "standard" - - name: MCP_API_SERVER_URL - value: "http://ambient-api-server.ambient-dev.svc:8000" - - name: USE_VERTEX - value: "1" - valueFrom: null - - name: ANTHROPIC_API_KEY - valueFrom: - secretKeyRef: - name: ambient-anthropic - key: api-key - optional: true - - name: ANTHROPIC_VERTEX_PROJECT_ID - value: "itpc-gcp-hcm-pe-eng-claude" - valueFrom: null - - name: CLOUD_ML_REGION - value: "global" - valueFrom: null - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/app/vertex/itpc-gcp-hcm-pe-eng.json" - valueFrom: null - - name: VERTEX_SECRET_NAME - value: "ambient-vertex" - - name: VERTEX_SECRET_NAMESPACE - value: "ambient-dev" - - name: OPENSHELL_USE_GATEWAY - value: "true" - - name: OPENSHELL_ENABLED - value: "true" - - name: CP_RUNTIME_NAMESPACE - value: "ambient-dev" - valueFrom: null diff --git a/components/manifests/overlays/hcmais-dev/kustomization.yaml b/components/manifests/overlays/hcmais-dev/kustomization.yaml deleted file mode 100644 index 3b5e59bc1..000000000 --- a/components/manifests/overlays/hcmais-dev/kustomization.yaml +++ /dev/null @@ -1,83 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: ambient-dev - -resources: -- ../../base -- ambient-ui-route.yaml -- api-server-route.yaml - -components: -- ../../components/postgresql-rhel -- ../../components/ambient-api-server-db - -patches: -# --- Delete unwanted deployments --- -- target: { group: apps, version: v1, kind: Deployment, name: minio } - patch: | - $patch: delete - apiVersion: apps/v1 - kind: Deployment - metadata: { name: minio } -# --- Delete unwanted services --- -- target: { version: v1, kind: Service, name: minio } - patch: | - $patch: delete - apiVersion: v1 - kind: Service - metadata: { name: minio } -# --- Delete unwanted PVCs --- -- target: { version: v1, kind: PersistentVolumeClaim, name: minio-data } - patch: | - $patch: delete - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: { name: minio-data } -# --- Delete unwanted PostgreSQL (shared instance, not used) --- -- target: { group: apps, version: v1, kind: Deployment, name: postgresql } - patch: | - $patch: delete - apiVersion: apps/v1 - kind: Deployment - metadata: { name: postgresql } -- target: { version: v1, kind: Service, name: postgresql } - patch: | - $patch: delete - apiVersion: v1 - kind: Service - metadata: { name: postgresql } -- target: { version: v1, kind: PersistentVolumeClaim, name: postgresql-data } - patch: | - $patch: delete - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: { name: postgresql-data } -# --- Delete unwanted misc --- -- target: { version: v1, kind: LimitRange, name: ambient-default-limits } - patch: | - $patch: delete - apiVersion: v1 - kind: LimitRange - metadata: { name: ambient-default-limits } -- target: { group: networking.k8s.io, version: v1, kind: NetworkPolicy, name: allow-from-runner-namespaces } - patch: | - $patch: delete - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: { name: allow-from-runner-namespaces } -# --- Env patches for retained components --- -- path: ambient-api-server-env-patch.yaml - target: { group: apps, version: v1, kind: Deployment, name: ambient-api-server } -- path: control-plane-env-patch.yaml - target: { group: apps, version: v1, kind: Deployment, name: ambient-control-plane } -- path: ambient-ui-env-patch.yaml - target: { group: apps, version: v1, kind: Deployment, name: ambient-ui } - -images: -- name: quay.io/ambient_code/acp_api_server - newTag: latest -- name: quay.io/ambient_code/acp_control_plane - newTag: latest -- name: quay.io/ambient_code/acp_ambient_ui - newTag: latest diff --git a/components/manifests/overlays/hcmais/ambient-ui-env-patch.yaml b/components/manifests/overlays/hcmais/ambient-ui-env-patch.yaml deleted file mode 100644 index e8aa96ffe..000000000 --- a/components/manifests/overlays/hcmais/ambient-ui-env-patch.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-ui -spec: - template: - spec: - containers: - - name: ambient-ui - env: - - name: NEXT_PUBLIC_PREVIEW_ALLOWED_HOSTS - value: "*.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com,*.openshiftapps.com" diff --git a/components/manifests/overlays/kind-local/ambient-api-server-local-image-patch.yaml b/components/manifests/overlays/kind-local/ambient-api-server-local-image-patch.yaml deleted file mode 100644 index f0901c017..000000000 --- a/components/manifests/overlays/kind-local/ambient-api-server-local-image-patch.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server -spec: - template: - spec: - initContainers: - - name: migration - image: localhost/acp_api_server:latest - imagePullPolicy: IfNotPresent - containers: - - name: api-server - image: localhost/acp_api_server:latest - imagePullPolicy: IfNotPresent diff --git a/components/manifests/overlays/kind-local/control-plane-local-images-patch.yaml b/components/manifests/overlays/kind-local/control-plane-local-images-patch.yaml deleted file mode 100644 index 5369a49a8..000000000 --- a/components/manifests/overlays/kind-local/control-plane-local-images-patch.yaml +++ /dev/null @@ -1,19 +0,0 @@ -# Override runner image references in control plane env vars for kind-local -# Sets imagePullPolicy to IfNotPresent via localhost/ prefix (see kube_reconciler.go:1190) -# Gateway image_pull_policy is set by LOCAL_IMAGES env var (see gateway/manifests.go) -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-control-plane -spec: - template: - spec: - containers: - - name: ambient-control-plane - env: - - name: RUNNER_IMAGE - value: "localhost/acp_claude_runner:latest" - - name: OPENSHELL_RUNNER_IMAGE - value: "localhost/acp_runner_openshell:latest" - - name: MCP_IMAGE - value: "localhost/acp_mcp:latest" diff --git a/components/manifests/overlays/kind-local/image-pull-policy-patch.yaml b/components/manifests/overlays/kind-local/image-pull-policy-patch.yaml deleted file mode 100644 index 2eda87093..000000000 --- a/components/manifests/overlays/kind-local/image-pull-policy-patch.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# Use locally-built images pre-loaded into kind cluster -# Set IfNotPresent so Kubernetes uses images from `kind load docker-image` -- op: replace - path: /spec/template/spec/containers/0/imagePullPolicy - value: IfNotPresent diff --git a/components/manifests/overlays/kind-local/kustomization.yaml b/components/manifests/overlays/kind-local/kustomization.yaml deleted file mode 100644 index 2aad36902..000000000 --- a/components/manifests/overlays/kind-local/kustomization.yaml +++ /dev/null @@ -1,75 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -# Layer on top of the kind overlay, overriding only image sources and pull policy -resources: -- ../kind - -# Override patches for kind-local -patches: -- path: ambient-api-server-local-image-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-api-server -- path: control-plane-local-images-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-control-plane - -# Override imagePullPolicy to IfNotPresent for all deployments -- path: image-pull-policy-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-api-server -- path: image-pull-policy-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-ui -- path: image-pull-policy-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-control-plane - -# Remap images from Quay.io to locally-built names -# Podman tags images with localhost/ prefix, which kind preserves when loading -images: -- name: quay.io/ambient_code/acp_api_server - newName: localhost/acp_api_server - newTag: latest -- name: quay.io/ambient_code/acp_ambient_ui - newName: localhost/acp_ambient_ui - newTag: latest -- name: quay.io/ambient_code/acp_control_plane - newName: localhost/acp_control_plane - newTag: latest -- name: quay.io/ambient_code/acp_claude_runner - newName: localhost/acp_claude_runner - newTag: latest -- name: quay.io/ambient_code/acp_runner_openshell - newName: localhost/acp_runner_openshell - newTag: latest -- name: quay.io/ambient_code/acp_mcp - newName: localhost/acp_mcp - newTag: latest -- name: quay.io/ambient_code/acp_credential_github - newName: localhost/acp_credential_github - newTag: latest -- name: quay.io/ambient_code/acp_credential_jira - newName: localhost/acp_credential_jira - newTag: latest -- name: quay.io/ambient_code/acp_credential_k8s - newName: localhost/acp_credential_k8s - newTag: latest -- name: quay.io/ambient_code/acp_credential_google - newName: localhost/acp_credential_google - newTag: latest diff --git a/components/manifests/overlays/kind/image-pull-policy-patch.yaml b/components/manifests/overlays/kind/image-pull-policy-patch.yaml deleted file mode 100644 index 428013071..000000000 --- a/components/manifests/overlays/kind/image-pull-policy-patch.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# Patch to set imagePullPolicy: Always for kind cluster with Quay images -# Always pull from Quay registry to ensure latest production images -# For local development, use overlays/kind-local/ which sets IfNotPresent -- op: replace - path: /spec/template/spec/containers/0/imagePullPolicy - value: Always diff --git a/components/manifests/overlays/local-dev/ambient-api-server-db-credentials-patch.yaml b/components/manifests/overlays/local-dev/ambient-api-server-db-credentials-patch.yaml deleted file mode 100644 index dbe96f2c6..000000000 --- a/components/manifests/overlays/local-dev/ambient-api-server-db-credentials-patch.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# Fix db.host for the vteam- namePrefix applied by local-dev kustomization -apiVersion: v1 -kind: Secret -metadata: - name: ambient-api-server-db -stringData: - db.host: vteam-ambient-api-server-db diff --git a/components/manifests/overlays/local-dev/ambient-api-server-db-json-patch.yaml b/components/manifests/overlays/local-dev/ambient-api-server-db-json-patch.yaml deleted file mode 100644 index 2888c8260..000000000 --- a/components/manifests/overlays/local-dev/ambient-api-server-db-json-patch.yaml +++ /dev/null @@ -1,42 +0,0 @@ -# JSON patch to replace ambient-api-server-db container for RHEL image -# Replaces volumeMounts to fix mount path for RHEL data directory -# Replaces env vars for RHEL naming convention (POSTGRESQL_* instead of POSTGRES_*) -# Replaces probes to use POSTGRESQL_USER env var -- op: replace - path: /spec/template/spec/containers/0/image - value: registry.redhat.io/rhel10/postgresql-16:10.1 -- op: replace - path: /spec/template/spec/containers/0/env - value: - - name: POSTGRESQL_USER - valueFrom: - secretKeyRef: - name: ambient-api-server-db - key: db.user - - name: POSTGRESQL_PASSWORD - valueFrom: - secretKeyRef: - name: ambient-api-server-db - key: db.password - - name: POSTGRESQL_DATABASE - valueFrom: - secretKeyRef: - name: ambient-api-server-db - key: db.name -- op: replace - path: /spec/template/spec/containers/0/volumeMounts - value: - - name: ambient-api-server-db-data - mountPath: /var/lib/pgsql/data -- op: replace - path: /spec/template/spec/containers/0/readinessProbe/exec/command - value: - - /bin/sh - - -c - - pg_isready -U "$POSTGRESQL_USER" -- op: replace - path: /spec/template/spec/containers/0/livenessProbe/exec/command - value: - - /bin/sh - - -c - - pg_isready -U "$POSTGRESQL_USER" diff --git a/components/manifests/overlays/local-dev/ambient-api-server-init-db-patch.yaml b/components/manifests/overlays/local-dev/ambient-api-server-init-db-patch.yaml deleted file mode 100644 index 408f7b9d5..000000000 --- a/components/manifests/overlays/local-dev/ambient-api-server-init-db-patch.yaml +++ /dev/null @@ -1,60 +0,0 @@ -# Patch ambient-api-server to add init container that waits for the database -# Required for RHEL PostgreSQL which doesn't support /docker-entrypoint-initdb.d/ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server -spec: - template: - spec: - initContainers: - - name: init-db - image: registry.redhat.io/rhel10/postgresql-16:10.1 - command: - - /bin/bash - - -c - - | - set -e - echo "Waiting for PostgreSQL to be ready (timeout: 10 minutes)..." - MAX_RETRIES=300 - RETRY_COUNT=0 - until pg_isready -h "$PGHOST" -U "$PGUSER"; do - RETRY_COUNT=$((RETRY_COUNT + 1)) - if [ $RETRY_COUNT -ge $MAX_RETRIES ]; then - echo "ERROR: PostgreSQL not ready after 10 minutes, giving up" - exit 1 - fi - echo "PostgreSQL not ready, waiting... (attempt $RETRY_COUNT/$MAX_RETRIES)" - sleep 2 - done - echo "PostgreSQL is ready" - - echo "Checking if database '$PGDATABASE' exists..." - if psql -h "$PGHOST" -U "$PGUSER" -lqt | cut -d \| -f 1 | grep -qw "$PGDATABASE"; then - echo "Database '$PGDATABASE' already exists" - else - echo "Creating database '$PGDATABASE'..." - psql -h "$PGHOST" -U "$PGUSER" -c "CREATE DATABASE $PGDATABASE;" - echo "Database '$PGDATABASE' created successfully" - fi - env: - - name: PGHOST - valueFrom: - secretKeyRef: - name: ambient-api-server-db - key: db.host - - name: PGUSER - valueFrom: - secretKeyRef: - name: ambient-api-server-db - key: db.user - - name: PGPASSWORD - valueFrom: - secretKeyRef: - name: ambient-api-server-db - key: db.password - - name: PGDATABASE - valueFrom: - secretKeyRef: - name: ambient-api-server-db - key: db.name diff --git a/components/manifests/overlays/local-dev/ambient-api-server-route.yaml b/components/manifests/overlays/local-dev/ambient-api-server-route.yaml deleted file mode 100644 index 1b3c195a9..000000000 --- a/components/manifests/overlays/local-dev/ambient-api-server-route.yaml +++ /dev/null @@ -1,38 +0,0 @@ ---- -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: ambient-api-server - labels: - app: ambient-api-server - component: api - annotations: - haproxy.router.openshift.io/timeout: 10m -spec: - to: - kind: Service - name: ambient-api-server - port: - targetPort: api - tls: - termination: reencrypt - insecureEdgeTerminationPolicy: Redirect ---- -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: ambient-api-server-grpc - labels: - app: ambient-api-server - component: grpc - annotations: - haproxy.router.openshift.io/timeout: 10m -spec: - to: - kind: Service - name: ambient-api-server - port: - targetPort: grpc - tls: - termination: reencrypt - insecureEdgeTerminationPolicy: Redirect diff --git a/components/manifests/overlays/local-dev/ambient-api-server-service-ca-patch.yaml b/components/manifests/overlays/local-dev/ambient-api-server-service-ca-patch.yaml deleted file mode 100644 index 6cff27b15..000000000 --- a/components/manifests/overlays/local-dev/ambient-api-server-service-ca-patch.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# OpenShift service-ca: auto-provision and rotate TLS certs for ambient-api-server. -apiVersion: v1 -kind: Service -metadata: - name: ambient-api-server - annotations: - service.beta.openshift.io/serving-cert-secret-name: ambient-api-server-tls diff --git a/components/manifests/overlays/local-dev/ambient-api-server-tls-patch.yaml b/components/manifests/overlays/local-dev/ambient-api-server-tls-patch.yaml deleted file mode 100644 index 41e38c4fb..000000000 --- a/components/manifests/overlays/local-dev/ambient-api-server-tls-patch.yaml +++ /dev/null @@ -1,79 +0,0 @@ -# Local-dev (OpenShift): enable end-to-end TLS using service-ca provisioned certs. -# Uses local JWKS file (not remote URL) for JWT validation. -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server -spec: - template: - spec: - containers: - - name: api-server - command: - - /usr/local/bin/ambient-api-server - - serve - - --db-host-file=/secrets/db/db.host - - --db-port-file=/secrets/db/db.port - - --db-user-file=/secrets/db/db.user - - --db-password-file=/secrets/db/db.password - - --db-name-file=/secrets/db/db.name - - --enable-jwt=true - # Authz disabled: api-server has no internal RBAC middleware yet. - # Auth is handled by the backend proxy. TODO: enable when authz is implemented. - - --enable-authz=false - - --jwk-cert-file=/configs/authentication/jwks.json - - --enable-https=true - - --https-cert-file=/etc/tls/tls.crt - - --https-key-file=/etc/tls/tls.key - - --enable-tls=true - - --tls-cert-file=/etc/tls/tls.crt - - --tls-key-file=/etc/tls/tls.key - - --tls-auto-detect-kubernetes=false - - --api-server-bindaddress=:8000 - - --metrics-server-bindaddress=:4433 - - --health-check-server-bindaddress=:4434 - - --enable-health-check-https=true - # SSL disabled: PostgreSQL is in-cluster (same namespace, pod network only). - # Switch to --db-sslmode=require if using an external database. - - --db-sslmode=disable - - --db-max-open-connections=50 - - --enable-db-debug=false - - --enable-metrics-https=false - - --http-read-timeout=5s - - --http-write-timeout=30s - - --cors-allowed-origins=* - - --cors-allowed-headers=X-Ambient-Project - - --enable-grpc=true - - --grpc-server-bindaddress=:9000 - - --grpc-enable-tls=true - - --grpc-tls-cert-file=/etc/tls/tls.crt - - --grpc-tls-key-file=/etc/tls/tls.key - - --alsologtostderr - - -v=4 - volumeMounts: - - name: tls-certs - mountPath: /etc/tls - readOnly: true - livenessProbe: - httpGet: - path: /api/ambient - port: 8000 - scheme: HTTPS - initialDelaySeconds: 15 - periodSeconds: 5 - readinessProbe: - httpGet: - path: /healthcheck - port: 4434 - scheme: HTTPS - httpHeaders: - - name: User-Agent - value: Probe - initialDelaySeconds: 20 - periodSeconds: 10 - volumes: - - name: tls-certs - secret: - # Auto-provisioned by OpenShift service-ca via the Service annotation - # service.beta.openshift.io/serving-cert-secret-name: ambient-api-server-tls - secretName: ambient-api-server-tls diff --git a/components/manifests/overlays/local-dev/dev-users.yaml b/components/manifests/overlays/local-dev/dev-users.yaml deleted file mode 100644 index 5d36d1c7f..000000000 --- a/components/manifests/overlays/local-dev/dev-users.yaml +++ /dev/null @@ -1,54 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: dev-user-admin ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: dev-user-edit ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: dev-user-view ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: dev-user-admin-binding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: -- kind: ServiceAccount - name: dev-user-admin - namespace: vteam-dev ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: dev-user-edit-binding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: edit -subjects: -- kind: ServiceAccount - name: dev-user-edit - namespace: vteam-dev ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: dev-user-view-binding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: view -subjects: -- kind: ServiceAccount - name: dev-user-view - namespace: vteam-dev diff --git a/components/manifests/overlays/local-dev/kustomization.yaml b/components/manifests/overlays/local-dev/kustomization.yaml deleted file mode 100644 index 7176c382f..000000000 --- a/components/manifests/overlays/local-dev/kustomization.yaml +++ /dev/null @@ -1,64 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: vteam-dev - -# Resources (base + local-dev-specific) -resources: -- ../../base -- ambient-api-server-route.yaml -- dev-users.yaml -- ldap-config.yaml -- ldap-credentials.yaml -# mlflow-db-credentials is applied separately (lives in redhat-ods-applications, -# incompatible with namePrefix and namespace directives in this overlay) - -# Patches for local dev environment -patches: -# Ambient API Server: enable end-to-end TLS (OpenShift service-ca provides certs) -- path: ambient-api-server-tls-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-api-server -- path: ambient-api-server-service-ca-patch.yaml - target: - version: v1 - kind: Service - name: ambient-api-server -# Ambient API Server DB: fix db.host for vteam- namePrefix -- path: ambient-api-server-db-credentials-patch.yaml -# Ambient API Server: init container to wait for DB and create database -- path: ambient-api-server-init-db-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-api-server -# PostgreSQL: use RHEL image with proper env vars and mount paths (JSON patch) -- path: postgresql-json-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: postgresql -- path: ambient-api-server-db-json-patch.yaml - target: - group: apps - version: v1 - kind: Deployment - name: ambient-api-server-db - -# Name prefix for local dev resources -namePrefix: vteam- - -# Images for local dev (internal registry) -images: -- name: quay.io/ambient_code/acp_claude_runner - newName: quay.io/ambient_code/acp_claude_runner - newTag: latest -- name: quay.io/ambient_code/acp_api_server - newName: quay.io/ambient_code/acp_api_server - newTag: latest -# PostgreSQL: RHEL image handled via JSON patch (postgresql-json-patch.yaml) diff --git a/components/manifests/overlays/local-dev/ldap-config.yaml b/components/manifests/overlays/local-dev/ldap-config.yaml deleted file mode 100644 index 23aae125b..000000000 --- a/components/manifests/overlays/local-dev/ldap-config.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: ldap-config - labels: - app: backend-api -data: - LDAP_SRV_DOMAIN: "ipa.redhat.com" - LDAP_URL: "ldaps://ipa.corp.redhat.com" - LDAP_BASE_DN: "cn=users,cn=accounts,dc=ipa,dc=redhat,dc=com" - LDAP_GROUP_BASE_DN: "cn=groups,cn=accounts,dc=ipa,dc=redhat,dc=com" - LDAP_BIND_DN: "uid=ambient-code-platform,cn=users,cn=accounts,dc=ipa,dc=redhat,dc=com" - LDAP_CA_CERT_PATH: "/etc/pki/custom-ca/rh-it-root-ca.pem" diff --git a/components/manifests/overlays/local-dev/mlflow-db-credentials.yaml b/components/manifests/overlays/local-dev/mlflow-db-credentials.yaml deleted file mode 100644 index 3c331a1fa..000000000 --- a/components/manifests/overlays/local-dev/mlflow-db-credentials.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# MLflow database credentials for local-dev (CRC/OpenShift Local) -# DO NOT use these credentials in production! -apiVersion: v1 -kind: Secret -metadata: - name: mlflow-db-credentials - namespace: redhat-ods-applications - labels: - app: mlflow - app.kubernetes.io/name: mlflow -type: Opaque -stringData: - # Database connection (uses shared PostgreSQL instance) - # Note: vteam- prefix from kustomization namePrefix - uri: "postgresql://postgres:postgres123@vteam-postgresql.vteam-dev.svc.cluster.local:5432/mlflow?sslmode=disable" diff --git a/components/manifests/overlays/local-dev/postgresql-json-patch.yaml b/components/manifests/overlays/local-dev/postgresql-json-patch.yaml deleted file mode 100644 index 78e40480b..000000000 --- a/components/manifests/overlays/local-dev/postgresql-json-patch.yaml +++ /dev/null @@ -1,42 +0,0 @@ -# JSON patch to replace PostgreSQL container for RHEL image -# Replaces volumeMounts to fix mount path for RHEL data directory -# Replaces env vars for RHEL naming convention (POSTGRESQL_* instead of POSTGRES_*) -# Replaces probes to use POSTGRESQL_USER env var -- op: replace - path: /spec/template/spec/containers/0/image - value: registry.redhat.io/rhel10/postgresql-16:10.1 -- op: replace - path: /spec/template/spec/containers/0/env - value: - - name: POSTGRESQL_USER - valueFrom: - secretKeyRef: - name: postgresql-credentials - key: db.user - - name: POSTGRESQL_PASSWORD - valueFrom: - secretKeyRef: - name: postgresql-credentials - key: db.password - - name: POSTGRESQL_DATABASE - valueFrom: - secretKeyRef: - name: postgresql-credentials - key: db.name -- op: replace - path: /spec/template/spec/containers/0/volumeMounts - value: - - name: data - mountPath: /var/lib/pgsql/data -- op: replace - path: /spec/template/spec/containers/0/readinessProbe/exec/command - value: - - /bin/sh - - -c - - pg_isready -U "$POSTGRESQL_USER" -- op: replace - path: /spec/template/spec/containers/0/livenessProbe/exec/command - value: - - /bin/sh - - -c - - pg_isready -U "$POSTGRESQL_USER" diff --git a/components/manifests/overlays/mpp-openshift/README.md b/components/manifests/overlays/mpp-openshift/README.md deleted file mode 100644 index 89252e1bf..000000000 --- a/components/manifests/overlays/mpp-openshift/README.md +++ /dev/null @@ -1,116 +0,0 @@ -# MPP OpenShift Overlay - -Kustomize overlay for the Managed Platform Plus (MPP) OpenShift environment: `ambient-code--runtime-int`. - -## Apply - -```bash -kubectl apply -k components/manifests/overlays/mpp-openshift/ -``` - -## What This Overlay Does - -- Targets namespace `ambient-code--runtime-int` -- Sets `PLATFORM_MODE=mpp` so the CP uses `MPPNamespaceProvisioner` (namespaces as `ambient-code--`) -- Configures OIDC client credentials auth (no static K8s SA token) -- Adds `--grpc-jwk-cert-url` so the api-server validates RH SSO tokens on gRPC -- Mounts `tenantaccess-ambient-control-plane-token` for the CP's project kube client -- Mounts `ambient-runner-api-token` for runner pods to authenticate as service callers on gRPC -- Adds `allow-ambient-tenant-ingress` NetworkPolicy (ports 8000/9000 from all `ambient-code` tenant namespaces) -- Deploys `ambient-ui` BFF with native SSO authentication (reads `sso-credentials` secret) - -## ⚠️ One-Time Manual Bootstrap - -Two secrets must be created manually once per cluster. They are **not** managed by kustomize (to avoid committing secret values) and are **not** required per session — only per cluster. - -### Step A — TenantServiceAccount - -Grants the CP's service account `namespace-admin` in every current and future tenant namespace via the tenant-access-operator. - -```bash -# Apply the TenantServiceAccount CR to ambient-code--config (NOT via kustomize) -kubectl apply -f components/manifests/overlays/mpp-openshift/ambient-cp-tenant-sa.yaml -``` - -Wait ~30s for the operator to create `tenantaccess-ambient-control-plane-token` in `ambient-code--config`, then copy it to the runtime namespace: - -```bash -kubectl get secret tenantaccess-ambient-control-plane-token \ - -n ambient-code--config \ - -o json \ - | python3 -c " -import json, sys -s = json.load(sys.stdin) -del s['metadata']['namespace'] -del s['metadata']['resourceVersion'] -del s['metadata']['uid'] -del s['metadata']['creationTimestamp'] -s['metadata'].pop('ownerReferences', None) -s['metadata'].pop('annotations', None) -s['type'] = 'Opaque' -print(json.dumps(s)) -" | kubectl apply -n ambient-code--runtime-int -f - -``` - -**Effect:** The operator automatically injects a `namespace-admin` RoleBinding into every `ambient-code--*` namespace, including ones created after this step. The CP mounts this token as its `projectKube` client for all namespace-scoped operations. - -### Step B — Static Runner API Token - -The runner uses a static token to authenticate as a gRPC service caller, bypassing the per-user session ownership check on `WatchSessionMessages`. - -```bash -# Generate a random token — record this value; you will need it for Step C -STATIC_TOKEN=$(python3 -c "import secrets; print(secrets.token_urlsafe(32))") - -kubectl create secret generic ambient-runner-api-token \ - --from-literal=token=${STATIC_TOKEN} \ - -n ambient-code--runtime-int -``` - -**Do not commit the token value.** - -### Step C — Set AMBIENT_API_TOKEN on the api-server - -The api-server must know the static token so it can recognise the runner as a service caller: - -```bash -# Patch the api-server args to include the token file -# (or set AMBIENT_API_TOKEN directly if your deployment supports it) -# The token value must match what was set in Step B -``` - -> **Note:** Step C `WatchSessionMessages PERMISSION_DENIED` was resolved — see `specs/platform/control-plane.spec.md`. - -## Files in This Overlay - -| File | Purpose | -|------|---------| -| `kustomization.yaml` | Root kustomize config; sets namespace, images, patches | -| `ambient-control-plane.yaml` | CP Deployment — OIDC env, `PROJECT_KUBE_TOKEN_FILE`, project-kube volume mount | -| `ambient-api-server.yaml` | api-server Deployment base | -| `ambient-api-server-args-patch.yaml` | api-server command args — db, grpc, OIDC JWKS URL | -| `ambient-api-server-service-ca-patch.yaml` | Service CA annotation for TLS | -| `ambient-api-server-db.yaml` | PostgreSQL Deployment + Service | -| `ambient-api-server-route.yaml` | OpenShift Route for external access | -| `ambient-control-plane-sa.yaml` | ServiceAccount for the CP | -| `ambient-control-plane-rbac.yaml` | RBAC for the CP SA | -| `ambient-tenant-ingress-netpol.yaml` | NetworkPolicy allowing runner→api-server traffic | -| `ambient-cp-tenant-sa.yaml` | TenantServiceAccount CR (applied manually — see Step A) | -| `ambient-ui.yaml` | ambient-ui Deployment, ServiceAccount, Service (BFF with native SSO) | -| `ambient-ui-route.yaml` | OpenShift Route for ambient-ui (TLS edge termination) | - -### Step D — SSO Credentials for ambient-ui - -The ambient-ui BFF requires an OIDC confidential client. Create the `sso-credentials` secret: - -```bash -kubectl create secret generic sso-credentials -n \ - --from-literal=SSO_ISSUER_URL= \ - --from-literal=SSO_CLIENT_ID= \ - --from-literal=SSO_CLIENT_SECRET= \ - --from-literal=SESSION_SECRET="$(openssl rand -base64 32)" -``` - -## Re-Bootstrap Required? - -Only if `ambient-code--runtime-int` is destroyed, which MPP should never do to runtime/config namespaces. Session namespaces (`ambient-code--`) are created and destroyed per session with no manual action required. diff --git a/components/manifests/overlays/mpp-openshift/ambient-api-server-args-patch.yaml b/components/manifests/overlays/mpp-openshift/ambient-api-server-args-patch.yaml deleted file mode 100644 index cddeaad2f..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-api-server-args-patch.yaml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server -spec: - template: - spec: - containers: - - name: api-server - command: - - /usr/local/bin/ambient-api-server - - serve - - --db-host-file=/secrets/db/db.host - - --db-port-file=/secrets/db/db.port - - --db-user-file=/secrets/db/db.user - - --db-password-file=/secrets/db/db.password - - --db-name-file=/secrets/db/db.name - - --enable-authz=true - - --enable-https=false - - --api-server-bindaddress=:8000 - - --metrics-server-bindaddress=:4433 - - --health-check-server-bindaddress=:4434 - - --db-sslmode=disable - - --db-max-open-connections=50 - - --enable-db-debug=false - - --enable-metrics-https=false - - --http-read-timeout=5s - - --http-write-timeout=30s - - --cors-allowed-origins=* - - --cors-allowed-headers=X-Ambient-Project - - --jwk-cert-file=/configs/authentication/jwks.json - - --enable-grpc=true - - --grpc-server-bindaddress=:9000 - - --grpc-enable-tls=true - - --grpc-tls-cert-file=/etc/tls/tls.crt - - --grpc-tls-key-file=/etc/tls/tls.key - - --alsologtostderr - - -v=4 - volumeMounts: - - name: tls-certs - mountPath: /etc/tls - readOnly: true - volumes: - - name: tls-certs - secret: - secretName: ambient-api-server-tls diff --git a/components/manifests/overlays/mpp-openshift/ambient-api-server-db.yaml b/components/manifests/overlays/mpp-openshift/ambient-api-server-db.yaml deleted file mode 100644 index e807ddeb2..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-api-server-db.yaml +++ /dev/null @@ -1,97 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: ambient-api-server-db - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server - component: database -spec: - ports: - - name: postgresql - port: 5432 - protocol: TCP - targetPort: 5432 - selector: - app: ambient-api-server - component: database - type: ClusterIP ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server-db - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server - component: database -spec: - replicas: 1 - selector: - matchLabels: - app: ambient-api-server - component: database - strategy: - type: Recreate - template: - metadata: - labels: - app: ambient-api-server - component: database - spec: - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: postgresql - image: registry.redhat.io/rhel10/postgresql-16:10.1 - ports: - - containerPort: 5432 - name: postgresql - env: - - name: POSTGRESQL_USER - valueFrom: - secretKeyRef: - key: db.user - name: ambient-api-server-db - - name: POSTGRESQL_PASSWORD - valueFrom: - secretKeyRef: - key: db.password - name: ambient-api-server-db - - name: POSTGRESQL_DATABASE - valueFrom: - secretKeyRef: - key: db.name - name: ambient-api-server-db - volumeMounts: - - name: ambient-api-server-db-data - mountPath: /var/lib/pgsql/data - subPath: pgdata - readinessProbe: - exec: - command: - - /bin/sh - - -c - - pg_isready -U "$POSTGRESQL_USER" - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - livenessProbe: - exec: - command: - - /bin/sh - - -c - - pg_isready -U "$POSTGRESQL_USER" - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - volumes: - - name: ambient-api-server-db-data - emptyDir: {} diff --git a/components/manifests/overlays/mpp-openshift/ambient-api-server-route.yaml b/components/manifests/overlays/mpp-openshift/ambient-api-server-route.yaml deleted file mode 100644 index 133ed0d55..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-api-server-route.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: ambient-api-server - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server - component: api - shard: internal - annotations: - haproxy.router.openshift.io/timeout: 10m - haproxy.router.openshift.io/timeout-tunnel: 10m -spec: - to: - kind: Service - name: ambient-api-server - port: - targetPort: api - tls: - termination: edge - insecureEdgeTerminationPolicy: Redirect ---- -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: ambient-api-server-grpc - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server - component: grpc - shard: internal - annotations: - haproxy.router.openshift.io/timeout: 10m - haproxy.router.openshift.io/timeout-tunnel: 10m -spec: - to: - kind: Service - name: ambient-api-server - port: - targetPort: grpc - tls: - termination: reencrypt - insecureEdgeTerminationPolicy: Redirect diff --git a/components/manifests/overlays/mpp-openshift/ambient-api-server-service-ca-patch.yaml b/components/manifests/overlays/mpp-openshift/ambient-api-server-service-ca-patch.yaml deleted file mode 100644 index 2ef884562..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-api-server-service-ca-patch.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: ambient-api-server - annotations: - service.beta.openshift.io/serving-cert-secret-name: ambient-api-server-tls diff --git a/components/manifests/overlays/mpp-openshift/ambient-api-server.yaml b/components/manifests/overlays/mpp-openshift/ambient-api-server.yaml deleted file mode 100644 index ee2b15c8f..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-api-server.yaml +++ /dev/null @@ -1,184 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: ambient-api-server-auth - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server - component: auth -data: - jwks.json: | - {"keys":[{"use":"sig","kty":"RSA","kid":"GWqMSQVJjDoKaU8TnH_LmZeII2wGWYez6x_Oa63hXMM","alg":"RS256","n":"5NBKTJAC7kLcQBWWT0eBuaAI-4lqO2hl3S2Oc37kwXqHowA-2XSGT5g5oW-Y3jtg5m9XUdnTdEoyIEfbcs9mkmDm-IT3fvCWgiDWvopTd9C5WxhcM0XcjqdVSshFzDK2V1ZLmic2pLZS743hfGb1FDezF9A-KNycE41_2IwisPDNJbjsxH6oabOkva4QtA_K9ivREq6gBQtZSIr_hoQLcafL6paVAuPW1wVreBENBqiYkM69iSq3pU6Svqb51WhMADCIcxUsEINTW-0hg91WOYdSJ0r1UpEc6nGxb56Jlw-5h_nFInNUorXeTezgSXcpaHz1EpQQe4vo68EWhf3I6w","e":"AQAB"},{"use":"sig","kty":"RSA","kid":"1milNqdanuBP4v4UolwNIJwbHgxj1BrgmGLdBDWpQDc","alg":"RS256","n":"lvJPPx7OqsIDUnQQtOHUw26qqvL-XjhgSxYWvONhPgIqc5f-dvkBqH9mo_5WkUZcEcvC12FuUvJlYs1mHB4Zy7FwHY00HgD2v3Qa7AuhnnX6EIhGsqL1bxEae5OeRKe5mcEpBBIaXsbbWhrxTxksZqOeYGwJfI9FK8TFFD8C9LJTAAT_CpvU9ieKvYj0rvvvELEk8-DzsjnHabd7extSRUwqtb7xMx4DcMwRi1Axt_dp7g3EyOV1aUZXeNjncE5ot1m3r0t6LtnDk9Sb94EN1YfaVtE5LzK7zD46e05nQIUguURNC8xMUzIFkkoKNv7-wEDw5AhmnbWw9960ObUcAw","e":"AQAB"},{"use":"sig","kty":"RSA","kid":"jtx9LVV86TSy7P5AsXEGe6yAWUCIdnAVEsK1S3PRE90","alg":"RS256","n":"32_0wd-rJldZn63xz7rHHrgjo-Y7A6GYN-hlBGF5EPlheR18A_jQmjHHxSzFKWx1Kgm0hV8nGNCjvXsuQ2hzDDLHYnXe1w7S9JhEQTxIV87FWod9OuGefddfCXUarI14_AvtjgrQG_0BTCpSG0IS5rojvxjvr5NeJuPu9msIbMl5xeYST63r1U6F46KGYcdAMYw21z59rT-s4d0c7FJIIu2llrlPj1m4N8FUEmf9GBCjXA_ys7ZmYLkue35WtzSSRYXZZy3czYtffsW1yeRVlWthIZ182qEzt6T00gZPlHjKNPrgPNQ9b5hA_ZC3SEWE2KU-Y_4QH4aTSsbAoRTtJbVdfb7k5Osvq2Vuu6TjDElZuZXAYu3gu5EtXp-xBWIX-Lvs_wW_5qL2h7zcv127vl4NocUz0kSl3m-t53u1JMrcxBsucQRn1CEzsph9oUABVBEP8ugviA8BbRIFfvx9cX-mSk6DYxn-deX4IOrLJqoekvoIIL0Z9wxVnp681xgLZVXG2JvOIc46ZXORGqol4m69OPbmxdrXdMNY8Hbnf4IycS99axN0rG3ZmnVLBR17b2Rl7cIS-E-1vQ8XKcH89SX8Mj9kwnmr4P6biK3T6Iyhv9CY2sZFpy6XrXGrL9eGRR_lRildgq6wCjcGAAYdTzUHgKAC3f3KT1_aTEBw9Ks","e":"AQAB"}]} - acl.yml: | - - claim: email - pattern: ^.*@(redhat\.com|ambient\.code)$ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ambient-api-server - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server - component: api -spec: - replicas: 1 - selector: - matchLabels: - app: ambient-api-server - component: api - strategy: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 25% - type: RollingUpdate - template: - metadata: - labels: - app: ambient-api-server - component: api - spec: - serviceAccountName: ambient-api-server - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - initContainers: - - name: migration - image: quay.io/ambient_code/acp_api_server:latest - imagePullPolicy: Always - command: - - /usr/local/bin/ambient-api-server - - migrate - - --db-host-file=/secrets/db/db.host - - --db-port-file=/secrets/db/db.port - - --db-user-file=/secrets/db/db.user - - --db-password-file=/secrets/db/db.password - - --db-name-file=/secrets/db/db.name - - --alsologtostderr - - -v=4 - volumeMounts: - - name: db-secrets - mountPath: /secrets/db - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - capabilities: - drop: - - ALL - containers: - - name: api-server - image: quay.io/ambient_code/acp_api_server:latest - imagePullPolicy: Always - env: - - name: AMBIENT_ENV - value: production - - name: GRPC_SERVICE_ACCOUNT - value: "service-account-ocm-ams-service" - - name: CREDENTIAL_ENCRYPTION_ALLOW_PLAINTEXT - value: "true" - ports: - - name: api - containerPort: 8000 - protocol: TCP - - name: metrics - containerPort: 4433 - protocol: TCP - - name: health - containerPort: 4434 - protocol: TCP - - name: grpc - containerPort: 9000 - protocol: TCP - volumeMounts: - - name: db-secrets - mountPath: /secrets/db - - name: app-secrets - mountPath: /secrets/service - - name: auth-config - mountPath: /configs/authentication - resources: - requests: - cpu: 200m - memory: 512Mi - limits: - cpu: 1 - memory: 1Gi - livenessProbe: - httpGet: - path: /api/ambient - port: 8000 - scheme: HTTP - initialDelaySeconds: 15 - periodSeconds: 5 - readinessProbe: - httpGet: - path: /healthcheck - port: 4434 - scheme: HTTP - httpHeaders: - - name: User-Agent - value: Probe - initialDelaySeconds: 20 - periodSeconds: 10 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - capabilities: - drop: - - ALL - volumes: - - name: db-secrets - secret: - secretName: ambient-api-server-db - - name: app-secrets - secret: - secretName: ambient-api-server - - name: auth-config - configMap: - name: ambient-api-server-auth ---- -apiVersion: v1 -kind: Service -metadata: - name: ambient-api-server - namespace: ambient-code--runtime-int - labels: - app: ambient-api-server - component: api -spec: - selector: - app: ambient-api-server - component: api - ports: - - name: api - port: 8000 - targetPort: 8000 - protocol: TCP - - name: grpc - port: 9000 - targetPort: 9000 - protocol: TCP - - name: metrics - port: 4433 - targetPort: 4433 - protocol: TCP - - name: health - port: 4434 - targetPort: 4434 - protocol: TCP diff --git a/components/manifests/overlays/mpp-openshift/ambient-control-plane-sa.yaml b/components/manifests/overlays/mpp-openshift/ambient-control-plane-sa.yaml deleted file mode 100644 index 8a8946c8a..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-control-plane-sa.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ambient-control-plane - namespace: ambient-code--runtime-int - labels: - app: ambient-control-plane ---- -apiVersion: v1 -kind: Secret -metadata: - name: ambient-control-plane-token - namespace: ambient-code--runtime-int - annotations: - kubernetes.io/service-account.name: ambient-control-plane -type: kubernetes.io/service-account-token diff --git a/components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml b/components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml deleted file mode 100644 index f4beba4a2..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: ambient-control-plane - namespace: ambient-code--runtime-int - labels: - app: ambient-control-plane -spec: - selector: - app: ambient-control-plane - ports: - - name: token - port: 8080 - targetPort: 8080 - protocol: TCP diff --git a/components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml b/components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml deleted file mode 100755 index 53a5db42b..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml +++ /dev/null @@ -1,116 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-control-plane - namespace: ambient-code--runtime-int - labels: - app: ambient-control-plane -spec: - replicas: 1 - selector: - matchLabels: - app: ambient-control-plane - template: - metadata: - labels: - app: ambient-control-plane - spec: - serviceAccountName: ambient-control-plane - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: ambient-control-plane - image: quay.io/ambient_code/acp_control_plane:latest - imagePullPolicy: Always - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - env: - - name: AMBIENT_API_TOKEN - valueFrom: - secretKeyRef: - name: ambient-control-plane-token - key: token - - name: AMBIENT_API_SERVER_URL - value: "http://ambient-api-server.ambient-code--runtime-int.svc:8000" - - name: AMBIENT_GRPC_SERVER_ADDR - value: "ambient-api-server.ambient-code--runtime-int.svc:9000" - - name: AMBIENT_GRPC_USE_TLS - value: "false" - - name: MODE - value: "kube" - - name: PLATFORM_MODE - value: "mpp" - - name: MPP_CONFIG_NAMESPACE - value: "ambient-code--config" - - name: LOG_LEVEL - value: "info" - - name: RUNNER_IMAGE - value: "quay.io/ambient_code/acp_claude_runner:latest" - - name: OIDC_CLIENT_ID - valueFrom: - secretKeyRef: - name: ambient-api-server - key: clientId - - name: OIDC_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: ambient-api-server - key: clientSecret - - name: PROJECT_KUBE_TOKEN_FILE - value: "/var/run/secrets/project-kube/token" - - name: USE_VERTEX - value: "1" - - name: ANTHROPIC_VERTEX_PROJECT_ID - value: "ambient-code-platform" - - name: CLOUD_ML_REGION - value: "global" - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/app/vertex/ambient-code-key.json" - - name: VERTEX_SECRET_NAME - value: "ambient-vertex" - - name: VERTEX_SECRET_NAMESPACE - value: "ambient-code--runtime-int" - - name: CP_RUNTIME_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CP_TOKEN_URL - value: "http://ambient-control-plane.ambient-code--ambient-s0.svc:8080/token" - - name: MCP_IMAGE - value: "quay.io/ambient_code/acp_mcp:latest" - - name: GITHUB_MCP_IMAGE - value: "quay.io/ambient_code/acp_credential_github:latest" - - name: JIRA_MCP_IMAGE - value: "quay.io/ambient_code/acp_credential_jira:latest" - - name: K8S_MCP_IMAGE - value: "quay.io/ambient_code/acp_credential_k8s:latest" - - name: GOOGLE_MCP_IMAGE - value: "quay.io/ambient_code/acp_credential_google:latest" - volumeMounts: - - name: project-kube-token - mountPath: /var/run/secrets/project-kube - readOnly: true - - name: vertex-credentials - mountPath: /app/vertex - readOnly: true - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 256Mi - volumes: - - name: project-kube-token - secret: - secretName: ambient-control-plane-token - - name: vertex-credentials - secret: - secretName: ambient-vertex - restartPolicy: Always diff --git a/components/manifests/overlays/mpp-openshift/ambient-cp-tenant-sa.yaml b/components/manifests/overlays/mpp-openshift/ambient-cp-tenant-sa.yaml deleted file mode 100644 index af4d808f7..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-cp-tenant-sa.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: tenantaccess.paas.redhat.com/v1beta1 -kind: TenantServiceAccount -metadata: - name: ambient-control-plane - namespace: ambient-code--config -spec: - create-permanent-token: true - roles: - - namespace-admin diff --git a/components/manifests/overlays/mpp-openshift/ambient-cp-token-netpol.yaml b/components/manifests/overlays/mpp-openshift/ambient-cp-token-netpol.yaml deleted file mode 100644 index aa11c728d..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-cp-token-netpol.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-runner-token-fetch - namespace: ambient-code--runtime-int - labels: - app: ambient-control-plane -spec: - podSelector: - matchLabels: - app: ambient-control-plane - ingress: - - from: - - namespaceSelector: - matchLabels: - tenant.paas.redhat.com/tenant: ambient-code - ports: - - protocol: TCP - port: 8080 - policyTypes: - - Ingress diff --git a/components/manifests/overlays/mpp-openshift/ambient-tenant-ingress-netpol.yaml b/components/manifests/overlays/mpp-openshift/ambient-tenant-ingress-netpol.yaml deleted file mode 100644 index 0564431dd..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-tenant-ingress-netpol.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-ambient-tenant-ingress - namespace: ambient-code--runtime-int -spec: - podSelector: {} - policyTypes: - - Ingress - ingress: - - from: - - namespaceSelector: - matchLabels: - tenant.paas.redhat.com/tenant: ambient-code - ports: - - port: 8000 - protocol: TCP - - port: 9000 - protocol: TCP diff --git a/components/manifests/overlays/mpp-openshift/ambient-ui-route.yaml b/components/manifests/overlays/mpp-openshift/ambient-ui-route.yaml deleted file mode 100644 index 8b4b186f9..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-ui-route.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: ambient-ui - namespace: ambient-code--runtime-int - labels: - app: ambient-ui - shard: internal - annotations: - haproxy.router.openshift.io/timeout: 10m - haproxy.router.openshift.io/timeout-tunnel: 10m -spec: - to: - kind: Service - name: ambient-ui - port: - targetPort: http - tls: - termination: edge - insecureEdgeTerminationPolicy: Redirect diff --git a/components/manifests/overlays/mpp-openshift/ambient-ui.yaml b/components/manifests/overlays/mpp-openshift/ambient-ui.yaml deleted file mode 100644 index 8e4323fa6..000000000 --- a/components/manifests/overlays/mpp-openshift/ambient-ui.yaml +++ /dev/null @@ -1,123 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ambient-ui - namespace: ambient-code--runtime-int - labels: - app: ambient-ui ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-ui - namespace: ambient-code--runtime-int - labels: - app: ambient-ui -spec: - replicas: 1 - selector: - matchLabels: - app: ambient-ui - template: - metadata: - labels: - app: ambient-ui - spec: - serviceAccountName: ambient-ui - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: ambient-ui - image: quay.io/ambient_code/acp_ambient_ui:latest - imagePullPolicy: Always - ports: - - containerPort: 3000 - name: http - env: - - name: API_SERVER_URL - value: "http://ambient-api-server.ambient-code--runtime-int.svc:8000" - - name: NODE_ENV - value: "production" - - name: SSO_ISSUER_URL - valueFrom: - secretKeyRef: - name: sso-credentials - key: SSO_ISSUER_URL - - name: SSO_CLIENT_ID - valueFrom: - secretKeyRef: - name: sso-credentials - key: SSO_CLIENT_ID - - name: SSO_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: sso-credentials - key: SSO_CLIENT_SECRET - - name: SESSION_SECRET - valueFrom: - secretKeyRef: - name: sso-credentials - key: SESSION_SECRET - - name: NODE_EXTRA_CA_CERTS - value: "/etc/ssl/service-ca/service-ca.crt" - volumeMounts: - - name: next-cache - mountPath: /app/.next/cache - - name: tmp - mountPath: /tmp - - name: service-ca - mountPath: /etc/ssl/service-ca - readOnly: true - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 500m - memory: 512Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - livenessProbe: - httpGet: - path: /api/healthz - port: http - initialDelaySeconds: 10 - periodSeconds: 10 - readinessProbe: - httpGet: - path: /api/healthz - port: http - initialDelaySeconds: 5 - periodSeconds: 5 - volumes: - - name: next-cache - emptyDir: {} - - name: tmp - emptyDir: {} - - name: service-ca - configMap: - name: openshift-service-ca.crt - optional: true ---- -apiVersion: v1 -kind: Service -metadata: - name: ambient-ui - namespace: ambient-code--runtime-int - labels: - app: ambient-ui -spec: - selector: - app: ambient-ui - ports: - - port: 3000 - targetPort: http - protocol: TCP - name: http - type: ClusterIP diff --git a/components/manifests/overlays/mpp-openshift/kustomization.yaml b/components/manifests/overlays/mpp-openshift/kustomization.yaml deleted file mode 100644 index 9c7434764..000000000 --- a/components/manifests/overlays/mpp-openshift/kustomization.yaml +++ /dev/null @@ -1,47 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -metadata: - name: ambient-mpp-openshift - -resources: -- ambient-api-server-db.yaml -- ambient-api-server.yaml -- ambient-control-plane.yaml -- ambient-control-plane-svc.yaml -- ambient-cp-token-netpol.yaml -- ambient-api-server-route.yaml -- ambient-control-plane-sa.yaml -- tenant-rbac/ -- ambient-tenant-ingress-netpol.yaml -- ambient-ui.yaml -- ambient-ui-route.yaml - -patches: -- path: ambient-api-server-args-patch.yaml - target: - group: apps - kind: Deployment - name: ambient-api-server - version: v1 -- path: ambient-api-server-service-ca-patch.yaml - target: - kind: Service - name: ambient-api-server - version: v1 - -images: -- name: quay.io/ambient_code/acp_api_server - newTag: latest -- name: quay.io/ambient_code/acp_api_server:latest - newName: quay.io/ambient_code/acp_api_server - newTag: latest -- name: quay.io/ambient_code/acp_control_plane - newTag: latest -- name: quay.io/ambient_code/acp_control_plane:latest - newName: quay.io/ambient_code/acp_control_plane - newTag: latest -- name: quay.io/ambient_code/acp_mcp - newTag: latest -- name: quay.io/ambient_code/acp_ambient_ui - newTag: latest diff --git a/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-runtime-int.yaml b/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-runtime-int.yaml deleted file mode 100644 index cc1907829..000000000 --- a/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-runtime-int.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: ambient-control-plane-tenant-namespaces-runtime-int - namespace: ambient-code--config -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ambient-control-plane-tenant-namespaces -subjects: - - kind: ServiceAccount - name: ambient-control-plane - namespace: ambient-code--runtime-int diff --git a/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-s0.yaml b/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-s0.yaml deleted file mode 100644 index 33b5e84fb..000000000 --- a/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-s0.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: ambient-control-plane-tenant-namespaces-s0 - namespace: ambient-code--config -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ambient-control-plane-tenant-namespaces -subjects: - - kind: ServiceAccount - name: ambient-control-plane - namespace: ambient-code--ambient-s0 diff --git a/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac.yaml b/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac.yaml deleted file mode 100644 index af30202cc..000000000 --- a/components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: ambient-control-plane-tenant-namespaces - namespace: ambient-code--config -rules: - - apiGroups: ["tenant.paas.redhat.com"] - resources: ["tenantnamespaces"] - verbs: ["get", "list", "watch", "create", "delete"] diff --git a/components/manifests/overlays/mpp-openshift/tenant-rbac/kustomization.yaml b/components/manifests/overlays/mpp-openshift/tenant-rbac/kustomization.yaml deleted file mode 100644 index fe14cc3d7..000000000 --- a/components/manifests/overlays/mpp-openshift/tenant-rbac/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- ambient-control-plane-rbac.yaml -- ambient-control-plane-rbac-runtime-int.yaml -- ambient-control-plane-rbac-s0.yaml diff --git a/components/manifests/overlays/openshift-dev/ambient-api-server-args-patch.yaml b/components/manifests/overlays/openshift-dev/ambient-api-server-args-patch.yaml deleted file mode 100644 index 62aa67848..000000000 --- a/components/manifests/overlays/openshift-dev/ambient-api-server-args-patch.yaml +++ /dev/null @@ -1,72 +0,0 @@ -# openshift-dev: TLS via OpenShift service-ca. JWT disabled; bearer token auth -# for service-to-service (control-plane) is handled via AMBIENT_API_TOKEN env var. -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server -spec: - template: - spec: - containers: - - name: api-server - command: - - /usr/local/bin/ambient-api-server - - serve - - --db-host-file=/secrets/db/db.host - - --db-port-file=/secrets/db/db.port - - --db-user-file=/secrets/db/db.user - - --db-password-file=/secrets/db/db.password - - --db-name-file=/secrets/db/db.name - - --enable-jwt=false - - --enable-authz=true - - --enable-https=true - - --https-cert-file=/etc/tls/tls.crt - - --https-key-file=/etc/tls/tls.key - - --enable-tls=true - - --tls-cert-file=/etc/tls/tls.crt - - --tls-key-file=/etc/tls/tls.key - - --tls-auto-detect-kubernetes=false - - --api-server-bindaddress=:8000 - - --metrics-server-bindaddress=:4433 - - --health-check-server-bindaddress=:4434 - - --enable-health-check-https=true - - --db-sslmode=disable - - --db-max-open-connections=50 - - --enable-db-debug=false - - --enable-metrics-https=false - - --http-read-timeout=5s - - --http-write-timeout=30s - - --cors-allowed-origins=* - - --cors-allowed-headers=X-Ambient-Project - - --enable-grpc=true - - --grpc-server-bindaddress=:9000 - - --grpc-enable-tls=true - - --grpc-tls-cert-file=/etc/tls/tls.crt - - --grpc-tls-key-file=/etc/tls/tls.key - - --alsologtostderr - - -v=4 - volumeMounts: - - name: tls-certs - mountPath: /etc/tls - readOnly: true - livenessProbe: - httpGet: - path: /api/ambient - port: 8000 - scheme: HTTPS - initialDelaySeconds: 15 - periodSeconds: 5 - readinessProbe: - httpGet: - path: /healthcheck - port: 4434 - scheme: HTTPS - httpHeaders: - - name: User-Agent - value: Probe - initialDelaySeconds: 20 - periodSeconds: 10 - volumes: - - name: tls-certs - secret: - secretName: ambient-api-server-tls diff --git a/components/manifests/overlays/openshift-dev/ambient-api-server-env-patch.yaml b/components/manifests/overlays/openshift-dev/ambient-api-server-env-patch.yaml deleted file mode 100644 index a2362569c..000000000 --- a/components/manifests/overlays/openshift-dev/ambient-api-server-env-patch.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ambient-api-server -spec: - template: - spec: - containers: - - name: api-server - env: - - name: AMBIENT_ENV - value: openshift-dev - - name: AMBIENT_API_TOKEN - valueFrom: - secretKeyRef: - name: ambient-control-plane-token - key: token - - name: CREDENTIAL_ENCRYPTION_ALLOW_PLAINTEXT - value: "true" diff --git a/components/manifests/overlays/openshift-dev/kustomization.yaml b/components/manifests/overlays/openshift-dev/kustomization.yaml deleted file mode 100644 index 14058cd42..000000000 --- a/components/manifests/overlays/openshift-dev/kustomization.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -metadata: - name: vteam-openshift-dev - -namespace: ambient-code - -resources: -- ../production - -patches: -- path: ambient-api-server-env-patch.yaml - target: - group: apps - kind: Deployment - name: ambient-api-server - version: v1 -- path: ambient-api-server-args-patch.yaml - target: - group: apps - kind: Deployment - name: ambient-api-server - version: v1 diff --git a/components/manifests/overlays/openshift-local/ldap-credentials.yaml b/components/manifests/overlays/openshift-local/ldap-credentials.yaml deleted file mode 100644 index 7dd604b4d..000000000 --- a/components/manifests/overlays/openshift-local/ldap-credentials.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: ldap-credentials - labels: - app: backend-api -type: Opaque -stringData: - LDAP_BIND_PASSWORD: "REPLACE_WITH_ACTUAL_PASSWORD" diff --git a/docs/internal/deployment/OPENSHIFT_DEPLOY.md b/docs/internal/deployment/OPENSHIFT_DEPLOY.md index d0e372887..ec55a7138 100644 --- a/docs/internal/deployment/OPENSHIFT_DEPLOY.md +++ b/docs/internal/deployment/OPENSHIFT_DEPLOY.md @@ -12,7 +12,7 @@ The Ambient Code Platform is an OpenShift-native platform that deploys an API se 1. **Deploy** (from project root): ```bash - # Choose an overlay (e.g., openshift-dev, production) + # Choose an overlay (e.g., crc, production, hcmai) oc apply -k components/manifests/overlays/ ``` This deploys to the `ambient-code` namespace using default images from quay.io/ambient_code. diff --git a/docs/internal/developer/local-development/kind.md b/docs/internal/developer/local-development/kind.md index 34aae5796..1ad1911b2 100755 --- a/docs/internal/developer/local-development/kind.md +++ b/docs/internal/developer/local-development/kind.md @@ -124,7 +124,7 @@ make kind-down # Cleanup Build all components from your local source tree and deploy to kind. -> **Note:** `LOCAL_IMAGES=true` requires **Podman** as the container engine. The `kind-local` overlay expects the `localhost/` image prefix that Podman uses natively. +> **Note:** `LOCAL_IMAGES=true` requires **Podman** as the container engine. The local image workflow expects the `localhost/` image prefix that Podman uses natively. ```bash # Build, load, and deploy in one step (requires CONTAINER_ENGINE=podman) @@ -134,7 +134,7 @@ make kind-up LOCAL_IMAGES=true make kind-up LOCAL_IMAGES=true LOCAL_VERTEX=true ``` -This builds all container images from source, loads them into the kind cluster, and deploys using the `kind-local` overlay (which sets `imagePullPolicy: IfNotPresent`). +This builds all container images from source, loads them into the kind cluster, and deploys using the `kind` overlay with local image overrides (which sets `imagePullPolicy: IfNotPresent`). #### Iterating After Code Changes diff --git a/skills/RECONCILE.md b/skills/RECONCILE.md index 76dc099d1..3be75daa1 100644 --- a/skills/RECONCILE.md +++ b/skills/RECONCILE.md @@ -124,7 +124,7 @@ Severity: `blocker` > `critical` > `major` > `minor` | P17 | openshell-gateway | Gateway Configuration Validation | CP | **done** | major | `internal/gateway/validation.go` consumed by `GatewayReconciler.reconcileGateway` — calls `gateway.ValidateGatewayConfig` before reconciling, skips invalid gateways with warning log. | | P18 | openshell-gateway | Kustomize Overlay Structure for Gateways | Examples | **done** | major | `examples/base/gateways/openshell-gateway.yaml` with `kind: Gateway`, image, server_dns_names, labels. `examples/base/gateways/kustomization.yaml`. Base kustomization updated. | | P19 | openshell-gateway | Gateway Deployment Failure Handling | CP | **done** | major | GatewayReconciler tracks per-gateway failures, updates `ambient.ai/reconcile-status` and `ambient.ai/last-reconciled-at` annotations on Gateway resources. Validation failures annotated as `ValidationFailed`. Reconcile loop counts and warns on partial failures. | -| P20 | openshell-gateway | platform-config ConfigMap overlays removal | Manifests | **done** | minor | Deleted `platform-config.yaml` from `overlays/kind/` and `overlays/hcmais-dev/`. Removed references from both `kustomization.yaml` files. | +| P20 | openshell-gateway | platform-config ConfigMap overlays removal | Manifests | **done** | minor | Deleted `platform-config.yaml` from `overlays/kind/` and deleted overlays. Removed references from `kustomization.yaml` files. | | P31 | openshell-gateway | cert-manager TLS certificate management | CP | **done** | major | `detectCertManager()` checks for `cert-manager.io/` API group at startup. `reconcileCertManagerResources()` creates self-signed Issuer, CA Certificate, CA Issuer, server Certificate, and client Certificate. Conditional on `r.hasCertManager`. | | P32 | openshell-gateway | Trusted CA bundle injection | CP | **done** | major | `gateway-trusted-ca` ConfigMap copied from CP namespace to tenant namespace. `applyTrustedCAOverrides()` adds volume mount at `/etc/pki/tls/certs/ca-bundle.crt`, sets `SSL_CERT_FILE` env var. | | P33 | openshell-gateway | OIDC API fields and TOML injection | BE+CP | **done** | major | `GatewayOidc` struct with 7 fields (issuer, audience, jwks_ttl, roles_claim, admin_role, user_role, scopes_claim). JSONB column in DB. `ApplyConfigOverrides()` injects `[openshell.gateway.oidc]` TOML section, disables mTLS by removing `client_ca_path`. Role validation enforces both-or-neither for admin/user roles. | diff --git a/skills/deploy/deploy-cluster/SKILL.md b/skills/deploy/deploy-cluster/SKILL.md index 5ca2da9ea..ac7ec9d70 100644 --- a/skills/deploy/deploy-cluster/SKILL.md +++ b/skills/deploy/deploy-cluster/SKILL.md @@ -105,7 +105,7 @@ oc create secret generic credential-encryption-key -n $NAMESPACE \ --from-literal=version=1 ``` -The hcmais overlay mounts this as `CREDENTIAL_ENCRYPTION_KEYRING` and `CREDENTIAL_ENCRYPTION_KEY_VERSION`. After first deploy, encrypt existing tokens: +The hcmai overlay mounts this as `CREDENTIAL_ENCRYPTION_KEYRING` and `CREDENTIAL_ENCRYPTION_KEY_VERSION`. After first deploy, encrypt existing tokens: ```bash oc exec deploy/ambient-api-server -n $NAMESPACE -- ambient-api-server encrypt-credentials @@ -402,11 +402,10 @@ never receives a raw JWT — only an httpOnly session cookie. | File | Purpose | |------|---------| | `components/manifests/base/core/ambient-ui-deployment.yaml` | Base Deployment, ServiceAccount, Service | -| `components/manifests/overlays/kind/kustomization.yaml` | Kind overlay (Quay images, no auth) | -| `components/manifests/overlays/kind-local/kustomization.yaml` | Kind-local overlay (localhost images) | +| `components/manifests/overlays/kind/kustomization.yaml` | Kind overlay (Quay or local images, no auth) | | `components/ambient-ui/Dockerfile` | Multi-stage Docker build | | `.github/workflows/components-build-deploy.yml` | CI build matrix entry | -| `components/manifests/overlays/hcmais/kustomization.yaml` | HCMAIS overlay (ambient-api namespace, Keycloak SSO) | +| `components/manifests/overlays/hcmai/kustomization.yaml` | HCMAI overlay (ambient-api namespace, Keycloak SSO) | Production overlay files exist (`ambient-ui-oauth-patch.yaml`, etc.) but are disabled — they used origin-oauth-proxy which can't produce JWTs. See Auth section. @@ -547,7 +546,7 @@ OpenShift Route with TLS edge termination, targeting the ambient-ui Service on p ## HCMAIS Environment (ambient-api namespace) -The `hcmais` overlay deploys to `ambient-api` namespace on the HCMAIS ROSA cluster. +The `hcmai` overlay deploys to `ambient-api` namespace on the HCMAI ROSA cluster. It includes only: ambient-api-server, ambient-api-server-db, ambient-control-plane, ambient-ui, and postgresql. @@ -572,7 +571,7 @@ ambient-ui, and postgresql. 3. **Deploy**: ```bash - kustomize build components/manifests/overlays/hcmais | oc apply -n ambient-api -f - + kustomize build components/manifests/overlays/hcmai | oc apply -n ambient-api -f - ``` 4. **Verify**: