mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
00f0ebec07
Bringing the long-running session-feature branch back into main in one deliberate sweep. The branch carried the cluster work that's been live for weeks (cross-cluster CNPG metrics, Grafana w/ Google OAuth, supabase oauth2-proxy, cluster recovery, pg.0.knoe.dev + per-engineer onboarding, GCS-backed CNPG backups via Workload Identity, the env-contamination guard, the Junie brief queue, the cnpg-grafana CSRF + memory-request fixes from today), while main accumulated Junie's parallel knoe-auth Phase 2 OIDC work (full provider surface: discovery, authorize, token, userinfo, JWKS, RS256 signing, code exchange, session services). Key decision: the two branches did COMPETING rebrands off the same starting point (5ba9b63, 2026-04-27): - claude branch (commit b355855, earlier): org.prole.authority.* → dev.knoe.auth.* (artifact renamed to knoe-auth.jar) - main (commit9daa94b, recent): org.prole.authority.* → dev.knoe.authority.* (kept "authority" artifact name) dev.knoe.auth wins: cluster runs from this name, the Maven artifact is already knoe-auth.jar, and the broader rename is the documented namespace direction (per ~/.claude/projects/-Users-chrisfu-dev-knoe-db/ memory/MEMORY.md). All of main's recent Phase 2 OIDC content was ported from authority/src/.../dev/knoe/authority/ into authority/src/.../dev/knoe/auth/ with package declarations rewritten. == File-level resolution summary == Textual conflicts (4): authority/pom.xml - Took our artifactId="auth" - Took our branch's removal of spring-security-kerberos-client (verified: Junie's Phase 2 OIDC code does not import it; the dep was already-dead config) docs/pipeline-phases.md - Took our branch's "Phase 1 not started" status. Main had a misplaced "✅ Complete" with a knoe-auth-Phase-1 commit ref in the autobuild Phase 1 section — different domain. docs/plans/knoe-auth-round-1.md - Took our branch's dev.knoe.auth file table (vs main's dev.knoe.authority listing). Pure rename mismatch. supabase/helm/knoe-supabase/templates/kong/config.yaml - Took our branch's onboard route + plain dashboard wiring. Main had an oauth2proxy.enabled toggle that put oauth2-proxy as a Kong upstream — but the deployed architecture (commit 25f1b2e) has oauth2-proxy in FRONT of Kong, not behind. Main's wrapper reflected an architecture that was never deployed. - Took our branch's removal of basic-auth from dashboard route (queue #15 brief still tracks the matching values.yaml / kong/deployment.yaml cleanup). Java tree reconciliation (44 file-pairs): 20 dual-path source files + 2 dual-path tests Body-identical between main's authority/ and our branch's auth/ after stripping package decls — main's commit9daa94bwas a pure rebrand. Took our branch's auth/ version for all 22. 8 main-only source files (Phase 2 OIDC), ported into auth/: web/JwksController.java web/OidcAuthorizeController.java web/OidcDiscoveryController.java web/OidcTokenController.java web/OidcUserInfoController.java session/OidcCodeService.java session/OidcTokenService.java session/SessionService.java 12 main-only test files, ported into auth/: HealthControllerTest.java enroll/EnrollValueTypesTest.java enroll/EnrollmentControllerTest.java enroll/TotpServiceTest.java kerberos/KadminClientTest.java kerberos/KerberosSpnegoResultTest.java web/LoginControllerTest.java admin/AdminControllerTest.java user/PrincipalNormalizerTest.java regression/IdentityRegressionTest.java session/OidcCodeServiceTest.java session/SessionServiceTest.java Port mechanics: read main:authority/...<file> via git show, then sed rewrite `package dev.knoe.authority` → `package dev.knoe.auth` and `import dev.knoe.authority` → `import dev.knoe.auth`. Body content unchanged. authority/src/main/java/dev/knoe/authority/ — DELETED (duplicate) authority/src/test/java/dev/knoe/authority/ — DELETED (duplicate) == Verification == - grep -rln '<<<<<<<' across .java/.md/.yaml/.yml/.sh/.xml/.tpl: clean - find authority/src -path '*/dev/knoe/authority*': empty (subtree gone) - grep 'package dev.knoe.authority' across repo: clean - bash -n install.sh deploy.sh etc/preflight_kubecontext.sh: clean - git ls-files -u | wc -l: 0 unmerged paths - helm lint supabase/helm/knoe-supabase: pre-existing failure on studioIngress.enabled undefined in values.yaml (introduced by Junie on main; unrelated to this merge — flagging as follow-up). == Followups (carried into TODO ranked queue or noted here) == - helm lint failure: studioIngress block in values.yaml is missing enable flag; templates/studio/{ingress,oauth2proxy-deployment, oauth2proxy-service}.yaml all reference studioIngress.enabled with no default. Pre-existing on main; not introduced by this merge. - The five Junie briefs filed on this branch are now reachable from main at docs/plans/junie/{02,06,07,13,15}-*.md. Junie can pick them up in any order. - knoe-auth Phase 2 OIDC source (now at dev.knoe.auth.*) is not yet deployed to the cluster. Deployment is its own task. - The branch claude/crazy-bose-fec256 stays in place (worktree at .claude/worktrees/crazy-bose-fec256 may have ongoing context for Claude Code sessions). Safe to delete once next session starts cleanly from main. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
74 lines
4.0 KiB
Plaintext
74 lines
4.0 KiB
Plaintext
feat: full GKE/prod deployment pipeline from UI to Artifact Registry
|
|
|
|
## GCP / Cluster Environment Screen
|
|
- Auto-populate Cloud tab from conf/prod/gcp.cfg on screen open (org_id,
|
|
billing_account, billing_project, project_id)
|
|
- gcloud auth validity checked on screen startup; friendly modal dialog
|
|
streams gcloud auth login output live so user never leaves the app
|
|
- Live GKE cluster browser: fetches clusters via gcloud container clusters
|
|
list, displays with checkmark selector, auto-selects saved cluster
|
|
- Selecting a cluster runs get-credentials, sets KUBECONFIG/KUBECONTEXT,
|
|
and syncs the region dropdown to the selected cluster's location
|
|
- Region dropdown populated live from gcloud compute regions list with
|
|
checkmark on currently selected region; graceful fallback when offline
|
|
- New 'GCP Storage' tab with workload->StorageClass mapping (CNPG->premium-rwo,
|
|
Redis/Monitoring->standard-rwo, Garage->garage-hdd) and Fetch from Cluster
|
|
- Provider readonly field styled correctly (no solid-black on macOS)
|
|
- Stale knoe.cfg/conf/knoe.cfg symlinks removed; all config I/O now
|
|
resolves env-specific paths via knoe_conf.entrypoint_path()
|
|
|
|
## GKE Autopilot Compatibility (Common Services)
|
|
- Synology iSCSI StorageClass and static PVs guarded behind KNOE_MODE!=k8s
|
|
in init_openbao.sh (GKE Autopilot forbids hostPath/iSCSI volumes)
|
|
- In-cluster Docker registry (hostPath) skipped in k8s mode; GCP Artifact
|
|
Registry used instead
|
|
- Kong renamed knoe-svc-kong in k8s mode; all health-check kubectl calls in
|
|
init_common_services.sh and status_common_services.sh updated accordingly
|
|
- DNS endpoints switched from *.knoe.org to *.knoe.dev in k8s mode
|
|
(api.knoe.dev, git.knoe.dev, svc.knoe.dev); ingress uses gce class
|
|
- New GKE-clean Kong manifests under deploy/opentofu/k8s/manifests/knoe/:
|
|
no k3s node affinity, explicit Autopilot resource requests/limits
|
|
|
|
## Garage S3 Store (GKE)
|
|
- New garage-statefulset-gcp.yaml targeting garage-hdd StorageClass
|
|
(pd-standard, avoids SSD_TOTAL_GB quota exhaustion in us-west3)
|
|
- New storageclass-gcp-hdd.yaml (pd-standard, Retain, WaitForFirstConsumer)
|
|
- GCP StorageClass manifests skipped on re-runs (Autopilot built-ins are
|
|
immutable; skip-if-exists guard added)
|
|
- PVC deletion guard extended to cover any storageClass (not just synology)
|
|
so stale claims are cleaned before StatefulSet recreation
|
|
|
|
## Topology (GKE Autopilot)
|
|
- DaemonSet collector skipped in prod mode (forbidden in kube-system by
|
|
GKE Warden); Kubernetes-only node facts path used instead
|
|
- All ready GKE nodes assumed cnpg-eligible and monitoring-eligible without
|
|
taint/synology-mount checks (skip_collector + assume_nodes_eligible flags)
|
|
|
|
## KUBECONFIG / kubectl (k8s mode)
|
|
- actions.py: new elif mode==k8s branch sets KUBECONFIG=~/.kube/config
|
|
and injects KUBECONTEXT from knoe_cfg_data into script env
|
|
- _build_kubectl_cmd falls back to Global.KUBECONTEXT when
|
|
init_cluster.selected_kubectx is empty
|
|
- _activate_selected_gke_cluster persists KUBECONFIG/KUBECONTEXT to
|
|
knoe_cfg_data and saves knoe.cfg immediately after get-credentials
|
|
|
|
## Database Build Screen (GKE)
|
|
- Registry display shows correct Artifact Registry URL
|
|
(<region>-docker.pkg.dev/<project>/<namespace>/knoe-db) in green
|
|
- Build+push: gcloud auth configure-docker, auto-creates AR repository
|
|
named after SERVICE_NAMESPACE (e.g. knoe-system) if missing, then
|
|
docker tag + push; falls back to gcr.io if region unavailable
|
|
- GCP config loaded from conf/prod/gcp.cfg on every screen entry;
|
|
keys normalised to lowercase so project_id lookup is always consistent
|
|
|
|
## Config / Namespace persistence
|
|
- knoe_conf.py activate_environment: symlink creation removed; sets
|
|
CLUSTER_ENV env-var so all subsequent calls resolve correct env directory
|
|
- knoe/ui/screens/__init__.py: startup config load uses entrypoint_path()
|
|
instead of hardcoded conf/knoe.cfg; seeds SERVICE_NAMESPACE=knoe-system
|
|
for managed envs so Common Services never defaults to 'default'
|
|
- cfg.py _save_knoe_cfg: saves to env-specific path via entrypoint_path()
|
|
- etc/knoe_cfg.sh: removed all ln -snf symlink creation
|
|
|
|
Co-authored-by: Junie <junie@jetbrains.com>
|