Skip to content

Finish GitOps stack recovery - #44

Merged
zlovtnik merged 1 commit into
mainfrom
dev
Aug 8, 2026
Merged

Finish GitOps stack recovery#44
zlovtnik merged 1 commit into
mainfrom
dev

Conversation

@zlovtnik

@zlovtnik zlovtnik commented Aug 8, 2026

Copy link
Copy Markdown
Owner

Summary

  • finish the Kustomize/Argo application source cleanup
  • make TiDB grant cleanup idempotent on fresh clusters
  • pin the rebuilt schema image containing the retry-safe migration and grant logic
  • preserve environment-specific identity and replication validation

Verification

  • make gitops-check
  • python3 scripts/check-tidb-schema-contract.py
  • python3 -m unittest scripts.tests.test_check_gitops -v
  • cd stackctl && pytest -q tests/test_deploy_regressions.py
  • pulled and inspected tidb-runtime-schema@sha256:5b04ee036ef89f9fefcaea3788132a7bc3982aaa93f9c8bc3a436abc2ec6f09e

GitHub-hosted CI remains unavailable because of the account billing lock; local repository checks passed.

Summary by CodeRabbit

  • New Features

    • Added Kustomize configuration across platform components and environment-specific identity hostnames.
    • Added GitOps validation for networking, authentication, database credentials, replication, and deployment configuration.
    • WireGuard traffic now binds UDP port 443 on the cluster node.
  • Bug Fixes

    • Corrected Keycloak database credential sourcing and expanded schema privilege cleanup.
    • Removed obsolete Atheros Search token configuration.
  • Deployment

    • Live deployments now require Argo CD/GitOps reconciliation; Stackctl supports rendering and dry runs only.
  • Documentation

    • Documented required TLS certificates and environment-specific identity settings.

…ted YAML files

- Deleted replication-factor.yaml and topic-replication.yaml as they are no longer needed.
- Updated entrypoint.sh to include a function for revoking schema privileges.
- Modified stackctl deployment process to reject direct deployment in favor of GitOps.
- Added checks for various configurations in check-gitops.py to enforce best practices.
- Created Kustomization files for all components to standardize deployment configurations.
- Added identity hostname ConfigMaps for dev and prod environments to ensure proper configuration.
- Updated stack.yaml to reference new Kustomization paths for components.
@zlovtnik
zlovtnik merged commit 4ffc6c3 into main Aug 8, 2026
1 of 7 checks passed
@coderabbitai

coderabbitai Bot commented Aug 8, 2026

Copy link
Copy Markdown

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a303d952-6cf6-4db4-9799-565655a7bf8d

📥 Commits

Reviewing files that changed from the base of the PR and between afa7c32 and 5d7835e.

📒 Files selected for processing (38)
  • Makefile
  • cyber-stack/README.md
  • cyber-stack/argocd/application-app-stack.yaml
  • cyber-stack/argocd/application-bootstrap.yaml
  • cyber-stack/argocd/application-data-plane.yaml
  • cyber-stack/argocd/application-prod-app-stack.yaml
  • cyber-stack/argocd/application-prod-bootstrap.yaml
  • cyber-stack/argocd/application-prod-data-plane.yaml
  • cyber-stack/base/atheros-search/deployment.yaml
  • cyber-stack/base/atheros-search/kustomization.yaml
  • cyber-stack/base/atheros-sensor/kustomization.yaml
  • cyber-stack/base/java-coordinator/kustomization.yaml
  • cyber-stack/base/minio/kustomization.yaml
  • cyber-stack/base/platform-config/kustomization.yaml
  • cyber-stack/base/proxy/deployment.yaml
  • cyber-stack/base/proxy/kustomization.yaml
  • cyber-stack/base/redis-runtime/kustomization.yaml
  • cyber-stack/base/redpanda/kustomization.yaml
  • cyber-stack/base/schema-migrator/keycloak.yaml
  • cyber-stack/base/telemetry/kustomization.yaml
  • cyber-stack/base/tidb/kustomization.yaml
  • cyber-stack/matrix/dev/app-stack/kustomization.yaml
  • cyber-stack/matrix/dev/bootstrap/kustomization.yaml
  • cyber-stack/matrix/dev/data-plane/kustomization.yaml
  • cyber-stack/matrix/dev/patches/identity-hostname.yaml
  • cyber-stack/matrix/prod/app-stack/kustomization.yaml
  • cyber-stack/matrix/prod/bootstrap/kustomization.yaml
  • cyber-stack/matrix/prod/patches/identity-hostname.yaml
  • cyber-stack/matrix/prod/patches/replication-factor.yaml
  • cyber-stack/matrix/prod/patches/topic-replication.yaml
  • k8s/tidb-schema-executor/entrypoint.sh
  • ops/src/sslproxy_ops/commands/up_ready/kubernetes.py
  • ops/src/sslproxy_ops/stack/core.py
  • ops/src/sslproxy_ops/stack/deploy.py
  • scripts/check-gitops.py
  • scripts/tests/test_check_gitops.py
  • stackctl/stack.yaml
  • stackctl/tests/test_deploy_regressions.py

📝 Walkthrough

Walkthrough

The pull request migrates Stackctl components from Helm paths to Kustomize sources. It routes deployment through Argo CD, adds rendered-manifest validation, updates environment overlays, and adds regression checks. It also adds dynamic schema privilege revocation.

Changes

GitOps migration

Layer / File(s) Summary
Kustomize component sources
cyber-stack/base/*, stackctl/stack.yaml
Base components now define Kustomizations. Stackctl references these repository paths instead of Helm chart paths.
Environment overlays and platform contracts
cyber-stack/argocd/*, cyber-stack/matrix/*, cyber-stack/README.md
Argo CD sources select Kustomize. Development and production overlays define identity hostnames and related platform settings.
GitOps-only deployment execution
ops/src/sslproxy_ops/..., stackctl/tests/test_deploy_regressions.py
Dry runs render Kustomize output. Live deployment paths now reject direct cluster changes and direct users to Argo CD.
Repository validation and test targets
Makefile, scripts/check-gitops.py, scripts/tests/test_check_gitops.py
Make targets and GitOps checks validate dependency boundaries, rendered manifests, deployment restrictions, identity hostnames, authentication, and replication limits.

Schema privilege cleanup

Layer / File(s) Summary
Dynamic schema privilege revocation
k8s/tidb-schema-executor/entrypoint.sh
The schema executor discovers schema-level privileges and revokes them for the configured accounts.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Stackctl
  participant Kustomize
  participant ArgoCD
  participant Cluster
  Stackctl->>Kustomize: render overlays during dry run
  Kustomize-->>Stackctl: return rendered manifests
  Stackctl-->>ArgoCD: reject direct live deployment
  ArgoCD->>Cluster: reconcile desired manifests
Loading

Possibly related PRs

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dev

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot mentioned this pull request Aug 9, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant