Finish GitOps stack recovery

Makefile

@@ -19,7 +19,7 @@ SERVICES := ssl-proxy java-coordinator atheros-sensor atheros-search wg-key-rota
 BUILD_TARGETS := $(addprefix build-,$(SERVICES))
 PUBLISH_TARGETS := $(addprefix publish-,$(SERVICES))
 
-.PHONY: build build-all publish publish-all buildx-ready require-registry docs-check gitops-check $(BUILD_TARGETS) $(PUBLISH_TARGETS)
+.PHONY: build build-all publish publish-all buildx-ready require-registry docs-check gitops-check test lint dependency-boundaries atheros-search-test $(BUILD_TARGETS) $(PUBLISH_TARGETS)
 
 build: build-all
 publish: publish-all
@@ -34,6 +34,27 @@ docs-check:
 gitops-check:
 	python3 scripts/check-gitops.py --kustomize "$(KUSTOMIZE)"
 
+test:
+	cargo test -p sync-plane
+	cargo test -p ssl-proxy
+	cargo test -p atheros-sensor
+	cd apps/schema-migrator && sbt test
+	cd services/octopus && sbt test
+	$(MAKE) atheros-search-test
+	$(MAKE) dependency-boundaries
+
+lint:
+	cargo clippy -- -D warnings
+
+dependency-boundaries:
+	@command -v rg >/dev/null
+	@! rg -n 'use ssl_proxy|ssl_proxy::|ssl-proxy = \{ path = "\.\./\.\."' services/atheros-sensor services/atheros-sensor/Cargo.toml
+	@cargo tree -p atheros-sensor --depth 1 --prefix none | awk '$$1 == "ssl-proxy" { found=1; print; } END { exit found ? 1 : 0 }'
+	@cargo tree -p ssl-proxy --depth 1 --prefix none | awk '$$1 == "atheros-sensor" { found=1; print; } END { exit found ? 1 : 0 }'
+
+atheros-search-test:
+	cd services/atheros-search && go test ./...
+
 require-registry:
 	@test -n "$(REGISTRY)" || { echo "REGISTRY is required" >&2; exit 2; }
 

cyber-stack/README.md

@@ -15,7 +15,10 @@ The platform team provides and operates:
   or scoped token that can create image-update pull requests;
 - registry access for `192.168.1.221:5000`;
 - workload Secrets and the production TiDB endpoint ConfigMap required by the
-  rendered manifests.
+  rendered manifests;
+- DNS and an `ssl-proxy-identity-tls` certificate for the hostname declared by
+  each environment overlay: `identity.dev.ssl-proxy.internal` for dev and
+  `identity.prod.ssl-proxy.internal` for prod.
 
 Platform inputs must be delivered by the platform's declarative control plane.
 Do not create or patch them by hand. This repository owns the `ssl-proxy`

cyber-stack/argocd/application-app-stack.yaml

@@ -15,6 +15,7 @@ spec:
     repoURL: https://github.com/zlovtnik/ssl-proxy.git
     targetRevision: main
     path: cyber-stack/matrix/dev/app-stack
+    kustomize: {}
   destination:
     server: https://kubernetes.default.svc
     namespace: dev-ssl-proxy

cyber-stack/argocd/application-bootstrap.yaml

@@ -15,8 +15,7 @@ spec:
     repoURL: https://github.com/zlovtnik/ssl-proxy.git
     targetRevision: main
     path: cyber-stack/matrix/dev/bootstrap
-    directory:
-      recurse: false
+    kustomize: {}
   destination:
     server: https://kubernetes.default.svc
     namespace: dev-ssl-proxy

cyber-stack/argocd/application-data-plane.yaml

@@ -15,8 +15,7 @@ spec:
     repoURL: https://github.com/zlovtnik/ssl-proxy.git
     targetRevision: main
     path: cyber-stack/matrix/dev/data-plane
-    directory:
-      recurse: false
+    kustomize: {}
   destination:
     server: https://kubernetes.default.svc
     namespace: dev-ssl-proxy

cyber-stack/argocd/application-prod-app-stack.yaml

@@ -15,8 +15,7 @@ spec:
     repoURL: https://github.com/zlovtnik/ssl-proxy.git
     targetRevision: main
     path: cyber-stack/matrix/prod/app-stack
-    directory:
-      recurse: false
+    kustomize: {}
   destination:
     server: https://kubernetes.default.svc
     namespace: prod-ssl-proxy

cyber-stack/argocd/application-prod-bootstrap.yaml

@@ -15,8 +15,7 @@ spec:
     repoURL: https://github.com/zlovtnik/ssl-proxy.git
     targetRevision: main
     path: cyber-stack/matrix/prod/bootstrap
-    directory:
-      recurse: false
+    kustomize: {}
   destination:
     server: https://kubernetes.default.svc
     namespace: prod-ssl-proxy

cyber-stack/argocd/application-prod-data-plane.yaml

@@ -15,8 +15,7 @@ spec:
     repoURL: https://github.com/zlovtnik/ssl-proxy.git
     targetRevision: main
     path: cyber-stack/matrix/prod/data-plane
-    directory:
-      recurse: false
+    kustomize: {}
   destination:
     server: https://kubernetes.default.svc
     namespace: prod-ssl-proxy

cyber-stack/base/atheros-search/deployment.yaml

@@ -81,11 +81,6 @@ spec:
               value: grpc
             - name: OTEL_SERVICE_NAME
               value: atheros-search
-            - name: ATHSEARCH_API_TOKEN_SHA256
-              valueFrom:
-                secretKeyRef:
-                  name: atheros-credentials
-                  key: api-token-sha256
           ports:
             - name: http
               containerPort: 8080

cyber-stack/base/atheros-search/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml

cyber-stack/base/atheros-sensor/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - daemonset.yaml

cyber-stack/base/java-coordinator/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml

cyber-stack/base/minio/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - statefulset.yaml

cyber-stack/base/platform-config/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - serviceaccount.yaml
+  - configmap.yaml

cyber-stack/base/proxy/deployment.yaml

@@ -129,6 +129,7 @@ spec:
               value: "ssl-proxy"
           ports:
             - containerPort: 443
+              hostPort: 443
               protocol: UDP
               name: wireguard
             - containerPort: 51820

cyber-stack/base/proxy/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml

cyber-stack/base/redis-runtime/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml

cyber-stack/base/redpanda/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - statefulset.yaml

cyber-stack/base/schema-migrator/keycloak.yaml

@@ -127,8 +127,8 @@ spec:
             - name: KC_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: schema-migrator-keycloak
-                  key: database-password
+                  name: tidb-keycloak
+                  key: password
             - name: KC_BOOTSTRAP_ADMIN_USERNAME
               value: "keycloak-admin"
             - name: KC_BOOTSTRAP_ADMIN_PASSWORD

cyber-stack/base/telemetry/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - prometheus.yaml
+  - prometheus-configmap.yaml
+  - grafana.yaml
+  - grafana-configmaps.yaml
+  - loki.yaml
+  - loki-configmap.yaml
+  - promtail.yaml
+  - promtail-configmap.yaml
+  - jaeger.yaml
+  - otel-collector.yaml
+  - otel-collector-configmap.yaml
+  - node-exporter.yaml
+  - cadvisor.yaml
+  - pushgateway.yaml

cyber-stack/base/tidb/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - statefulset.yaml

cyber-stack/matrix/dev/app-stack/kustomization.yaml

@@ -37,6 +37,7 @@ images:
     newName: 192.168.1.221:5000/schema-migrator-ui
     digest: sha256:dfeda482650825f803fa84ee70b2a1df32bd807aa3e26b398407a4c9be69f536
 patches:
+  - path: ../patches/identity-hostname.yaml
   - path: ../patches/proxy-replicas.yaml
   - path: ../patches/octopus-environment.yaml
 configurations:

cyber-stack/matrix/dev/bootstrap/kustomization.yaml

@@ -5,6 +5,8 @@ resources:
   - ../namespace.yaml
   - ../../../base/platform-config/serviceaccount.yaml
   - ../../../base/platform-config/configmap.yaml
+patches:
+  - path: ../patches/identity-hostname.yaml
 configurations:
   - ../../../base/schema-migrator/kustomizeconfig.yaml
 vars:

cyber-stack/matrix/dev/data-plane/kustomization.yaml

@@ -24,7 +24,7 @@ resources:
 images:
   - name: tidb-runtime-schema
     newName: 192.168.1.221:5000/tidb-runtime-schema
-    digest: sha256:dc9405a0c6d023e57fc975c5bc667406d81ca73d20c1936b266c7b8d90b4af80
+    digest: sha256:5b04ee036ef89f9fefcaea3788132a7bc3982aaa93f9c8bc3a436abc2ec6f09e
 patches:
   - path: ../patches/tidb-replicas.yaml
   - path: ../patches/alloy-positions.yaml

cyber-stack/matrix/dev/patches/identity-hostname.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ssl-proxy-platform-config
+  namespace: ssl-proxy
+data:
+  IDENTITY_HOSTNAME: identity.dev.ssl-proxy.internal

cyber-stack/matrix/prod/app-stack/kustomization.yaml

@@ -32,6 +32,7 @@ images:
     newName: 192.168.1.221:5000/schema-migrator-ui
     digest: sha256:dfeda482650825f803fa84ee70b2a1df32bd807aa3e26b398407a4c9be69f536
 patches:
+  - path: ../patches/identity-hostname.yaml
   - target:
       kind: ConfigMap
       labelSelector: app.kubernetes.io/component=platform-config
@@ -41,7 +42,6 @@ patches:
         value: "true"
   - path: ../patches/proxy-replicas.yaml
   - path: ../patches/resources.yaml
-  - path: ../patches/replication-factor.yaml
   - path: ../patches/external-tidb.yaml
 configurations:
   - ../../../base/schema-migrator/kustomizeconfig.yaml

cyber-stack/matrix/prod/bootstrap/kustomization.yaml

@@ -6,7 +6,7 @@ resources:
   - ../../../base/platform-config/serviceaccount.yaml
   - ../../../base/platform-config/configmap.yaml
 patches:
-  - path: ../patches/topic-replication.yaml
+  - path: ../patches/identity-hostname.yaml
 configurations:
   - ../../../base/schema-migrator/kustomizeconfig.yaml
 vars:

cyber-stack/matrix/prod/patches/identity-hostname.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ssl-proxy-platform-config
+  namespace: ssl-proxy
+data:
+  IDENTITY_HOSTNAME: identity.prod.ssl-proxy.internal

k8s/tidb-schema-executor/entrypoint.sh

@@ -104,15 +104,34 @@ apply_grant_fixture() {
     "${fixture}" | mysql_run
 }
 
+revoke_schema_privileges() {
+  database="$1"
+  account="$2"
+  privileges="$(mysql_run --batch --skip-column-names -e "
+    SELECT COALESCE(
+      GROUP_CONCAT(privilege_type ORDER BY privilege_type SEPARATOR ', '),
+      ''
+    )
+    FROM information_schema.schema_privileges
+    WHERE table_schema = '${database}'
+      AND REPLACE(SUBSTRING_INDEX(grantee, '@', 1), CHAR(39), '') = '${account}';
+  ")"
+
+  if [ -n "${privileges}" ]; then
+    mysql_run -e "REVOKE ${privileges} ON ${database}.* FROM '${account}';"
+  fi
+}
+
 for domain in octopus_core atheros_search integration_console schema_migrator; do
   apply_domain "${domain}"
 done
 
 # The TiDB bootstrap job grants database-wide privileges so it can create
 # accounts before tables exist. Once canonical DDL is present, replace those
 # bootstrap grants with the checked-in table ownership matrix.
-mysql_run -e "REVOKE SELECT, INSERT, UPDATE, DELETE ON atheros_search.* FROM '${octopus_account}', '${atheros_search_account}';"
-mysql_run -e "REVOKE SELECT ON octopus_core.* FROM '${atheros_search_account}';"
+revoke_schema_privileges atheros_search "${octopus_account}"
+revoke_schema_privileges atheros_search "${atheros_search_account}"
+revoke_schema_privileges octopus_core "${atheros_search_account}"
 apply_grant_fixture "${schema_root}/octopus_core/grants/least_privilege.sql.tmpl"
 apply_grant_fixture "${schema_root}/atheros_search/grants/least_privilege.sql.tmpl"
 apply_grant_fixture "${schema_root}/schema_migrator/grants/least_privilege.sql.tmpl"