- Pin Prometheus/Alertmanager + Grafana to merlin.prole.org in k3s to avoid PV node-affinity issues
- Taint myrddin.prole.org as control-plane-only and add CNPG toleration
- Prevent init_cloudnative_pg from deploying prole-svc-kong into the DB namespace
- GitOps-manage Kong declarative config via ConfigMap + add placement/init tests
Prefer infra-managed manifests for bootstrap; reconcile CNPG instances based on Ready+schedulable labeled db nodes; update manifests to use node-role affinity + anti-affinity; add policy/tests and config touch-ups (incl. prole.cfg).
Update inventory/roles to keep K3s state on local storage and prevent iSCSI from managing /var/lib/rancher.
Also add a single-host k3s install playbook, a systemd override template, and docs describing the installer ↔ Ansible boundary and slow-storage knobs.
Co-authored-by: Junie <junie@jetbrains.com>
- Add diagnostics/reset/retry logic for stuck monitoring Helm installs\n- Add optional cluster-side node/lease deletion during k3s reset via delegated control-plane\n- Bump prole-db image tag/version to 18-123\n- Update monitoring init unit test for reset/diagnostics path
- k3s_sync: choose any server as sync source fallback; refresh kubeconfig and validate nodes\n- fetch_kubeconfig: save to prole-k3s.kubeconfig and etc/secrets/k3s.kubeconfig\n- k3s sync: sync server URL into config.yaml; restore TLS bundle only on servers\n- cert-manager/ACME: wait for CNI/webhook readiness; retry ClusterIssuer/Certificate apply\n- inventory: tune myrddin control-plane timing args; add render test\n- misc: update port mappings and prole-db manifests/version
Co-authored-by: Junie <junie@jetbrains.com>
- Materialize required DB Kubernetes secrets from user-entered password before CNPG init
- Auto-generate a temporary OpenTofu admin password in non-interactive runs when none is available
- Update installer UI flows and tests to cover the new preflights/rotation
Co-authored-by: Junie <junie@jetbrains.com>
- Introduce lib/shell helpers and keep etc/* scripts thin via compatibility shims
- Move Kerberos validation to scripts/validation/check_kerberos.sh and update callers
- Add deterministic shellspec unit tests under tests/shellspec/ and wire Maven to run them
- Add minimal Spring Boot authority module with startup + /health endpoint and Maven wiring
- Document the new layout in docs/layout.md
Co-authored-by: Junie <junie@jetbrains.com>
- Add `ansible.builtin.stat` task to verify `prole.cfg` availability before loading defaults.
- Prevent errors when `prole.cfg` is missing by skipping `lookup` operations.
- Update documentation to note `/external` may already be mounted before Ansible runs.
- Avoid redundant ownership and permissions enforcement in `mariadb_primary` role.
- Ensure dashboard service doesn't create an ordering cycle with `multi-user.target`.
- Verify service safely attaches to a virtual terminal (VT) and passes VT to Xorg.
- Ensure no `su` usage by default in the service.
- Validate script behavior for passing VT and `-keeptty` options to Xorg.
chore(dashboard): update systemd unit to avoid VT conflicts and improve logging
- Remove `After` and `Wants` directives for `multi-user.target` to prevent conflicts.
- Add `TTYPath`, `StandardInput`, and related options for VT attachment.
- Ensure `ExecStopPost` restores getty service for the dashboard VT.
fix(dashboard): improve Xorg resolution and clean up script logic
- Dynamically determine Xorg executable location in `dashboard.sh`.
- Pass VT, display, and `-keeptty` to Xorg to improve script reliability.
fix(mariadb): correct exFAT mount options for external storage
- Avoid `chown` failures by setting root ownership with group access for `mysql`.
- Update external mount options to `uid=0,gid=mysql,umask=0002`.
cleanup(mariadb): remove unnecessary owner/group permissions from migration marker task
- Enable mounting borrowed USB disk (exFAT) persistently at `/external`.
- Migrate MariaDB datadir to `/external/mariadb` with bind mount at `/srv/mariadb/mariadb`.
- Add migration marker and rollback support to prevent accidental remigration.
- Include Ansible tasks for external storage setup and migration validation.
- Add ssl_hosts group and prole_ssl role to deploy registry cert/key to /etc/ssl/certs/prole
- Configure k8s registry deployment to serve HTTPS using mounted host certs
- Switch k3s/containerd registry mirror config to https:// and prefer HTTPS checks with HTTP fallback
Co-authored-by: Junie <junie@jetbrains.com>
- Introduced `recycle_released_prole_iscsi_pv_for_pvc` to resolve stale claimRef issues during restarts.
- Updated `init_garage_store.sh` and `init_openbao.sh` to invoke the recycling logic when rollouts are stuck.
- Added regression tests to validate PV recycling for Garage and OpenBao services.
- Deleted `prole.cfg` as part of configuration cleanup.
- Added regression tests to ensure Docker is skipped during KDC setup when unavailable or unnecessary.
- Fixed `init_kong.sh` to avoid leaking temporary traps, addressing unbound variable errors.
- Rewrite stale foreign home prefixes when loading env defaults (macOS <-> Linux)
- Write /Users/chrisfu-relative values to env.sh; sanitize prole.cfg paths to use ${HOME}
- Remove remaining /Users/chrisfu defaults from helper scripts and OpenTofu kubeconfig path
- Make installer tests more reliable by forcing repo root to front of sys.path
Co-authored-by: Junie <junie@jetbrains.com>
- Eliminated reliance on `bash -lc` for dependency lookups, using `shutil.which` for better cross-platform support.
- Added `_resolve_brew_bin` fallback logic to handle specific Homebrew scenarios.
- Updated tests to align with the new streamlined lookup mechanism.
- Refactored subprocess checks to respect augmented environment configurations and reduce PATH issues.
- Deleted `prole.cfg`, `port-mapping.cfg`, and PostgreSQL version file as part of configuration cleanup.
- Enhanced Homebrew dependency resolution with `_resolve_brew_bin` and `_augment_env_for_brew` methods to manage PATH automatically.
- Updated subprocess calls to respect augmented environment configurations.
- Added unit tests for Homebrew PATH augmentation and dependency validation logic.
- Deleted `prole.cfg`, `port-mapping.cfg`, and PostgreSQL version file as part of configuration cleanup.
- Enhanced Homebrew dependency resolution with `_resolve_brew_bin` and `_augment_env_for_brew` methods to manage PATH automatically.
- Updated subprocess calls to respect augmented environment configurations.
- Added unit tests for Homebrew PATH augmentation and dependency validation logic.
- Introduced `test_init_cloudnative_pg_instances.sh` to validate CNPG instance count enforcement (default 3, configurable via `CNPG_INSTANCES`).
- Implemented support for opt-in Docker image pre-loading (`DOCKER_PRELOAD`/`PROLE_DOCKER_PRELOAD`) in `init_common_services.sh`.
- Added tests and validation for default pre-load behavior and toggle functionality in `test_init_common_services.sh`.
- Made `SERVICE_NAMESPACE` values consistent across configurations.
- Reuse namespace from existing prole.cfg unless env overrides
- Support k3s_hosts children groups and prefer k3s_servers as default
- Add headless pytest tkinter stubs and blocked-cluster reconciliation tests
- Update registry mirror endpoint, port mappings, and prole-db manifests
- Introduced `repair_pipeline_cli.py` to implement the repair pipeline in Python, enhancing maintainability and flexibility.
- Added `_repair_stale_released_pvs` method to handle reconciliation of stale Persistent Volumes and Persistent Volume Claims.
- Replaced complex bash-implemented repair logic in `repair_pipeline.sh` with a simplified wrapper that calls the Python script.
- Added unit tests for key repair methods, including `_match_stale_released_pv` and `_clear_pv_claim_ref`.
- Ensured support for namespace-scoped PVC repair logic and improved error handling during repair actions.
- Updated subprocess calls to handle interactions with `kubectl` within the pipeline's Python implementation.
This change simplifies cluster repair flows and improves future extensibility.
- Added tasks and playbooks for K3s datastore export/import using MariaDB Tools role, with associated tests and defaults.
- Enhanced iSCSI role to support mkfs-once logic and safer re-initialization of block storage.
- Migrated iSCSI-backed Rancher data from retropie to merlin.prole.org.
- Updated k3s roles/playbooks to relax Rancher storage preflight checks, supporting PARTUUID-based mounts.
- Adjusted Samba AD NetBIOS name derivation to use uppercase short hostname by default.
- Incremented prole DB version to 104, updated generated prole.cfg, inventory, and recovery manifest templates.
- Detect/remove legacy prole-svc-kong resources (deploy/svc/configmap) in default during repair
- Ensure canonical Kong exists in configured SERVICE_NAMESPACE before cleanup
- Remove hardcoded knoe-system defaults; require non-default SERVICE_NAMESPACE in k3s
- Avoid silent installer hangs under CI/pytest by auto-generating DB master password
- Update tests for namespace/repair behavior and DB version defaults
Co-authored-by: Junie <junie@jetbrains.com>
ArgoCD IO load distribution: Updated k8s/argocd/install.yaml to use hostPath volumes for application-controller (/prole/d001), redis (/prole/d002), and repo-server (/prole/d003). Updated Ansible configure task to create hostPath directories on myrddin.prole.org.
K3s configuration and testing: Added test playbooks for kubeconfig rewriting and argument validation. Updated K3s install, configure, and image import tasks. Configured required mounts and host-specific variables for myrddin.prole.org.
Miscellaneous: Updated conf/prole.cfg with K3S_TOKEN. Bumped prole-db version and updated recovery manifest templates. Minor UI adjustments in cluster screen.
Co-authored-by: Junie <junie@jetbrains.com>
* CNPG: Implement version pinning, automatic manifest URL derivation, and optional operator upgrades.
* CNPG: Add installation and management of the kubectl-cnpg plugin with architecture detection.
* k3s: Update etc/init_cloudnative_pg.sh to support configurable CNPG operator versions.
* Ansible: Enhance cgroups and k3s roles with improved check mode support and more robust variable defaults.
* Ansible: Improve kernel command-line path selection logic in the cgroups role.
Co-authored-by: Junie <junie@jetbrains.com>
We can now complete a full K3s deployment run and deliver a working CloudNativePG (CNPG) stack from the standalone installer.\n\nHighlights:\n- Installer scripts hardened for CNPG deploy + recovery templating + rollout control\n- OpenTofu/K3s manifests aligned with in-repo k8s templates for prole-db\n- Supporting init flows updated (OpenBao, monitoring, Kerberos, OpenTofu)
Co-authored-by: Junie <junie@jetbrains.com>
- Removed all logic that read or set NAMESPACE/PROLE_NAMESPACE from the shell environment or wrote it to env.sh.
- prole.cfg is now the sole source of truth for the namespace value, loaded exclusively by prole_cfg.sh.
- etc/prole_cfg.sh & mock_val/prole_cfg.sh: Removed kubectl-context fallback and default for PROLE_NAMESPACE.
- Shell scripts (init_*.sh): Replaced NAMESPACE=${NAMESPACE:-...} with NAMESPACE="${PROLE_NAMESPACE}".
- Python (actions, environment, milestone): Removed env["PROLE_NAMESPACE"] from subprocess env dicts and env.sh.
- etc/init_cloudnative_pg.sh: Removed DB_PASSWORD env fallback for secret creation.
Co-authored-by: Junie <junie@jetbrains.com>
