Skip to content

Commit 726fd64

Browse files
mjudeikismjudeikis
authored
docs(pm): point ManagedProvider config at published v0.0.7 charts (#669)
* docs(pm): bump ManagedProvider chart references to v0.0.7 The provider-quickstart Helm charts are now published at v0.0.7 under ghcr.io/platform-mesh/provider-quickstart/charts (first release including the publish-helm CI job from #668). Point the config/pm ManagedProvider manifest and docs at the published version. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt> * feat(pm): pin kcp front-proxy via hostAliases, IP set through kustomize The wildwest-controller's endpoint watcher dials the APIExport virtual-workspace URL (https://root.kcp.localhost:8443/...) directly. Inside the pod that hostname resolves to 127.0.0.1, so the watch fails with connection refused. Enable common.hostAliases on the controller to pin *.kcp.localhost to the in-cluster front-proxy service. The ClusterIP is environment-specific, so it is exposed as the single editable field via a kustomize JSON patch in kustomization.yaml rather than hardcoded in the manifest. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt> * feat(pm): deploy wildwest-armament-sync via ManagedProvider Add the armament syncer as a third runtimeDeployments component. It connects to kcp through the provider workspace kubeconfig, so it gets the same wildwest-provider-kubeconfig override and *.kcp.localhost hostAliases pinning as the controller; the front-proxy IP is patched for both via kustomization.yaml. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt> * ci: build and publish the armament-sync image The wildwest-armament-sync chart referenced ghcr.io/platform-mesh/provider-quickstart-armament-sync, but no CI job ever built that image, so deploying the chart fails with ImagePullBackOff. Add a build-armament-sync job (mirroring build-controller, using deploy/armament-sync.Dockerfile) and gate publish-helm on it. Default the chart's image.tag to the appVersion so the released chart (packaged with --app-version=<release tag>) pulls the matching image tag the job publishes. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt> --------- Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
1 parent dea3b47 commit 726fd64

5 files changed

Lines changed: 167 additions & 17 deletions

File tree

‎.github/workflows/build-images.yaml‎

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,56 @@ jobs:
110110
cache-to: type=gha,mode=max
111111
platforms: linux/amd64,linux/arm64
112112

113+
build-armament-sync:
114+
runs-on: ubuntu-latest
115+
permissions:
116+
contents: read
117+
packages: write
118+
steps:
119+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
120+
121+
- name: Set up QEMU
122+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
123+
124+
- name: Set up Docker Buildx
125+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
126+
127+
- name: Log in to GHCR
128+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
129+
with:
130+
registry: ghcr.io
131+
username: ${{ github.actor }}
132+
password: ${{ secrets.GITHUB_TOKEN }}
133+
134+
- name: Extract metadata
135+
id: meta
136+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
137+
with:
138+
images: ghcr.io/platform-mesh/provider-quickstart-armament-sync
139+
tags: |
140+
type=ref,event=branch
141+
type=ref,event=pr
142+
type=semver,pattern={{version}}
143+
type=semver,pattern={{major}}.{{minor}}
144+
type=sha
145+
type=raw,value=latest,enable={{is_default_branch}}
146+
147+
- name: Build and push
148+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
149+
with:
150+
context: .
151+
file: deploy/armament-sync.Dockerfile
152+
push: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}
153+
tags: ${{ steps.meta.outputs.tags }}
154+
labels: ${{ steps.meta.outputs.labels }}
155+
build-args: |
156+
VERSION=${{ github.ref_name }}
157+
GIT_COMMIT=${{ github.sha }}
158+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
159+
cache-from: type=gha
160+
cache-to: type=gha,mode=max
161+
platforms: linux/amd64,linux/arm64
162+
113163
publish-ocm:
114164
runs-on: ubuntu-latest
115165
needs: [build-controller, build-portal]
@@ -166,7 +216,7 @@ jobs:
166216
167217
publish-helm:
168218
runs-on: ubuntu-latest
169-
needs: [build-controller, build-portal]
219+
needs: [build-controller, build-portal, build-armament-sync]
170220
if: startsWith(github.ref, 'refs/tags/v')
171221
permissions:
172222
contents: read

‎config/pm/README.md‎

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,10 @@ On the **runtime cluster**:
4343

4444
Published artifacts the manifest references:
4545

46-
- OCI **Helm charts** at (version tracks the release tag — latest is `v0.0.6`):
47-
- `oci://ghcr.io/platform-mesh/provider-quickstart/charts/wildwest-controller:0.0.6`
48-
- `oci://ghcr.io/platform-mesh/provider-quickstart/charts/wildwest-portal:0.0.6`
46+
- OCI **Helm charts** at (version tracks the release tag — latest is `v0.0.7`):
47+
- `oci://ghcr.io/platform-mesh/provider-quickstart/charts/wildwest-controller:0.0.7`
48+
- `oci://ghcr.io/platform-mesh/provider-quickstart/charts/wildwest-portal:0.0.7`
49+
- `oci://ghcr.io/platform-mesh/provider-quickstart/charts/wildwest-armament-sync:0.0.7`
4950
- The chart `values.image.tag` digests resolve from `ghcr.io/platform-mesh/provider-quickstart*`.
5051

5152
> **Publishing note.** The operator's `Deploy` subroutine consumes **plain OCI Helm
@@ -56,10 +57,29 @@ Published artifacts the manifest references:
5657
> the `publish-helm` job in [`build-images.yaml`](../../.github/workflows/build-images.yaml)
5758
> on every `v*` tag (via `make helm-push`). CI versions all release artifacts from the git
5859
> tag (`VERSION = ${tag#v}`), so the chart version equals the release tag — latest is
59-
> `v0.0.6`. (The internal `deploy/helm/*/Chart.yaml` version is overridden at publish
60+
> `v0.0.7`. (The internal `deploy/helm/*/Chart.yaml` version is overridden at publish
6061
> time.) If you publish elsewhere, update `registry` / `componentName` / `version` in
6162
> [`managedprovider.yaml`](./managedprovider.yaml) accordingly.
6263
64+
## Configure the front-proxy IP (required)
65+
66+
kcp advertises the provider's APIExport virtual-workspace endpoint as
67+
`https://root.kcp.localhost:8443/...`. Inside the controller pod that hostname
68+
resolves to `127.0.0.1`, so the controller's endpoint watcher fails with
69+
`dial tcp 127.0.0.1:8443: connect: connection refused`. To fix this the chart
70+
pins those hostnames to the front-proxy service ClusterIP via `hostAliases`.
71+
72+
This is the **one value you must set for your cluster**. Find the IP:
73+
74+
```bash
75+
kubectl -n platform-mesh-system get svc frontproxy-front-proxy \
76+
-o jsonpath='{.spec.clusterIP}'
77+
```
78+
79+
and set it in [`kustomization.yaml`](./kustomization.yaml) (the `patches:` entry,
80+
`value:`). The IP is stable for the lifetime of the service; update it if the
81+
front-proxy Service is recreated.
82+
6383
## Apply
6484

6585
```bash
@@ -83,8 +103,9 @@ kubectl get secret wildwest-provider-kubeconfig -n platform-mesh-system
83103
# Flux objects emitted by the Deploy subroutine
84104
kubectl get ocirepository,helmrelease -n platform-mesh-system
85105

86-
# Workloads
87-
kubectl get pods -n platform-mesh-system -l app.kubernetes.io/name=wildwest-controller
106+
# Workloads (controller, portal, armament syncer)
107+
kubectl get pods -n platform-mesh-system \
108+
-l 'app.kubernetes.io/name in (wildwest-controller,wildwest-portal,wildwest-armament-sync)'
88109
```
89110

90111
## Tear down

‎config/pm/kustomization.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,29 @@ kind: Kustomization
55
namespace: platform-mesh-system
66
resources:
77
- managedprovider.yaml
8+
9+
# ---------------------------------------------------------------------------
10+
# Front-proxy IP for kcp hostAliases (environment-specific).
11+
#
12+
# kcp advertises the APIExport virtual-workspace endpoint as
13+
# https://root.kcp.localhost:8443/... which resolves to 127.0.0.1 inside the
14+
# controller pod. We pin those hostnames to the front-proxy service ClusterIP so
15+
# the controller can reach the virtual workspace.
16+
#
17+
# Set the IP for your cluster (it is the only value you should need to edit):
18+
# kubectl -n platform-mesh-system get svc frontproxy-front-proxy \
19+
# -o jsonpath='{.spec.clusterIP}'
20+
# ---------------------------------------------------------------------------
21+
patches:
22+
- target:
23+
group: providers.platform-mesh.io
24+
version: v1alpha1
25+
kind: ManagedProvider
26+
name: wildwest
27+
patch: |
28+
- op: replace
29+
path: /spec/runtimeDeployments/0/ocm/values/hostAliases/entries/0/ip
30+
value: "10.96.188.4"
31+
- op: replace
32+
path: /spec/runtimeDeployments/2/ocm/values/hostAliases/entries/0/ip
33+
value: "10.96.188.4"

‎config/pm/managedprovider.yaml‎

Lines changed: 59 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ spec:
3737
- ocm:
3838
componentName: wildwest-controller
3939
registry: ghcr.io/platform-mesh/provider-quickstart/charts
40-
version: "0.0.6"
40+
version: "0.0.7"
4141
values:
4242
# Provider-workspace kubeconfig copied in by the operator
4343
# (defaults to <ManagedProvider.name>-provider-kubeconfig / key "kubeconfig").
@@ -60,19 +60,69 @@ spec:
6060
# If the copied kubeconfig needs a different front-proxy host than the one
6161
# baked in, set providerHostOverride on this spec (preferred) or:
6262
# hostOverride: https://frontproxy-front-proxy.platform-mesh-system:8443
63+
# kcp advertises the APIExport virtual-workspace endpoint as
64+
# https://root.kcp.localhost:8443/... which resolves to 127.0.0.1 inside the
65+
# pod. Pin those hostnames to the in-cluster front-proxy service IP so the
66+
# controller can reach the virtual workspace. The IP is environment-specific
67+
# and is set via the kustomize patch in kustomization.yaml.
68+
hostAliases:
69+
enabled: true
70+
entries:
71+
- ip: "127.0.0.1" # PLACEHOLDER - overridden by kustomization.yaml patch
72+
hostnames:
73+
- root.kcp.localhost
74+
- kcp.localhost
75+
- localhost
6376

6477
# ---- Wild West portal (Angular UI) ---------------------------------------
6578
- ocm:
6679
componentName: wildwest-portal
6780
registry: ghcr.io/platform-mesh/provider-quickstart/charts
68-
version: "0.0.6"
69-
# Portal needs no kubeconfig. Enable httpRoute/middleware here if your
70-
# runtime exposes a Gateway (see deploy/helm/wildwest-portal/values.yaml).
71-
# values:
72-
# httpRoute:
73-
# enabled: true
74-
# middleware:
75-
# enabled: true
81+
version: "0.0.7"
82+
# Portal needs no kubeconfig. Expose it through the platform Gateway.
83+
# These values are passed verbatim into the HelmRelease; the chart defaults
84+
# already match the platform-mesh-system Gateway / CORS setup, so enabling the
85+
# toggles is enough (override hostnames/parentRefs/corsOrigins below if needed).
86+
# NOTE: under ManagedProvider the chart installs into this ManagedProvider's
87+
# namespace (platform-mesh-system), so the HTTPRoute backendRef Service and the
88+
# route/middleware all live in platform-mesh-system.
89+
values:
90+
httpRoute:
91+
enabled: true
92+
middleware:
93+
enabled: true
94+
# If the portal pod needs hostAliases (as in the manual install), add:
95+
# common:
96+
# defaults:
97+
# hostAliases:
98+
# enabled: true
99+
100+
# ---- Wild West armament syncer -------------------------------------------
101+
# Replicates an external armament catalog into the provider workspace as
102+
# Armament CRs. Connects to kcp via the provider workspace kubeconfig
103+
# (KUBECONFIG=/etc/kcp/kubeconfig), so it needs the same kubeconfig + hostAliases
104+
# wiring as the controller.
105+
- ocm:
106+
componentName: wildwest-armament-sync
107+
registry: ghcr.io/platform-mesh/provider-quickstart/charts
108+
version: "0.0.7"
109+
values:
110+
# Chart default is wildwest-controller-kubeconfig; under ManagedProvider the
111+
# operator copies the provider kubeconfig as wildwest-provider-kubeconfig.
112+
kubeconfig:
113+
secretName: wildwest-provider-kubeconfig
114+
secretKey: kubeconfig
115+
syncer:
116+
interval: 30s
117+
# Same kcp front-proxy pinning as the controller; IP set via kustomize patch.
118+
hostAliases:
119+
enabled: true
120+
entries:
121+
- ip: "127.0.0.1" # PLACEHOLDER - overridden by kustomization.yaml patch
122+
hostnames:
123+
- root.kcp.localhost
124+
- kcp.localhost
125+
- localhost
76126

77127
# ---- Optional overrides -----------------------------------------------------
78128
# Override the kcp front-proxy host written into the generated kubeconfig:

‎deploy/helm/wildwest-armament-sync/values.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@ replicaCount: 1
33
image:
44
repository: ghcr.io/platform-mesh/provider-quickstart-armament-sync
55
pullPolicy: IfNotPresent
6-
tag: "0.1.0"
6+
# Empty -> falls back to the chart appVersion. CI packages the chart with
7+
# --app-version=<release tag> (matching the image tag pushed by the
8+
# build-armament-sync job), so the published chart pulls the matching image.
9+
tag: ""
710

811
imagePullSecrets: []
912
nameOverride: ""

0 commit comments

Comments
 (0)