diff --git a/config/hwlab-node-lanes.yaml b/config/hwlab-node-lanes.yaml index a8f0c2d6..96c76235 100644 --- a/config/hwlab-node-lanes.yaml +++ b/config/hwlab-node-lanes.yaml @@ -968,7 +968,7 @@ lanes: renderDir: runtime-v03 runtimeStore: postgres: - mode: local-k3s + mode: platform-service secretName: hwlab-v03-postgres statefulSet: hwlab-v03-postgres serviceName: hwlab-v03-postgres @@ -1219,6 +1219,30 @@ lanes: email: ops@pikapython.com tls: auto responseHeaderTimeoutSeconds: 600 + externalPostgres: + provider: PK01 + configRef: config/platform-db/postgres-pk01.yaml + serviceName: jd01-pk01-platform-postgres + endpointAddress: 82.156.23.220 + port: 5432 + runtimeAccess: + endpointAddress: 82.156.23.220 + port: 5432 + sslmode: require + database: hwlab_jd01_v03 + cloudApi: + secretName: hwlab-cloud-api-v03-db + secretKey: database-url + sourceRef: hwlab/jd01-v03-cloud-api-db.env + envKey: DATABASE_URL + role: hwlab_jd01_v03_app + openfga: + secretName: hwlab-v03-openfga + secretKey: datastore-uri + sourceRef: hwlab/jd01-v03-openfga-db.env + envKey: DATASTORE_URI + authnKey: authn-preshared-key + role: hwlab_jd01_v03_app networkProfiles: node-ci-egress: diff --git a/config/platform-db/postgres-pk01.yaml b/config/platform-db/postgres-pk01.yaml index 31ef245d..5d9fa8ae 100644 --- a/config/platform-db/postgres-pk01.yaml +++ b/config/platform-db/postgres-pk01.yaml @@ -316,6 +316,36 @@ postgres: user: hwlab_d601_v03_app address: 74.48.78.17/32 method: scram-sha-256 + - type: hostssl + database: hwlab_jd01_v03 + user: hwlab_jd01_v03_app + address: 10.0.8.0/22 + method: scram-sha-256 + - type: hostssl + database: postgres + user: hwlab_jd01_v03_app + address: 10.0.8.0/22 + method: scram-sha-256 + - type: hostssl + database: hwlab_jd01_v03 + user: hwlab_jd01_v03_app + address: 117.72.122.178/32 + method: scram-sha-256 + - type: hostssl + database: postgres + user: hwlab_jd01_v03_app + address: 117.72.122.178/32 + method: scram-sha-256 + - type: hostssl + database: hwlab_jd01_v03 + user: hwlab_jd01_v03_app + address: 74.48.78.17/32 + method: scram-sha-256 + - type: hostssl + database: postgres + user: hwlab_jd01_v03_app + address: 74.48.78.17/32 + method: scram-sha-256 secrets: source: master-local @@ -405,6 +435,20 @@ secrets: HWLAB_D601_V03_DB_NAME: hwlab_d601_v03 randomHex: HWLAB_D601_V03_DB_PASSWORD: 32 + - name: hwlab-jd01-v03-db-credentials + sourceRef: platform-db/hwlab-jd01-v03-db.env + type: env + requiredKeys: + - HWLAB_JD01_V03_DB_USER + - HWLAB_JD01_V03_DB_PASSWORD + - HWLAB_JD01_V03_DB_NAME + createIfMissing: + enabled: true + values: + HWLAB_JD01_V03_DB_USER: hwlab_jd01_v03_app + HWLAB_JD01_V03_DB_NAME: hwlab_jd01_v03 + randomHex: + HWLAB_JD01_V03_DB_PASSWORD: 32 objects: roles: - name: sub2api @@ -461,6 +505,15 @@ objects: createdb: false createrole: false superuser: false + - name: hwlab_jd01_v03_app + passwordRef: + sourceRef: platform-db/hwlab-jd01-v03-db.env + key: HWLAB_JD01_V03_DB_PASSWORD + login: true + attributes: + createdb: false + createrole: false + superuser: false databases: - name: sub2api owner: sub2api @@ -492,6 +545,11 @@ objects: encoding: UTF8 locale: C.UTF-8 extensions: [] + - name: hwlab_jd01_v03 + owner: hwlab_jd01_v03_app + encoding: UTF8 + locale: C.UTF-8 + extensions: [] exports: connectionStrings: @@ -602,6 +660,38 @@ exports: - scope: hwlab-d601-v03 secret: hwlab-v03-openfga key: DATASTORE_URI + - name: hwlab-jd01-v03-cloud-api-database-url + sourceSecretRef: platform-db/hwlab-jd01-v03-db.env + render: + envKey: DATABASE_URL + format: postgresql://$(HWLAB_JD01_V03_DB_USER):$(HWLAB_JD01_V03_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(HWLAB_JD01_V03_DB_NAME)?sslmode=require + variables: + PGHOST: 82.156.23.220 + PGPORT: "5432" + writeToSecretSource: + sourceRef: hwlab/jd01-v03-cloud-api-db.env + key: DATABASE_URL + mode: update-or-insert + consumers: + - scope: hwlab-jd01-v03 + secret: hwlab-cloud-api-v03-db + key: DATABASE_URL + - name: hwlab-jd01-v03-openfga-datastore-uri + sourceSecretRef: platform-db/hwlab-jd01-v03-db.env + render: + envKey: DATASTORE_URI + format: postgres://$(HWLAB_JD01_V03_DB_USER):$(HWLAB_JD01_V03_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(HWLAB_JD01_V03_DB_NAME)?sslmode=require + variables: + PGHOST: 82.156.23.220 + PGPORT: "5432" + writeToSecretSource: + sourceRef: hwlab/jd01-v03-openfga-db.env + key: DATASTORE_URI + mode: update-or-insert + consumers: + - scope: hwlab-jd01-v03 + secret: hwlab-v03-openfga + key: DATASTORE_URI backup: phase: minimum-restoreable diff --git a/scripts/src/hwlab-node/render.ts b/scripts/src/hwlab-node/render.ts index 56216c29..a674493d 100644 --- a/scripts/src/hwlab-node/render.ts +++ b/scripts/src/hwlab-node/render.ts @@ -215,21 +215,25 @@ export function nodeRuntimeControlPlaneStatus(scoped: ReturnType 0 && workloadReadiness.every((item) => item.ready); const localPostgresExpectedAbsent = nodeRuntimeLocalPostgresExpectedAbsent(spec); const localPostgresReady = localPostgresExpectedAbsent ? localPostgresObjects.length === 0 : localPostgresObjects.length > 0; - const runtimeReady = namespaceExists && localPostgresReady && workloadsReady && (activeExternalPostgres === undefined || (bridge.ready && secrets.ready)) && codeAgentRuntime.ready === true; + const postgresReady = activeExternalPostgres === undefined + ? localPostgresReady + : bridge.ready === true && secrets.ready === true; + const runtimeReady = namespaceExists && postgresReady && workloadsReady && codeAgentRuntime.ready === true; const codeAgentRuntimeDegradedReason = typeof codeAgentRuntime.degradedReason === "string" ? codeAgentRuntime.degradedReason : null; - const runtimeDegradedReason = !namespaceExists - ? "runtime-namespace-missing" - : !localPostgresReady - ? "runtime-local-postgres-not-ready" - : !workloadsReady - ? "runtime-workloads-not-ready" - : activeExternalPostgres !== undefined && bridge.ready !== true - ? "external-postgres-bridge-not-ready" - : activeExternalPostgres !== undefined && secrets.ready !== true - ? "external-postgres-secrets-not-ready" - : codeAgentRuntime.ready !== true - ? codeAgentRuntimeDegradedReason ?? "code-agent-runtime-not-ready" - : "runtime-not-ready"; + let runtimeDegradedReason = "runtime-not-ready"; + if (!namespaceExists) { + runtimeDegradedReason = "runtime-namespace-missing"; + } else if (activeExternalPostgres !== undefined && bridge.ready !== true) { + runtimeDegradedReason = "external-postgres-bridge-not-ready"; + } else if (activeExternalPostgres !== undefined && secrets.ready !== true) { + runtimeDegradedReason = "external-postgres-secrets-not-ready"; + } else if (activeExternalPostgres === undefined && !localPostgresReady) { + runtimeDegradedReason = "runtime-local-postgres-not-ready"; + } else if (!workloadsReady) { + runtimeDegradedReason = "runtime-workloads-not-ready"; + } else if (codeAgentRuntime.ready !== true) { + runtimeDegradedReason = codeAgentRuntimeDegradedReason ?? "code-agent-runtime-not-ready"; + } const argoReady = argo.exitCode === 0 && repoURL === spec.argoRepoUrl && targetRevision === spec.gitopsBranch && path === spec.runtimePath && syncStatus === "Synced" && health === "Healthy"; const argoDiagnostics = argo.exitCode === 0 && !argoReady ? nodeRuntimeArgoDiagnostics(spec, probeTimeoutSeconds)