Rename env config files from conf/*/prole.cfg to conf/k3d.cfg, conf/k3s.cfg, and conf/gke.cfg. Update shell/Python loaders and etc/deploy scripts to resolve named configs cleanly while keeping legacy fallback behavior. Align k3s Ansible tasks, docs, and regression coverage with the new configuration layout.
Co-authored-by: Junie <junie@jetbrains.com>
## GCP / Cluster Environment Screen
- Auto-populate Cloud tab from conf/prod/gcp.cfg on screen open (org_id,
billing_account, billing_project, project_id)
- gcloud auth validity checked on screen startup; friendly modal dialog
streams gcloud auth login output live so user never leaves the app
- Live GKE cluster browser: fetches clusters via gcloud container clusters
list, displays with checkmark selector, auto-selects saved cluster
- Selecting a cluster runs get-credentials, sets KUBECONFIG/KUBECONTEXT,
and syncs the region dropdown to the selected cluster's location
- Region dropdown populated live from gcloud compute regions list with
checkmark on currently selected region; graceful fallback when offline
- New 'GCP Storage' tab with workload->StorageClass mapping (CNPG->premium-rwo,
Redis/Monitoring->standard-rwo, Garage->garage-hdd) and Fetch from Cluster
- Provider readonly field styled correctly (no solid-black on macOS)
- Stale prole.cfg/conf/prole.cfg symlinks removed; all config I/O now
resolves env-specific paths via prole_conf.entrypoint_path()
## GKE Autopilot Compatibility (Common Services)
- Synology iSCSI StorageClass and static PVs guarded behind PROLE_MODE!=k8s
in init_openbao.sh (GKE Autopilot forbids hostPath/iSCSI volumes)
- In-cluster Docker registry (hostPath) skipped in k8s mode; GCP Artifact
Registry used instead
- Kong renamed knoe-svc-kong in k8s mode; all health-check kubectl calls in
init_common_services.sh and status_common_services.sh updated accordingly
- DNS endpoints switched from *.prole.org to *.knoe.dev in k8s mode
(api.knoe.dev, git.knoe.dev, svc.knoe.dev); ingress uses gce class
- New GKE-clean Kong manifests under deploy/opentofu/k8s/manifests/prole/:
no k3s node affinity, explicit Autopilot resource requests/limits
## Garage S3 Store (GKE)
- New garage-statefulset-gcp.yaml targeting garage-hdd StorageClass
(pd-standard, avoids SSD_TOTAL_GB quota exhaustion in us-west3)
- New storageclass-gcp-hdd.yaml (pd-standard, Retain, WaitForFirstConsumer)
- GCP StorageClass manifests skipped on re-runs (Autopilot built-ins are
immutable; skip-if-exists guard added)
- PVC deletion guard extended to cover any storageClass (not just synology)
so stale claims are cleaned before StatefulSet recreation
## Topology (GKE Autopilot)
- DaemonSet collector skipped in prod mode (forbidden in kube-system by
GKE Warden); Kubernetes-only node facts path used instead
- All ready GKE nodes assumed cnpg-eligible and monitoring-eligible without
taint/synology-mount checks (skip_collector + assume_nodes_eligible flags)
## KUBECONFIG / kubectl (k8s mode)
- actions.py: new elif mode==k8s branch sets KUBECONFIG=~/.kube/config
and injects KUBECONTEXT from prole_cfg_data into script env
- _build_kubectl_cmd falls back to Global.KUBECONTEXT when
init_cluster.selected_kubectx is empty
- _activate_selected_gke_cluster persists KUBECONFIG/KUBECONTEXT to
prole_cfg_data and saves prole.cfg immediately after get-credentials
## Database Build Screen (GKE)
- Registry display shows correct Artifact Registry URL
(<region>-docker.pkg.dev/<project>/<namespace>/knoe-db) in green
- Build+push: gcloud auth configure-docker, auto-creates AR repository
named after SERVICE_NAMESPACE (e.g. knoe-system) if missing, then
docker tag + push; falls back to gcr.io if region unavailable
- GCP config loaded from conf/prod/gcp.cfg on every screen entry;
keys normalised to lowercase so project_id lookup is always consistent
## Config / Namespace persistence
- prole_conf.py activate_environment: symlink creation removed; sets
CLUSTER_ENV env-var so all subsequent calls resolve correct env directory
- knoe/ui/screens/__init__.py: startup config load uses entrypoint_path()
instead of hardcoded conf/prole.cfg; seeds SERVICE_NAMESPACE=knoe-system
for managed envs so Common Services never defaults to 'default'
- cfg.py _save_prole_cfg: saves to env-specific path via entrypoint_path()
- etc/prole_cfg.sh: removed all ln -snf symlink creation
Co-authored-by: Junie <junie@jetbrains.com>
- Rename iSCSI storage class and PV/PVC selectors/labels from prole to synology across k8s and OpenTofu manifests\n- Update CNPG/OpenBao/Garage/monitoring init flows, render helpers, and mock scripts for synology-backed storage objects\n- Integrate related UI/core/service config/version updates and add supporting regression tests for CNPG storage/image behavior\n- Keep storage reconciliation tests aligned with current CNPG affinity output
Co-authored-by: Junie <junie@jetbrains.com>
- Implement centralized `resolve_prole_home` utility for consistent environment-based `PROLE_HOME` resolution across modules
- Replace hardcoded home paths with `resolve_prole_home`
- Refactor PV management to support iSCSI mounts and node placement from Ansible manifests
- Improve Kubernetes manifest handling to dynamically apply namespaces per document
- Adjust `knoe-db` build context path and related tests
- Add utilities for detecting and applying Ansible-defined node labels and PVs
- Introduced `recycle_released_prole_iscsi_pv_for_pvc` to resolve stale claimRef issues during restarts.
- Updated `init_garage_store.sh` and `init_openbao.sh` to invoke the recycling logic when rollouts are stuck.
- Added regression tests to validate PV recycling for Garage and OpenBao services.
We can now complete a full K3s deployment run and deliver a working CloudNativePG (CNPG) stack from the standalone installer.\n\nHighlights:\n- Installer scripts hardened for CNPG deploy + recovery templating + rollout control\n- OpenTofu/K3s manifests aligned with in-repo k8s templates for prole-db\n- Supporting init flows updated (OpenBao, monitoring, Kerberos, OpenTofu)
Co-authored-by: Junie <junie@jetbrains.com>
- Renamed etc/init_prole-db-backup.sh to etc/init_cnpg_backup.sh and updated all references.
- Enhanced CNPG backup script with authoritative status validation.
- Implemented SupabaseImagePreloadMilestone to front-load heavy image transfers.
- Updated supabase/deploy.sh with --prefetch-images-only and --skip-prefetch.
- Updated unit tests for CNPG backups and Supabase silent milestone sequencing.
- Included incidental environment updates from installer execution.
Co-authored-by: Junie <junie@jetbrains.com>
- Resolve namespace drift in Kerberos test flow and OpenBao deployment.
- Fix OpenAPI credential-validation failures in etc scripts by using --validate=false with kubectl.
- Introduce preferred_service_namespace() to accurately target namespaces for KDC policy/test paths.
- Default Kerberos test user to 'administrator' and prefill from Ansible vault secrets.
- Generalized OpenBao deployment logic to correctly handle multi-namespace environments.
- Added regression test 'tests/etc/test_init_kerberos_k3s_real_kdc.sh'.
- Synchronized SERVICE_NAMESPACE extraction in prole_cfg.sh.
Co-authored-by: Junie <junie@jetbrains.com>
- Dockerfile: Resolved interactive tzdata prompts with debconf and fixed Percona package names (percona-pg-stat-monitor18 and percona-postgresql-contrib).
- Configuration: Updated prole.cfg with specific namespace (prole-hq0-db0), user (chrisfu), and encrypted secrets.
- Installer: Enhanced initialization scripts (init_openbao.sh, init_certmgr.sh) and updated service layers for cluster deployment.
- Tests: Added coverage for dependent image collection in installer core.
- Version: Bumped prole-db version to 77.
Co-authored-by: Junie <junie@jetbrains.com>
- Tighten Cluster Environment screen layout; switch Service/Prod to kubectx context selection; keep namespace and key controls on one line; ensure Repair button remains reachable.
- Add UI layout regression test to render with large mock data and assert key widgets remain visible and console is scrollable.
- Make kubeconfig generation deterministic under tests by avoiding overwriting cert-based kubeconfigs; write token sidecar kubeconfig when needed.
- Update common-services init scripts and add k3s/Helm deployment bits (svc-check, Kong/CertMgr tasks).
Kong API Gateway (replacing prole nginx):
- Add etc/init_kong.sh provisioning script (DB-less mode, prole-db namespace)
- Add kong-deployment.yaml and kong-service.yaml manifests
- Rewire ingress rules (svc/git/api.prole.org) to prole-db-kong:8000
- Update kustomization.yaml to reference kong manifests
PostgREST & DB Manager in prole-db namespace:
- Add etc/init_postgrest.sh and etc/init_db_manager.sh scripts
- Add postgrest/db-manager deployment and service manifests
- Add src/db-manager/ Node.js REST endpoint for backup triggers
- Default NAMESPACE changed to prole-db in both scripts
Docker image pre-load from PROLE_DATA/docker-import:
- Add _preload_docker_images() to init_common_services.sh
- Scan for .tar files exported by final_deployment.sh
- Import via k3d image import (k3d) or ctr (k3s) before deployments
- Increase rollout timeouts to 300s (configurable via ROLLOUT_TIMEOUT) in init_openbao.sh, init_opentofu.sh, init_garage_store.sh, init_registry.sh
OpenTofu password resolution fix:
- Add Kubernetes secret fallback in resolve_admin_password()
- Change hard exit 1 to graceful return 1 with warning
- Wrap call in if-guard so set -e doesn't abort the script chain
Milestone fix (init scripts not running):
- Add init_kong.sh, init_postgrest.sh, init_db_manager.sh to InitializationScriptsMilestone.execute() script list and arg branches
- Previously only actions.py had these; milestones.py was missing them
Installer integration:
- Add Kong/PostgREST/DB Manager to silent installer _step_init_scripts
- Add corresponding tabs and execution blocks in UI services.py
- Monitoring: Migrated from manual Grafana/Prometheus manifests to kube-prometheus-stack based setup in etc/init_monitoring.sh. Removed old manifest files from deploy/ and k8s/.
- Installer Core: Refactored installer with new modules for actions, environment handling, and UI screens. Enhanced Milestone logic to support advanced configuration (ArgoCD, Registry namespaces, Kerberos flags, etc.).
- Service & Init Scripts: Updated multiple initialization scripts (init_*.sh) for better integration with OpenBao, Kerberos, and the new monitoring stack. Added new scripts for Nginx Ingress, Ollama parsing, and K3D route fixes.
- Infrastructure: Enhanced Samba AD DC Ansible role with realm derivation, provisioning guidance, and group management. Updated K3s role tasks.
- Configuration: Refined default settings in conf/ to align with the new deployment architecture.
- App & Tools: Updated prole-app Swift code and prole.sh for improved environment variable handling and installation flow.
Repairs and improvements:
- iSCSI: Added cleanup tasks to remove stale mounts and fstab entries. Improved robustness of iSCSI target management and added 'iscsi_absent_mounts' support.
- K3s:
- Updated service start logic to accept 'activating' state, preventing premature failure during slow startups.
- Improved service stop logic to safely handle missing or not-found services.
- Ensured 'prole-installer' ServiceAccount and ClusterRoleBinding exist for K8s administration.
- Added leader election and etcd tuning arguments (forgiving leases) to config.yaml.j2.
- Removed deprecated 'prole-port-forwards' systemd service.
- Installer & Scripts:
- Updated legacy_tk.py to support K3s mode, secret resolution for passwords, and better environment management (including ~/.prole/env.sh for service mode).
- Updated init_ansible.sh to support PROLE_VAULT_PASS_FILE and ANSIBLE_VAULT_PASSWORD_FILE.
- Improved directory and kubeconfig path resolution in prole_cfg.sh to support fallback to ~/.prole.
- Enhanced Grafana password resolution in init_monitoring.sh.
- Added automatic application of iSCSI StorageClass and PersistentVolumes in init_openbao.sh.
- General: Switched conf/prole.cfg to k3s deployment mode and updated vault_k3s.yml token.
New Ansible Tasks and Playbooks:
- infrastructure/playbooks/iscsi_cleanup.yml: Automates logout and removal of stale iSCSI node records.
- infrastructure/playbooks/prole_logs_migrate.yml: Orchestrates /prole/logs migration to iSCSI storage.
- infrastructure/playbooks/tmp_bao_dir.yml: Ensures host-level storage directories for OpenBao.
- infrastructure/playbooks/tmp_mount.yml: Utility to verify and enforce host-level mounts.
- infrastructure/playbooks/k3s_sync.yml: Added tasks to start K3s after sync and update local kubeconfig on the controller.
- Added 'Unmount stale iSCSI mounts' and 'Remove stale iSCSI fstab entries' to the iscsi role.
- Added 'Ensure prole-installer service account exists' to the k3s role.
- Finalized stable, repeatable reset logic for the k3d pipeline.
- Refactored installer into modular components: core, milestone, runner, and state.
- Introduced new UI abstractions with support for ncurses and Tkinter.
- Updated initialization scripts and configurations for CloudNativePG, Kerberos, OpenBao, and Monitoring.
- Improved pipeline repair and port-forwarding mechanisms.
- install.py: Major update including configuration variable expansion, improved k3s/k3d handling, and enhanced installation logic.
- etc/ scripts: Significant refactoring of initialization scripts (Kerberos, Port Forwards, Garage Store, etc.).
- Port Forwards: Transitioned from XML to port-mappings.conf for managing kubectl port-forwards.
- Status Reporting: Improved status checking for common services.
- Infrastructure: Updated Ansible inventory and rsyslog role configurations.
- Tests: Added a comprehensive suite of tests for 'etc' initialization scripts in prole/tests/etc/.
- Documentation: Added prole-db-documentation-mcp-architecture.md.
- General: Updated Dockerfiles and various helper scripts.
- Installer: Updated k3s deployment logic and configuration generation.
- k3s Role: Implemented token drift protection to verify Vault secrets against live node tokens.
- DNS: Enhanced samba_reverse_dns role to support multiple reverse zones.
- Service Init: Updated initialization scripts and status reporting.
- Infrastructure: Added prole management role and k3s diagnostic playbook.
- Configuration: Updated prole.cfg and added vaulted group variables.
- Consolidated and split initialization scripts in etc/:
- Removed init_prole-db.sh and init_authority.sh.
- Added init_kdc.sh for in-cluster MIT Kerberos KDC (prole-authority).
- Added init_ollama.sh for Ollama AI service integration.
- Added init_service_layer.sh for high-level service orchestration.
- Added init_k3s_registry.sh for private registry management.
- Major updates to install.py:
- Support for new Ollama and KDC configuration.
- Improved prole.cfg rendering and namespace handling.
- Updated unattended install flags.
- Infrastructure and Deployment:
- Updated K3s Ansible role with private registry support (registries.yaml template).
- Added prole-authority Dockerfile.
- Updated OpenBao Kerberos ConfigMap and other K8s manifests.
- Configuration:
- Updated prole.cfg with new sections for Ollama and Monitoring.
- Refined environment variable exports in env.sh and prole_cfg.sh.
- Add k3s start/stop Ansible playbooks and roles.
- Implement OpenTofu initialization scripts and k8s manifests.
- Update ncurses installer with OpenTofu support and improved k3s integration.
- Add mode support (--mode) to etc/ initialization scripts.
- Update prole-db with recovery, barman objectstore, and SSH OpenBao support.
- Refine k8s manifests for OpenBao and prole-db.
- Updated tests/silent_install_test.sh to support unique logging via SILENT_INSTALL_LOG=true
- Created shared IntelliJ Run Configuration '.idea/runConfigurations/Silent_Install_Test.xml'
- Updated various init scripts, port mappings, and installer logic
- Added supabase.sh and init_monitoring.sh
- Add a fallback mechanism to RSA when ed25519 key generation fails in `install.py`.
- Update SSH key generation logic to avoid ed25519-specific messaging.
- Simplify comments and logic in `init_openbao.sh` by removing ed25519 assumptions.
- Compact XML formatting for port-mappings.
- Consistently source `prole_cfg.sh` across multiple init scripts for unified configuration handling.
- Enhanced error handling in `screen.py` to manage potential UI exceptions gracefully.
- Improved asynchronous function scheduling using the new `safe_after` method.
- Ensure cluster exists before attempting to patch the image in `init_prole-db.sh`.
- Introduce function to apply hostNetwork patch for OpenBao in `init_openbao.sh`.
- Refactored installer UI with updated canvas rendering, sidebar navigation, and footer buttons.
- Enhanced styling for macOS compatibility and consistent design across controls.
- Added Pytest-based unit tests for `screen.py` and `config.py`.
- Expanded dependency catalog with new tools like `tshark` and `pyshark`.
- Improved error tolerance for background rendering and added placeholders for Kerberos configuration.
