feat: add refresh-app script to platform image for ArgoCD hard-refresh - #6
Open
rrp-bot wants to merge 66 commits into
Open
feat: add refresh-app script to platform image for ArgoCD hard-refresh#6rrp-bot wants to merge 66 commits into
rrp-bot wants to merge 66 commits into
Conversation
…fleet-db PR openshift-online#677 replaced Maestro (MQTT-based resource distribution) with kube-applier (DynamoDB-backed controller) and hyperfleet-db (Aurora PostgreSQL). Update core documentation to reflect the current architecture: - CLAUDE.md/AGENTS.md: Replace Maestro references in architecture overview, key technologies, and architecture patterns - docs/README.md: Fix broken links to deleted maestro-infrastructure and maestro-agent terraform modules; add kube-applier, kube-applier- dynamodb, and hyperfleet-db module links - docs/FAQ.md: Update RC service list, disaster recovery section, and rewrite Maestro Q&A as kube-applier Q&A - docs/design/maestro-mqtt-resource-distribution.md: Mark status as Superseded with link to replacement modules - docs/environment-provisioning.md: Update ArgoCD app lists and remove obsolete Maestro connectivity verification step - docs/development-environment.md: Remove Maestro from port-forward service table - docs/hostedcluster-teardown.md: Update deletion propagation to reference kube-applier Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Bot PRs (e.g. docs-agent updates) were invisible on the dashboard because they had no labels. Fetch all open redhat-chai-bot PRs and merge them into the Automated & AI PRs section, deduplicating against label-fetched results. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ries to self-heal properly.
ROSAENG-61610: Fixing missed settings
ROSAENG-61610: Spelling fix.
…ve the changes, just explore the data.
ROSAENG-61610: Adding SRE documentation on SRE-UI ALB.
ROSAENG-62511: Enabling "can_edit" for viewers.
This forces the refresh of cached Helm charts on sync failure and pulls the correct values instead of using outdated ones.
ROSAENG-62507: Add refresh flag to ArgoCD automatic retries.
ROSAENG-61610: Removing Loki from the exposed SRE UI apps.
…ate-maestro-kube-applier-2026-07-24 NO-JIRA: [docs-agent] Update architecture docs: Maestro → kube-applier + hyperfleet-db
NO-JIRA: Include all open chai-bot PRs in the PR dashboard
Introduce a standalone elasticache-valkey Terraform module with: - Single-node Valkey 9.1 replication group (GCRA counters) - TLS in transit and KMS encryption at rest (FedRAMP SC-8/SC-13) - Security groups for EKS, Auto Mode, and bastion ingress - Gated by enable_rate_limit_redis (default: true) Wire the module into regional-cluster config, ECS bootstrap (cluster secret annotation + REDIS_ENDPOINT env var), and rendered pipeline/ApplicationSet templates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Platform API Helm chart changes: - Deployment: RATE_LIMIT_ENABLED, RATE_LIMIT_CONFIG_FILE, REDIS_ENDPOINT env vars; rate-limits ConfigMap volume mount - ConfigMap: per-route GCRA rates (clusters, nodepools, trusted-actions) - ServiceMonitor: Prometheus scraping for rate limit metrics Alerting (PrometheusRule): - RateLimitValkeyDown: Valkey connectivity failure (5m) - RateLimitHighDenialRatio: aggregated >50% denial across pods (10m) - RateLimitPodHighDenialRatio: per-pod >70% denial (5m) - promtool unit tests for all three alerts Documentation: - ADR: rate limiting architecture with security section (TLS in transit, KMS encryption at rest) - CLAUDE.md: rate limiting key files reference Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Rename RateLimitValkeyDown → RateLimitFailOpenActive with percentage-based threshold (>20% aggregated, 5m for duration) - Add denominator guards (and ... > 0) to all three alerts to prevent NaN on zero traffic - Add explicit redisTimeout: 20ms in rate limit config - Fix image reference to match main branch - Update promtool tests for renamed alert with new threshold cases Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add explicit KMS key policy scoping usage to elasticache.amazonaws.com service principal (CKV2_AWS_64) instead of relying on the implicit default account-root policy. Follows pattern from eks-cluster/kms.tf. - Remove unrestricted 0.0.0.0/0 egress on Valkey security group — ElastiCache never initiates outbound connections; response traffic is handled by stateful SG connection tracking. - Update CLAUDE.md rate limiting table to reference the new elasticache-valkey module paths (hyperfleet-infrastructure was deleted). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The 2>/dev/null was swallowing the actual AWS error (e.g. expired SAML session, missing CLI subcommand, access denied), making it impossible to debug ephemeral-provision failures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
provision-infra-rc.sh reads individual keys from terraform.json and exports them as TF_VAR_* env vars, but hyperfleet_db_deletion_protection was never wired. This caused Terraform to always use the module default (true), ignoring the ephemeral environment setting of false, which blocked RDS cluster teardown.
Critical alerts page the incident commander on integration, which is too aggressive for a fail-open rate limiter. All three rate limit alerts are now warning severity. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…leet-db-deletion-protection ROSAENG-60886: fix: wire hyperfleet_db_deletion_protection to Terraform in CI
Delete the CLM Observability dashboard (clm.json + dashboard-clm.yaml) which tracked Sentinel metrics from the old architecture. Remove "clm" from the RC Health namespace filter and "Maestro" from the RDS dashboard description. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ROSAENG-61608: Add per-account rate limiting for Platform API
…-logs-force-destroy ROSAENG-60886: fix: add force_destroy to SRE ALB access logs S3 bucket
ROSAENG-62642: Use the konflux image
…or_swallow ROSAENG-62981: fix teardown swallowing pipeline failures and collecting wrong logs
…nvironments The regional_oidc S3 bucket had force_destroy=false, causing ephemeral teardown to fail with BucketNotEmpty when HyperShift OIDC discovery documents were present. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ROSAENG-63020: Enable force_destroy on OIDC S3 bucket for ephemeral teardown
Add response_templates block to the aws_api_gateway_gateway_response.default_4xx resource. AWS API Gateway automatically sets a default response template on DEFAULT_4XX responses, causing Terraform to detect drift on every plan/apply and attempt to remove it. This pins the template explicitly, matching the pattern already used by the unauthorized and access_denied gateway responses. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The collect-logs tooling was renamed to dump-env in PR openshift-online#715 (merged), which also added DB state collection. These .spec/ files still referenced the old name. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The fork repo name was derived from the source repo
(self.source_repo.split("/")[-1]), which breaks when the PR comes from
a fork with a non-standard name (e.g. openshift-online_rosa-regional-platform
instead of rosa-hyperfleet). Use a constant for the upstream repo name
instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Update platform-api image tag to include test removal (openshift-online#231) and compactor fix (openshift-online#234) - Switch hyperfleet chart source from typeid/hyperfleet-operator to openshift-online/rosa-hyperfleet-api - Pin chart targetRevision to merge commit SHA - Update hyperfleet-operator image tag to match Co-Authored-By: Chai Bot <ship-help-github@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ate-spec-refs-2026-07-31 [docs-agent] Update .spec/ references: collect-logs → dump-env
…ult-4xx-response-template-drift NO-JIRA: Fix DEFAULT_4XX response_templates drift in API Gateway module
…-api-image-tag NO-JIRA: Bump platform-api image to 4712cf8 (remove flaky ratelimit test)
…k-repo-name NO-JIRA: Fix ephemeral provider pushing to wrong fork repo name
Maestro (MQTT/IoT Core resource distribution) has been fully replaced by kube-applier-aws (DynamoDB-based), and the CLM stack (hyperfleet-api, hyperfleet-sentinel, hyperfleet-adapter, hyperfleet-broker) has been replaced by hyperfleet-operator (postgres-based controller-runtime). Updates ~37 files across docs, terraform configs, ArgoCD configs, and agent/bot definitions. Deletes the superseded maestro design doc. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…up-maestro-clm ROSAENG-62353: docs: replace stale Maestro/CLM references with current architecture
…c and checksum verification (openshift-online#734) * fix: add SHA-256 checksum verification for Helm installation * fix: improve Helm download reliability with retry logic and direct checksum verification Replace get-helm-3 script (which lacks retry logic) with direct download using curl retry parameters. This matches the pattern used for Terraform and other tools, ensuring transient network failures don't break CI builds. - Add architecture detection (amd64/arm64) for multi-arch support - Download Helm tarball and SHA-256 checksum with retry/timeout settings - Verify checksum before extraction (fails build on mismatch) - Add helm version verification step at end * change the version of helm * adding same retry logic to Dockerfile * fix: add retry logic to all curl commands in platform-image Dockerfile Apply the same retry pattern (3 retries, 2s delay, 300s timeout) that was added to Helm downloads across all remaining curl commands: AWS CLI, kubectl, k9s, stern, yq, oc, and Terraform downloads. This improves build reliability when downloading tools from external sources. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: improve platform-image Dockerfile error handling and curl retry configuration - Consolidate CURL_RETRY, CURL_RETRY_DELAY, and CURL_MAX_TIME ARG declarations at the top with default values (3, 2, 300) to eliminate redundant redeclarations across 7 install blocks - Add `set -euo pipefail` to k9s, stern, and oc download RUN blocks so piped curl | tar commands fail fast on network errors instead of silently continuing with empty input - Improves build reliability by ensuring all curl commands use consistent retry behavior and download failures halt the build immediately Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: force fresh base image pull in platform-image build to invalidate stale cache Add --pull flag to docker/podman build command to ensure the base image is always pulled fresh. This invalidates Docker's layer cache from the FROM instruction forward, preventing builds from using stale ARG layers from previous Dockerfile versions. Root cause: commit de123bb declared CURL_RETRY* ARGs before each RUN block without defaults. When those were refactored to single top-level declarations with defaults (40dfb26), cached layers with empty ARG values persisted, causing "curl: option --retry: expected a proper numerical parameter" failures. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Replace "Maestro MQTT distribution" with "kube-applier DynamoDB-backed resource distribution" to reflect the current architecture. Maestro was replaced by kube-applier in the platform redesign (PR openshift-online#717). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-stale-maestro-ref-2026-08-07 [docs-agent] Fix stale Maestro reference in testing strategy doc
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents the hyperfleet-operator + hyperfleet-db architecture: controller-runtime reconciliation backed by PostgreSQL instead of etcd. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-store ROSAENG-64794: feat: Add AVP PolicyTemplate permissions to frontend API role
…hitecture ROSAENG-63138: Add regional control plane architecture design doc
Clarify that hash4 uniqueness per cluster_alias is enforced by the platform-api at creation time, derived from the cluster UUID. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ROSAENG-1089: update DNS architecture doc for hash4 uniqueness
…scan (openshift-online#740) * fix: preserve base ephemeral config when applying .ephemeral-env/ overrides _inject_ephemeral_config deleted and replaced every file in config/ephemeral/, including defaults.yaml, when an override directory was supplied. Since overrides are typically partial, any base environment setting they didn't include (e.g. dns.domain) silently disappeared from the config used to provision the environment. Scope the delete-and-replace behavior to region YAML files only, and deep-merge defaults.yaml with the override instead of replacing it, reusing the same load_and_merge utility already used by _apply_provision_overrides elsewhere in this file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: don't treat Go template keywords in escaped strings as Jinja variables scan_template_variables() flagged if/else/end as undocumented context variables when they appeared inside an escaped Go template string (e.g. {{ '{{ if .foo }}X{{ else }}Y{{ end }}' }} — used to emit literal Go template syntax into rendered output). Add a regex that identifies these escaped spans and skip any variable match whose position falls inside one, so only real Jinja2 variables are reported. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * refactor: hoist _is_inside_escaped_go_template out of the per-template loop It was redefined as a closure on every iteration of scan_template_variables' outer loop, needlessly capturing skip_ranges. Take skip_ranges as an explicit parameter and define the helper once at module scope instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
rrp-bot
force-pushed
the
worktree-argocd-refresh-script
branch
from
August 12, 2026 05:34
46d2cea to
1c79ab2
Compare
Adds a refresh-app.sh shell script to the platform (bastion) image that allows operators to trigger a hard ArgoCD refresh on any application via kubectl annotation from within an ECS Exec session. The root app is always refreshed first before the target app (unless the target is root itself), ensuring generated child apps are up-to-date before the specific application is re-synced. - terraform/modules/platform-image/scripts/refresh-app.sh: new script - terraform/modules/platform-image/Dockerfile: COPY scripts into /opt/platform/scripts and add to PATH so refresh-app is directly callable Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rrp-bot
force-pushed
the
worktree-argocd-refresh-script
branch
from
August 12, 2026 09:35
1c79ab2 to
6c19f34
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Usage
```bash
From an ECS Exec session on the bastion task:
refresh-app hyperfleet-operator # refreshes root, then hyperfleet-operator
refresh-app argocd # refreshes root, then argocd
refresh-app root # refreshes root only
```
Under the hood this runs:
```bash
kubectl annotate app <app_name> -n argocd argocd.argoproj.io/refresh=hard --overwrite
```
Changes
The Dockerfile change causes the image tag (computed as `sha256(Dockerfile)` in `main.tf`) to rotate, so the new image will be built and pushed on the next `build-platform-image.sh` run.
Notes