ROSAENG-62444: feat: add SNS/SQS messaging infrastructure for hyperfleet notifications #710
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,10 +7,12 @@ hyperfleet: | |
|
|
||
| project: default | ||
|
|
||
| sqsQueueUrlPrefix: "" | ||
|
|
||
| source: | ||
| repoURL: https://github.com/rrp-bot/rosa-hyperfleet-api.git | ||
| targetRevision: feature/sns-sqs | ||
| path: hyperfleet-operator/charts | ||
|
Comment on lines
12
to
+15
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== candidate file =="
if [ -f argocd/config/regional-cluster/hyperfleet/values.yaml ]; then
nl -ba argocd/config/regional-cluster/hyperfleet/values.yaml | sed -n '1,40p'
else
echo "missing argocd/config/regional-cluster/hyperfleet/values.yaml"
fi
echo
echo "== all rosa-hyperfleet-api refs in argocd =="
rg -n "rosa-hyperfleet-api|source:|repoURL:|targetRevision:" argocd/config/regional-cluster || true
echo
echo "== git status/stat =="
git status --shortRepository: openshift-online/rosa-hyperfleet Length of output: 231 🌐 Web query:
💡 Result: The term "rrp-bot" refers to a GitHub bot (frequently appearing as Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== argocd file excerpt =="
while IFS= read -r line; do
printf '%s\n' "$line"
done < argocd/config/regional-cluster/hyperfleet/values.yaml | sed -n '1,60p'
echo
echo "== rosa-hyperfleet-api refs in argocd =="
rg -n "rosa-hyperfleet-api|repoURL:|targetRevision:" argocd/config/regional-cluster || true
echo
echo "== git status/stat =="
git status --shortRepository: openshift-online/rosa-hyperfleet Length of output: 1492 Pin the Argo CD chart source to an approved immutable revision. This config points to the mutable 🤖 Prompt for AI AgentsSources: Coding guidelines, Path instructions |
||
|
|
||
| syncPolicy: | ||
| automated: | ||
|
|
@@ -19,8 +21,8 @@ hyperfleet: | |
|
|
||
| helmValues: | ||
| image: | ||
| repository: quay.io/psav/hyperfleet-operator | ||
| tag: "c756faf" | ||
|
Comment on lines
+24
to
+25
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '--- values.yaml context ---\n'
if [ -f argocd/config/regional-cluster/hyperfleet/values.yaml ]; then
nl -ba argocd/config/regional-cluster/hyperfleet/values.yaml | sed -n '1,80p'
else
fd -a 'values.yaml' . | sed -n '1,50p'
fi
printf '\n--- image references nearby ---\n'
rg -n "repository:|tag:|pullPolicy:|quay.io/psav/hyperfleet-operator|c756faf" argocd/config/regional-cluster/hyperfleet || trueRepository: openshift-online/rosa-hyperfleet Length of output: 261 🌐 Web query:
💡 Result: As of August 2026, Red Hat Quay and Project Quay support image tag immutability, which prevents existing tags from being overwritten, modified, or deleted [1]. This feature can be managed via the Web UI or the API [1]. There are three primary ways to implement tag immutability: 1. Individual Tag Settings: Users with write access can manually toggle the immutable status of a specific tag using the Red Hat Quay UI or the API [1]. For the API, you can use the PUT /api/v1/repository/{repository}/tag/{tag} endpoint with the "immutable" boolean field [2][3]. Setting this to true marks the tag as immutable; unsetting it requires admin permissions [2][1][3]. 2. Immutability Policies: Administrators can define regex-based policies at the organization or repository level [1]. These policies automatically mark new tags that match the specified regex pattern as immutable [1]. This is configured via the Red Hat Quay v2 UI under the Immutability Policies tab or through the API endpoints under /api/v1/organization/{orgname}/immutabilitypolicy/ or /api/v1/repository/{repository}/immutabilitypolicy/ [4][1][5][6]. 3. Manifest Labels: During the build process, you can trigger immutability by including the quay.immutable=true label in your Containerfile or Dockerfile [1]. These features are enabled by the IMMUTABLE_TAGS feature flag within the Quay platform [5][6]. Note that older discussions suggesting Quay lacks this feature are outdated, as these capabilities were added in recent versions (e.g., version 3.17) [4][1][7][5]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Quay metadata probe for tag and repo ---'
python3 - <<'PY'
import json
import urllib.request
import urllib.error
base = 'https://quay.io/api/v1/repository/psav/hyperfleet-operator/public'
urls = [
base,
base + '?includeTags=true&tag=100',
base + '/tag/?specificTag=c756faf',
'https://quay.io/api/v1/repository/psav/hyperfleet-operator/',
'https://quay.io/api/v1/repository/psav/hyperfleet-operator/tag/?specificTag=c756faf&limit=10',
'https://quay.io/api/v1/repository/psav/hyperfleet-operator/tag/?specificTag=c756faf',
]
for url in urls:
print(f'\n### {url}')
try:
req = urllib.request.Request(url)
req.add_header('Accept', 'application/json')
with urllib.request.urlopen(req, timeout=20) as rsp:
data = rsp.read()
print(f'status={rsp.status}')
text = data.decode('utf-8', 'replace')
if text.startswith('{') or text.startswith('['):
obj = json.loads(text)
print('top_level_keys=', sorted(obj.keys()) if isinstance(obj, dict) else None)
print(json.dumps(obj, indent=2, sort_keys=True)[:8000])
else:
print(text[:8000])
except Exception as e:
print(f'error={type(e).__name__}: {e}')
PYRepository: openshift-online/rosa-hyperfleet Length of output: 1636 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- values.yaml context ---'
if [ -f argocd/config/regional-cluster/hyperfleet/values.yaml ]; then
nl -ba argocd/config/regional-cluster/hyperfleet/values.yaml | sed -n '1,80p'
else
fd -a 'values.yaml' . | sed -n '1,50p'
fi || true
printf '%s\n' '--- image references nearby ---'
rg -n "repository:|tag:|pullPolicy:|quay.io/psav/hyperfleet-operator|c756faf" argocd/config/regional-cluster/hyperfleet || true
python3 - <<'PY'
import json
import ssl
import urllib.request
import urllib.error
ctx = ssl._create_unverified_context()
base = 'https://quay.io/api/v1/repository/psav/hyperfleet-operator/public'
urls = [
base,
base + '?includeTags=true&tag=100',
base + '/tag/?specificTag=c756faf',
'https://quay.io/api/v1/repository/psav/hyperfleet-operator/tag/?specificTag=c756faf&limit=10',
]
for url in urls:
print(f'\n### {url}')
try:
req = urllib.request.Request(url)
req.add_header('Accept', 'application/json')
with urllib.request.urlopen(req, context=ctx, timeout=20) as rsp:
data = rsp.read()
print(f'status={rsp.status}')
text = data.decode('utf-8', 'replace')
if text.startswith('{') or text.startswith('['):
obj = json.loads(text)
print('top_level_keys=', sorted(obj.keys()) if isinstance(obj, dict) else None)
print(json.dumps(obj, indent=2, sort_keys=True)[:10000])
else:
print(text[:10000])
except Exception as e:
print(f'error={type(e).__name__}: {e}')
PYRepository: openshift-online/rosa-hyperfleet Length of output: 1462 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- values.yaml excerpt ---'
awk 'NR>=1 && NR<=40 { printf "%6d %s\n", NR, $0 }' argocd/config/regional-cluster/hyperfleet/values.yaml
python3 - <<'PY'
import json
import ssl
import urllib.request
import urllib.error
ctx = ssl._create_unverified_context()
urls = [
'https://quay.io/api/v1/repository/psav/hyperfleet-operator/tag/?includeManifestSummary=true',
'https://quay.io/api/v1/repository/psav/hyperfleet-operator/tag/?includeManifestSummary=true&limit=1',
]
for url in urls:
print(f'\n### {url}')
try:
req = urllib.request.Request(url)
req.add_header('Accept', 'application/json')
with urllib.request.urlopen(req, context=ctx, timeout=20) as rsp:
data = rsp.read()
print(f'status={rsp.status}')
obj = json.loads(data.decode('utf-8', 'replace'))
tags = obj.get('tags', [])
print('tag_count=', len(tags))
for tag in tags[:5]:
print('name=', tag.get('name'))
ms = tag.get('manifest_summary') or {}
print(' manifest_digest=', ms.get('manifest_digest'))
for v in (tag.get('target') or {}).values() if isinstance(tag.get('target'), dict) else []:
if isinstance(v, dict):
print(' image_digest=', v.get('manifest_digest'))
if tags:
print('manifest_deduplicated=', sorted(set(t.get('manifest_summary', {}).get('manifest_digest') for t in tags)))
except Exception as e:
print(f'error={type(e).__name__}: {e}')
PYRepository: openshift-online/rosa-hyperfleet Length of output: 1764 Pin the hyperfleet-operator image to an immutable digest.
🤖 Prompt for AI Agents |
||
| pullPolicy: Always | ||
|
|
||
| replicaCount: 2 | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -138,4 +138,3 @@ variable "oidc_cloudfront_domain" { | |
| type = string | ||
| default = "" | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: openshift-online/rosa-hyperfleet
Length of output: 8968
Populate the regional SQS queue URL prefix.
argocd/config/regional-cluster/hyperfleet/templates/application.yamlpasses this value directly to the Hyperfleet chart, and no overlay overrides it. Sync renders the regional Application with an emptysqsQueueUrlPrefix, so the Hyperfleet SQS messaging path does not receive the required queue URL prefix. Populate this regional cluster value from the Terraform/bootstrap SQS queue-name output or the same source used for the regional bootstrap ApplicationSet.🤖 Prompt for AI Agents
Source: Path instructions