From ed3b1a1e9bf89361a35a96d591a594b41a341a21 Mon Sep 17 00:00:00 2001 From: Lucas Mundim Date: Thu, 9 Jul 2026 20:28:16 -0300 Subject: [PATCH 1/2] docs: point overrides references at the gitops repo (post-#84) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to shingonoide's review on #84: with deployment/.../overrides/ removed (moved to gitops), sweep the now-stale references so no one looks for the deleted directory: - AGENTS.md: drop the overrides/ bullet; note overrides live in the gitops repo. - values.yaml comments (gpuNodeSelector, valkey.enabled, externalValkey): point at the gitops overrides instead of overrides/.yaml. Not touching values-production.yaml here — it carries config NOT present in the gitops production override (affinity, security contexts, valkey persistence/resources, ...), so its removal needs a migrate-or-confirm-dead decision, tracked separately. --- AGENTS.md | 3 +-- deployment/openfilter-pipelines-controller/values.yaml | 7 ++++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index c569063..af2877f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -161,8 +161,7 @@ cd deployment/openfilter-pipelines-controller && helm dependency update - `deployment/openfilter-pipelines-controller/`: Main Helm chart - `deployment/openfilter-pipelines-controller/crds/`: CRD manifests (synced from config/crd/bases) - `deployment/openfilter-pipelines-controller/templates/`: Kubernetes resource templates - - `deployment/openfilter-pipelines-controller/overrides/`: Per-environment value overrides (development, lab, staging, production) - - `deployment/openfilter-pipelines-controller/values.yaml`: Default configuration values + - `deployment/openfilter-pipelines-controller/values.yaml`: Default configuration values (per-environment overrides live in the private `gitops` repo, not here) - **hack/**: Utility scripts - `hack/update-helm-crds.sh`: Script to sync CRDs from config/crd/bases to Helm chart diff --git a/deployment/openfilter-pipelines-controller/values.yaml b/deployment/openfilter-pipelines-controller/values.yaml index a369b1d..f77e674 100644 --- a/deployment/openfilter-pipelines-controller/values.yaml +++ b/deployment/openfilter-pipelines-controller/values.yaml @@ -136,7 +136,8 @@ volumeMounts: [] # GPU node selector: comma-separated key=value pairs applied to pods that request # nvidia.com/gpu resources (e.g. "cloud.google.com/gke-gpu-driver-version=latest"). # Leave empty to disable (no node selector is applied). The GKE-specific value is -# set per environment in overrides/.yaml, so the chart installs cleanly on +# set per environment in the gitops repo (controllers/openfilter-pipelines-controller/ +# overrides/.yaml), so the chart installs cleanly on # non-GKE clusters (kind, minikube, EKS, bare metal) out of the box. gpuNodeSelector: "" @@ -200,7 +201,7 @@ args: [] valkey: # Enable the bundled Valkey subchart so the chart self-installs out of the box. # Environments that connect to a cluster-managed Valkey flip this to false and - # enable externalValkey below — see overrides/.yaml. + # enable externalValkey below — see the gitops repo overrides. enabled: true # Valkey architecture (standalone or replication) @@ -242,7 +243,7 @@ valkey: # External Valkey configuration # Use this to connect to an existing Valkey instance instead of deploying one. # Disabled by default; the cluster-managed host + auth Secret are environment- - # specific and live in overrides/.yaml, not in the chart defaults. + # specific and live in the gitops repo overrides, not in the chart defaults. externalValkey: enabled: false host: "" From f7ff64b8c1662851deee5d0c77a58e30400310e1 Mon Sep 17 00:00:00 2001 From: Lucas Mundim Date: Thu, 9 Jul 2026 20:53:34 -0300 Subject: [PATCH 2/2] chart: remove orphaned values-production.yaml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Completes shingonoide's #84 cleanup ask. This standalone 'sample production values' file predates the ArgoCD/gitops overrides pattern and is referenced by nothing (no appset, CI, Makefile, or docs) — so it deploys nowhere. Verified every production-relevant key is already covered by the chart defaults + the gitops overrides/production.yaml (telemetry, resources, security contexts; prod uses external valkey so the bundled-valkey config is moot). The only key unique to this file — affinity.podAntiAffinity — is a no-op at the effective replicaCount of 1; if prod ever scales to 2+ replicas, add anti-affinity to the gitops override then. Also keeps Plainsight-internal prod config (otel-collector host, plainsightai image) out of this OSS repo. --- .../values-production.yaml | 95 ------------------- 1 file changed, 95 deletions(-) delete mode 100644 deployment/openfilter-pipelines-controller/values-production.yaml diff --git a/deployment/openfilter-pipelines-controller/values-production.yaml b/deployment/openfilter-pipelines-controller/values-production.yaml deleted file mode 100644 index 4f21ec9..0000000 --- a/deployment/openfilter-pipelines-controller/values-production.yaml +++ /dev/null @@ -1,95 +0,0 @@ -# Production values for openfilter-pipelines-controller -# This is a sample configuration for production deployments - -# Inject OTel exporter config into every filter container the controller spawns -# so spans/metrics flow to the in-cluster otel-collector (and from there to -# Cloud Trace via the googlecloud exporter). -# -# Use "otlp" (not "otlp_grpc") here: openfilter's metrics factory -# (observability/client.py) only matches "otlp" and silently falls through to -# ConsoleMetricExporter on any other value, while the tracing factory -# (observability/tracing.py) accepts both — so "otlp" is the only string that -# wires gRPC for both signals against today's openfilter. -telemetry: - exporterType: "otlp" - exporterOtlpEndpoint: "otel-collector.monitoring.svc.cluster.local:4317" - -replicaCount: 1 - -image: - repository: plainsightai/openfilter-pipelines-controller - pullPolicy: IfNotPresent - tag: "" - -# Production resource limits -resources: - limits: - cpu: 1000m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - -# Enhanced security context -podSecurityContext: - runAsNonRoot: true - runAsUser: 65532 - runAsGroup: 65532 - fsGroup: 65532 - seccompProfile: - type: RuntimeDefault - -securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 65532 - capabilities: - drop: - - ALL - -# Enable Valkey for production workloads -valkey: - enabled: true - architecture: replication - auth: - enabled: true - primary: - persistence: - enabled: true - size: 20Gi - storageClass: "" # Use default storage class - resources: - limits: - cpu: 500m - memory: 512Mi - requests: - cpu: 250m - memory: 256Mi - replica: - replicaCount: 2 - persistence: - enabled: true - size: 20Gi - storageClass: "" # Use default storage class - resources: - limits: - cpu: 500m - memory: 512Mi - requests: - cpu: 250m - memory: 256Mi - -# Production affinity rules for high availability -affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - openfilter-pipelines-controller - topologyKey: kubernetes.io/hostname