feat(argocd): Can now detect argocd instance when already installed and write crd accordingly. One major caveat though is that crd versions are not managed properly yet

Cargo.lock

@@ -6049,21 +6049,6 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
-[[package]]
-name = "test-score"
-version = "0.1.0"
-dependencies = [
- "base64 0.22.1",
- "env_logger",
- "harmony",
- "harmony_cli",
- "harmony_macros",
- "harmony_types",
- "log",
- "tokio",
- "url",
-]
-
 [[package]]
 name = "thiserror"
 version = "1.0.69"

adr/015-higher-order-topologies.md

@@ -1,114 +0,0 @@
-# Architecture Decision Record: Higher-Order Topologies
-
-**Initial Author:** Jean-Gabriel Gill-Couture  
-**Initial Date:** 2025-12-08  
-**Last Updated Date:** 2025-12-08  
-
-## Status
-
-Implemented
-
-## Context
-
-Harmony models infrastructure as **Topologies** (deployment targets like `K8sAnywhereTopology`, `LinuxHostTopology`) implementing **Capabilities** (tech traits like `PostgreSQL`, `Docker`).
-
-**Higher-Order Topologies** (e.g., `FailoverTopology<T>`) compose/orchestrate capabilities *across* multiple underlying topologies (e.g., primary+replica `T`).
-
-Naive design requires manual `impl Capability for HigherOrderTopology<T>` *per T per capability*, causing:
-- **Impl explosion**: N topologies × M capabilities = N×M boilerplate.
-- **ISP violation**: Topologies forced to impl unrelated capabilities.
-- **Maintenance hell**: New topology needs impls for *all* orchestrated capabilities; new capability needs impls for *all* topologies/higher-order.
-- **Barrier to extension**: Users can't easily add topologies without todos/panics.
-
-This makes scaling Harmony impractical as ecosystem grows.
-
-## Decision
-
-Use **blanket trait impls** on higher-order topologies to *automatically* derive orchestration:
-
-````rust
-/// Higher-Order Topology: Orchestrates capabilities across sub-topologies.
-pub struct FailoverTopology<T> {
-    /// Primary sub-topology.
-    primary: T,
-    /// Replica sub-topology.
-    replica: T,
-}
-
-/// Automatically provides PostgreSQL failover for *any* `T: PostgreSQL`.
-/// Delegates to primary for queries; orchestrates deploy across both.
-#[async_trait]
-impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        // Deploy primary; extract certs/endpoint;
-        // deploy replica with pg_basebackup + TLS passthrough.
-        // (Full impl logged/elaborated.)
-    }
-
-    // Delegate queries to primary.
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        self.primary.get_replication_certs(cluster_name).await
-    }
-    // ...
-}
-
-/// Similarly for other capabilities.
-#[async_trait]
-impl<T: Docker> Docker for FailoverTopology<T> {
-    // Failover Docker orchestration.
-}
-````
-
-**Key properties:**
-- **Auto-derivation**: `Failover<K8sAnywhere>` gets `PostgreSQL` iff `K8sAnywhere: PostgreSQL`.
-- **No boilerplate**: One blanket impl per capability *per higher-order type*.
-
-## Rationale
-
-- **Composition via generics**: Rust trait solver auto-selects impls; zero runtime cost.
-- **Compile-time safety**: Missing `T: Capability` → compile error (no panics).
-- **Scalable**: O(capabilities) impls per higher-order; new `T` auto-works.
-- **ISP-respecting**: Capabilities only surface if sub-topology provides.
-- **Centralized logic**: Orchestration (e.g., cert propagation) in one place.
-
-**Example usage:**
-````rust
-// ✅ Works: K8sAnywhere: PostgreSQL → Failover provides failover PG
-let pg_failover: FailoverTopology<K8sAnywhereTopology> = ...;
-pg_failover.deploy_pg(config).await;
-
-// ✅ Works: LinuxHost: Docker → Failover provides failover Docker
-let docker_failover: FailoverTopology<LinuxHostTopology> = ...;
-docker_failover.deploy_docker(...).await;
-
-// ❌ Compile fail: K8sAnywhere !: Docker
-let invalid: FailoverTopology<K8sAnywhereTopology>;
-invalid.deploy_docker(...); // `T: Docker` bound unsatisfied
-````
-
-## Consequences
-
-**Pros:**
-- **Extensible**: New topology `AWSTopology: PostgreSQL` → instant `Failover<AWSTopology>: PostgreSQL`.
-- **Lean**: No useless impls (e.g., no `K8sAnywhere: Docker`).
-- **Observable**: Logs trace every step.
-
-**Cons:**
-- **Monomorphization**: Generics generate code per T (mitigated: few Ts).
-- **Delegation opacity**: Relies on rustdoc/logs for internals.
-
-## Alternatives considered
-
-| Approach | Pros | Cons |
-|----------|------|------|
-| **Manual per-T impls**<br>`impl PG for Failover<K8s> {..}`<br>`impl PG for Failover<Linux> {..}` | Explicit control | N×M explosion; violates ISP; hard to extend. |
-| **Dynamic trait objects**<br>`Box<dyn AnyCapability>` | Runtime flex | Perf hit; type erasure; error-prone dispatch. |
-| **Mega-topology trait**<br>All-in-one `OrchestratedTopology` | Simple wiring | Monolithic; poor composition. |
-| **Registry dispatch**<br>Runtime capability lookup | Decoupled | Complex; no compile safety; perf/debug overhead. |
-
-**Selected**: Blanket impls leverage Rust generics for safe, zero-cost composition.
-
-## Additional Notes
-
-- Applies to `MultisiteTopology<T>`, `ShardedTopology<T>`, etc.
-- `FailoverTopology` in `failover.rs` is first implementation.

adr/015-higher-order-topologies/example.rs

@@ -1,153 +0,0 @@
-//! Example of Higher-Order Topologies in Harmony.
-//! Demonstrates how `FailoverTopology<T>` automatically provides failover for *any* capability
-//! supported by a sub-topology `T` via blanket trait impls.
-//! 
-//! Key insight: No manual impls per T or capability -- scales effortlessly.
-//! Users can:
-//! - Write new `Topology` (impl capabilities on a struct).
-//! - Compose with `FailoverTopology` (gets capabilities if T has them).
-//! - Compile fails if capability missing (safety).
-
-use async_trait::async_trait;
-use tokio;
-
-/// Capability trait: Deploy and manage PostgreSQL.
-#[async_trait]
-pub trait PostgreSQL {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String>;
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String>;
-}
-
-/// Capability trait: Deploy Docker.
-#[async_trait]
-pub trait Docker {
-    async fn deploy_docker(&self) -> Result<String, String>;
-}
-
-/// Configuration for PostgreSQL deployments.
-#[derive(Clone)]
-pub struct PostgreSQLConfig;
-
-/// Replication certificates.
-#[derive(Clone)]
-pub struct ReplicationCerts;
-
-/// Concrete topology: Kubernetes Anywhere (supports PostgreSQL).
-#[derive(Clone)]
-pub struct K8sAnywhereTopology;
-
-#[async_trait]
-impl PostgreSQL for K8sAnywhereTopology {
-    async fn deploy(&self, _config: &PostgreSQLConfig) -> Result<String, String> {
-        // Real impl: Use k8s helm chart, operator, etc.
-        Ok("K8sAnywhere PostgreSQL deployed".to_string())
-    }
-
-    async fn get_replication_certs(&self, _cluster_name: &str) -> Result<ReplicationCerts, String> {
-        Ok(ReplicationCerts)
-    }
-}
-
-/// Concrete topology: Linux Host (supports Docker).
-#[derive(Clone)]
-pub struct LinuxHostTopology;
-
-#[async_trait]
-impl Docker for LinuxHostTopology {
-    async fn deploy_docker(&self) -> Result<String, String> {
-        // Real impl: Install/configure Docker on host.
-        Ok("LinuxHost Docker deployed".to_string())
-    }
-}
-
-/// Higher-Order Topology: Composes multiple sub-topologies (primary + replica).
-/// Automatically derives *all* capabilities of `T` with failover orchestration.
-/// 
-/// - If `T: PostgreSQL`, then `FailoverTopology<T>: PostgreSQL` (blanket impl).
-/// - Same for `Docker`, etc. No boilerplate!
-/// - Compile-time safe: Missing `T: Capability` → error.
-#[derive(Clone)]
-pub struct FailoverTopology<T> {
-    /// Primary sub-topology.
-    pub primary: T,
-    /// Replica sub-topology.
-    pub replica: T,
-}
-
-/// Blanket impl: Failover PostgreSQL if T provides PostgreSQL.
-/// Delegates reads to primary; deploys to both.
-#[async_trait]
-impl<T: PostgreSQL + Send + Sync + Clone> PostgreSQL for FailoverTopology<T> {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        // Orchestrate: Deploy primary first, then replica (e.g., via pg_basebackup).
-        let primary_result = self.primary.deploy(config).await?;
-        let replica_result = self.replica.deploy(config).await?;
-        Ok(format!("Failover PG deployed: {} | {}", primary_result, replica_result))
-    }
-
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        // Delegate to primary (replica follows).
-        self.primary.get_replication_certs(cluster_name).await
-    }
-}
-
-/// Blanket impl: Failover Docker if T provides Docker.
-#[async_trait]
-impl<T: Docker + Send + Sync + Clone> Docker for FailoverTopology<T> {
-    async fn deploy_docker(&self) -> Result<String, String> {
-        // Orchestrate across primary + replica.
-        let primary_result = self.primary.deploy_docker().await?;
-        let replica_result = self.replica.deploy_docker().await?;
-        Ok(format!("Failover Docker deployed: {} | {}", primary_result, replica_result))
-    }
-}
-
-#[tokio::main]
-async fn main() {
-    let config = PostgreSQLConfig;
-
-    println!("=== ✅ PostgreSQL Failover (K8sAnywhere supports PG) ===");
-    let pg_failover = FailoverTopology {
-        primary: K8sAnywhereTopology,
-        replica: K8sAnywhereTopology,
-    };
-    let result = pg_failover.deploy(&config).await.unwrap();
-    println!("Result: {}", result);
-
-    println!("\n=== ✅ Docker Failover (LinuxHost supports Docker) ===");
-    let docker_failover = FailoverTopology {
-        primary: LinuxHostTopology,
-        replica: LinuxHostTopology,
-    };
-    let result = docker_failover.deploy_docker().await.unwrap();
-    println!("Result: {}", result);
-
-    println!("\n=== ❌ Would fail to compile (K8sAnywhere !: Docker) ===");
-    // let invalid = FailoverTopology {
-    //     primary: K8sAnywhereTopology,
-    //     replica: K8sAnywhereTopology,
-    // };
-    // invalid.deploy_docker().await.unwrap(); // Error: `K8sAnywhereTopology: Docker` not satisfied!
-    // Very clear error message :
-    // error[E0599]: the method `deploy_docker` exists for struct `FailoverTopology<K8sAnywhereTopology>`, but its trait bounds were not satisfied
-    //   --> src/main.rs:90:9
-    //    |
-    //  4 | pub struct FailoverTopology<T> {
-    //    | ------------------------------ method `deploy_docker` not found for this struct because it doesn't satisfy `FailoverTopology<K8sAnywhereTopology>: Docker`
-    // ...
-    // 37 | struct K8sAnywhereTopology;
-    //    | -------------------------- doesn't satisfy `K8sAnywhereTopology: Docker`
-    // ...
-    // 90 | invalid.deploy_docker(); // `T: Docker` bound unsatisfied
-    //    |         ^^^^^^^^^^^^^ method cannot be called on `FailoverTopology<K8sAnywhereTopology>` due to unsatisfied trait bounds
-    //    |
-    // note: trait bound `K8sAnywhereTopology: Docker` was not satisfied
-    //   --> src/main.rs:61:9
-    //    |
-    // 61 | impl<T: Docker + Send + Sync> Docker for FailoverTopology<T> {
-    //    |         ^^^^^^                ------     -------------------
-    //    |         |
-    //    |         unsatisfied trait bound introduced here
-    // note: the trait `Docker` must be implemented
-}
-

adr/016-Harmony-Agent-And-Global-Mesh-For-Decentralized-Workload-Management.md

@@ -1,90 +0,0 @@
-# Architecture Decision Record: Global Orchestration Mesh & The Harmony Agent
-
-**Status:** Proposed
-**Date:** 2025-12-19
-
-## Context
-
-Harmony is designed to enable a truly decentralized infrastructure where independent clusters—owned by different organizations or running on diverse hardware—can collaborate reliably. This vision combines the decentralization of Web3 with the performance and capabilities of Web2.
-
-Currently, Harmony operates as a stateless CLI tool, invoked manually or via CI runners. While effective for deployment, this model presents a critical limitation: **a CLI cannot react to real-time events.**
-
-To achieve automated failover and dynamic workload management, we need a system that is "always on." Relying on manual intervention or scheduled CI jobs to recover from a cluster failure creates unacceptable latency and prevents us from scaling to thousands of nodes.
-
-Furthermore, we face a challenge in serving diverse workloads:
-*   **Financial workloads** require absolute consistency (CP - Consistency/Partition Tolerance).
-*   **AI/Inference workloads** require maximum availability (AP - Availability/Partition Tolerance).
-
-There are many more use cases, but those are the two extremes.
-
-We need a unified architecture that automates cluster coordination and supports both consistency models without requiring a complete re-architecture in the future.
-
-## Decision
-
-We propose a fundamental architectural evolution. It has been clear since the start of Harmony that it would be necessary to transition Harmony from a purely ephemeral CLI tool to a system that includes a persistent **Harmony Agent**. This Agent will connect to a **Global Orchestration Mesh** based on a strongly consistent protocol.
-
-The proposal consists of four key pillars:
-
-### 1. The Harmony Agent (New Component)
-We will develop a long-running process (Daemon/Agent) to be deployed alongside workloads.
-*   **Shift from CLI:** Unlike the CLI, which applies configuration and exits, the Agent maintains a persistent connection to the mesh.
-*   **Responsibility:** It actively monitors cluster health, participates in consensus, and executes lifecycle commands (start/stop/fence) instantly when the mesh dictates a state change.
-
-### 2. The Technology: NATS JetStream
-We will utilize **NATS JetStream** as the underlying transport and consensus layer for the Agent and the Mesh.
-*   **Why not raw Raft?** Implementing a raw Raft library requires building and maintaining the transport layer, log compaction, snapshotting, and peer discovery manually. NATS JetStream provides a battle-tested, distributed log and Key-Value store (based on Raft) out of the box, along with a high-performance pub/sub system for event propagation.
-*   **Role:** It will act as the "source of truth" for the cluster state.
-
-### 3. Strong Consistency at the Mesh Layer
-The mesh will operate with **Strong Consistency** by default.
-*   All critical cluster state changes (topology updates, lease acquisitions, leadership elections) will require consensus among the Agents.
-*   This ensures that in the event of a network partition, we have a mathematical guarantee of which side holds the valid state, preventing data corruption.
-
-### 4. Public UX: The `FailoverStrategy` Abstraction
-To keep the user experience stable and simple, we will expose the complexity of the mesh through a high-level configuration API, tentatively called `FailoverStrategy`.
-
-The user defines the *intent* in their config, and the Harmony Agent automates the *execution*:
-
-*   **`FailoverStrategy::AbsoluteConsistency`**:
-    *   *Use Case:* Banking, Transactional DBs.
-    *   *Behavior:* If the mesh detects a partition, the Agent on the minority side immediately halts workloads. No split-brain is ever allowed.
-*   **`FailoverStrategy::SplitBrainAllowed`**:
-    *   *Use Case:* LLM Inference, Stateless Web Servers.
-    *   *Behavior:* If a partition occurs, the Agent keeps workloads running to maximize uptime. State is reconciled when connectivity returns.
-
-## Rationale
-
-**The Necessity of an Agent**
-You cannot automate what you do not monitor. Moving to an Agent-based model is the only way to achieve sub-second reaction times to infrastructure failures. It transforms Harmony from a deployment tool into a self-healing platform.
-
-**Scaling & Decentralization**
-To allow independent clusters to collaborate, they need a shared language. A strongly consistent mesh allows Cluster A (Organization X) and Cluster B (Organization Y) to agree on workload placement without a central authority.
-
-**Why Strong Consistency First?**
-It is technically feasible to relax a strongly consistent system to allow for "Split Brain" behavior (AP) when the user requests it. However, it is nearly impossible to take an eventually consistent system and force it to be strongly consistent (CP) later. By starting with strict constraints, we cover the hardest use cases (Finance) immediately.
-
-**Future Topologies**
-While our immediate need is `FailoverTopology` (Multi-site), this architecture supports any future topology logic:
-*   **`CostTopology`**: Agents negotiate to route workloads to the cluster with the cheapest spot instances.
-*   **`HorizontalTopology`**: Spreading a single workload across 100 clusters for massive scale.
-*   **`GeoTopology`**: Ensuring data stays within specific legal jurisdictions.
-
-The mesh provides the *capability* (consensus and messaging); the topology provides the *logic*.
-
-## Consequences
-
-**Positive**
-*   **Automation:** Eliminates manual failover, enabling massive scale.
-*   **Reliability:** Guarantees data safety for critical workloads by default.
-*   **Flexibility:** A single codebase serves both high-frequency trading and AI inference.
-*   **Stability:** The public API remains abstract, allowing us to optimize the mesh internals without breaking user code.
-
-**Negative**
-*   **Deployment Complexity:** Users must now deploy and maintain a running service (the Agent) rather than just downloading a binary.
-*   **Engineering Complexity:** Integrating NATS JetStream and handling distributed state machines is significantly more complex than the current CLI logic.
-
-## Implementation Plan (Short Term)
-1.  **Agent Bootstrap:** Create the initial scaffold for the Harmony Agent (daemon).
-2.  **Mesh Integration:** Prototype NATS JetStream embedding within the Agent.
-3.  **Strategy Implementation:** Add `FailoverStrategy` to the configuration schema and implement the logic in the Agent to read and act on it.
-4.  **Migration:** Transition the current manual failover scripts into event-driven logic handled by the Agent.

brocade/src/lib.rs

@@ -31,7 +31,6 @@ pub struct BrocadeOptions {
 pub struct TimeoutConfig {
     pub shell_ready: Duration,
     pub command_execution: Duration,
-    pub command_output: Duration,
     pub cleanup: Duration,
     pub message_wait: Duration,
 }
@@ -41,7 +40,6 @@ impl Default for TimeoutConfig {
         Self {
             shell_ready: Duration::from_secs(10),
             command_execution: Duration::from_secs(60), // Commands like `deploy` (for a LAG) can take a while
-            command_output: Duration::from_secs(5), // Delay to start logging "waiting for command output"
             cleanup: Duration::from_secs(10),
             message_wait: Duration::from_millis(500),
         }

brocade/src/network_operating_system.rs

@@ -3,7 +3,6 @@ use std::str::FromStr;
 use async_trait::async_trait;
 use harmony_types::switch::{PortDeclaration, PortLocation};
 use log::{debug, info};
-use regex::Regex;
 
 use crate::{
     BrocadeClient, BrocadeInfo, Error, ExecutionMode, InterSwitchLink, InterfaceInfo,
@@ -104,37 +103,13 @@ impl NetworkOperatingSystemClient {
         };
 
         Some(Ok(InterfaceInfo {
-            name: format!("{interface_type} {port_location}"),
+            name: format!("{} {}", interface_type, port_location),
             port_location,
             interface_type,
             operating_mode,
             status,
         }))
     }
-
-    fn map_configure_interfaces_error(&self, err: Error) -> Error {
-        debug!("[Brocade] {err}");
-
-        if let Error::CommandError(message) = &err {
-            if message.contains("switchport")
-                && message.contains("Cannot configure aggregator member")
-            {
-                let re = Regex::new(r"\(conf-if-([a-zA-Z]+)-([\d/]+)\)#").unwrap();
-
-                if let Some(caps) = re.captures(message) {
-                    let interface_type = &caps[1];
-                    let port_location = &caps[2];
-                    let interface = format!("{interface_type} {port_location}");
-
-                    return Error::CommandError(format!(
-                        "Cannot configure interface '{interface}', it is a member of a port-channel (LAG)"
-                    ));
-                }
-            }
-        }
-
-        err
-    }
 }
 
 #[async_trait]
@@ -222,10 +197,11 @@ impl BrocadeClient for NetworkOperatingSystemClient {
             commands.push("exit".into());
         }
 
+        commands.push("write memory".into());
+
         self.shell
             .run_commands(commands, ExecutionMode::Regular)
-            .await
-            .map_err(|err| self.map_configure_interfaces_error(err))?;
+            .await?;
 
         info!("[Brocade] Interfaces configured.");
 
@@ -237,7 +213,7 @@ impl BrocadeClient for NetworkOperatingSystemClient {
 
         let output = self
             .shell
-            .run_command("show port-channel summary", ExecutionMode::Regular)
+            .run_command("show port-channel", ExecutionMode::Regular)
             .await?;
 
         let used_ids: Vec<u8> = output
@@ -272,12 +248,7 @@ impl BrocadeClient for NetworkOperatingSystemClient {
         ports: &[PortLocation],
     ) -> Result<(), Error> {
         info!(
-            "[Brocade] Configuring port-channel '{channel_id} {channel_name}' with ports: {}",
-            ports
-                .iter()
-                .map(|p| format!("{p}"))
-                .collect::<Vec<String>>()
-                .join(", ")
+            "[Brocade] Configuring port-channel '{channel_name} {channel_id}' with ports: {ports:?}"
         );
 
         let interfaces = self.get_interfaces().await?;
@@ -305,6 +276,8 @@ impl BrocadeClient for NetworkOperatingSystemClient {
             commands.push("exit".into());
         }
 
+        commands.push("write memory".into());
+
         self.shell
             .run_commands(commands, ExecutionMode::Regular)
             .await?;
@@ -321,6 +294,7 @@ impl BrocadeClient for NetworkOperatingSystemClient {
             "configure terminal".into(),
             format!("no interface port-channel {}", channel_name),
             "exit".into(),
+            "write memory".into(),
         ];
 
         self.shell

brocade/src/shell.rs

@@ -211,7 +211,7 @@ impl BrocadeSession {
         let mut output = Vec::new();
         let start = Instant::now();
         let read_timeout = Duration::from_millis(500);
-        let log_interval = Duration::from_secs(5);
+        let log_interval = Duration::from_secs(3);
         let mut last_log = Instant::now();
 
         loop {
@@ -221,9 +221,7 @@ impl BrocadeSession {
                 ));
             }
 
-            if start.elapsed() > self.options.timeouts.command_output
-                && last_log.elapsed() > log_interval
-            {
+            if start.elapsed() > Duration::from_secs(5) && last_log.elapsed() > log_interval {
                 info!("[Brocade] Waiting for command output...");
                 last_log = Instant::now();
             }
@@ -278,7 +276,7 @@ impl BrocadeSession {
         let output_lower = output.to_lowercase();
         if ERROR_PATTERNS.iter().any(|&p| output_lower.contains(p)) {
             return Err(Error::CommandError(format!(
-                "Command error: {}",
+                "Command '{command}' failed: {}",
                 output.trim()
             )));
         }

examples/application_monitoring_with_tenant/src/main.rs

@@ -27,6 +27,7 @@ async fn main() {
     };
     let application = Arc::new(RustWebapp {
         name: "example-monitoring".to_string(),
+        dns: "example-monitoring.harmony.mcd".to_string(),
         project_root: PathBuf::from("./examples/rust/webapp"),
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/nanodc/src/main.rs

@@ -1,6 +1,6 @@
 use std::{
     net::{IpAddr, Ipv4Addr},
-    sync::{Arc, OnceLock},
+    sync::Arc,
 };
 
 use brocade::BrocadeOptions;
@@ -61,7 +61,6 @@ async fn main() {
     let gateway_ipv4 = Ipv4Addr::new(192, 168, 33, 1);
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     let topology = harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "ncd0.harmony.mcd".to_string(), // TODO this must be set manually correctly
         // when setting up the opnsense firewall
         router: Arc::new(UnmanagedRouter::new(
@@ -107,7 +106,6 @@ async fn main() {
             },
         ],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     };
 
     let inventory = Inventory {

examples/okd_installation/src/topology.rs

@@ -9,10 +9,7 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{
-    net::IpAddr,
-    sync::{Arc, OnceLock},
-};
+use std::{net::IpAddr, sync::Arc};
 
 #[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
 struct OPNSenseFirewallConfig {
@@ -62,7 +59,6 @@ pub async fn get_topology() -> HAClusterTopology {
     let gateway_ipv4 = ipv4!("192.168.1.1");
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "demo.harmony.mcd".to_string(),
         router: Arc::new(UnmanagedRouter::new(
             gateway_ip,
@@ -84,7 +80,6 @@ pub async fn get_topology() -> HAClusterTopology {
         },
         workers: vec![],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     }
 }
 

examples/okd_pxe/src/topology.rs

@@ -10,10 +10,7 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{
-    net::IpAddr,
-    sync::{Arc, OnceLock},
-};
+use std::{net::IpAddr, sync::Arc};
 
 pub async fn get_topology() -> HAClusterTopology {
     let firewall = harmony::topology::LogicalHost {
@@ -57,7 +54,6 @@ pub async fn get_topology() -> HAClusterTopology {
     let gateway_ipv4 = ipv4!("192.168.1.1");
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "demo.harmony.mcd".to_string(),
         router: Arc::new(UnmanagedRouter::new(
             gateway_ip,
@@ -79,7 +75,6 @@ pub async fn get_topology() -> HAClusterTopology {
         },
         workers: vec![],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     }
 }
 

examples/opnsense/src/main.rs

@@ -1,6 +1,6 @@
 use std::{
     net::{IpAddr, Ipv4Addr},
-    sync::{Arc, OnceLock},
+    sync::Arc,
 };
 
 use brocade::BrocadeOptions;
@@ -57,7 +57,6 @@ async fn main() {
     let gateway_ipv4 = Ipv4Addr::new(10, 100, 8, 1);
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     let topology = harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "demo.harmony.mcd".to_string(),
         router: Arc::new(UnmanagedRouter::new(
             gateway_ip,
@@ -79,7 +78,6 @@ async fn main() {
         },
         workers: vec![],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     };
 
     let inventory = Inventory {

examples/rhob_application_monitoring/src/main.rs

@@ -16,6 +16,7 @@ use harmony_types::net::Url;
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "test-rhob-monitoring".to_string(),
+        dns: "test-rhob-monitoring.harmony.mcd".to_string(),
         project_root: PathBuf::from("./webapp"), // Relative from 'harmony-path' param
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/rust/src/main.rs

@@ -19,6 +19,7 @@ use harmony_macros::hurl;
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "harmony-example-rust-webapp".to_string(),
+        dns: "harmony-example-rust-webapp.harmony.mcd".to_string(),
         project_root: PathBuf::from("./webapp"),
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/try_rust_webapp/files_to_add/main.rs

@@ -2,12 +2,11 @@ use harmony::{
     inventory::Inventory,
     modules::{
         application::{
-            ApplicationScore, RustWebFramework, RustWebapp,
-            features::{PackagingDeployment, rhob_monitoring::Monitoring},
+            features::{rhob_monitoring::Monitoring, PackagingDeployment}, ApplicationScore, RustWebFramework, RustWebapp
         },
         monitoring::alert_channel::discord_alert_channel::DiscordWebhook,
     },
-    topology::K8sAnywhereTopology,
+    topology::{K8sAnywhereTopology, LocalhostTopology},
 };
 use harmony_macros::hurl;
 use std::{path::PathBuf, sync::Arc};
@@ -22,8 +21,8 @@ async fn main() {
     });
 
     let discord_webhook = DiscordWebhook {
-        name: "harmony_demo".to_string(),
-        url: hurl!("http://not_a_url.com"),
+        name: "harmony-demo".to_string(),
+        url: hurl!("https://discord.com/api/webhooks/1415391405681021050/V6KzV41vQ7yvbn7BchejRu9C8OANxy0i2ESZOz2nvCxG8xAY3-2i3s5MS38k568JKTzH"),
     };
 
     let app = ApplicationScore {

examples/try_rust_webapp/src/main.rs

@@ -3,7 +3,7 @@ use harmony::{
     modules::{
         application::{
             ApplicationScore, RustWebFramework, RustWebapp,
-            features::{Monitoring, PackagingDeployment},
+            features::{PackagingDeployment, rhob_monitoring::Monitoring},
         },
         monitoring::alert_channel::discord_alert_channel::DiscordWebhook,
     },
@@ -16,6 +16,7 @@ use std::{path::PathBuf, sync::Arc};
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "harmony-example-tryrust".to_string(),
+        dns: "tryrust.example.harmony.mcd".to_string(),
         project_root: PathBuf::from("./tryrust.org"), // <== Project root, in this case it is a
         // submodule
         framework: Some(RustWebFramework::Leptos),

harmony/src/domain/inventory/mod.rs

@@ -1,6 +1,4 @@
 mod repository;
-use std::fmt;
-
 pub use repository::*;
 
 #[derive(Debug, new, Clone)]
@@ -71,14 +69,5 @@ pub enum HostRole {
     Bootstrap,
     ControlPlane,
     Worker,
-}
-
-impl fmt::Display for HostRole {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match self {
-            HostRole::Bootstrap => write!(f, "Bootstrap"),
-            HostRole::ControlPlane => write!(f, "ControlPlane"),
-            HostRole::Worker => write!(f, "Worker"),
-        }
-    }
+    Storage,
 }

harmony/src/domain/topology/ha_cluster.rs

@@ -1,25 +1,32 @@
 use async_trait::async_trait;
 use harmony_macros::ip;
 use harmony_types::{
-    id::Id,
     net::{MacAddress, Url},
     switch::PortLocation,
 };
+use k8s_openapi::api::core::v1::Namespace;
+use kube::api::ObjectMeta;
 use log::debug;
 use log::info;
 
-use crate::infra::network_manager::OpenShiftNmStateNetworkManager;
+use crate::data::FileContent;
+use crate::executors::ExecutorError;
+use crate::hardware::PhysicalHost;
+use crate::modules::okd::crd::{
+    InstallPlanApproval, OperatorGroup, OperatorGroupSpec, Subscription, SubscriptionSpec,
+    nmstate::{self, NMState, NodeNetworkConfigurationPolicy, NodeNetworkConfigurationPolicySpec},
+};
 use crate::topology::PxeOptions;
-use crate::{data::FileContent, executors::ExecutorError};
 
 use super::{
     DHCPStaticEntry, DhcpServer, DnsRecord, DnsRecordType, DnsServer, Firewall, HostNetworkConfig,
-    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost, NetworkError,
-    NetworkManager, PreparationError, PreparationOutcome, Router, Switch, SwitchClient,
-    SwitchError, TftpServer, Topology, k8s::K8sClient,
+    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost,
+    PreparationError, PreparationOutcome, Router, Switch, SwitchClient, SwitchError, TftpServer,
+    Topology, k8s::K8sClient,
 };
 
-use std::sync::{Arc, OnceLock};
+use std::collections::BTreeMap;
+use std::sync::Arc;
 
 #[derive(Debug, Clone)]
 pub struct HAClusterTopology {
@@ -35,8 +42,6 @@ pub struct HAClusterTopology {
     pub bootstrap_host: LogicalHost,
     pub control_plane: Vec<LogicalHost>,
     pub workers: Vec<LogicalHost>,
-    pub kubeconfig: Option<String>,
-    pub network_manager: OnceLock<Arc<dyn NetworkManager>>,
 }
 
 #[async_trait]
@@ -55,17 +60,9 @@ impl Topology for HAClusterTopology {
 #[async_trait]
 impl K8sclient for HAClusterTopology {
     async fn k8s_client(&self) -> Result<Arc<K8sClient>, String> {
-        match &self.kubeconfig {
-            None => Ok(Arc::new(
-                K8sClient::try_default().await.map_err(|e| e.to_string())?,
-            )),
-            Some(kubeconfig) => {
-                let Some(client) = K8sClient::from_kubeconfig(kubeconfig).await else {
-                    return Err("Failed to create k8s client".to_string());
-                };
-                Ok(Arc::new(client))
-            }
-        }
+        Ok(Arc::new(
+            K8sClient::try_default().await.map_err(|e| e.to_string())?,
+        ))
     }
 }
 
@@ -90,12 +87,208 @@ impl HAClusterTopology {
             .to_string()
     }
 
-    pub async fn network_manager(&self) -> &dyn NetworkManager {
-        let k8s_client = self.k8s_client().await.unwrap();
+    async fn ensure_nmstate_operator_installed(&self) -> Result<(), String> {
+        // FIXME: Find a way to check nmstate is already available (get pod -n openshift-nmstate)
+        debug!("Installing NMState operator...");
+        let k8s_client = self.k8s_client().await?;
 
-        self.network_manager
-            .get_or_init(|| Arc::new(OpenShiftNmStateNetworkManager::new(k8s_client.clone())))
-            .as_ref()
+        let nmstate_namespace = Namespace {
+            metadata: ObjectMeta {
+                name: Some("openshift-nmstate".to_string()),
+                finalizers: Some(vec!["kubernetes".to_string()]),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+        debug!("Creating NMState namespace: {nmstate_namespace:#?}");
+        k8s_client
+            .apply(&nmstate_namespace, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        let nmstate_operator_group = OperatorGroup {
+            metadata: ObjectMeta {
+                name: Some("openshift-nmstate".to_string()),
+                namespace: Some("openshift-nmstate".to_string()),
+                ..Default::default()
+            },
+            spec: OperatorGroupSpec {
+                target_namespaces: vec!["openshift-nmstate".to_string()],
+            },
+        };
+        debug!("Creating NMState operator group: {nmstate_operator_group:#?}");
+        k8s_client
+            .apply(&nmstate_operator_group, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        let nmstate_subscription = Subscription {
+            metadata: ObjectMeta {
+                name: Some("kubernetes-nmstate-operator".to_string()),
+                namespace: Some("openshift-nmstate".to_string()),
+                ..Default::default()
+            },
+            spec: SubscriptionSpec {
+                channel: Some("stable".to_string()),
+                install_plan_approval: Some(InstallPlanApproval::Automatic),
+                name: "kubernetes-nmstate-operator".to_string(),
+                source: "redhat-operators".to_string(),
+                source_namespace: "openshift-marketplace".to_string(),
+            },
+        };
+        debug!("Subscribing to NMState Operator: {nmstate_subscription:#?}");
+        k8s_client
+            .apply(&nmstate_subscription, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        let nmstate = NMState {
+            metadata: ObjectMeta {
+                name: Some("nmstate".to_string()),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+        debug!("Creating NMState: {nmstate:#?}");
+        k8s_client
+            .apply(&nmstate, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        Ok(())
+    }
+
+    fn get_next_bond_id(&self) -> u8 {
+        42 // FIXME: Find a better way to declare the bond id
+    }
+
+    async fn configure_bond(
+        &self,
+        host: &PhysicalHost,
+        config: &HostNetworkConfig,
+    ) -> Result<(), SwitchError> {
+        self.ensure_nmstate_operator_installed()
+            .await
+            .map_err(|e| {
+                SwitchError::new(format!(
+                    "Can't configure bond, NMState operator not available: {e}"
+                ))
+            })?;
+
+        let bond_config = self.create_bond_configuration(host, config);
+        debug!("Configuring bond for host {host:?}: {bond_config:#?}");
+        self.k8s_client()
+            .await
+            .unwrap()
+            .apply(&bond_config, None)
+            .await
+            .unwrap();
+
+        todo!()
+    }
+
+    fn create_bond_configuration(
+        &self,
+        host: &PhysicalHost,
+        config: &HostNetworkConfig,
+    ) -> NodeNetworkConfigurationPolicy {
+        let host_name = host.id.clone();
+
+        let bond_id = self.get_next_bond_id();
+        let bond_name = format!("bond{bond_id}");
+        let mut bond_mtu: Option<u32> = None;
+        let mut bond_mac_address: Option<String> = None;
+        let mut bond_ports = Vec::new();
+        let mut interfaces: Vec<nmstate::InterfaceSpec> = Vec::new();
+
+        for switch_port in &config.switch_ports {
+            let interface_name = switch_port.interface.name.clone();
+
+            interfaces.push(nmstate::InterfaceSpec {
+                name: interface_name.clone(),
+                description: Some(format!("Member of bond {bond_name}")),
+                r#type: "ethernet".to_string(),
+                state: "up".to_string(),
+                mtu: Some(switch_port.interface.mtu),
+                mac_address: Some(switch_port.interface.mac_address.to_string()),
+                ipv4: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                ipv6: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                link_aggregation: None,
+                ..Default::default()
+            });
+
+            bond_ports.push(interface_name);
+
+            // Use the first port's details for the bond mtu and mac address
+            if bond_mtu.is_none() {
+                bond_mtu = Some(switch_port.interface.mtu);
+            }
+            if bond_mac_address.is_none() {
+                bond_mac_address = Some(switch_port.interface.mac_address.to_string());
+            }
+        }
+
+        interfaces.push(nmstate::InterfaceSpec {
+            name: bond_name.clone(),
+            description: Some(format!("Network bond for host {host_name}")),
+            r#type: "bond".to_string(),
+            state: "up".to_string(),
+            mtu: bond_mtu,
+            mac_address: bond_mac_address,
+            ipv4: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            ipv6: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                autoconf: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            link_aggregation: Some(nmstate::BondSpec {
+                mode: "802.3ad".to_string(),
+                ports: bond_ports,
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+
+        NodeNetworkConfigurationPolicy {
+            metadata: ObjectMeta {
+                name: Some(format!("{host_name}-bond-config")),
+                ..Default::default()
+            },
+            spec: NodeNetworkConfigurationPolicySpec {
+                node_selector: Some(BTreeMap::from([(
+                    "kubernetes.io/hostname".to_string(),
+                    host_name.to_string(),
+                )])),
+                desired_state: nmstate::DesiredStateSpec { interfaces },
+            },
+        }
+    }
+
+    async fn configure_port_channel(
+        &self,
+        host: &PhysicalHost,
+        config: &HostNetworkConfig,
+    ) -> Result<(), SwitchError> {
+        debug!("Configuring port channel: {config:#?}");
+        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
+
+        self.switch_client
+            .configure_port_channel(&format!("Harmony_{}", host.id), switch_ports)
+            .await
+            .map_err(|e| SwitchError::new(format!("Failed to configure switch: {e}")))?;
+
+        Ok(())
     }
 
     pub fn autoload() -> Self {
@@ -106,7 +299,6 @@ impl HAClusterTopology {
         };
 
         Self {
-            kubeconfig: None,
             domain_name: "DummyTopology".to_string(),
             router: dummy_infra.clone(),
             load_balancer: dummy_infra.clone(),
@@ -119,7 +311,6 @@ impl HAClusterTopology {
             bootstrap_host: dummy_host,
             control_plane: vec![],
             workers: vec![],
-            network_manager: OnceLock::new(),
         }
     }
 }
@@ -277,40 +468,25 @@ impl HttpServer for HAClusterTopology {
 #[async_trait]
 impl Switch for HAClusterTopology {
     async fn setup_switch(&self) -> Result<(), SwitchError> {
-        self.switch_client.setup().await.map(|_| ())
+        self.switch_client.setup().await?;
+        Ok(())
     }
 
     async fn get_port_for_mac_address(
         &self,
         mac_address: &MacAddress,
     ) -> Result<Option<PortLocation>, SwitchError> {
-        self.switch_client.find_port(mac_address).await
+        let port = self.switch_client.find_port(mac_address).await?;
+        Ok(port)
     }
 
-    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
-        debug!("Configuring port channel: {config:#?}");
-        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
-
-        self.switch_client
-            .configure_port_channel(&format!("Harmony_{}", config.host_id), switch_ports)
-            .await
-            .map_err(|e| SwitchError::new(format!("Failed to configure port-channel: {e}")))?;
-
-        Ok(())
-    }
-}
-
-#[async_trait]
-impl NetworkManager for HAClusterTopology {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-        self.network_manager()
-            .await
-            .ensure_network_manager_installed()
-            .await
-    }
-
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-        self.network_manager().await.configure_bond(config).await
+    async fn configure_host_network(
+        &self,
+        host: &PhysicalHost,
+        config: HostNetworkConfig,
+    ) -> Result<(), SwitchError> {
+        self.configure_bond(host, &config).await?;
+        self.configure_port_channel(host, &config).await
     }
 }
 

harmony/src/domain/topology/k8s.rs

@@ -1,22 +1,17 @@
-use std::time::Duration;
+use std::{collections::HashMap, time::Duration};
 
 use derive_new::new;
 use k8s_openapi::{
     ClusterResourceScope, NamespaceResourceScope,
-    api::{
-        apps::v1::Deployment,
-        core::v1::{Node, Pod, ServiceAccount},
-    },
+    api::{apps::v1::Deployment, core::v1::Pod},
+    apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition,
     apimachinery::pkg::version::Info,
 };
 use kube::{
     Client, Config, Discovery, Error, Resource,
-    api::{
-        Api, AttachParams, DeleteParams, ListParams, ObjectList, Patch, PatchParams, ResourceExt,
-    },
+    api::{Api, AttachParams, DeleteParams, ListParams, Patch, PatchParams, ResourceExt},
     config::{KubeConfigOptions, Kubeconfig},
     core::ErrorResponse,
-    discovery::{ApiCapabilities, Scope},
     error::DiscoveryError,
     runtime::reflector::Lookup,
 };
@@ -25,12 +20,11 @@ use kube::{
     api::{ApiResource, GroupVersionKind},
     runtime::wait::await_condition,
 };
-use log::{debug, error, trace, warn};
+use log::{debug, error, info, trace};
 use serde::{Serialize, de::DeserializeOwned};
-use serde_json::json;
+use serde_json::{json, Value};
 use similar::TextDiff;
 use tokio::{io::AsyncReadExt, time::sleep};
-use url::Url;
 
 #[derive(new, Clone)]
 pub struct K8sClient {
@@ -64,9 +58,146 @@ impl K8sClient {
         })
     }
 
-    pub async fn service_account_api(&self, namespace: &str) -> Api<ServiceAccount> {
-        let api: Api<ServiceAccount> = Api::namespaced(self.client.clone(), namespace);
-        api
+     // Returns true if any deployment in the given namespace matching the label selector
+    // has status.availableReplicas > 0 (or condition Available=True).
+    pub async fn has_healthy_deployment_with_label(
+        &self,
+        namespace: &str,
+        label_selector: &str,
+    ) -> Result<bool, Error> {
+        let api: Api<Deployment> = Api::namespaced(self.client.clone(), namespace);
+        let lp = ListParams::default().labels(label_selector);
+        let list = api.list(&lp).await?;
+        for d in list.items {
+            // Check AvailableReplicas > 0 or Available condition
+            let available = d
+                .status
+                .as_ref()
+                .and_then(|s| s.available_replicas)
+                .unwrap_or(0);
+            if available > 0 {
+                return Ok(true);
+            }
+            // Fallback: scan conditions
+            if let Some(conds) = d.status.as_ref().and_then(|s| s.conditions.as_ref()) {
+                if conds.iter().any(|c| {
+                    c.type_ == "Available"
+                        && c.status == "True"
+                }) {
+                    return Ok(true);
+                }
+            }
+        }
+        Ok(false)
+    }
+
+    // Cluster-wide: returns namespaces that have at least one healthy deployment
+    // matching the label selector (equivalent to kubectl -A -l ...).
+    pub async fn list_namespaces_with_healthy_deployments(
+        &self,
+        label_selector: &str,
+    ) -> Result<Vec<String>, Error> {
+        let api: Api<Deployment> = Api::all(self.client.clone());
+        let lp = ListParams::default().labels(label_selector);
+        let list = api.list(&lp).await?;
+
+        let mut healthy_ns: HashMap<String, bool> = HashMap::new();
+        for d in list.items {
+            let ns = match d.metadata.namespace.clone() {
+                Some(n) => n,
+                None => continue,
+            };
+            let available = d
+                .status
+                .as_ref()
+                .and_then(|s| s.available_replicas)
+                .unwrap_or(0);
+            let is_healthy = if available > 0 {
+                true
+            } else {
+                d.status
+                    .as_ref()
+                    .and_then(|s| s.conditions.as_ref())
+                    .map(|conds| {
+                        conds.iter().any(|c| {
+                            c.type_ == "Available"
+                                && c.status == "True"
+                        })
+                    })
+                    .unwrap_or(false)
+            };
+            if is_healthy {
+                healthy_ns.insert(ns, true);
+            }
+        }
+
+        Ok(healthy_ns.into_keys().collect())
+    }
+
+    // Get the application-controller ServiceAccount name (fallback to default)
+    pub async fn get_argocd_controller_sa_name(&self, ns: &str) -> Result<String, Error> {
+        let api: Api<Deployment> = Api::namespaced(self.client.clone(), ns);
+        let lp = ListParams::default().labels("app.kubernetes.io/component=controller");
+        let list = api.list(&lp).await?;
+        if let Some(dep) = list.items.get(0) {
+            if let Some(sa) = dep
+                .spec
+                .as_ref()
+                .and_then(|ds| ds.template.spec.as_ref())
+                .and_then(|ps| ps.service_account_name.clone())
+            {
+                return Ok(sa);
+            }
+        }
+        Ok("argocd-application-controller".to_string())
+    }
+
+    // List ClusterRoleBindings dynamically and return as JSON values
+    pub async fn list_clusterrolebindings_json(&self) -> Result<Vec<Value>, Error> {
+        let gvk = kube::api::GroupVersionKind::gvk(
+            "rbac.authorization.k8s.io",
+            "v1",
+            "ClusterRoleBinding",
+        );
+        let ar = kube::api::ApiResource::from_gvk(&gvk);
+        let api: Api<kube::api::DynamicObject> = Api::all_with(self.client.clone(), &ar);
+        let crbs = api.list(&ListParams::default()).await?;
+        let mut out = Vec::new();
+        for o in crbs {
+            let v = serde_json::to_value(&o).unwrap_or(Value::Null);
+            out.push(v);
+        }
+        Ok(out)
+    }
+
+    // Determine if Argo controller in ns has cluster-wide permissions via CRBs
+    // TODO This does not belong in the generic k8s client, should be refactored at some point
+    pub async fn is_argocd_cluster_wide(&self, ns: &str) -> Result<bool, Error> {
+        let sa = self.get_argocd_controller_sa_name(ns).await?;
+        let crbs = self.list_clusterrolebindings_json().await?;
+        let sa_user = format!("system:serviceaccount:{}:{}", ns, sa);
+        for crb in crbs {
+            if let Some(subjects) = crb.get("subjects").and_then(|s| s.as_array()) {
+                for subj in subjects {
+                    let kind = subj.get("kind").and_then(|v| v.as_str()).unwrap_or("");
+                    let name = subj.get("name").and_then(|v| v.as_str()).unwrap_or("");
+                    let subj_ns = subj.get("namespace").and_then(|v| v.as_str()).unwrap_or("");
+                    if (kind == "ServiceAccount" && name == sa && subj_ns == ns)
+                        || (kind == "User" && name == sa_user)
+                    {
+                        return Ok(true);
+                    }
+                }
+            }
+        }
+        Ok(false)
+    }
+
+    pub async fn has_crd(&self, name: &str) -> Result<bool, Error> {
+        let api: Api<CustomResourceDefinition> = Api::all(self.client.clone());
+        let lp = ListParams::default().fields(&format!("metadata.name={}", name));
+        let crds = api.list(&lp).await?;
+        Ok(!crds.items.is_empty())
     }
 
     pub async fn get_apiserver_version(&self) -> Result<Info, Error> {
@@ -92,8 +223,7 @@ impl K8sClient {
         } else {
             Api::default_namespaced_with(self.client.clone(), &gvk)
         };
-
-        resource.get(name).await
+        Ok(resource.get(name).await?)
     }
 
     pub async fn get_deployment(
@@ -108,9 +238,8 @@ impl K8sClient {
             debug!("getting default namespace deployment");
             Api::default_namespaced(self.client.clone())
         };
-
         debug!("getting deployment {} in ns {}", name, namespace.unwrap());
-        deps.get_opt(name).await
+        Ok(deps.get_opt(name).await?)
     }
 
     pub async fn get_pod(&self, name: &str, namespace: Option<&str>) -> Result<Option<Pod>, Error> {
@@ -119,8 +248,7 @@ impl K8sClient {
         } else {
             Api::default_namespaced(self.client.clone())
         };
-
-        pods.get_opt(name).await
+        Ok(pods.get_opt(name).await?)
     }
 
     pub async fn scale_deployment(
@@ -163,9 +291,9 @@ impl K8sClient {
 
     pub async fn wait_until_deployment_ready(
         &self,
-        name: &str,
+        name: String,
         namespace: Option<&str>,
-        timeout: Option<Duration>,
+        timeout: Option<u64>,
     ) -> Result<(), String> {
         let api: Api<Deployment>;
 
@@ -175,9 +303,9 @@ impl K8sClient {
             api = Api::default_namespaced(self.client.clone());
         }
 
-        let establish = await_condition(api, name, conditions::is_deployment_completed());
-        let timeout = timeout.unwrap_or(Duration::from_secs(120));
-        let res = tokio::time::timeout(timeout, establish).await;
+        let establish = await_condition(api, name.as_str(), conditions::is_deployment_completed());
+        let t = timeout.unwrap_or(300);
+        let res = tokio::time::timeout(std::time::Duration::from_secs(t), establish).await;
 
         if res.is_ok() {
             Ok(())
@@ -267,7 +395,7 @@ impl K8sClient {
 
                 if let Some(s) = status.status {
                     let mut stdout_buf = String::new();
-                    if let Some(mut stdout) = process.stdout() {
+                    if let Some(mut stdout) = process.stdout().take() {
                         stdout
                             .read_to_string(&mut stdout_buf)
                             .await
@@ -373,14 +501,14 @@ impl K8sClient {
                 Ok(current) => {
                     trace!("Received current value {current:#?}");
                     // The resource exists, so we calculate and display a diff.
-                    println!("\nPerforming dry-run for resource: '{name}'");
+                    println!("\nPerforming dry-run for resource: '{}'", name);
                     let mut current_yaml = serde_yaml::to_value(&current).unwrap_or_else(|_| {
                         panic!("Could not serialize current value : {current:#?}")
                     });
                     if current_yaml.is_mapping() && current_yaml.get("status").is_some() {
                         let map = current_yaml.as_mapping_mut().unwrap();
                         let removed = map.remove_entry("status");
-                        trace!("Removed status {removed:?}");
+                        trace!("Removed status {:?}", removed);
                     } else {
                         trace!(
                             "Did not find status entry for current object {}/{}",
@@ -409,14 +537,14 @@ impl K8sClient {
                             similar::ChangeTag::Insert => "+",
                             similar::ChangeTag::Equal => " ",
                         };
-                        print!("{sign}{change}");
+                        print!("{}{}", sign, change);
                     }
                     // In a dry run, we return the new resource state that would have been applied.
                     Ok(resource.clone())
                 }
                 Err(Error::Api(ErrorResponse { code: 404, .. })) => {
                     // The resource does not exist, so the "diff" is the entire new resource.
-                    println!("\nPerforming dry-run for new resource: '{name}'");
+                    println!("\nPerforming dry-run for new resource: '{}'", name);
                     println!(
                         "Resource does not exist. It would be created with the following content:"
                     );
@@ -425,14 +553,14 @@ impl K8sClient {
 
                     // Print each line of the new resource with a '+' prefix.
                     for line in new_yaml.lines() {
-                        println!("+{line}");
+                        println!("+{}", line);
                     }
                     // In a dry run, we return the new resource state that would have been created.
                     Ok(resource.clone())
                 }
                 Err(e) => {
                     // Another API error occurred.
-                    error!("Failed to get resource '{name}': {e}");
+                    error!("Failed to get resource '{}': {}", name, e);
                     Err(e)
                 }
             }
@@ -447,7 +575,7 @@ impl K8sClient {
     where
         K: Resource + Clone + std::fmt::Debug + DeserializeOwned + serde::Serialize,
         <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as Resource>::DynamicType: Default,
+        <K as kube::Resource>::DynamicType: Default,
     {
         let mut result = Vec::new();
         for r in resource.iter() {
@@ -512,7 +640,10 @@ impl K8sClient {
 
         // 6. Apply the object to the cluster using Server-Side Apply.
         //    This will create the resource if it doesn't exist, or update it if it does.
-        println!("Applying '{name}' in namespace '{namespace}'...",);
+        println!(
+            "Applying Argo Application '{}' in namespace '{}'...",
+            name, namespace
+        );
         let patch_params = PatchParams::apply("harmony"); // Use a unique field manager name
         let result = api.patch(name, &patch_params, &Patch::Apply(&obj)).await?;
 
@@ -521,103 +652,7 @@ impl K8sClient {
         Ok(())
     }
 
-    /// Apply a resource from a URL
-    ///
-    /// It is the equivalent of `kubectl apply -f <url>`
-    pub async fn apply_url(&self, url: Url, ns: Option<&str>) -> Result<(), Error> {
-        let patch_params = PatchParams::apply("harmony");
-        let discovery = kube::Discovery::new(self.client.clone()).run().await?;
-
-        let yaml = reqwest::get(url)
-            .await
-            .expect("Could not get URL")
-            .text()
-            .await
-            .expect("Could not get content from URL");
-
-        for doc in multidoc_deserialize(&yaml).expect("failed to parse YAML from file") {
-            let obj: DynamicObject =
-                serde_yaml::from_value(doc).expect("cannot apply without valid YAML");
-            let namespace = obj.metadata.namespace.as_deref().or(ns);
-            let type_meta = obj
-                .types
-                .as_ref()
-                .expect("cannot apply object without valid TypeMeta");
-            let gvk = GroupVersionKind::try_from(type_meta)
-                .expect("cannot apply object without valid GroupVersionKind");
-            let name = obj.name_any();
-
-            if let Some((ar, caps)) = discovery.resolve_gvk(&gvk) {
-                let api = get_dynamic_api(ar, caps, self.client.clone(), namespace, false);
-                trace!(
-                    "Applying {}: \n{}",
-                    gvk.kind,
-                    serde_yaml::to_string(&obj).expect("Failed to serialize YAML")
-                );
-                let data: serde_json::Value =
-                    serde_json::to_value(&obj).expect("Failed to serialize JSON");
-                let _r = api.patch(&name, &patch_params, &Patch::Apply(data)).await?;
-                debug!("applied {} {}", gvk.kind, name);
-            } else {
-                warn!("Cannot apply document for unknown {gvk:?}");
-            }
-        }
-
-        Ok(())
-    }
-
-    /// Gets a single named resource of a specific type `K`.
-    ///
-    /// This function uses the `ApplyStrategy` trait to correctly determine
-    /// whether to look in a specific namespace or in the entire cluster.
-    ///
-    /// Returns `Ok(None)` if the resource is not found (404).
-    pub async fn get_resource<K>(
-        &self,
-        name: &str,
-        namespace: Option<&str>,
-    ) -> Result<Option<K>, Error>
-    where
-        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
-        <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as kube::Resource>::DynamicType: Default,
-    {
-        let api: Api<K> =
-            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
-
-        api.get_opt(name).await
-    }
-
-    /// Lists all resources of a specific type `K`.
-    ///
-    /// This function uses the `ApplyStrategy` trait to correctly determine
-    /// whether to list from a specific namespace or from the entire cluster.
-    pub async fn list_resources<K>(
-        &self,
-        namespace: Option<&str>,
-        list_params: Option<ListParams>,
-    ) -> Result<ObjectList<K>, Error>
-    where
-        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
-        <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as kube::Resource>::DynamicType: Default,
-    {
-        let api: Api<K> =
-            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
-
-        let list_params = list_params.unwrap_or_default();
-        api.list(&list_params).await
-    }
-
-    /// Fetches a list of all Nodes in the cluster.
-    pub async fn get_nodes(
-        &self,
-        list_params: Option<ListParams>,
-    ) -> Result<ObjectList<Node>, Error> {
-        self.list_resources(None, list_params).await
-    }
-
-    pub async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
+    pub(crate) async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
         let k = match Kubeconfig::read_from(path) {
             Ok(k) => k,
             Err(e) => {
@@ -636,31 +671,6 @@ impl K8sClient {
     }
 }
 
-fn get_dynamic_api(
-    resource: ApiResource,
-    capabilities: ApiCapabilities,
-    client: Client,
-    ns: Option<&str>,
-    all: bool,
-) -> Api<DynamicObject> {
-    if capabilities.scope == Scope::Cluster || all {
-        Api::all_with(client, &resource)
-    } else if let Some(namespace) = ns {
-        Api::namespaced_with(client, namespace, &resource)
-    } else {
-        Api::default_namespaced_with(client, &resource)
-    }
-}
-
-fn multidoc_deserialize(data: &str) -> Result<Vec<serde_yaml::Value>, serde_yaml::Error> {
-    use serde::Deserialize;
-    let mut docs = vec![];
-    for de in serde_yaml::Deserializer::from_str(data) {
-        docs.push(serde_yaml::Value::deserialize(de)?);
-    }
-    Ok(docs)
-}
-
 pub trait ApplyStrategy<K: Resource> {
     fn get_api(client: &Client, ns: Option<&str>) -> Api<K>;
 }

harmony/src/domain/topology/k8s_anywhere.rs

@@ -1,13 +1,8 @@
-use std::{collections::BTreeMap, process::Command, sync::Arc, time::Duration};
+use std::{process::Command, sync::Arc};
 
 use async_trait::async_trait;
-use base64::{Engine, engine::general_purpose};
-use k8s_openapi::api::{
-    core::v1::Secret,
-    rbac::v1::{ClusterRoleBinding, RoleRef, Subject},
-};
-use kube::api::{DynamicObject, GroupVersionKind, ObjectMeta};
-use log::{debug, info, warn};
+use kube::api::GroupVersionKind;
+use log::{debug, info, trace, warn};
 use serde::Serialize;
 use tokio::sync::OnceCell;
 
@@ -17,26 +12,14 @@ use crate::{
     inventory::Inventory,
     modules::{
         k3d::K3DInstallationScore,
-        k8s::ingress::{K8sIngressScore, PathType},
-        monitoring::{
-            grafana::{grafana::Grafana, helm::helm_grafana::grafana_helm_chart_score},
-            kube_prometheus::crd::{
-                crd_alertmanager_config::CRDPrometheus,
-                crd_grafana::{
-                    Grafana as GrafanaCRD, GrafanaCom, GrafanaDashboard,
-                    GrafanaDashboardDatasource, GrafanaDashboardSpec, GrafanaDatasource,
-                    GrafanaDatasourceConfig, GrafanaDatasourceJsonData,
-                    GrafanaDatasourceSecureJsonData, GrafanaDatasourceSpec, GrafanaSpec,
-                },
-                crd_prometheuses::LabelSelector,
-                prometheus_operator::prometheus_operator_helm_chart_score,
-                rhob_alertmanager_config::RHOBObservability,
-                service_monitor::ServiceMonitor,
-            },
+        monitoring::kube_prometheus::crd::{
+            crd_alertmanager_config::CRDPrometheus,
+            prometheus_operator::prometheus_operator_helm_chart_score,
+            rhob_alertmanager_config::RHOBObservability,
         },
         prometheus::{
             k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
-            prometheus::PrometheusMonitoring, rhob_alerting_score::RHOBAlertingScore,
+            prometheus::PrometheusApplicationMonitoring, rhob_alerting_score::RHOBAlertingScore,
         },
     },
     score::Score,
@@ -88,6 +71,7 @@ pub struct K8sAnywhereTopology {
 #[async_trait]
 impl K8sclient for K8sAnywhereTopology {
     async fn k8s_client(&self) -> Result<Arc<K8sClient>, String> {
+        trace!("getting k8s client");
         let state = match self.k8s_state.get() {
             Some(state) => state,
             None => return Err("K8s state not initialized yet".to_string()),
@@ -103,172 +87,41 @@ impl K8sclient for K8sAnywhereTopology {
 }
 
 #[async_trait]
-impl Grafana for K8sAnywhereTopology {
-    async fn ensure_grafana_operator(
-        &self,
-        inventory: &Inventory,
-    ) -> Result<PreparationOutcome, PreparationError> {
-        debug!("ensure grafana operator");
-        let client = self.k8s_client().await.unwrap();
-        let grafana_gvk = GroupVersionKind {
-            group: "grafana.integreatly.org".to_string(),
-            version: "v1beta1".to_string(),
-            kind: "Grafana".to_string(),
-        };
-        let name = "grafanas.grafana.integreatly.org";
-        let ns = "grafana";
-
-        let grafana_crd = client
-            .get_resource_json_value(name, Some(ns), &grafana_gvk)
-            .await;
-        match grafana_crd {
-            Ok(_) => {
-                return Ok(PreparationOutcome::Success {
-                    details: "Found grafana CRDs in cluster".to_string(),
-                });
-            }
-
-            Err(_) => {
-                return self
-                    .install_grafana_operator(inventory, Some("grafana"))
-                    .await;
-            }
-        };
-    }
-    async fn install_grafana(&self) -> Result<PreparationOutcome, PreparationError> {
-        let ns = "grafana";
-
-        let mut label = BTreeMap::new();
-
-        label.insert("dashboards".to_string(), "grafana".to_string());
-
-        let label_selector = LabelSelector {
-            match_labels: label.clone(),
-            match_expressions: vec![],
-        };
-
-        let client = self.k8s_client().await?;
-
-        let grafana = self.build_grafana(ns, &label);
-
-        client.apply(&grafana, Some(ns)).await?;
-        //TODO change this to a ensure ready or something better than just a timeout
-        client
-            .wait_until_deployment_ready(
-                "grafana-grafana-deployment",
-                Some("grafana"),
-                Some(Duration::from_secs(30)),
-            )
-            .await?;
-
-        let sa_name = "grafana-grafana-sa";
-        let token_secret_name = "grafana-sa-token-secret";
-
-        let sa_token_secret = self.build_sa_token_secret(token_secret_name, sa_name, ns);
-
-        client.apply(&sa_token_secret, Some(ns)).await?;
-        let secret_gvk = GroupVersionKind {
-            group: "".to_string(),
-            version: "v1".to_string(),
-            kind: "Secret".to_string(),
-        };
-
-        let secret = client
-            .get_resource_json_value(token_secret_name, Some(ns), &secret_gvk)
-            .await?;
-
-        let token = format!(
-            "Bearer {}",
-            self.extract_and_normalize_token(&secret).unwrap()
-        );
-
-        debug!("creating grafana clusterrole binding");
-
-        let clusterrolebinding =
-            self.build_cluster_rolebinding(sa_name, "cluster-monitoring-view", ns);
-
-        client.apply(&clusterrolebinding, Some(ns)).await?;
-
-        debug!("creating grafana datasource crd");
-
-        let thanos_url = format!(
-            "https://{}",
-            self.get_domain("thanos-querier-openshift-monitoring")
-                .await
-                .unwrap()
-        );
-
-        let thanos_openshift_datasource = self.build_grafana_datasource(
-            "thanos-openshift-monitoring",
-            ns,
-            &label_selector,
-            &thanos_url,
-            &token,
-        );
-
-        client.apply(&thanos_openshift_datasource, Some(ns)).await?;
-
-        debug!("creating grafana dashboard crd");
-        let dashboard = self.build_grafana_dashboard(ns, &label_selector);
-
-        client.apply(&dashboard, Some(ns)).await?;
-        debug!("creating grafana ingress");
-        let grafana_ingress = self.build_grafana_ingress(ns).await;
-
-        grafana_ingress
-            .interpret(&Inventory::empty(), self)
-            .await
-            .map_err(|e| PreparationError::new(e.to_string()))?;
-
-        Ok(PreparationOutcome::Success {
-            details: "Installed grafana composants".to_string(),
-        })
-    }
-}
-
-#[async_trait]
-impl PrometheusMonitoring<CRDPrometheus> for K8sAnywhereTopology {
+impl PrometheusApplicationMonitoring<CRDPrometheus> for K8sAnywhereTopology {
     async fn install_prometheus(
         &self,
         sender: &CRDPrometheus,
-        _inventory: &Inventory,
-        _receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
-    ) -> Result<PreparationOutcome, PreparationError> {
-        let client = self.k8s_client().await?;
-
-        for monitor in sender.service_monitor.iter() {
-            client
-                .apply(monitor, Some(&sender.namespace))
-                .await
-                .map_err(|e| PreparationError::new(e.to_string()))?;
-        }
-        Ok(PreparationOutcome::Success {
-            details: "successfuly installed prometheus components".to_string(),
-        })
-    }
-
-    async fn ensure_prometheus_operator(
-        &self,
-        sender: &CRDPrometheus,
-        _inventory: &Inventory,
+        inventory: &Inventory,
+        receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
     ) -> Result<PreparationOutcome, PreparationError> {
         let po_result = self.ensure_prometheus_operator(sender).await?;
 
-        match po_result {
-            PreparationOutcome::Success { details: _ } => {
-                debug!("Detected prometheus crds operator present in cluster.");
-                return Ok(po_result);
-            }
-            PreparationOutcome::Noop => {
-                debug!("Skipping Prometheus CR installation due to missing operator.");
-                return Ok(po_result);
-            }
+        if po_result == PreparationOutcome::Noop {
+            debug!("Skipping Prometheus CR installation due to missing operator.");
+            return Ok(po_result);
+        }
+
+        let result = self
+            .get_k8s_prometheus_application_score(sender.clone(), receivers)
+            .await
+            .interpret(inventory, self)
+            .await;
+
+        match result {
+            Ok(outcome) => match outcome.status {
+                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
+                    details: outcome.message,
+                }),
+                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
+                _ => Err(PreparationError::new(outcome.message)),
+            },
+            Err(err) => Err(PreparationError::new(err.to_string())),
         }
     }
 }
 
 #[async_trait]
-impl PrometheusMonitoring<RHOBObservability> for K8sAnywhereTopology {
+impl PrometheusApplicationMonitoring<RHOBObservability> for K8sAnywhereTopology {
     async fn install_prometheus(
         &self,
         sender: &RHOBObservability,
@@ -302,14 +155,6 @@ impl PrometheusMonitoring<RHOBObservability> for K8sAnywhereTopology {
             Err(err) => Err(PreparationError::new(err.to_string())),
         }
     }
-
-    async fn ensure_prometheus_operator(
-        &self,
-        sender: &RHOBObservability,
-        inventory: &Inventory,
-    ) -> Result<PreparationOutcome, PreparationError> {
-        todo!()
-    }
 }
 
 impl Serialize for K8sAnywhereTopology {
@@ -371,180 +216,6 @@ impl K8sAnywhereTopology {
             .await
     }
 
-    fn extract_and_normalize_token(&self, secret: &DynamicObject) -> Option<String> {
-        let token_b64 = secret
-            .data
-            .get("token")
-            .or_else(|| secret.data.get("data").and_then(|d| d.get("token")))
-            .and_then(|v| v.as_str())?;
-
-        let bytes = general_purpose::STANDARD.decode(token_b64).ok()?;
-
-        let s = String::from_utf8(bytes).ok()?;
-
-        let cleaned = s
-            .trim_matches(|c: char| c.is_whitespace() || c == '\0')
-            .to_string();
-        Some(cleaned)
-    }
-
-    pub fn build_cluster_rolebinding(
-        &self,
-        service_account_name: &str,
-        clusterrole_name: &str,
-        ns: &str,
-    ) -> ClusterRoleBinding {
-        ClusterRoleBinding {
-            metadata: ObjectMeta {
-                name: Some(format!("{}-view-binding", service_account_name)),
-                ..Default::default()
-            },
-            role_ref: RoleRef {
-                api_group: "rbac.authorization.k8s.io".into(),
-                kind: "ClusterRole".into(),
-                name: clusterrole_name.into(),
-            },
-            subjects: Some(vec![Subject {
-                kind: "ServiceAccount".into(),
-                name: service_account_name.into(),
-                namespace: Some(ns.into()),
-                ..Default::default()
-            }]),
-        }
-    }
-
-    pub fn build_sa_token_secret(
-        &self,
-        secret_name: &str,
-        service_account_name: &str,
-        ns: &str,
-    ) -> Secret {
-        let mut annotations = BTreeMap::new();
-        annotations.insert(
-            "kubernetes.io/service-account.name".to_string(),
-            service_account_name.to_string(),
-        );
-
-        Secret {
-            metadata: ObjectMeta {
-                name: Some(secret_name.into()),
-                namespace: Some(ns.into()),
-                annotations: Some(annotations),
-                ..Default::default()
-            },
-            type_: Some("kubernetes.io/service-account-token".to_string()),
-            ..Default::default()
-        }
-    }
-
-    fn build_grafana_datasource(
-        &self,
-        name: &str,
-        ns: &str,
-        label_selector: &LabelSelector,
-        url: &str,
-        token: &str,
-    ) -> GrafanaDatasource {
-        let mut json_data = BTreeMap::new();
-        json_data.insert("timeInterval".to_string(), "5s".to_string());
-
-        GrafanaDatasource {
-            metadata: ObjectMeta {
-                name: Some(name.to_string()),
-                namespace: Some(ns.to_string()),
-                ..Default::default()
-            },
-            spec: GrafanaDatasourceSpec {
-                instance_selector: label_selector.clone(),
-                allow_cross_namespace_import: Some(true),
-                values_from: None,
-                datasource: GrafanaDatasourceConfig {
-                    access: "proxy".to_string(),
-                    name: name.to_string(),
-                    r#type: "prometheus".to_string(),
-                    url: url.to_string(),
-                    database: None,
-                    json_data: Some(GrafanaDatasourceJsonData {
-                        time_interval: Some("60s".to_string()),
-                        http_header_name1: Some("Authorization".to_string()),
-                        tls_skip_verify: Some(true),
-                        oauth_pass_thru: Some(true),
-                    }),
-                    secure_json_data: Some(GrafanaDatasourceSecureJsonData {
-                        http_header_value1: Some(format!("Bearer {token}")),
-                    }),
-                    is_default: Some(false),
-                    editable: Some(true),
-                },
-            },
-        }
-    }
-
-    fn build_grafana_dashboard(
-        &self,
-        ns: &str,
-        label_selector: &LabelSelector,
-    ) -> GrafanaDashboard {
-        let graf_dashboard = GrafanaDashboard {
-            metadata: ObjectMeta {
-                name: Some(format!("grafana-dashboard-{}", ns)),
-                namespace: Some(ns.to_string()),
-                ..Default::default()
-            },
-            spec: GrafanaDashboardSpec {
-                resync_period: Some("30s".to_string()),
-                instance_selector: label_selector.clone(),
-                datasources: Some(vec![GrafanaDashboardDatasource {
-                    input_name: "DS_PROMETHEUS".to_string(),
-                    datasource_name: "thanos-openshift-monitoring".to_string(),
-                }]),
-                json: None,
-                grafana_com: Some(GrafanaCom {
-                    id: 17406,
-                    revision: None,
-                }),
-            },
-        };
-        graf_dashboard
-    }
-
-    fn build_grafana(&self, ns: &str, labels: &BTreeMap<String, String>) -> GrafanaCRD {
-        let grafana = GrafanaCRD {
-            metadata: ObjectMeta {
-                name: Some(format!("grafana-{}", ns)),
-                namespace: Some(ns.to_string()),
-                labels: Some(labels.clone()),
-                ..Default::default()
-            },
-            spec: GrafanaSpec {
-                config: None,
-                admin_user: None,
-                admin_password: None,
-                ingress: None,
-                persistence: None,
-                resources: None,
-            },
-        };
-        grafana
-    }
-
-    async fn build_grafana_ingress(&self, ns: &str) -> K8sIngressScore {
-        let domain = self.get_domain(&format!("grafana-{}", ns)).await.unwrap();
-        let name = format!("{}-grafana", ns);
-        let backend_service = format!("grafana-{}-service", ns);
-
-        K8sIngressScore {
-            name: fqdn::fqdn!(&name),
-            host: fqdn::fqdn!(&domain),
-            backend_service: fqdn::fqdn!(&backend_service),
-            port: 3000,
-            path: Some("/".to_string()),
-            path_type: Some(PathType::Prefix),
-            namespace: Some(fqdn::fqdn!(&ns)),
-            ingress_class_name: Some("openshift-default".to_string()),
-        }
-    }
-
     async fn get_cluster_observability_operator_prometheus_application_score(
         &self,
         sender: RHOBObservability,
@@ -562,14 +233,13 @@ impl K8sAnywhereTopology {
         &self,
         sender: CRDPrometheus,
         receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
-        service_monitors: Option<Vec<ServiceMonitor>>,
     ) -> K8sPrometheusCRDAlertingScore {
-        return K8sPrometheusCRDAlertingScore {
+        K8sPrometheusCRDAlertingScore {
             sender,
             receivers: receivers.unwrap_or_default(),
-            service_monitors: service_monitors.unwrap_or_default(),
+            service_monitors: vec![],
             prometheus_rules: vec![],
-        };
+        }
     }
 
     async fn openshift_ingress_operator_available(&self) -> Result<(), PreparationError> {
@@ -837,30 +507,6 @@ impl K8sAnywhereTopology {
             details: "prometheus operator present in cluster".into(),
         })
     }
-
-    async fn install_grafana_operator(
-        &self,
-        inventory: &Inventory,
-        ns: Option<&str>,
-    ) -> Result<PreparationOutcome, PreparationError> {
-        let namespace = ns.unwrap_or("grafana");
-        info!("installing grafana operator in ns {namespace}");
-        let tenant = self.get_k8s_tenant_manager()?.get_tenant_config().await;
-        let mut namespace_scope = false;
-        if tenant.is_some() {
-            namespace_scope = true;
-        }
-        let _grafana_operator_score = grafana_helm_chart_score(namespace, namespace_scope)
-            .interpret(inventory, self)
-            .await
-            .map_err(|e| PreparationError::new(e.to_string()));
-        Ok(PreparationOutcome::Success {
-            details: format!(
-                "Successfully installed grafana operator in ns {}",
-                ns.unwrap()
-            ),
-        })
-    }
 }
 
 #[derive(Clone, Debug)]
@@ -975,36 +621,56 @@ impl TenantManager for K8sAnywhereTopology {
 
 #[async_trait]
 impl Ingress for K8sAnywhereTopology {
-    //TODO this is specifically for openshift/okd which violates the k8sanywhere idea
     async fn get_domain(&self, service: &str) -> Result<String, PreparationError> {
+        use log::{trace, debug, warn};
+
         let client = self.k8s_client().await?;
 
         if let Some(Some(k8s_state)) = self.k8s_state.get() {
             match k8s_state.source {
-                K8sSource::LocalK3d => Ok(format!("{service}.local.k3d")),
+                K8sSource::LocalK3d => {
+                    // Local developer UX
+                    return Ok(format!("{service}.local.k3d"));
+                }
                 K8sSource::Kubeconfig => {
-                    self.openshift_ingress_operator_available().await?;
+                    trace!("K8sSource is kubeconfig; attempting to detect domain");
 
-                    let gvk = GroupVersionKind {
-                        group: "operator.openshift.io".into(),
-                        version: "v1".into(),
-                        kind: "IngressController".into(),
-                    };
-                    let ic = client
-                        .get_resource_json_value(
-                            "default",
-                            Some("openshift-ingress-operator"),
-                            &gvk,
-                        )
-                        .await
-                        .map_err(|_| {
-                            PreparationError::new("Failed to fetch IngressController".to_string())
-                        })?;
+                    // 1) Try OpenShift IngressController domain (backward compatible)
+                    if self.openshift_ingress_operator_available().await.is_ok() {
+                        trace!("OpenShift ingress operator detected; using IngressController");
+                        let gvk = GroupVersionKind {
+                            group: "operator.openshift.io".into(),
+                            version: "v1".into(),
+                            kind: "IngressController".into(),
+                        };
+                        let ic = client
+                            .get_resource_json_value("default", Some("openshift-ingress-operator"), &gvk)
+                            .await
+                            .map_err(|_| PreparationError::new("Failed to fetch IngressController".to_string()))?;
 
-                    match ic.data["status"]["domain"].as_str() {
-                        Some(domain) => Ok(format!("{service}.{domain}")),
-                        None => Err(PreparationError::new("Could not find domain".to_string())),
+                        if let Some(domain) = ic.data["status"]["domain"].as_str() {
+                            return Ok(format!("{service}.{domain}"));
+                        } else {
+                            warn!("OpenShift IngressController present but no status.domain set");
+                        }
+                    } else {
+                        trace!("OpenShift ingress operator not detected; trying generic Kubernetes");
                     }
+
+                    // 2) Try NGINX Ingress Controller common setups
+                    // 2.a) Well-known namespace/name for the controller Service
+                    //      - upstream default: namespace "ingress-nginx", service "ingress-nginx-controller"
+                    //      - some distros: "ingress-nginx-controller" svc in "ingress-nginx" ns
+                    // If found with LoadBalancer ingress hostname, use its base domain.
+                    if let Some(domain) = try_nginx_lb_domain(&client).await? {
+                        return Ok(format!("{service}.{domain}"));
+                    }
+
+                    // 3) Fallback: internal cluster DNS suffix (service.namespace.svc.cluster.local)
+                    // We don't have tenant namespace here, so we fallback to 'default' with a warning.
+                    warn!("Could not determine external ingress domain; falling back to internal-only DNS");
+                    let internal = format!("{service}.default.svc.cluster.local");
+                    Ok(internal)
                 }
             }
         } else {
@@ -1014,3 +680,57 @@ impl Ingress for K8sAnywhereTopology {
         }
     }
 }
+
+async fn try_nginx_lb_domain(client: &K8sClient) -> Result<Option<String>, PreparationError> {
+    use log::{trace, debug};
+
+    // Try common service path: svc/ingress-nginx-controller in ns/ingress-nginx
+    let svc_gvk = GroupVersionKind {
+        group: "".into(), // core
+        version: "v1".into(),
+        kind: "Service".into(),
+    };
+
+    let candidates = [
+        ("ingress-nginx", "ingress-nginx-controller"),
+        ("ingress-nginx", "ingress-nginx-controller-internal"),
+        ("ingress-nginx", "ingress-nginx"), // some charts name the svc like this
+        ("kube-system", "ingress-nginx-controller"), // less common but seen
+    ];
+
+    for (ns, name) in candidates {
+        trace!("Checking NGINX Service {ns}/{name} for LoadBalancer hostname");
+        if let Ok(svc) = client.get_resource_json_value(ns, Some(name), &svc_gvk).await {
+            let lb_hosts = svc.data["status"]["loadBalancer"]["ingress"].as_array().cloned().unwrap_or_default();
+            for entry in lb_hosts {
+                if let Some(host) = entry.get("hostname").and_then(|v| v.as_str()) {
+                    debug!("Found NGINX LB hostname: {host}");
+                    if let Some(domain) = extract_base_domain(host) {
+                        return Ok(Some(domain.to_string()));
+                    } else {
+                        return Ok(Some(host.to_string())); // already a domain
+                    }
+                }
+                if let Some(ip) = entry.get("ip").and_then(|v| v.as_str()) {
+                    // If only an IP is exposed, we can't create a hostname; return None to keep searching
+                    debug!("NGINX LB exposes IP {ip} (no hostname); skipping");
+                }
+            }
+        }
+    }
+
+    Ok(None)
+}
+
+fn extract_base_domain(host: &str) -> Option<String> {
+    // For a host like a1b2c3d4e5f6abcdef.elb.amazonaws.com -> base domain elb.amazonaws.com
+    // For a managed DNS like xyz.example.com -> base domain example.com (keep 2+ labels)
+    // Heuristic: keep last 2 labels by default; special-case known multi-label TLDs if needed.
+    let parts: Vec<&str> = host.split('.').collect();
+    if parts.len() >= 2 {
+        // Very conservative: last 2 labels
+        Some(parts[parts.len() - 2..].join("."))
+    } else {
+        None
+    }
+}

harmony/src/domain/topology/mod.rs

@@ -186,7 +186,7 @@ impl TopologyState {
     }
 }
 
-#[derive(Debug)]
+#[derive(Debug, PartialEq)]
 pub enum DeploymentTarget {
     LocalDev,
     Staging,

harmony/src/domain/topology/network.rs

@@ -9,13 +9,12 @@ use std::{
 use async_trait::async_trait;
 use derive_new::new;
 use harmony_types::{
-    id::Id,
     net::{IpAddress, MacAddress},
     switch::PortLocation,
 };
 use serde::Serialize;
 
-use crate::executors::ExecutorError;
+use crate::{executors::ExecutorError, hardware::PhysicalHost};
 
 use super::{LogicalHost, k8s::K8sClient};
 
@@ -183,37 +182,6 @@ impl FromStr for DnsRecordType {
     }
 }
 
-#[async_trait]
-pub trait NetworkManager: Debug + Send + Sync {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError>;
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError>;
-}
-
-#[derive(Debug, Clone, new)]
-pub struct NetworkError {
-    msg: String,
-}
-
-impl fmt::Display for NetworkError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(&self.msg)
-    }
-}
-
-impl Error for NetworkError {}
-
-impl From<kube::Error> for NetworkError {
-    fn from(value: kube::Error) -> Self {
-        NetworkError::new(value.to_string())
-    }
-}
-
-impl From<String> for NetworkError {
-    fn from(value: String) -> Self {
-        NetworkError::new(value)
-    }
-}
-
 #[async_trait]
 pub trait Switch: Send + Sync {
     async fn setup_switch(&self) -> Result<(), SwitchError>;
@@ -223,12 +191,15 @@ pub trait Switch: Send + Sync {
         mac_address: &MacAddress,
     ) -> Result<Option<PortLocation>, SwitchError>;
 
-    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError>;
+    async fn configure_host_network(
+        &self,
+        host: &PhysicalHost,
+        config: HostNetworkConfig,
+    ) -> Result<(), SwitchError>;
 }
 
 #[derive(Clone, Debug, PartialEq)]
 pub struct HostNetworkConfig {
-    pub host_id: Id,
     pub switch_ports: Vec<SwitchPort>,
 }
 

harmony/src/domain/topology/oberservability/monitoring.rs

@@ -31,7 +31,6 @@ impl<S: AlertSender + Installable<T>, T: Topology> Interpret<T> for AlertingInte
         inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
-        debug!("hit sender configure for AlertingInterpret");
         self.sender.configure(inventory, topology).await?;
         for receiver in self.receivers.iter() {
             receiver.install(&self.sender).await?;
@@ -87,5 +86,4 @@ pub trait AlertRule<S: AlertSender>: std::fmt::Debug + Send + Sync {
 #[async_trait]
 pub trait ScrapeTarget<S: AlertSender>: std::fmt::Debug + Send + Sync {
     async fn install(&self, sender: &S) -> Result<Outcome, InterpretError>;
-    fn clone_box(&self) -> Box<dyn ScrapeTarget<S>>;
 }

harmony/src/infra/inventory/mod.rs

@@ -11,7 +11,7 @@ pub struct InventoryRepositoryFactory;
 impl InventoryRepositoryFactory {
     pub async fn build() -> Result<Box<dyn InventoryRepository>, RepoError> {
         Ok(Box::new(
-            SqliteInventoryRepository::new(&DATABASE_URL).await?,
+            SqliteInventoryRepository::new(&(*DATABASE_URL)).await?,
         ))
     }
 }

harmony/src/infra/kube.rs

@@ -1,182 +0,0 @@
-use k8s_openapi::Resource as K8sResource;
-use kube::api::{ApiResource, DynamicObject, GroupVersionKind};
-use kube::core::TypeMeta;
-use serde::Serialize;
-use serde::de::DeserializeOwned;
-use serde_json::Value;
-
-/// Convert a typed Kubernetes resource `K` into a `DynamicObject`.
-///
-/// Requirements:
-/// - `K` must be a k8s_openapi resource (provides static GVK via `Resource`).
-/// - `K` must have standard Kubernetes shape (metadata + payload fields).
-///
-/// Notes:
-/// - We set `types` (apiVersion/kind) and copy `metadata`.
-/// - We place the remaining top-level fields into `obj.data` as JSON.
-/// - Scope is not encoded on the object itself; you still need the corresponding
-///   `DynamicResource` (derived from K::group/version/kind) when constructing an Api.
-///
-/// Example usage:
-///   let dyn_obj = kube_resource_to_dynamic(secret)?;
-///   let api: Api<DynamicObject> = Api::namespaced_with(client, "ns", &dr);
-///   api.patch(&dyn_obj.name_any(), &PatchParams::apply("mgr"), &Patch::Apply(dyn_obj)).await?;
-pub fn kube_resource_to_dynamic<K>(res: &K) -> Result<DynamicObject, String>
-where
-    K: K8sResource + Serialize + DeserializeOwned,
-{
-    // Serialize the typed resource to JSON so we can split metadata and payload
-    let mut v = serde_json::to_value(res).map_err(|e| format!("Failed to serialize : {e}"))?;
-    let obj = v
-        .as_object_mut()
-        .ok_or_else(|| "expected object JSON".to_string())?;
-
-    // Extract and parse metadata into kube::core::ObjectMeta
-    let metadata_value = obj
-        .remove("metadata")
-        .ok_or_else(|| "missing metadata".to_string())?;
-    let metadata: kube::core::ObjectMeta = serde_json::from_value(metadata_value)
-        .map_err(|e| format!("Failed to deserialize : {e}"))?;
-
-    // Name is required for DynamicObject::new; prefer metadata.name
-    let name = metadata
-        .name
-        .clone()
-        .ok_or_else(|| "metadata.name is required".to_string())?;
-
-    // Remaining fields (spec/status/data/etc.) become the dynamic payload
-    let payload = Value::Object(obj.clone());
-
-    // Construct the DynamicObject
-    let mut dyn_obj = DynamicObject::new(
-        &name,
-        &ApiResource::from_gvk(&GroupVersionKind::gvk(K::GROUP, K::VERSION, K::KIND)),
-    );
-    dyn_obj.types = Some(TypeMeta {
-        api_version: api_version_for::<K>(),
-        kind: K::KIND.into(),
-    });
-
-    // Preserve namespace/labels/annotations/etc.
-    dyn_obj.metadata = metadata;
-
-    // Attach payload
-    dyn_obj.data = payload;
-
-    Ok(dyn_obj)
-}
-
-/// Helper: compute apiVersion string ("group/version" or "v1" for core).
-fn api_version_for<K>() -> String
-where
-    K: K8sResource,
-{
-    let group = K::GROUP;
-    let version = K::VERSION;
-    if group.is_empty() {
-        version.to_string() // core/v1 => "v1"
-    } else {
-        format!("{}/{}", group, version)
-    }
-}
-#[cfg(test)]
-mod test {
-    use super::*;
-    use k8s_openapi::api::{
-        apps::v1::{Deployment, DeploymentSpec},
-        core::v1::{PodTemplateSpec, Secret},
-    };
-    use kube::api::ObjectMeta;
-    use pretty_assertions::assert_eq;
-
-    #[test]
-    fn secret_to_dynamic_roundtrip() {
-        // Create a sample Secret resource
-        let mut secret = Secret {
-            metadata: ObjectMeta {
-                name: Some("my-secret".to_string()),
-                ..Default::default()
-            },
-            type_: Some("kubernetes.io/service-account-token".to_string()),
-            ..Default::default()
-        };
-
-        // Convert to DynamicResource
-        let dynamic: DynamicObject =
-            kube_resource_to_dynamic(&secret).expect("Failed to convert Secret to DynamicResource");
-
-        // Serialize both the original and dynamic resources to Value
-        let original_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
-        let dynamic_value =
-            serde_json::to_value(&dynamic).expect("Failed to serialize DynamicResource");
-
-        // Assert that they are identical
-        assert_eq!(original_value, dynamic_value);
-
-        secret.metadata.namespace = Some("false".to_string());
-        let modified_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
-        assert_ne!(modified_value, dynamic_value);
-    }
-
-    #[test]
-    fn deployment_to_dynamic_roundtrip() {
-        // Create a sample Deployment with nested structures
-        let mut deployment = Deployment {
-            metadata: ObjectMeta {
-                name: Some("my-deployment".to_string()),
-                labels: Some({
-                    let mut map = std::collections::BTreeMap::new();
-                    map.insert("app".to_string(), "nginx".to_string());
-                    map
-                }),
-                ..Default::default()
-            },
-            spec: Some(DeploymentSpec {
-                replicas: Some(3),
-                selector: Default::default(),
-                template: PodTemplateSpec {
-                    metadata: Some(ObjectMeta {
-                        labels: Some({
-                            let mut map = std::collections::BTreeMap::new();
-                            map.insert("app".to_string(), "nginx".to_string());
-                            map
-                        }),
-                        ..Default::default()
-                    }),
-                    spec: Some(Default::default()), // PodSpec with empty containers for simplicity
-                },
-                ..Default::default()
-            }),
-            ..Default::default()
-        };
-
-        let dynamic = kube_resource_to_dynamic(&deployment).expect("Failed to convert Deployment");
-
-        let original_value = serde_json::to_value(&deployment).unwrap();
-        let dynamic_value = serde_json::to_value(&dynamic).unwrap();
-
-        assert_eq!(original_value, dynamic_value);
-
-        assert_eq!(
-            dynamic.data.get("spec").unwrap().get("replicas").unwrap(),
-            3
-        );
-        assert_eq!(
-            dynamic
-                .data
-                .get("spec")
-                .unwrap()
-                .get("template")
-                .unwrap()
-                .get("metadata")
-                .unwrap()
-                .get("labels")
-                .unwrap()
-                .get("app")
-                .unwrap()
-                .as_str()
-                .unwrap(),
-            "nginx".to_string()
-        );
-    }
-}

harmony/src/infra/mod.rs

@@ -3,7 +3,5 @@ pub mod executors;
 pub mod hp_ilo;
 pub mod intel_amt;
 pub mod inventory;
-pub mod kube;
-pub mod network_manager;
 pub mod opnsense;
 mod sqlx;

harmony/src/infra/network_manager.rs

@@ -1,264 +0,0 @@
-use std::{
-    collections::{BTreeMap, HashSet},
-    sync::Arc,
-};
-
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use k8s_openapi::api::core::v1::Node;
-use kube::{
-    ResourceExt,
-    api::{ObjectList, ObjectMeta},
-};
-use log::{debug, info};
-
-use crate::{
-    modules::okd::crd::nmstate,
-    topology::{HostNetworkConfig, NetworkError, NetworkManager, k8s::K8sClient},
-};
-
-/// TODO document properly the non-intuitive behavior or "roll forward only" of nmstate in general
-/// It is documented in nmstate official doc, but worth mentionning here :
-///
-/// - You create a bond, nmstate will apply it
-/// - You delete de bond from nmstate, it will NOT delete it
-/// - To delete it you have to update it with configuration set to null
-pub struct OpenShiftNmStateNetworkManager {
-    k8s_client: Arc<K8sClient>,
-}
-
-impl std::fmt::Debug for OpenShiftNmStateNetworkManager {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("OpenShiftNmStateNetworkManager").finish()
-    }
-}
-
-#[async_trait]
-impl NetworkManager for OpenShiftNmStateNetworkManager {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-        debug!("Installing NMState controller...");
-        // TODO use operatorhub maybe?
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/nmstate.io_nmstates.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState namespace...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/namespace.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState service account...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/service_account.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState role...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState role binding...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role_binding.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState operator...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/operator.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        self.k8s_client
-            .wait_until_deployment_ready("nmstate-operator", Some("nmstate"), None)
-            .await?;
-
-        let nmstate = nmstate::NMState {
-            metadata: ObjectMeta {
-                name: Some("nmstate".to_string()),
-                ..Default::default()
-            },
-            ..Default::default()
-        };
-        debug!(
-            "Creating NMState:\n{}",
-            serde_yaml::to_string(&nmstate).unwrap()
-        );
-        self.k8s_client.apply(&nmstate, None).await?;
-
-        Ok(())
-    }
-
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-        let hostname = self.get_hostname(&config.host_id).await.map_err(|e| {
-            NetworkError::new(format!(
-                "Can't configure bond, can't get hostname for host '{}': {e}",
-                config.host_id
-            ))
-        })?;
-        let bond_id = self.get_next_bond_id(&hostname).await.map_err(|e| {
-            NetworkError::new(format!(
-                "Can't configure bond, can't get an available bond id for host '{}': {e}",
-                config.host_id
-            ))
-        })?;
-        let bond_config = self.create_bond_configuration(&hostname, &bond_id, config);
-
-        debug!(
-            "Applying NMState bond config for host {}:\n{}",
-            config.host_id,
-            serde_yaml::to_string(&bond_config).unwrap(),
-        );
-        self.k8s_client
-            .apply(&bond_config, None)
-            .await
-            .map_err(|e| NetworkError::new(format!("Failed to configure bond: {e}")))?;
-
-        Ok(())
-    }
-}
-
-impl OpenShiftNmStateNetworkManager {
-    pub fn new(k8s_client: Arc<K8sClient>) -> Self {
-        Self { k8s_client }
-    }
-
-    fn create_bond_configuration(
-        &self,
-        host: &str,
-        bond_name: &str,
-        config: &HostNetworkConfig,
-    ) -> nmstate::NodeNetworkConfigurationPolicy {
-        info!("Configuring bond '{bond_name}' for host '{host}'...");
-
-        let mut bond_mtu: Option<u32> = None;
-        let mut copy_mac_from: Option<String> = None;
-        let mut bond_ports = Vec::new();
-        let mut interfaces: Vec<nmstate::Interface> = Vec::new();
-
-        for switch_port in &config.switch_ports {
-            let interface_name = switch_port.interface.name.clone();
-
-            interfaces.push(nmstate::Interface {
-                name: interface_name.clone(),
-                description: Some(format!("Member of bond {bond_name}")),
-                r#type: nmstate::InterfaceType::Ethernet,
-                state: "up".to_string(),
-                ipv4: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                ipv6: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                link_aggregation: None,
-                ..Default::default()
-            });
-
-            bond_ports.push(interface_name.clone());
-
-            // Use the first port's details for the bond mtu and mac address
-            if bond_mtu.is_none() {
-                bond_mtu = Some(switch_port.interface.mtu);
-            }
-            if copy_mac_from.is_none() {
-                copy_mac_from = Some(interface_name);
-            }
-        }
-
-        interfaces.push(nmstate::Interface {
-            name: bond_name.to_string(),
-            description: Some(format!("HARMONY - Network bond for host {host}")),
-            r#type: nmstate::InterfaceType::Bond,
-            state: "up".to_string(),
-            copy_mac_from,
-            ipv4: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            ipv6: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                autoconf: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            link_aggregation: Some(nmstate::BondSpec {
-                mode: "802.3ad".to_string(),
-                ports: bond_ports,
-                ..Default::default()
-            }),
-            ..Default::default()
-        });
-
-        nmstate::NodeNetworkConfigurationPolicy {
-            metadata: ObjectMeta {
-                name: Some(format!("{host}-bond-config")),
-                ..Default::default()
-            },
-            spec: nmstate::NodeNetworkConfigurationPolicySpec {
-                node_selector: Some(BTreeMap::from([(
-                    "kubernetes.io/hostname".to_string(),
-                    host.to_string(),
-                )])),
-                desired_state: nmstate::NetworkState {
-                    interfaces,
-                    ..Default::default()
-                },
-            },
-        }
-    }
-
-    async fn get_hostname(&self, host_id: &Id) -> Result<String, String> {
-        let nodes: ObjectList<Node> = self
-            .k8s_client
-            .list_resources(None, None)
-            .await
-            .map_err(|e| format!("Failed to list nodes: {e}"))?;
-
-        let Some(node) = nodes.iter().find(|n| {
-            n.status
-                .as_ref()
-                .and_then(|s| s.node_info.as_ref())
-                .map(|i| i.system_uuid == host_id.to_string())
-                .unwrap_or(false)
-        }) else {
-            return Err(format!("No node found for host '{host_id}'"));
-        };
-
-        node.labels()
-            .get("kubernetes.io/hostname")
-            .ok_or(format!(
-                "Node '{host_id}' has no kubernetes.io/hostname label"
-            ))
-            .cloned()
-    }
-
-    async fn get_next_bond_id(&self, hostname: &str) -> Result<String, String> {
-        let network_state: Option<nmstate::NodeNetworkState> = self
-            .k8s_client
-            .get_resource(hostname, None)
-            .await
-            .map_err(|e| format!("Failed to list nodes: {e}"))?;
-
-        let interfaces = vec![];
-        let existing_bonds: Vec<&nmstate::Interface> = network_state
-            .as_ref()
-            .and_then(|network_state| network_state.status.current_state.as_ref())
-            .map_or(&interfaces, |current_state| &current_state.interfaces)
-            .iter()
-            .filter(|i| i.r#type == nmstate::InterfaceType::Bond)
-            .collect();
-
-        let used_ids: HashSet<u32> = existing_bonds
-            .iter()
-            .filter_map(|i| {
-                i.name
-                    .strip_prefix("bond")
-                    .and_then(|id| id.parse::<u32>().ok())
-            })
-            .collect();
-
-        let next_id = (0..).find(|id| !used_ids.contains(id)).unwrap();
-        Ok(format!("bond{next_id}"))
-    }
-}

harmony/src/infra/opnsense/dns.rs

@@ -10,7 +10,7 @@ use super::OPNSenseFirewall;
 
 #[async_trait]
 impl DnsServer for OPNSenseFirewall {
-    async fn register_hosts(&self, hosts: Vec<DnsRecord>) -> Result<(), ExecutorError> {
+    async fn register_hosts(&self, _hosts: Vec<DnsRecord>) -> Result<(), ExecutorError> {
         todo!("Refactor this to use dnsmasq")
         // let mut writable_opnsense = self.opnsense_config.write().await;
         // let mut dns = writable_opnsense.dns();
@@ -68,7 +68,7 @@ impl DnsServer for OPNSenseFirewall {
         self.host.clone()
     }
 
-    async fn register_dhcp_leases(&self, register: bool) -> Result<(), ExecutorError> {
+    async fn register_dhcp_leases(&self, _register: bool) -> Result<(), ExecutorError> {
         todo!("Refactor this to use dnsmasq")
         // let mut writable_opnsense = self.opnsense_config.write().await;
         // let mut dns = writable_opnsense.dns();

harmony/src/modules/application/features/argo_types.rs

@@ -21,7 +21,7 @@ pub struct Helm {
     pub skip_schema_validation: Option<bool>,
     pub version: Option<String>,
     pub kube_version: Option<String>,
-    pub api_versions: Vec<String>,
+    // pub api_versions: Vec<String>,
     pub namespace: Option<String>,
 }
 
@@ -105,7 +105,7 @@ impl Default for ArgoApplication {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    api_versions: vec![],
+                    // api_versions: vec![],
                     namespace: None,
                 },
                 path: "".to_string(),
@@ -155,7 +155,7 @@ impl From<CDApplicationConfig> for ArgoApplication {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    api_versions: vec![],
+                    // api_versions: vec![],
                     namespace: None,
                 },
             },
@@ -181,13 +181,11 @@ impl From<CDApplicationConfig> for ArgoApplication {
 }
 
 impl ArgoApplication {
-    pub fn to_yaml(&self) -> serde_yaml::Value {
+    pub fn to_yaml(&self, target_namespace: Option<&str>) -> serde_yaml::Value {
         let name = &self.name;
-        let namespace = if let Some(ns) = self.namespace.as_ref() {
-            ns
-        } else {
-            "argocd"
-        };
+        let default_ns = "argocd".to_string();
+        let namespace: &str =
+            target_namespace.unwrap_or(self.namespace.as_ref().unwrap_or(&default_ns));
         let project = &self.project;
 
         let yaml_str = format!(
@@ -285,7 +283,7 @@ mod tests {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    api_versions: vec![],
+                    // api_versions: vec![],
                     namespace: None,
                 },
                 path: "".to_string(),
@@ -345,7 +343,7 @@ spec:
 
         assert_eq!(
             expected_yaml_output.trim(),
-            serde_yaml::to_string(&app.clone().to_yaml())
+            serde_yaml::to_string(&app.clone().to_yaml(None))
                 .unwrap()
                 .trim()
         );

harmony/src/modules/application/features/helm_argocd_score.rs

@@ -1,22 +1,21 @@
 use async_trait::async_trait;
 use harmony_macros::hurl;
 use kube::{Api, api::GroupVersionKind};
-use log::{debug, warn};
+use log::{debug, info, trace, warn};
 use non_blank_string_rs::NonBlankString;
 use serde::Serialize;
-use serde::de::DeserializeOwned;
-use std::{process::Command, str::FromStr, sync::Arc};
+use std::{str::FromStr, sync::Arc};
 
 use crate::{
     data::Version,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
-    modules::helm::chart::{HelmChartScore, HelmRepository},
-    score::Score,
-    topology::{
-        HelmCommand, K8sclient, PreparationError, PreparationOutcome, Topology, ingress::Ingress,
-        k8s::K8sClient,
+    modules::{
+        argocd::{ArgoDeploymentType, detect_argo_deployment_type},
+        helm::chart::{HelmChartScore, HelmRepository},
     },
+    score::Score,
+    topology::{HelmCommand, K8sclient, Topology, ingress::Ingress, k8s::K8sClient},
 };
 use harmony_types::id::Id;
 
@@ -25,6 +24,7 @@ use super::ArgoApplication;
 #[derive(Debug, Serialize, Clone)]
 pub struct ArgoHelmScore {
     pub namespace: String,
+    // TODO: remove and rely on topology (it now knows the flavor)
     pub openshift: bool,
     pub argo_apps: Vec<ArgoApplication>,
 }
@@ -55,29 +55,101 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
         inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
-        let k8s_client = topology.k8s_client().await?;
-        let svc = format!("argo-{}", self.score.namespace.clone());
+        trace!("Starting ArgoInterpret execution {self:?}");
+        let k8s_client: Arc<K8sClient> = topology.k8s_client().await?;
+        trace!("Got k8s client");
+        let desired_ns = self.score.namespace.clone();
+
+        debug!("ArgoInterpret detecting cluster configuration");
+        let svc = format!("argo-{}", desired_ns);
         let domain = topology.get_domain(&svc).await?;
-        let helm_score =
-            argo_helm_chart_score(&self.score.namespace, self.score.openshift, &domain);
+        debug!("Resolved Argo service domain for '{}': {}", svc, domain);
 
-        helm_score.interpret(inventory, topology).await?;
+        // Detect current Argo deployment type
+        let current = detect_argo_deployment_type(&k8s_client, &desired_ns).await?;
+        info!("Detected Argo deployment type: {:?}", current);
 
+        // Decide control namespace and whether we must install
+        let (control_ns, must_install) = match current.clone() {
+            ArgoDeploymentType::NotInstalled => {
+                info!(
+                    "Argo CD not installed. Will install via Helm into namespace '{}'.",
+                    desired_ns
+                );
+                (desired_ns.clone(), true)
+            }
+            ArgoDeploymentType::AvailableInDesiredNamespace(ns) => {
+                info!(
+                    "Argo CD already installed by Harmony in '{}'. Skipping install.",
+                    ns
+                );
+                (ns, false)
+            }
+            ArgoDeploymentType::InstalledClusterWide(ns) => {
+                info!(
+                    "Argo CD installed cluster-wide in namespace '{}'.",
+                    ns
+                );
+                (ns, false)
+            }
+            ArgoDeploymentType::InstalledNamespaceScoped(ns) => {
+                // TODO we could support this use case by installing a new argo instance. But that
+                // means handling a few cases that are out of scope for now :
+                // - Wether argo operator is installed
+                // - Managing CRD versions compatibility
+                // - Potentially handling the various k8s flavors and setups we might encounter
+                //
+                // There is a possibility that the helm chart already handles most or even all of these use cases but they are out of scope for now.
+                let msg = format!(
+                    "Argo CD found in '{}' but it is namespace-scoped and not supported for attachment yet.",
+                    ns
+                );
+                warn!("{}", msg);
+                return Err(InterpretError::new(msg));
+            }
+        };
+
+        info!("ArgoCD will be installed : {must_install} . Current argocd status : {current:?} ");
+
+        if must_install {
+            let helm_score = argo_helm_chart_score(&desired_ns, self.score.openshift, &domain);
+            info!(
+                "Installing Argo CD via Helm into namespace '{}' ...",
+                desired_ns
+            );
+            helm_score.interpret(inventory, topology).await?;
+            info!("Argo CD install complete in '{}'.", desired_ns);
+        }
+
+        let yamls: Vec<serde_yaml::Value> = self
+            .argo_apps
+            .iter()
+            .map(|a| a.to_yaml(Some(&control_ns)))
+            .collect();
+        info!(
+            "Applying {} Argo application object(s) into control namespace '{}'.",
+            yamls.len(),
+            control_ns
+        );
         k8s_client
-            .apply_yaml_many(&self.argo_apps.iter().map(|a| a.to_yaml()).collect(), None)
+            .apply_yaml_many(&yamls, Some(control_ns.as_str()))
             .await
-            .unwrap();
+            .map_err(|e| InterpretError::new(format!("Failed applying Argo CRs: {e}")))?;
 
         Ok(Outcome::success_with_details(
             format!(
                 "ArgoCD {} {}",
                 self.argo_apps.len(),
-                match self.argo_apps.len() {
-                    1 => "application",
-                    _ => "applications",
+                if self.argo_apps.len() == 1 {
+                    "application"
+                } else {
+                    "applications"
                 }
             ),
-            vec![format!("argo application: http://{}", domain)],
+            vec![
+                format!("control_namespace={}", control_ns),
+                format!("argo ui: http://{}", domain),
+            ],
         ))
     }
 
@@ -86,7 +158,7 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
     }
 
     fn get_version(&self) -> Version {
-        todo!()
+        Version::from("0.1.0").unwrap()
     }
 
     fn get_status(&self) -> InterpretStatus {
@@ -94,39 +166,7 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
     }
 
     fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-}
-
-impl ArgoInterpret {
-    pub async fn get_host_domain(
-        &self,
-        client: Arc<K8sClient>,
-        openshift: bool,
-    ) -> Result<String, InterpretError> {
-        //This should be the job of the topology to determine if we are in
-        //openshift, potentially we need on openshift topology the same way we create a
-        //localhosttopology
-        match openshift {
-            true => {
-                let gvk = GroupVersionKind {
-                    group: "operator.openshift.io".into(),
-                    version: "v1".into(),
-                    kind: "IngressController".into(),
-                };
-                let ic = client
-                    .get_resource_json_value("default", Some("openshift-ingress-operator"), &gvk)
-                    .await?;
-
-                match ic.data["status"]["domain"].as_str() {
-                    Some(domain) => return Ok(domain.to_string()),
-                    None => return Err(InterpretError::new("Could not find domain".to_string())),
-                }
-            }
-            false => {
-                todo!()
-            }
-        };
+        vec![]
     }
 }
 

harmony/src/modules/application/features/monitoring.rs

@@ -2,11 +2,7 @@ use crate::modules::application::{
     Application, ApplicationFeature, InstallationError, InstallationOutcome,
 };
 use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
-use crate::modules::monitoring::grafana::grafana::Grafana;
 use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus;
-use crate::modules::monitoring::kube_prometheus::crd::service_monitor::{
-    ServiceMonitor, ServiceMonitorSpec,
-};
 use crate::topology::MultiTargetTopology;
 use crate::topology::ingress::Ingress;
 use crate::{
@@ -18,7 +14,7 @@ use crate::{
     topology::{HelmCommand, K8sclient, Topology, tenant::TenantManager},
 };
 use crate::{
-    modules::prometheus::prometheus::PrometheusMonitoring,
+    modules::prometheus::prometheus::PrometheusApplicationMonitoring,
     topology::oberservability::monitoring::AlertReceiver,
 };
 use async_trait::async_trait;
@@ -26,7 +22,6 @@ use base64::{Engine as _, engine::general_purpose};
 use harmony_secret::SecretManager;
 use harmony_secret_derive::Secret;
 use harmony_types::net::Url;
-use kube::api::ObjectMeta;
 use log::{debug, info};
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
@@ -45,8 +40,7 @@ impl<
         + TenantManager
         + K8sclient
         + MultiTargetTopology
-        + PrometheusMonitoring<CRDPrometheus>
-        + Grafana
+        + PrometheusApplicationMonitoring<CRDPrometheus>
         + Ingress
         + std::fmt::Debug,
 > ApplicationFeature<T> for Monitoring
@@ -63,20 +57,10 @@ impl<
             .unwrap_or_else(|| self.application.name());
         let domain = topology.get_domain("ntfy").await.unwrap();
 
-        let app_service_monitor = ServiceMonitor {
-            metadata: ObjectMeta {
-                name: Some(self.application.name()),
-                namespace: Some(namespace.clone()),
-                ..Default::default()
-            },
-            spec: ServiceMonitorSpec::default(),
-        };
-
         let mut alerting_score = ApplicationMonitoringScore {
             sender: CRDPrometheus {
                 namespace: namespace.clone(),
                 client: topology.k8s_client().await.unwrap(),
-                service_monitor: vec![app_service_monitor],
             },
             application: self.application.clone(),
             receivers: self.alert_receiver.clone(),

harmony/src/modules/application/features/packaging_deployment.rs

@@ -10,12 +10,11 @@ use crate::{
     data::Version,
     inventory::Inventory,
     modules::application::{
-        ApplicationFeature, HelmPackage, InstallationError, InstallationOutcome, OCICompliant,
-        features::{ArgoApplication, ArgoHelmScore},
+        features::{ArgoApplication, ArgoHelmScore}, webapp::Webapp, ApplicationFeature, HelmPackage, InstallationError, InstallationOutcome, OCICompliant
     },
     score::Score,
     topology::{
-        DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, Topology, ingress::Ingress,
+        ingress::Ingress, DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, Topology
     },
 };
 
@@ -47,11 +46,11 @@ use crate::{
 /// - ArgoCD to install/upgrade/rollback/inspect k8s resources
 /// - Kubernetes for runtime orchestration
 #[derive(Debug, Default, Clone)]
-pub struct PackagingDeployment<A: OCICompliant + HelmPackage> {
+pub struct PackagingDeployment<A: OCICompliant + HelmPackage + Webapp> {
     pub application: Arc<A>,
 }
 
-impl<A: OCICompliant + HelmPackage> PackagingDeployment<A> {
+impl<A: OCICompliant + HelmPackage + Webapp> PackagingDeployment<A> {
     async fn deploy_to_local_k3d(
         &self,
         app_name: String,
@@ -137,7 +136,7 @@ impl<A: OCICompliant + HelmPackage> PackagingDeployment<A> {
 
 #[async_trait]
 impl<
-    A: OCICompliant + HelmPackage + Clone + 'static,
+    A: OCICompliant + HelmPackage + Webapp + Clone + 'static,
     T: Topology + HelmCommand + MultiTargetTopology + K8sclient + Ingress + 'static,
 > ApplicationFeature<T> for PackagingDeployment<A>
 {
@@ -146,10 +145,15 @@ impl<
         topology: &T,
     ) -> Result<InstallationOutcome, InstallationError> {
         let image = self.application.image_name();
-        let domain = topology
+
+        let domain = if topology.current_target() == DeploymentTarget::Production {
+            self.application.dns()
+        } else {
+ topology
             .get_domain(&self.application.name())
             .await
-            .map_err(|e| e.to_string())?;
+            .map_err(|e| e.to_string())?
+        };
 
         // TODO Write CI/CD workflow files
         // we can autotedect the CI type using the remote url (default to github action for github
@@ -194,7 +198,7 @@ impl<
                     openshift: true,
                     argo_apps: vec![ArgoApplication::from(CDApplicationConfig {
                         // helm pull oci://hub.nationtech.io/harmony/harmony-example-rust-webapp-chart --version 0.1.0
-                        version: Version::from("0.1.0").unwrap(),
+                        version: Version::from("0.2.1").unwrap(),
                         helm_chart_repo_url: "hub.nationtech.io/harmony".to_string(),
                         helm_chart_name: format!("{}-chart", self.application.name()),
                         values_overrides: None,

harmony/src/modules/application/features/rhob_monitoring.rs

@@ -3,7 +3,6 @@ use std::sync::Arc;
 use crate::modules::application::{
     Application, ApplicationFeature, InstallationError, InstallationOutcome,
 };
-use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
 use crate::modules::monitoring::application_monitoring::rhobs_application_monitoring_score::ApplicationRHOBMonitoringScore;
 
 use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::RHOBObservability;
@@ -18,7 +17,7 @@ use crate::{
     topology::{HelmCommand, K8sclient, Topology, tenant::TenantManager},
 };
 use crate::{
-    modules::prometheus::prometheus::PrometheusMonitoring,
+    modules::prometheus::prometheus::PrometheusApplicationMonitoring,
     topology::oberservability::monitoring::AlertReceiver,
 };
 use async_trait::async_trait;
@@ -42,7 +41,7 @@ impl<
         + MultiTargetTopology
         + Ingress
         + std::fmt::Debug
-        + PrometheusMonitoring<RHOBObservability>,
+        + PrometheusApplicationMonitoring<RHOBObservability>,
 > ApplicationFeature<T> for Monitoring
 {
     async fn ensure_installed(

harmony/src/modules/application/mod.rs

@@ -2,6 +2,7 @@ mod feature;
 pub mod features;
 pub mod oci;
 mod rust;
+mod webapp;
 use std::sync::Arc;
 
 pub use feature::*;

harmony/src/modules/application/rust.rs

@@ -16,6 +16,7 @@ use tar::{Builder, Header};
 use walkdir::WalkDir;
 
 use crate::config::{REGISTRY_PROJECT, REGISTRY_URL};
+use crate::modules::application::webapp::Webapp;
 use crate::{score::Score, topology::Topology};
 
 use super::{Application, ApplicationFeature, ApplicationInterpret, HelmPackage, OCICompliant};
@@ -60,6 +61,10 @@ pub struct RustWebapp {
     pub project_root: PathBuf,
     pub service_port: u32,
     pub framework: Option<RustWebFramework>,
+    /// Host name that will be used in production environment.
+    ///
+    /// This is the place to put the public host name if this is a public facing webapp.
+    pub dns: String,
 }
 
 impl Application for RustWebapp {
@@ -68,6 +73,12 @@ impl Application for RustWebapp {
     }
 }
 
+impl Webapp for RustWebapp {
+    fn dns(&self) -> String {
+        self.dns.clone()
+    }
+}
+
 #[async_trait]
 impl HelmPackage for RustWebapp {
     async fn build_push_helm_package(
@@ -194,10 +205,10 @@ impl RustWebapp {
                     Some(body_full(tar_data.into())),
                 );
 
-                while let Some(mut msg) = image_build_stream.next().await {
+                while let Some(msg) = image_build_stream.next().await {
                     trace!("Got bollard msg {msg:?}");
                     match msg {
-                        Ok(mut msg) => {
+                        Ok(msg) => {
                             if let Some(progress) = msg.progress_detail {
                                 info!(
                                     "Build progress {}/{}",
@@ -257,7 +268,6 @@ impl RustWebapp {
                 ".harmony_generated",
                 "harmony",
                 "node_modules",
-                "Dockerfile.harmony",
             ];
             let mut entries: Vec<_> = WalkDir::new(project_root)
                 .into_iter()
@@ -461,52 +471,53 @@ impl RustWebapp {
 
         let (image_repo, image_tag) = image_url.rsplit_once(':').unwrap_or((image_url, "latest"));
 
+        let app_name = &self.name;
+        let service_port = self.service_port;
         // Create Chart.yaml
         let chart_yaml = format!(
             r#"
 apiVersion: v2
-name: {}
-description: A Helm chart for the {} web application.
+name: {chart_name}
+description: A Helm chart for the {app_name} web application.
 type: application
-version: 0.1.0
-appVersion: "{}"
+version: 0.2.1
+appVersion: "{image_tag}"
 "#,
-            chart_name, self.name, image_tag
         );
         fs::write(chart_dir.join("Chart.yaml"), chart_yaml)?;
 
         // Create values.yaml
         let values_yaml = format!(
             r#"
-# Default values for {}.
+# Default values for {chart_name}.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
 replicaCount: 1
 
 image:
-  repository: {}
+  repository: {image_repo}
   pullPolicy: IfNotPresent
   # Overridden by the chart's appVersion
-  tag: "{}"
+  tag: "{image_tag}"
 
 service:
   type: ClusterIP
-  port: {}
+  port: {service_port}
 
 ingress:
   enabled: true
+  tls: true
   # Annotations for cert-manager to handle SSL.
   annotations:
     # Add other annotations like nginx ingress class if needed
     # kubernetes.io/ingress.class: nginx
   hosts:
-    - host: {}
+    - host: {domain}
       paths:
         - path: /
           pathType: ImplementationSpecific
 "#,
-            chart_name, image_repo, image_tag, self.service_port, domain,
         );
         fs::write(chart_dir.join("values.yaml"), values_yaml)?;
 
@@ -583,7 +594,11 @@ spec:
         );
         fs::write(templates_dir.join("deployment.yaml"), deployment_yaml)?;
 
+        let service_port = self.service_port;
+
         // Create templates/ingress.yaml
+        // TODO get issuer name and tls config from topology as it may be different from one
+        // cluster to another, also from one version to another
         let ingress_yaml = format!(
             r#"
 {{{{- if $.Values.ingress.enabled -}}}}
@@ -596,13 +611,11 @@ metadata:
 spec:
   {{{{- if $.Values.ingress.tls }}}}
   tls:
-    {{{{- range $.Values.ingress.tls }}}}
-    - hosts:
-        {{{{- range .hosts }}}}
-        - {{{{ . | quote }}}}
+    - secretName: {{{{ include "chart.fullname" . }}}}-tls
+      hosts:
+        {{{{- range $.Values.ingress.hosts }}}}
+        - {{{{ .host | quote }}}}
         {{{{- end }}}}
-      secretName: {{{{ .secretName }}}}
-    {{{{- end }}}}
   {{{{- end }}}}
   rules:
     {{{{- range $.Values.ingress.hosts }}}}
@@ -616,12 +629,11 @@ spec:
               service:
                 name: {{{{ include "chart.fullname" $ }}}}
                 port:
-                  number: {{{{ $.Values.service.port | default {} }}}}
+                  number: {{{{ $.Values.service.port | default {service_port} }}}}
           {{{{- end }}}}
     {{{{- end }}}}
 {{{{- end }}}}
 "#,
-            self.service_port
         );
         fs::write(templates_dir.join("ingress.yaml"), ingress_yaml)?;
 

harmony/src/modules/application/webapp.rs

@@ -0,0 +1,7 @@
+use super::Application;
+use async_trait::async_trait;
+
+#[async_trait]
+pub trait Webapp: Application {
+    fn dns(&self) -> String;
+}

harmony/src/modules/argocd/mod.rs

@@ -0,0 +1,203 @@
+use std::sync::Arc;
+
+use log::{debug, info};
+
+use crate::{interpret::InterpretError, topology::k8s::K8sClient};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ArgoScope {
+    ClusterWide(String),
+    NamespaceScoped(String),
+}
+
+#[derive(Clone, Debug)]
+pub struct DiscoveredArgo {
+    pub control_namespace: String,
+    pub scope: ArgoScope,
+    pub has_crds: bool,
+    pub has_applicationset: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ArgoDeploymentType {
+    NotInstalled,
+    AvailableInDesiredNamespace(String),
+    InstalledClusterWide(String),
+    InstalledNamespaceScoped(String),
+}
+
+pub async fn discover_argo_all(
+    k8s: &Arc<K8sClient>,
+) -> Result<Vec<DiscoveredArgo>, InterpretError> {
+    use log::{debug, info, trace, warn};
+
+    trace!("Starting Argo discovery");
+
+    // CRDs
+    let mut has_crds = true;
+    let required_crds = vec!["applications.argoproj.io", "appprojects.argoproj.io"];
+    trace!("Checking required Argo CRDs: {:?}", required_crds);
+
+    for crd in required_crds {
+        trace!("Verifying CRD presence: {crd}");
+        let crd_exists = k8s.has_crd(crd).await.map_err(|e| {
+            InterpretError::new(format!("Failed to verify existence of CRD {crd}: {e}"))
+        })?;
+
+        debug!("CRD {crd} exists: {crd_exists}");
+        if !crd_exists {
+            info!(
+                "Missing Argo CRD {crd}, looks like Argo CD is not installed (or partially installed)"
+            );
+            has_crds = false;
+            break;
+        }
+    }
+
+    trace!(
+        "Listing namespaces with healthy Argo CD deployments using selector app.kubernetes.io/part-of=argocd"
+    );
+    let mut candidate_namespaces = k8s
+        .list_namespaces_with_healthy_deployments("app.kubernetes.io/part-of=argocd")
+        .await
+        .map_err(|e| InterpretError::new(format!("List healthy argocd deployments: {e}")))?;
+    trace!(
+        "Listing namespaces with healthy Argo CD deployments using selector app.kubernetes.io/name=argo-cd"
+    );
+    candidate_namespaces.append(
+        &mut k8s
+            .list_namespaces_with_healthy_deployments("app.kubernetes.io/name=argo-cd")
+            .await
+            .map_err(|e| InterpretError::new(format!("List healthy argocd deployments: {e}")))?,
+    );
+
+    debug!(
+        "Discovered {} candidate namespace(s) for Argo CD: {:?}",
+        candidate_namespaces.len(),
+        candidate_namespaces
+    );
+
+    let mut found = Vec::new();
+    for ns in candidate_namespaces {
+        trace!("Evaluating namespace '{ns}' for Argo CD instance");
+
+        // Require the application-controller to be healthy (sanity check)
+        trace!(
+            "Checking healthy deployment with label app.kubernetes.io/name=argocd-application-controller in namespace '{ns}'"
+        );
+        let controller_ok = k8s
+            .has_healthy_deployment_with_label(
+                &ns,
+                "app.kubernetes.io/name=argocd-application-controller",
+            )
+            .await
+            .unwrap_or_else(|e| {
+                warn!(
+                    "Error while checking application-controller health in namespace '{ns}': {e}"
+                );
+                false
+            }) || k8s
+            .has_healthy_deployment_with_label(
+                &ns,
+                "app.kubernetes.io/component=controller",
+            )
+            .await
+            .unwrap_or_else(|e| {
+                warn!(
+                    "Error while checking application-controller health in namespace '{ns}': {e}"
+                );
+                false
+            });
+        debug!("Namespace '{ns}': application-controller healthy = {controller_ok}");
+
+        if !controller_ok {
+            trace!("Skipping namespace '{ns}' because application-controller is not healthy");
+            continue;
+        }
+
+        trace!("Determining Argo CD scope for namespace '{ns}' (cluster-wide vs namespace-scoped)");
+        let scope = match k8s.is_argocd_cluster_wide(&ns).await {
+            Ok(true) => {
+                debug!("Namespace '{ns}' identified as cluster-wide Argo CD control plane");
+                ArgoScope::ClusterWide(ns.to_string())
+            }
+            Ok(false) => {
+                debug!("Namespace '{ns}' identified as namespace-scoped Argo CD control plane");
+                ArgoScope::NamespaceScoped(ns.to_string())
+            }
+            Err(e) => {
+                warn!(
+                    "Failed to determine Argo CD scope for namespace '{ns}': {e}. Assuming namespace-scoped."
+                );
+                ArgoScope::NamespaceScoped(ns.to_string())
+            }
+        };
+
+        trace!("Checking optional ApplicationSet CRD (applicationsets.argoproj.io)");
+        let has_applicationset = match k8s.has_crd("applicationsets.argoproj.io").await {
+            Ok(v) => {
+                debug!("applicationsets.argoproj.io present: {v}");
+                v
+            }
+            Err(e) => {
+                warn!("Failed to check applicationsets.argoproj.io CRD: {e}. Assuming absent.");
+                false
+            }
+        };
+
+        let argo = DiscoveredArgo {
+            control_namespace: ns.clone(),
+            scope,
+            has_crds,
+            has_applicationset,
+        };
+
+        debug!("Discovered Argo instance in '{ns}': {argo:?}");
+        found.push(argo);
+    }
+
+    if found.is_empty() {
+        info!("No Argo CD installations discovered");
+    } else {
+        info!(
+            "Argo CD discovery complete: {} instance(s) found",
+            found.len()
+        );
+    }
+
+    Ok(found)
+}
+
+pub async fn detect_argo_deployment_type(
+    k8s: &Arc<K8sClient>,
+    desired_namespace: &str,
+) -> Result<ArgoDeploymentType, InterpretError> {
+    let discovered = discover_argo_all(k8s).await?;
+    debug!("Discovered argo instances {discovered:?}");
+
+    if discovered.is_empty() {
+        return Ok(ArgoDeploymentType::NotInstalled);
+    }
+
+    if let Some(d) = discovered
+        .iter()
+        .find(|d| d.control_namespace == desired_namespace)
+    {
+        return Ok(ArgoDeploymentType::AvailableInDesiredNamespace(
+            d.control_namespace.clone(),
+        ));
+    }
+
+    if let Some(d) = discovered
+        .iter()
+        .find(|d| matches!(d.scope, ArgoScope::ClusterWide(_)))
+    {
+        return Ok(ArgoDeploymentType::InstalledClusterWide(
+            d.control_namespace.clone(),
+        ));
+    }
+
+    Ok(ArgoDeploymentType::InstalledNamespaceScoped(
+        discovered[0].control_namespace.clone(),
+    ))
+}

harmony/src/modules/inventory/discovery.rs

@@ -74,11 +74,7 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
 
             match ans {
                 Ok(choice) => {
-                    info!(
-                        "Selected {} as the {:?} node.",
-                        choice.summary(),
-                        self.score.role
-                    );
+                    info!("Selected {} as the bootstrap node.", choice.summary());
                     host_repo
                         .save_role_mapping(&self.score.role, &choice)
                         .await?;
@@ -94,7 +90,10 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
                         "Failed to select node for role {:?} : {}",
                         self.score.role, e
                     );
-                    return Err(InterpretError::new(format!("Could not select host : {e}")));
+                    return Err(InterpretError::new(format!(
+                        "Could not select host : {}",
+                        e.to_string()
+                    )));
                 }
             }
         }

harmony/src/modules/inventory/mod.rs

@@ -90,12 +90,12 @@ impl<T: Topology> Interpret<T> for DiscoverInventoryAgentInterpret {
                             // refactoring to do it now
                             let harmony_inventory_agent::hwinfo::PhysicalHost {
                                 storage_drives,
-                                storage_controller,
+                                storage_controller: _,
                                 memory_modules,
                                 cpus,
-                                chipset,
+                                chipset: _,
                                 network_interfaces,
-                                management_interface,
+                                management_interface: _,
                                 host_uuid,
                             } = host;
 

harmony/src/modules/k8s/resource.rs

@@ -38,15 +38,13 @@ impl<
         + 'static
         + Send
         + Clone,
-    T: Topology + K8sclient,
+    T: Topology,
 > Score<T> for K8sResourceScore<K>
 where
     <K as kube::Resource>::DynamicType: Default,
 {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(K8sResourceInterpret {
-            score: self.clone(),
-        })
+        todo!()
     }
 
     fn name(&self) -> String {

harmony/src/modules/mod.rs

@@ -17,3 +17,4 @@ pub mod prometheus;
 pub mod storage;
 pub mod tenant;
 pub mod tftp;
+pub mod argocd;

harmony/src/modules/monitoring/application_monitoring/application_monitoring_score.rs

@@ -1,23 +1,21 @@
 use std::sync::Arc;
 
-use log::debug;
+use async_trait::async_trait;
 use serde::Serialize;
 
 use crate::{
-    interpret::Interpret,
+    data::Version,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
     modules::{
         application::Application,
-        monitoring::{
-            grafana::grafana::Grafana, kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus,
-        },
-        prometheus::prometheus::PrometheusMonitoring,
+        monitoring::kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus,
+        prometheus::prometheus::PrometheusApplicationMonitoring,
     },
     score::Score,
-    topology::{
-        K8sclient, Topology,
-        oberservability::monitoring::{AlertReceiver, AlertingInterpret, ScrapeTarget},
-    },
+    topology::{PreparationOutcome, Topology, oberservability::monitoring::AlertReceiver},
 };
+use harmony_types::id::Id;
 
 #[derive(Debug, Clone, Serialize)]
 pub struct ApplicationMonitoringScore {
@@ -26,16 +24,12 @@ pub struct ApplicationMonitoringScore {
     pub receivers: Vec<Box<dyn AlertReceiver<CRDPrometheus>>>,
 }
 
-impl<T: Topology + PrometheusMonitoring<CRDPrometheus> + K8sclient + Grafana> Score<T>
+impl<T: Topology + PrometheusApplicationMonitoring<CRDPrometheus>> Score<T>
     for ApplicationMonitoringScore
 {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        debug!("creating alerting interpret");
-        Box::new(AlertingInterpret {
-            sender: self.sender.clone(),
-            receivers: self.receivers.clone(),
-            rules: vec![],
-            scrape_targets: None,
+        Box::new(ApplicationMonitoringInterpret {
+            score: self.clone(),
         })
     }
 
@@ -46,3 +40,55 @@ impl<T: Topology + PrometheusMonitoring<CRDPrometheus> + K8sclient + Grafana> Sc
         )
     }
 }
+
+#[derive(Debug)]
+pub struct ApplicationMonitoringInterpret {
+    score: ApplicationMonitoringScore,
+}
+
+#[async_trait]
+impl<T: Topology + PrometheusApplicationMonitoring<CRDPrometheus>> Interpret<T>
+    for ApplicationMonitoringInterpret
+{
+    async fn execute(
+        &self,
+        inventory: &Inventory,
+        topology: &T,
+    ) -> Result<Outcome, InterpretError> {
+        let result = topology
+            .install_prometheus(
+                &self.score.sender,
+                inventory,
+                Some(self.score.receivers.clone()),
+            )
+            .await;
+
+        match result {
+            Ok(outcome) => match outcome {
+                PreparationOutcome::Success { details: _ } => {
+                    Ok(Outcome::success("Prometheus installed".into()))
+                }
+                PreparationOutcome::Noop => {
+                    Ok(Outcome::noop("Prometheus installation skipped".into()))
+                }
+            },
+            Err(err) => Err(InterpretError::from(err)),
+        }
+    }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::ApplicationMonitoring
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}

harmony/src/modules/monitoring/application_monitoring/rhobs_application_monitoring_score.rs

@@ -12,7 +12,7 @@ use crate::{
         monitoring::kube_prometheus::crd::{
             crd_alertmanager_config::CRDPrometheus, rhob_alertmanager_config::RHOBObservability,
         },
-        prometheus::prometheus::PrometheusMonitoring,
+        prometheus::prometheus::PrometheusApplicationMonitoring,
     },
     score::Score,
     topology::{PreparationOutcome, Topology, oberservability::monitoring::AlertReceiver},
@@ -26,7 +26,7 @@ pub struct ApplicationRHOBMonitoringScore {
     pub receivers: Vec<Box<dyn AlertReceiver<RHOBObservability>>>,
 }
 
-impl<T: Topology + PrometheusMonitoring<RHOBObservability>> Score<T>
+impl<T: Topology + PrometheusApplicationMonitoring<RHOBObservability>> Score<T>
     for ApplicationRHOBMonitoringScore
 {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
@@ -49,7 +49,7 @@ pub struct ApplicationRHOBMonitoringInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + PrometheusMonitoring<RHOBObservability>> Interpret<T>
+impl<T: Topology + PrometheusApplicationMonitoring<RHOBObservability>> Interpret<T>
     for ApplicationRHOBMonitoringInterpret
 {
     async fn execute(

harmony/src/modules/monitoring/grafana/grafana.rs

@@ -1,17 +0,0 @@
-use async_trait::async_trait;
-use k8s_openapi::Resource;
-
-use crate::{
-    inventory::Inventory,
-    topology::{PreparationError, PreparationOutcome},
-};
-
-#[async_trait]
-pub trait Grafana {
-    async fn ensure_grafana_operator(
-        &self,
-        inventory: &Inventory,
-    ) -> Result<PreparationOutcome, PreparationError>;
-
-    async fn install_grafana(&self) -> Result<PreparationOutcome, PreparationError>;
-}

harmony/src/modules/monitoring/grafana/helm/helm_grafana.rs

@@ -1,28 +1,27 @@
-use harmony_macros::hurl;
 use non_blank_string_rs::NonBlankString;
-use std::{collections::HashMap, str::FromStr};
+use std::str::FromStr;
 
-use crate::modules::helm::chart::{HelmChartScore, HelmRepository};
+use crate::modules::helm::chart::HelmChartScore;
+
+pub fn grafana_helm_chart_score(ns: &str) -> HelmChartScore {
+    let values = r#"
+rbac:
+  namespaced: true
+sidecar:
+  dashboards:
+    enabled: true
+        "#
+    .to_string();
 
-pub fn grafana_helm_chart_score(ns: &str, namespace_scope: bool) -> HelmChartScore {
-    let mut values_overrides = HashMap::new();
-    values_overrides.insert(
-        NonBlankString::from_str("namespaceScope").unwrap(),
-        namespace_scope.to_string(),
-    );
     HelmChartScore {
         namespace: Some(NonBlankString::from_str(ns).unwrap()),
-        release_name: NonBlankString::from_str("grafana-operator").unwrap(),
-        chart_name: NonBlankString::from_str("grafana/grafana-operator").unwrap(),
+        release_name: NonBlankString::from_str("grafana").unwrap(),
+        chart_name: NonBlankString::from_str("oci://ghcr.io/grafana/helm-charts/grafana").unwrap(),
         chart_version: None,
-        values_overrides: Some(values_overrides),
-        values_yaml: None,
+        values_overrides: None,
+        values_yaml: Some(values.to_string()),
         create_namespace: true,
         install_only: true,
-        repository: Some(HelmRepository::new(
-            "grafana".to_string(),
-            hurl!("https://grafana.github.io/helm-charts"),
-            true,
-        )),
+        repository: None,
     }
 }

harmony/src/modules/monitoring/grafana/mod.rs

@@ -1,2 +1 @@
-pub mod grafana;
 pub mod helm;

harmony/src/modules/monitoring/kube_prometheus/crd/crd_alertmanager_config.rs

@@ -1,25 +1,12 @@
 use std::sync::Arc;
 
-use async_trait::async_trait;
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::{
-    interpret::{InterpretError, Outcome},
-    inventory::Inventory,
-    modules::{
-        monitoring::{
-            grafana::grafana::Grafana, kube_prometheus::crd::service_monitor::ServiceMonitor,
-        },
-        prometheus::prometheus::PrometheusMonitoring,
-    },
-    topology::{
-        K8sclient, Topology,
-        installable::Installable,
-        k8s::K8sClient,
-        oberservability::monitoring::{AlertReceiver, AlertSender, ScrapeTarget},
-    },
+use crate::topology::{
+    k8s::K8sClient,
+    oberservability::monitoring::{AlertReceiver, AlertSender},
 };
 
 #[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
@@ -39,7 +26,6 @@ pub struct AlertmanagerConfigSpec {
 pub struct CRDPrometheus {
     pub namespace: String,
     pub client: Arc<K8sClient>,
-    pub service_monitor: Vec<ServiceMonitor>,
 }
 
 impl AlertSender for CRDPrometheus {
@@ -54,12 +40,6 @@ impl Clone for Box<dyn AlertReceiver<CRDPrometheus>> {
     }
 }
 
-impl Clone for Box<dyn ScrapeTarget<CRDPrometheus>> {
-    fn clone(&self) -> Self {
-        self.clone_box()
-    }
-}
-
 impl Serialize for Box<dyn AlertReceiver<CRDPrometheus>> {
     fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
     where
@@ -68,24 +48,3 @@ impl Serialize for Box<dyn AlertReceiver<CRDPrometheus>> {
         todo!()
     }
 }
-
-#[async_trait]
-impl<T: Topology + K8sclient + PrometheusMonitoring<CRDPrometheus> + Grafana> Installable<T>
-    for CRDPrometheus
-{
-    async fn configure(&self, inventory: &Inventory, topology: &T) -> Result<(), InterpretError> {
-        topology.ensure_grafana_operator(inventory).await?;
-        topology.ensure_prometheus_operator(self, inventory).await?;
-        Ok(())
-    }
-
-    async fn ensure_installed(
-        &self,
-        inventory: &Inventory,
-        topology: &T,
-    ) -> Result<(), InterpretError> {
-        topology.install_grafana().await?;
-        topology.install_prometheus(&self, inventory, None).await?;
-        Ok(())
-    }
-}

harmony/src/modules/monitoring/kube_prometheus/crd/crd_grafana.rs

@@ -103,34 +103,9 @@ pub struct GrafanaDashboardSpec {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub resync_period: Option<String>,
 
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub datasources: Option<Vec<GrafanaDashboardDatasource>>,
-
     pub instance_selector: LabelSelector,
 
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub json: Option<String>,
-
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub grafana_com: Option<GrafanaCom>,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct GrafanaDashboardDatasource {
-    pub input_name: String,
-    pub datasource_name: String,
-}
-
-// ------------------------------------------------------------------------------------------------
-
-#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct GrafanaCom {
-    pub id: u32,
-
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub revision: Option<u32>,
+    pub json: String,
 }
 
 // ------------------------------------------------------------------------------------------------
@@ -151,79 +126,20 @@ pub struct GrafanaDatasourceSpec {
     pub allow_cross_namespace_import: Option<bool>,
 
     pub datasource: GrafanaDatasourceConfig,
-
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub values_from: Option<Vec<GrafanaValueFrom>>,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct GrafanaValueFrom {
-    pub target_path: String,
-    pub value_from: GrafanaValueSource,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct GrafanaValueSource {
-    pub secret_key_ref: GrafanaSecretKeyRef,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct GrafanaSecretKeyRef {
-    pub name: String,
-    pub key: String,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct GrafanaDatasourceConfig {
     pub access: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub database: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub json_data: Option<BTreeMap<String, String>>,
     pub name: String,
     pub r#type: String,
     pub url: String,
-    /// Represents jsonData in the GrafanaDatasource spec
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub json_data: Option<GrafanaDatasourceJsonData>,
-
-    /// Represents secureJsonData (secrets)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub secure_json_data: Option<GrafanaDatasourceSecureJsonData>,
-
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub is_default: Option<bool>,
-
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub editable: Option<bool>,
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct GrafanaDatasourceJsonData {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub time_interval: Option<String>,
-
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub http_header_name1: Option<String>,
-
-    /// Disable TLS skip verification (false = verify)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tls_skip_verify: Option<bool>,
-
-    /// Auth type - set to "forward" for OpenShift OAuth identity
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub oauth_pass_thru: Option<bool>,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct GrafanaDatasourceSecureJsonData {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub http_header_value1: Option<String>,
-}
 // ------------------------------------------------------------------------------------------------
 
 #[derive(Serialize, Deserialize, Debug, Clone, JsonSchema, Default)]

harmony/src/modules/monitoring/kube_prometheus/crd/rhob_monitoring_stack.rs

@@ -1,12 +1,8 @@
-use std::collections::BTreeMap;
-
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::{
-    LabelSelector, PrometheusSpec,
-};
+use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::LabelSelector;
 
 /// MonitoringStack CRD for monitoring.rhobs/v1alpha1
 #[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]

harmony/src/modules/monitoring/ntfy/ntfy.rs

@@ -100,7 +100,11 @@ impl<T: Topology + HelmCommand + K8sclient + MultiTargetTopology> Interpret<T> f
 
         info!("deploying ntfy...");
         client
-            .wait_until_deployment_ready("ntfy", Some(self.score.namespace.as_str()), None)
+            .wait_until_deployment_ready(
+                "ntfy".to_string(),
+                Some(self.score.namespace.as_str()),
+                None,
+            )
             .await?;
         info!("ntfy deployed");
 

harmony/src/modules/monitoring/prometheus/prometheus.rs

@@ -114,7 +114,7 @@ impl Prometheus {
         };
 
         if let Some(ns) = namespace.as_deref() {
-            grafana_helm_chart_score(ns, false)
+            grafana_helm_chart_score(ns)
                 .interpret(inventory, topology)
                 .await
         } else {

harmony/src/modules/monitoring/scrape_target/server.rs

@@ -73,8 +73,4 @@ impl ScrapeTarget<CRDPrometheus> for Server {
             self.name.clone()
         )))
     }
-
-    fn clone_box(&self) -> Box<dyn ScrapeTarget<CRDPrometheus>> {
-        Box::new(self.clone())
-    }
 }

harmony/src/modules/okd/bootstrap_03_control_plane.rs

@@ -1,8 +1,22 @@
 use crate::{
-    interpret::Interpret, inventory::HostRole, modules::okd::bootstrap_okd_node::OKDNodeInterpret,
-    score::Score, topology::HAClusterTopology,
+    data::Version,
+    hardware::PhysicalHost,
+    infra::inventory::InventoryRepositoryFactory,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::{HostRole, Inventory},
+    modules::{
+        dhcp::DhcpHostBindingScore,
+        http::IPxeMacBootFileScore,
+        inventory::DiscoverHostForRoleScore,
+        okd::{host_network::HostNetworkConfigurationScore, templates::BootstrapIpxeTpl},
+    },
+    score::Score,
+    topology::{HAClusterTopology, HostBinding},
 };
+use async_trait::async_trait;
 use derive_new::new;
+use harmony_types::id::Id;
+use log::{debug, info};
 use serde::Serialize;
 
 // -------------------------------------------------------------------------------------------------
@@ -16,13 +30,252 @@ pub struct OKDSetup03ControlPlaneScore {}
 
 impl Score<HAClusterTopology> for OKDSetup03ControlPlaneScore {
     fn create_interpret(&self) -> Box<dyn Interpret<HAClusterTopology>> {
-        // TODO: Implement a step to wait for the control plane nodes to join the cluster
-        // and for the cluster operators to become available. This would be similar to
-        // the `wait-for bootstrap-complete` command.
-        Box::new(OKDNodeInterpret::new(HostRole::ControlPlane))
+        Box::new(OKDSetup03ControlPlaneInterpret::new())
     }
 
     fn name(&self) -> String {
         "OKDSetup03ControlPlaneScore".to_string()
     }
 }
+
+#[derive(Debug, Clone)]
+pub struct OKDSetup03ControlPlaneInterpret {
+    version: Version,
+    status: InterpretStatus,
+}
+
+impl OKDSetup03ControlPlaneInterpret {
+    pub fn new() -> Self {
+        let version = Version::from("1.0.0").unwrap();
+        Self {
+            version,
+            status: InterpretStatus::QUEUED,
+        }
+    }
+
+    /// Ensures that three physical hosts are discovered and available for the ControlPlane role.
+    /// It will trigger discovery if not enough hosts are found.
+    async fn get_nodes(
+        &self,
+        inventory: &Inventory,
+        topology: &HAClusterTopology,
+    ) -> Result<Vec<PhysicalHost>, InterpretError> {
+        const REQUIRED_HOSTS: usize = 3;
+        let repo = InventoryRepositoryFactory::build().await?;
+        let mut control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
+
+        while control_plane_hosts.len() < REQUIRED_HOSTS {
+            info!(
+                "Discovery of {} control plane hosts in progress, current number {}",
+                REQUIRED_HOSTS,
+                control_plane_hosts.len()
+            );
+            // This score triggers the discovery agent for a specific role.
+            DiscoverHostForRoleScore {
+                role: HostRole::ControlPlane,
+            }
+            .interpret(inventory, topology)
+            .await?;
+            control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
+        }
+
+        if control_plane_hosts.len() < REQUIRED_HOSTS {
+            Err(InterpretError::new(format!(
+                "OKD Requires at least {} control plane hosts, but only found {}. Cannot proceed.",
+                REQUIRED_HOSTS,
+                control_plane_hosts.len()
+            )))
+        } else {
+            // Take exactly the number of required hosts to ensure consistency.
+            Ok(control_plane_hosts
+                .into_iter()
+                .take(REQUIRED_HOSTS)
+                .collect())
+        }
+    }
+
+    /// Configures DHCP host bindings for all control plane nodes.
+    async fn configure_host_binding(
+        &self,
+        inventory: &Inventory,
+        topology: &HAClusterTopology,
+        nodes: &Vec<PhysicalHost>,
+    ) -> Result<(), InterpretError> {
+        info!("[ControlPlane] Configuring host bindings for control plane nodes.");
+
+        // Ensure the topology definition matches the number of physical nodes found.
+        if topology.control_plane.len() != nodes.len() {
+            return Err(InterpretError::new(format!(
+                "Mismatch between logical control plane hosts defined in topology ({}) and physical nodes found ({}).",
+                topology.control_plane.len(),
+                nodes.len()
+            )));
+        }
+
+        // Create a binding for each physical host to its corresponding logical host.
+        let bindings: Vec<HostBinding> = topology
+            .control_plane
+            .iter()
+            .zip(nodes.iter())
+            .map(|(logical_host, physical_host)| {
+                info!(
+                    "Creating binding: Logical Host '{}' -> Physical Host ID '{}'",
+                    logical_host.name, physical_host.id
+                );
+                HostBinding {
+                    logical_host: logical_host.clone(),
+                    physical_host: physical_host.clone(),
+                }
+            })
+            .collect();
+
+        DhcpHostBindingScore {
+            host_binding: bindings,
+            domain: Some(topology.domain_name.clone()),
+        }
+        .interpret(inventory, topology)
+        .await?;
+
+        Ok(())
+    }
+
+    /// Renders and deploys a per-MAC iPXE boot file for each control plane node.
+    async fn configure_ipxe(
+        &self,
+        inventory: &Inventory,
+        topology: &HAClusterTopology,
+        nodes: &Vec<PhysicalHost>,
+    ) -> Result<(), InterpretError> {
+        info!("[ControlPlane] Rendering per-MAC iPXE configurations.");
+
+        // The iPXE script content is the same for all control plane nodes,
+        // pointing to the 'master.ign' ignition file.
+        let content = BootstrapIpxeTpl {
+            http_ip: &topology.http_server.get_ip().to_string(),
+            scos_path: "scos",
+            ignition_http_path: "okd_ignition_files",
+            installation_device: "/dev/sda", // This might need to be configurable per-host in the future
+            ignition_file_name: "master.ign", // Control plane nodes use the master ignition file
+        }
+        .to_string();
+
+        debug!("[ControlPlane] iPXE content template:\n{content}");
+
+        // Create and apply an iPXE boot file for each node.
+        for node in nodes {
+            let mac_address = node.get_mac_address();
+            if mac_address.is_empty() {
+                return Err(InterpretError::new(format!(
+                    "Physical host with ID '{}' has no MAC addresses defined.",
+                    node.id
+                )));
+            }
+            info!(
+                "[ControlPlane] Applying iPXE config for node ID '{}' with MACs: {:?}",
+                node.id, mac_address
+            );
+
+            IPxeMacBootFileScore {
+                mac_address,
+                content: content.clone(),
+            }
+            .interpret(inventory, topology)
+            .await?;
+        }
+
+        Ok(())
+    }
+
+    /// Prompts the user to reboot the target control plane nodes.
+    async fn reboot_targets(&self, nodes: &Vec<PhysicalHost>) -> Result<(), InterpretError> {
+        let node_ids: Vec<String> = nodes.iter().map(|n| n.id.to_string()).collect();
+        info!("[ControlPlane] Requesting reboot for control plane nodes: {node_ids:?}",);
+
+        let confirmation = inquire::Confirm::new(
+                &format!("Please reboot the {} control plane nodes ({}) to apply their PXE configuration. Press enter when ready.", nodes.len(), node_ids.join(", ")),
+        )
+        .prompt()
+        .map_err(|e| InterpretError::new(format!("User prompt failed: {e}")))?;
+
+        if !confirmation {
+            return Err(InterpretError::new(
+                "User aborted the operation.".to_string(),
+            ));
+        }
+
+        Ok(())
+    }
+
+    /// Placeholder for automating network bonding configuration.
+    async fn persist_network_bond(
+        &self,
+        inventory: &Inventory,
+        topology: &HAClusterTopology,
+        hosts: &Vec<PhysicalHost>,
+    ) -> Result<(), InterpretError> {
+        info!("[ControlPlane] Ensuring persistent bonding");
+        let score = HostNetworkConfigurationScore {
+            hosts: hosts.clone(),
+        };
+        score.interpret(inventory, topology).await?;
+
+        inquire::Confirm::new(
+            "Network configuration for control plane nodes is not automated yet. Configure it manually if needed.",
+        )
+        .prompt()
+        .map_err(|e| InterpretError::new(format!("User prompt failed: {e}")))?;
+
+        Ok(())
+    }
+}
+
+#[async_trait]
+impl Interpret<HAClusterTopology> for OKDSetup03ControlPlaneInterpret {
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("OKDSetup03ControlPlane")
+    }
+
+    fn get_version(&self) -> Version {
+        self.version.clone()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        self.status.clone()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        vec![]
+    }
+
+    async fn execute(
+        &self,
+        inventory: &Inventory,
+        topology: &HAClusterTopology,
+    ) -> Result<Outcome, InterpretError> {
+        // 1. Ensure we have 3 physical hosts for the control plane.
+        let nodes = self.get_nodes(inventory, topology).await?;
+
+        // 2. Create DHCP reservations for the control plane nodes.
+        self.configure_host_binding(inventory, topology, &nodes)
+            .await?;
+
+        // 3. Create iPXE files for each control plane node to boot from the master ignition.
+        self.configure_ipxe(inventory, topology, &nodes).await?;
+
+        // 4. Reboot the nodes to start the OS installation.
+        self.reboot_targets(&nodes).await?;
+
+        // 5. Placeholder for post-boot network configuration (e.g., bonding).
+        self.persist_network_bond(inventory, topology, &nodes)
+            .await?;
+
+        // TODO: Implement a step to wait for the control plane nodes to join the cluster
+        // and for the cluster operators to become available. This would be similar to
+        // the `wait-for bootstrap-complete` command.
+        info!("[ControlPlane] Provisioning initiated. Monitor the cluster convergence manually.");
+
+        Ok(Outcome::success(
+            "Control plane provisioning has been successfully initiated.".into(),
+        ))
+    }
+}

harmony/src/modules/okd/bootstrap_04_workers.rs

@@ -1,9 +1,15 @@
+use async_trait::async_trait;
 use derive_new::new;
+use harmony_types::id::Id;
+use log::info;
 use serde::Serialize;
 
 use crate::{
-    interpret::Interpret, inventory::HostRole, modules::okd::bootstrap_okd_node::OKDNodeInterpret,
-    score::Score, topology::HAClusterTopology,
+    data::Version,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
+    score::Score,
+    topology::HAClusterTopology,
 };
 
 // -------------------------------------------------------------------------------------------------
@@ -17,10 +23,61 @@ pub struct OKDSetup04WorkersScore {}
 
 impl Score<HAClusterTopology> for OKDSetup04WorkersScore {
     fn create_interpret(&self) -> Box<dyn Interpret<HAClusterTopology>> {
-        Box::new(OKDNodeInterpret::new(HostRole::Worker))
+        Box::new(OKDSetup04WorkersInterpret::new(self.clone()))
     }
 
     fn name(&self) -> String {
         "OKDSetup04WorkersScore".to_string()
     }
 }
+
+#[derive(Debug, Clone)]
+pub struct OKDSetup04WorkersInterpret {
+    score: OKDSetup04WorkersScore,
+    version: Version,
+    status: InterpretStatus,
+}
+
+impl OKDSetup04WorkersInterpret {
+    pub fn new(score: OKDSetup04WorkersScore) -> Self {
+        let version = Version::from("1.0.0").unwrap();
+        Self {
+            version,
+            score,
+            status: InterpretStatus::QUEUED,
+        }
+    }
+
+    async fn render_and_reboot(&self) -> Result<(), InterpretError> {
+        info!("[Workers] Rendering per-MAC PXE for workers and rebooting");
+        Ok(())
+    }
+}
+
+#[async_trait]
+impl Interpret<HAClusterTopology> for OKDSetup04WorkersInterpret {
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("OKDSetup04Workers")
+    }
+
+    fn get_version(&self) -> Version {
+        self.version.clone()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        self.status.clone()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        vec![]
+    }
+
+    async fn execute(
+        &self,
+        _inventory: &Inventory,
+        _topology: &HAClusterTopology,
+    ) -> Result<Outcome, InterpretError> {
+        self.render_and_reboot().await?;
+        Ok(Outcome::success("Workers provisioned".into()))
+    }
+}

harmony/src/modules/okd/bootstrap_okd_node.rs

@@ -1,303 +0,0 @@
-use async_trait::async_trait;
-use derive_new::new;
-use harmony_types::id::Id;
-use log::{debug, info};
-use serde::Serialize;
-
-use crate::{
-    data::Version,
-    hardware::PhysicalHost,
-    infra::inventory::InventoryRepositoryFactory,
-    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
-    inventory::{HostRole, Inventory},
-    modules::{
-        dhcp::DhcpHostBindingScore,
-        http::IPxeMacBootFileScore,
-        inventory::DiscoverHostForRoleScore,
-        okd::{
-            okd_node::{
-                BootstrapRole, ControlPlaneRole, OKDRoleProperties, StorageRole, WorkerRole,
-            },
-            templates::BootstrapIpxeTpl,
-        },
-    },
-    score::Score,
-    topology::{HAClusterTopology, HostBinding, LogicalHost},
-};
-
-#[derive(Debug, Clone, Serialize, new)]
-pub struct OKDNodeInstallationScore {
-    host_role: HostRole,
-}
-
-impl Score<HAClusterTopology> for OKDNodeInstallationScore {
-    fn name(&self) -> String {
-        "OKDNodeScore".to_string()
-    }
-
-    fn create_interpret(&self) -> Box<dyn Interpret<HAClusterTopology>> {
-        Box::new(OKDNodeInterpret::new(self.host_role.clone()))
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct OKDNodeInterpret {
-    host_role: HostRole,
-}
-
-impl OKDNodeInterpret {
-    pub fn new(host_role: HostRole) -> Self {
-        Self { host_role }
-    }
-
-    fn okd_role_properties(&self, role: &HostRole) -> &'static dyn OKDRoleProperties {
-        match role {
-            HostRole::Bootstrap => &BootstrapRole,
-            HostRole::ControlPlane => &ControlPlaneRole,
-            HostRole::Worker => &WorkerRole,
-        }
-    }
-
-    async fn get_nodes(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-    ) -> Result<Vec<PhysicalHost>, InterpretError> {
-        let repo = InventoryRepositoryFactory::build().await?;
-
-        let mut hosts = repo.get_host_for_role(&self.host_role).await?;
-
-        let okd_host_properties = self.okd_role_properties(&self.host_role);
-
-        let required_hosts: usize = okd_host_properties.required_hosts();
-
-        while hosts.len() < required_hosts {
-            info!(
-                "Discovery of {} {} hosts in progress, current number {}",
-                required_hosts,
-                self.host_role,
-                hosts.len()
-            );
-            // This score triggers the discovery agent for a specific role.
-            DiscoverHostForRoleScore {
-                role: self.host_role.clone(),
-            }
-            .interpret(inventory, topology)
-            .await?;
-            hosts = repo.get_host_for_role(&self.host_role).await?;
-        }
-
-        if hosts.len() < required_hosts {
-            Err(InterpretError::new(format!(
-                "OKD Requires at least {} {} hosts, but only found {}. Cannot proceed.",
-                required_hosts,
-                self.host_role,
-                hosts.len()
-            )))
-        } else {
-            // Take exactly the number of required hosts to ensure consistency.
-            Ok(hosts.into_iter().take(required_hosts).collect())
-        }
-    }
-
-    /// Configures DHCP host bindings for all nodes.
-    async fn configure_host_binding(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-        nodes: &Vec<PhysicalHost>,
-    ) -> Result<(), InterpretError> {
-        info!(
-            "[{}] Configuring host bindings for {} plane nodes.",
-            self.host_role, self.host_role,
-        );
-
-        let host_properties = self.okd_role_properties(&self.host_role);
-
-        self.validate_host_node_match(nodes, host_properties.logical_hosts(topology))?;
-
-        let bindings: Vec<HostBinding> =
-            self.host_bindings(nodes, host_properties.logical_hosts(topology));
-
-        DhcpHostBindingScore {
-            host_binding: bindings,
-            domain: Some(topology.domain_name.clone()),
-        }
-        .interpret(inventory, topology)
-        .await?;
-
-        Ok(())
-    }
-
-    // Ensure the topology definition matches the number of physical nodes found.
-    fn validate_host_node_match(
-        &self,
-        nodes: &Vec<PhysicalHost>,
-        hosts: &Vec<LogicalHost>,
-    ) -> Result<(), InterpretError> {
-        if hosts.len() != nodes.len() {
-            return Err(InterpretError::new(format!(
-                "Mismatch between logical hosts defined in topology ({}) and physical nodes found ({}).",
-                hosts.len(),
-                nodes.len()
-            )));
-        }
-        Ok(())
-    }
-
-    // Create a binding for each physical host to its corresponding logical host.
-    fn host_bindings(
-        &self,
-        nodes: &Vec<PhysicalHost>,
-        hosts: &Vec<LogicalHost>,
-    ) -> Vec<HostBinding> {
-        hosts
-            .iter()
-            .zip(nodes.iter())
-            .map(|(logical_host, physical_host)| {
-                info!(
-                    "Creating binding: Logical Host '{}' -> Physical Host ID '{}'",
-                    logical_host.name, physical_host.id
-                );
-                HostBinding {
-                    logical_host: logical_host.clone(),
-                    physical_host: physical_host.clone(),
-                }
-            })
-            .collect()
-    }
-
-    /// Renders and deploys a per-MAC iPXE boot file for each node.
-    async fn configure_ipxe(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-        nodes: &Vec<PhysicalHost>,
-    ) -> Result<(), InterpretError> {
-        info!(
-            "[{}] Rendering per-MAC iPXE configurations.",
-            self.host_role
-        );
-
-        let okd_role_properties = self.okd_role_properties(&self.host_role);
-        // The iPXE script content is the same for all control plane nodes,
-        // pointing to the 'master.ign' ignition file.
-        let content = BootstrapIpxeTpl {
-            http_ip: &topology.http_server.get_ip().to_string(),
-            scos_path: "scos",
-            ignition_http_path: "okd_ignition_files",
-            //TODO must be refactored to not only use /dev/sda
-            installation_device: "/dev/sda", // This might need to be configurable per-host in the future
-            ignition_file_name: okd_role_properties.ignition_file(),
-        }
-        .to_string();
-
-        debug!("[{}] iPXE content template:\n{content}", self.host_role);
-
-        // Create and apply an iPXE boot file for each node.
-        for node in nodes {
-            let mac_address = node.get_mac_address();
-            if mac_address.is_empty() {
-                return Err(InterpretError::new(format!(
-                    "Physical host with ID '{}' has no MAC addresses defined.",
-                    node.id
-                )));
-            }
-            info!(
-                "[{}] Applying iPXE config for node ID '{}' with MACs: {:?}",
-                self.host_role, node.id, mac_address
-            );
-
-            IPxeMacBootFileScore {
-                mac_address,
-                content: content.clone(),
-            }
-            .interpret(inventory, topology)
-            .await?;
-        }
-
-        Ok(())
-    }
-
-    /// Prompts the user to reboot the target control plane nodes.
-    async fn reboot_targets(&self, nodes: &Vec<PhysicalHost>) -> Result<(), InterpretError> {
-        let node_ids: Vec<String> = nodes.iter().map(|n| n.id.to_string()).collect();
-        info!(
-            "[{}] Requesting reboot for control plane nodes: {node_ids:?}",
-            self.host_role
-        );
-
-        let confirmation = inquire::Confirm::new(
-                &format!("Please reboot the {} {} nodes ({}) to apply their PXE configuration. Press enter when ready.", nodes.len(), self.host_role, node_ids.join(", ")),
-        )
-        .prompt()
-        .map_err(|e| InterpretError::new(format!("User prompt failed: {e}")))?;
-
-        if !confirmation {
-            return Err(InterpretError::new(
-                "User aborted the operation.".to_string(),
-            ));
-        }
-
-        Ok(())
-    }
-}
-
-#[async_trait]
-impl Interpret<HAClusterTopology> for OKDNodeInterpret {
-    async fn execute(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-    ) -> Result<Outcome, InterpretError> {
-        // 1. Ensure we have the specfied number of physical hosts.
-        let nodes = self.get_nodes(inventory, topology).await?;
-
-        // 2. Create DHCP reservations for the nodes.
-        self.configure_host_binding(inventory, topology, &nodes)
-            .await?;
-
-        // 3. Create iPXE files for each node to boot from the ignition.
-        self.configure_ipxe(inventory, topology, &nodes).await?;
-
-        // 4. Reboot the nodes to start the OS installation.
-        self.reboot_targets(&nodes).await?;
-        // TODO: Implement a step to validate that the installation of the nodes is
-        // complete and for the cluster operators to become available.
-        //
-        // The OpenShift installer only provides two wait commands which currently need to be
-        // run manually:
-        //   - `openshift-install wait-for bootstrap-complete`
-        //   - `openshift-install wait-for install-complete`
-        //
-        // There is no installer command that waits specifically for worker node
-        // provisioning. Worker nodes join asynchronously (via ignition + CSR approval),
-        // and the cluster becomes fully functional only once all nodes are Ready and the
-        // cluster operators report Available=True.
-        info!(
-            "[{}] Provisioning initiated. Monitor the cluster convergence manually.",
-            self.host_role
-        );
-
-        Ok(Outcome::success(format!(
-            "{} provisioning has been successfully initiated.",
-            self.host_role
-        )))
-    }
-
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("OKDNodeSetup".into())
-    }
-
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-}

harmony/src/modules/okd/bootstrap_persist_network_bond.rs

@@ -1,130 +0,0 @@
-use crate::{
-    data::Version,
-    hardware::PhysicalHost,
-    infra::inventory::InventoryRepositoryFactory,
-    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
-    inventory::{HostRole, Inventory},
-    modules::okd::host_network::HostNetworkConfigurationScore,
-    score::Score,
-    topology::HAClusterTopology,
-};
-use async_trait::async_trait;
-use derive_new::new;
-use harmony_types::id::Id;
-use log::info;
-use serde::Serialize;
-
-// -------------------------------------------------------------------------------------------------
-// Persist Network Bond
-// - Persist bonding via NMState
-// - Persist port channels on the Switch
-// -------------------------------------------------------------------------------------------------
-
-#[derive(Debug, Clone, Serialize, new)]
-pub struct OKDSetupPersistNetworkBondScore {}
-
-impl Score<HAClusterTopology> for OKDSetupPersistNetworkBondScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<HAClusterTopology>> {
-        Box::new(OKDSetupPersistNetworkBondInterpet::new())
-    }
-
-    fn name(&self) -> String {
-        "OKDSetupPersistNetworkBondScore".to_string()
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct OKDSetupPersistNetworkBondInterpet {
-    version: Version,
-    status: InterpretStatus,
-}
-
-impl OKDSetupPersistNetworkBondInterpet {
-    pub fn new() -> Self {
-        let version = Version::from("1.0.0").unwrap();
-        Self {
-            version,
-            status: InterpretStatus::QUEUED,
-        }
-    }
-
-    /// Ensures that three physical hosts are discovered and available for the ControlPlane role.
-    /// It will trigger discovery if not enough hosts are found.
-    async fn get_nodes(
-        &self,
-        _inventory: &Inventory,
-        _topology: &HAClusterTopology,
-    ) -> Result<Vec<PhysicalHost>, InterpretError> {
-        const REQUIRED_HOSTS: usize = 3;
-        let repo = InventoryRepositoryFactory::build().await?;
-        let control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
-
-        if control_plane_hosts.len() < REQUIRED_HOSTS {
-            Err(InterpretError::new(format!(
-                "OKD Requires at least {} control plane hosts, but only found {}. Cannot proceed.",
-                REQUIRED_HOSTS,
-                control_plane_hosts.len()
-            )))
-        } else {
-            // Take exactly the number of required hosts to ensure consistency.
-            Ok(control_plane_hosts
-                .into_iter()
-                .take(REQUIRED_HOSTS)
-                .collect())
-        }
-    }
-
-    async fn persist_network_bond(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-        hosts: &Vec<PhysicalHost>,
-    ) -> Result<(), InterpretError> {
-        info!("Ensuring persistent bonding");
-
-        let score = HostNetworkConfigurationScore {
-            hosts: hosts.clone(),
-        };
-        score.interpret(inventory, topology).await?;
-
-        Ok(())
-    }
-}
-
-#[async_trait]
-impl Interpret<HAClusterTopology> for OKDSetupPersistNetworkBondInterpet {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("OKDSetupPersistNetworkBondInterpet")
-    }
-
-    fn get_version(&self) -> Version {
-        self.version.clone()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        self.status.clone()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        vec![]
-    }
-
-    async fn execute(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-    ) -> Result<Outcome, InterpretError> {
-        let nodes = self.get_nodes(inventory, topology).await?;
-
-        let res = self.persist_network_bond(inventory, topology, &nodes).await;
-
-        match res {
-            Ok(_) => Ok(Outcome::success(
-                "Network bond successfully persisted".into(),
-            )),
-            Err(_) => Err(InterpretError::new(
-                "Failed to persist network bond".to_string(),
-            )),
-        }
-    }
-}

harmony/src/modules/okd/crd/mod.rs

@@ -1 +1,41 @@
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
 pub mod nmstate;
+
+#[derive(CustomResource, Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[kube(
+    group = "operators.coreos.com",
+    version = "v1",
+    kind = "OperatorGroup",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct OperatorGroupSpec {
+    pub target_namespaces: Vec<String>,
+}
+
+#[derive(CustomResource, Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[kube(
+    group = "operators.coreos.com",
+    version = "v1alpha1",
+    kind = "Subscription",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct SubscriptionSpec {
+    pub name: String,
+    pub source: String,
+    pub source_namespace: String,
+    pub channel: Option<String>,
+    pub install_plan_approval: Option<InstallPlanApproval>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
+pub enum InstallPlanApproval {
+    #[serde(rename = "Automatic")]
+    Automatic,
+    #[serde(rename = "Manual")]
+    Manual,
+}

harmony/src/modules/okd/crd/nmstate.rs

@@ -1,22 +1,14 @@
 use std::collections::BTreeMap;
 
-use k8s_openapi::{ClusterResourceScope, Resource};
-use kube::{CustomResource, api::ObjectMeta};
+use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
 #[derive(CustomResource, Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[kube(
-    group = "nmstate.io",
-    version = "v1",
-    kind = "NMState",
-    plural = "nmstates",
-    namespaced = false
-)]
+#[kube(group = "nmstate.io", version = "v1", kind = "NMState", namespaced)]
 #[serde(rename_all = "camelCase")]
 pub struct NMStateSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub probe_configuration: Option<ProbeConfig>,
 }
 
@@ -48,350 +40,55 @@ pub struct ProbeDns {
     group = "nmstate.io",
     version = "v1",
     kind = "NodeNetworkConfigurationPolicy",
-    namespaced = false
+    namespaced
 )]
 #[serde(rename_all = "camelCase")]
 pub struct NodeNetworkConfigurationPolicySpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub node_selector: Option<BTreeMap<String, String>>,
-    pub desired_state: NetworkState,
-}
-
-// Currently, kube-rs derive doesn't support resources without a `spec` field, so we have
-// to implement it ourselves.
-//
-// Ref:
-// - https://github.com/kube-rs/kube/issues/1763
-// - https://github.com/kube-rs/kube/discussions/1762
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct NodeNetworkState {
-    metadata: ObjectMeta,
-    pub status: NodeNetworkStateStatus,
-}
-
-impl Resource for NodeNetworkState {
-    const API_VERSION: &'static str = "nmstate.io/v1beta1";
-    const GROUP: &'static str = "nmstate.io";
-    const VERSION: &'static str = "v1beta1";
-    const KIND: &'static str = "NodeNetworkState";
-    const URL_PATH_SEGMENT: &'static str = "nodenetworkstates";
-    type Scope = ClusterResourceScope;
-}
-
-impl k8s_openapi::Metadata for NodeNetworkState {
-    type Ty = ObjectMeta;
-
-    fn metadata(&self) -> &Self::Ty {
-        &self.metadata
-    }
-
-    fn metadata_mut(&mut self) -> &mut Self::Ty {
-        &mut self.metadata
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct NodeNetworkStateStatus {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub current_state: Option<NetworkState>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub handler_nmstate_version: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_network_manager_version: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub last_successful_update_time: Option<String>,
-}
-
-/// The NetworkState is the top-level struct, representing the entire
-/// desired or current network state.
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-#[serde(deny_unknown_fields)]
-pub struct NetworkState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hostname: Option<HostNameState>,
-    #[serde(rename = "dns-resolver", skip_serializing_if = "Option::is_none")]
-    pub dns: Option<DnsState>,
-    #[serde(rename = "route-rules", skip_serializing_if = "Option::is_none")]
-    pub rules: Option<RouteRuleState>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub routes: Option<RouteState>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub interfaces: Vec<Interface>,
-    #[serde(rename = "ovs-db", skip_serializing_if = "Option::is_none")]
-    pub ovsdb: Option<OvsDbGlobalConfig>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ovn: Option<OvnConfiguration>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct HostNameState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<String>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct DnsState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<DnsResolverConfig>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<DnsResolverConfig>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct DnsResolverConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub search: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub server: Option<Vec<String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteRuleState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<Vec<RouteRule>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<Vec<RouteRule>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<Vec<Route>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<Vec<Route>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteRule {
-    #[serde(rename = "ip-from", skip_serializing_if = "Option::is_none")]
-    pub ip_from: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub priority: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub route_table: Option<u32>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct Route {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub destination: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metric: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_hop_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_hop_interface: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub table_id: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mtu: Option<u32>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvsDbGlobalConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_ids: Option<BTreeMap<String, String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub other_config: Option<BTreeMap<String, String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvnConfiguration {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bridge_mappings: Option<Vec<OvnBridgeMapping>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvnBridgeMapping {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub localnet: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bridge: Option<String>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(untagged)]
-#[serde(rename_all = "kebab-case")]
-pub enum StpSpec {
-    Bool(bool),
-    Options(StpOptions),
+    pub desired_state: DesiredStateSpec,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct LldpState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled: Option<bool>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvsDb {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_ids: Option<BTreeMap<String, String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub other_config: Option<BTreeMap<String, String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct PatchState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub peer: Option<String>,
+pub struct DesiredStateSpec {
+    pub interfaces: Vec<InterfaceSpec>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct Interface {
+pub struct InterfaceSpec {
     pub name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
-    pub r#type: InterfaceType,
+    pub r#type: String,
     pub state: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub copy_mac_from: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub controller: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ipv4: Option<IpStackSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ipv6: Option<IpStackSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ethernet: Option<EthernetSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub link_aggregation: Option<BondSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vlan: Option<VlanSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vxlan: Option<VxlanSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_vtap: Option<MacVtapSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_vlan: Option<MacVlanSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub infiniband: Option<InfinibandSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub linux_bridge: Option<LinuxBridgeSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    #[serde(alias = "bridge")]
     pub ovs_bridge: Option<OvsBridgeSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ethtool: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub accept_all_mac_addresses: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub identifier: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub lldp: Option<LldpState>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub permanent_mac_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub min_mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mptcp: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub profile_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wait_ip: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ovs_db: Option<OvsDb>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub driver: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub patch: Option<PatchState>,
-}
-
-#[derive(Deserialize, Serialize, Clone, PartialEq, Eq, PartialOrd, Ord, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub enum InterfaceType {
-    #[serde(rename = "unknown")]
-    Unknown,
-    #[serde(rename = "dummy")]
-    Dummy,
-    #[serde(rename = "loopback")]
-    Loopback,
-    #[serde(rename = "linux-bridge")]
-    LinuxBridge,
-    #[serde(rename = "ovs-bridge")]
-    OvsBridge,
-    #[serde(rename = "ovs-interface")]
-    OvsInterface,
-    #[serde(rename = "bond")]
-    Bond,
-    #[serde(rename = "ipvlan")]
-    IpVlan,
-    #[serde(rename = "vlan")]
-    Vlan,
-    #[serde(rename = "vxlan")]
-    Vxlan,
-    #[serde(rename = "mac-vlan")]
-    Macvlan,
-    #[serde(rename = "mac-vtap")]
-    Macvtap,
-    #[serde(rename = "ethernet")]
-    Ethernet,
-    #[serde(rename = "infiniband")]
-    Infiniband,
-    #[serde(rename = "vrf")]
-    Vrf,
-    #[serde(rename = "veth")]
-    Veth,
-    #[serde(rename = "ipsec")]
-    Ipsec,
-    #[serde(rename = "hsr")]
-    Hrs,
-}
-
-impl Default for InterfaceType {
-    fn default() -> Self {
-        Self::Loopback
-    }
+    pub ethtool: Option<EthtoolSpec>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct IpStackSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub dhcp: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub autoconf: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub address: Option<Vec<IpAddressSpec>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_dns: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_gateway: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_routes: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub dhcp_client_id: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub dhcp_duid: Option<String>,
 }
 
@@ -405,11 +102,8 @@ pub struct IpAddressSpec {
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct EthernetSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub speed: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub duplex: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_negotiation: Option<bool>,
 }
 
@@ -417,9 +111,7 @@ pub struct EthernetSpec {
 #[serde(rename_all = "kebab-case")]
 pub struct BondSpec {
     pub mode: String,
-    #[serde(alias = "port")]
     pub ports: Vec<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub options: Option<BTreeMap<String, Value>>,
 }
 
@@ -428,7 +120,6 @@ pub struct BondSpec {
 pub struct VlanSpec {
     pub base_iface: String,
     pub id: u16,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub protocol: Option<String>,
 }
 
@@ -438,11 +129,8 @@ pub struct VxlanSpec {
     pub base_iface: String,
     pub id: u32,
     pub remote: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub local: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub learning: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub destination_port: Option<u16>,
 }
 
@@ -451,7 +139,6 @@ pub struct VxlanSpec {
 pub struct MacVtapSpec {
     pub base_iface: String,
     pub mode: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub promiscuous: Option<bool>,
 }
 
@@ -460,7 +147,6 @@ pub struct MacVtapSpec {
 pub struct MacVlanSpec {
     pub base_iface: String,
     pub mode: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub promiscuous: Option<bool>,
 }
 
@@ -475,35 +161,25 @@ pub struct InfinibandSpec {
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgeSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub options: Option<LinuxBridgeOptions>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ports: Option<Vec<LinuxBridgePort>>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgeOptions {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_ageing_time: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub multicast_snooping: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub stp: Option<StpOptions>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct StpOptions {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub forward_delay: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub hello_time: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub max_age: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub priority: Option<u16>,
 }
 
@@ -511,20 +187,15 @@ pub struct StpOptions {
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgePort {
     pub name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vlan: Option<LinuxBridgePortVlan>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgePortVlan {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mode: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub trunk_tags: Option<Vec<VlanTag>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub tag: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub enable_native: Option<bool>,
 }
 
@@ -532,7 +203,6 @@ pub struct LinuxBridgePortVlan {
 #[serde(rename_all = "kebab-case")]
 pub struct VlanTag {
     pub id: u16,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub id_range: Option<VlanIdRange>,
 }
 
@@ -546,35 +216,36 @@ pub struct VlanIdRange {
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct OvsBridgeSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub options: Option<OvsBridgeOptions>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ports: Option<Vec<OvsPortSpec>>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct OvsBridgeOptions {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stp: Option<StpSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stp: Option<bool>,
     pub rstp: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mcast_snooping_enable: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub datapath: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub fail_mode: Option<String>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct OvsPortSpec {
     pub name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub link_aggregation: Option<BondSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vlan: Option<LinuxBridgePortVlan>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub r#type: Option<String>,
 }
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct EthtoolSpec {
+    // TODO: Properly describe this spec (https://nmstate.io/devel/yaml_api.html#ethtool)
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct EthtoolFecSpec {
+    pub auto: Option<bool>,
+    pub mode: Option<String>,
+}

harmony/src/modules/okd/host_network.rs

@@ -1,6 +1,6 @@
 use async_trait::async_trait;
 use harmony_types::id::Id;
-use log::{info, warn};
+use log::{debug, info};
 use serde::Serialize;
 
 use crate::{
@@ -9,7 +9,7 @@ use crate::{
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
     score::Score,
-    topology::{HostNetworkConfig, NetworkInterface, NetworkManager, Switch, SwitchPort, Topology},
+    topology::{HostNetworkConfig, NetworkInterface, Switch, SwitchPort, Topology},
 };
 
 #[derive(Debug, Clone, Serialize)]
@@ -17,7 +17,7 @@ pub struct HostNetworkConfigurationScore {
     pub hosts: Vec<PhysicalHost>,
 }
 
-impl<T: Topology + NetworkManager + Switch> Score<T> for HostNetworkConfigurationScore {
+impl<T: Topology + Switch> Score<T> for HostNetworkConfigurationScore {
     fn name(&self) -> String {
         "HostNetworkConfigurationScore".into()
     }
@@ -35,91 +35,34 @@ pub struct HostNetworkConfigurationInterpret {
 }
 
 impl HostNetworkConfigurationInterpret {
-    async fn configure_network_for_host<T: Topology + NetworkManager + Switch>(
+    async fn configure_network_for_host<T: Topology + Switch>(
         &self,
         topology: &T,
         host: &PhysicalHost,
-        current_host: &usize,
-        total_hosts: &usize,
-    ) -> Result<HostNetworkConfig, InterpretError> {
-        if host.network.is_empty() {
-            info!("[Host {current_host}/{total_hosts}] No interfaces to configure, skipping");
-            return Ok(HostNetworkConfig {
-                host_id: host.id.clone(),
-                switch_ports: vec![],
-            });
-        }
-        if host.network.len() == 1 {
-            info!("[Host {current_host}/{total_hosts}] Only one interface to configure, skipping");
-            return Ok(HostNetworkConfig {
-                host_id: host.id.clone(),
-                switch_ports: vec![],
-            });
-        }
-
-        let switch_ports = self
-            .collect_switch_ports_for_host(topology, host, current_host, total_hosts)
-            .await?;
-
-        let config = HostNetworkConfig {
-            host_id: host.id.clone(),
-            switch_ports,
-        };
-
-        if config.switch_ports.len() > 1 {
-            info!(
-                "[Host {current_host}/{total_hosts}] Found {} ports for {} interfaces",
-                config.switch_ports.len(),
-                host.network.len()
-            );
-
-            info!("[Host {current_host}/{total_hosts}] Configuring host network...");
-            topology.configure_bond(&config).await.map_err(|e| {
-                InterpretError::new(format!("Failed to configure host network: {e}"))
-            })?;
+    ) -> Result<(), InterpretError> {
+        let switch_ports = self.collect_switch_ports_for_host(topology, host).await?;
+        if !switch_ports.is_empty() {
             topology
-                .configure_port_channel(&config)
+                .configure_host_network(host, HostNetworkConfig { switch_ports })
                 .await
-                .map_err(|e| {
-                    InterpretError::new(format!("Failed to configure host network: {e}"))
-                })?;
-        } else if config.switch_ports.is_empty() {
-            info!(
-                "[Host {current_host}/{total_hosts}] No ports found for {} interfaces, skipping",
-                host.network.len()
-            );
-        } else {
-            warn!(
-                "[Host {current_host}/{total_hosts}] Found a single port for {} interfaces, skipping",
-                host.network.len()
-            );
+                .map_err(|e| InterpretError::new(format!("Failed to configure host: {e}")))?;
         }
 
-        Ok(config)
+        Ok(())
     }
 
     async fn collect_switch_ports_for_host<T: Topology + Switch>(
         &self,
         topology: &T,
         host: &PhysicalHost,
-        current_host: &usize,
-        total_hosts: &usize,
     ) -> Result<Vec<SwitchPort>, InterpretError> {
         let mut switch_ports = vec![];
 
-        if host.network.is_empty() {
-            return Ok(switch_ports);
-        }
-
-        info!("[Host {current_host}/{total_hosts}] Collecting ports on switch...");
         for network_interface in &host.network {
             let mac_address = network_interface.mac_address;
 
             match topology.get_port_for_mac_address(&mac_address).await {
                 Ok(Some(port)) => {
-                    info!(
-                        "[Host {current_host}/{total_hosts}] Found port '{port}' for '{mac_address}'"
-                    );
                     switch_ports.push(SwitchPort {
                         interface: NetworkInterface {
                             name: network_interface.name.clone(),
@@ -130,7 +73,7 @@ impl HostNetworkConfigurationInterpret {
                         port,
                     });
                 }
-                Ok(None) => {}
+                Ok(None) => debug!("No port found for host '{}', skipping", host.id),
                 Err(e) => {
                     return Err(InterpretError::new(format!(
                         "Failed to get port for host '{}': {}",
@@ -142,42 +85,10 @@ impl HostNetworkConfigurationInterpret {
 
         Ok(switch_ports)
     }
-
-    fn format_host_configuration(&self, configs: Vec<HostNetworkConfig>) -> Vec<String> {
-        let mut report = vec![
-            "Network Configuration Report".to_string(),
-            "------------------------------------------------------------------".to_string(),
-        ];
-
-        for config in configs {
-            if config.switch_ports.is_empty() {
-                report.push(format!(
-                    "⏭️ Host {}: SKIPPED (No matching switch ports found)",
-                    config.host_id
-                ));
-            } else {
-                let mappings: Vec<String> = config
-                    .switch_ports
-                    .iter()
-                    .map(|p| format!("[{} -> {}]", p.interface.name, p.port))
-                    .collect();
-
-                report.push(format!(
-                    "✅ Host {}: Bonded {} port(s) {}",
-                    config.host_id,
-                    config.switch_ports.len(),
-                    mappings.join(", ")
-                ));
-            }
-        }
-        report
-            .push("------------------------------------------------------------------".to_string());
-        report
-    }
 }
 
 #[async_trait]
-impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
+impl<T: Topology + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
     fn get_name(&self) -> InterpretName {
         InterpretName::Custom("HostNetworkConfigurationInterpret")
     }
@@ -203,45 +114,27 @@ impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigur
             return Ok(Outcome::noop("No hosts to configure".into()));
         }
 
-        let host_count = self.score.hosts.len();
-        info!("Started network configuration for {host_count} host(s)...",);
+        info!(
+            "Started network configuration for {} host(s)...",
+            self.score.hosts.len()
+        );
 
-        info!("Setting up NetworkManager...",);
-        topology
-            .ensure_network_manager_installed()
-            .await
-            .map_err(|e| InterpretError::new(format!("NetworkManager setup failed: {e}")))?;
-
-        info!("Setting up switch with sane defaults...");
         topology
             .setup_switch()
             .await
             .map_err(|e| InterpretError::new(format!("Switch setup failed: {e}")))?;
-        info!("Switch ready");
-
-        let mut current_host = 1;
-        let mut host_configurations = vec![];
 
+        let mut configured_host_count = 0;
         for host in &self.score.hosts {
-            let host_configuration = self
-                .configure_network_for_host(topology, host, &current_host, &host_count)
-                .await?;
-
-            host_configurations.push(host_configuration);
-            current_host += 1;
+            self.configure_network_for_host(topology, host).await?;
+            configured_host_count += 1;
         }
 
-        if current_host > 1 {
-            let details = self.format_host_configuration(host_configurations);
-
-            Ok(Outcome::success_with_details(
-                format!(
-                    "Configured {}/{} host(s)",
-                    current_host - 1,
-                    self.score.hosts.len()
-                ),
-                details,
-            ))
+        if configured_host_count > 0 {
+            Ok(Outcome::success(format!(
+                "Configured {configured_host_count}/{} host(s)",
+                self.score.hosts.len()
+            )))
         } else {
             Ok(Outcome::noop("No hosts configured".into()))
         }
@@ -257,8 +150,7 @@ mod tests {
     use crate::{
         hardware::HostCategory,
         topology::{
-            HostNetworkConfig, NetworkError, PreparationError, PreparationOutcome, SwitchError,
-            SwitchPort,
+            HostNetworkConfig, PreparationError, PreparationOutcome, SwitchError, SwitchPort,
         },
     };
     use std::{
@@ -283,18 +175,6 @@ mod tests {
             speed_mbps: None,
             mtu: 1,
         };
-        pub static ref YET_ANOTHER_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
-            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F3".to_string()).unwrap(),
-            name: "interface-3".into(),
-            speed_mbps: None,
-            mtu: 1,
-        };
-        pub static ref LAST_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
-            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F4".to_string()).unwrap(),
-            name: "interface-4".into(),
-            speed_mbps: None,
-            mtu: 1,
-        };
         pub static ref UNKNOWN_INTERFACE: NetworkInterface = NetworkInterface {
             mac_address: MacAddress::try_from("11:22:33:44:55:61".to_string()).unwrap(),
             name: "unknown-interface".into(),
@@ -303,8 +183,6 @@ mod tests {
         };
         pub static ref PORT: PortLocation = PortLocation(1, 0, 42);
         pub static ref ANOTHER_PORT: PortLocation = PortLocation(2, 0, 42);
-        pub static ref YET_ANOTHER_PORT: PortLocation = PortLocation(1, 0, 45);
-        pub static ref LAST_PORT: PortLocation = PortLocation(2, 0, 45);
     }
 
     #[tokio::test]
@@ -320,33 +198,27 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn should_setup_network_manager() {
+    async fn host_with_one_mac_address_should_create_bond_with_one_interface() {
         let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
         let score = given_score(vec![host]);
         let topology = TopologyWithSwitch::new();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let network_manager_setup = topology.network_manager_setup.lock().unwrap();
-        assert_that!(*network_manager_setup).is_true();
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![(
+            HOST_ID.clone(),
+            HostNetworkConfig {
+                switch_ports: vec![SwitchPort {
+                    interface: EXISTING_INTERFACE.clone(),
+                    port: PORT.clone(),
+                }],
+            },
+        )]);
     }
 
     #[tokio::test]
-    async fn host_with_one_mac_address_should_skip_host_configuration() {
-        let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
-        let score = given_score(vec![host]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-    }
-
-    #[tokio::test]
-    async fn host_with_multiple_mac_addresses_should_configure_one_bond_with_all_interfaces() {
+    async fn host_with_multiple_mac_addresses_should_create_one_bond_with_all_interfaces() {
         let score = given_score(vec![given_host(
             &HOST_ID,
             vec![
@@ -358,11 +230,10 @@ mod tests {
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![(
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![(
             HOST_ID.clone(),
             HostNetworkConfig {
-                host_id: HOST_ID.clone(),
                 switch_ports: vec![
                     SwitchPort {
                         interface: EXISTING_INTERFACE.clone(),
@@ -378,183 +249,47 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn host_with_multiple_mac_addresses_should_configure_one_port_channel_with_all_interfaces()
-     {
-        let score = given_score(vec![given_host(
-            &HOST_ID,
-            vec![
-                EXISTING_INTERFACE.clone(),
-                ANOTHER_EXISTING_INTERFACE.clone(),
-            ],
-        )]);
+    async fn multiple_hosts_should_create_one_bond_per_host() {
+        let score = given_score(vec![
+            given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]),
+            given_host(&ANOTHER_HOST_ID, vec![ANOTHER_EXISTING_INTERFACE.clone()]),
+        ]);
         let topology = TopologyWithSwitch::new();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![(
-            HOST_ID.clone(),
-            HostNetworkConfig {
-                host_id: HOST_ID.clone(),
-                switch_ports: vec![
-                    SwitchPort {
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![
+            (
+                HOST_ID.clone(),
+                HostNetworkConfig {
+                    switch_ports: vec![SwitchPort {
                         interface: EXISTING_INTERFACE.clone(),
                         port: PORT.clone(),
-                    },
-                    SwitchPort {
+                    }],
+                },
+            ),
+            (
+                ANOTHER_HOST_ID.clone(),
+                HostNetworkConfig {
+                    switch_ports: vec![SwitchPort {
                         interface: ANOTHER_EXISTING_INTERFACE.clone(),
                         port: ANOTHER_PORT.clone(),
-                    },
-                ],
-            },
-        )]);
-    }
-
-    #[tokio::test]
-    async fn multiple_hosts_should_configure_one_bond_per_host() {
-        let score = given_score(vec![
-            given_host(
-                &HOST_ID,
-                vec![
-                    EXISTING_INTERFACE.clone(),
-                    ANOTHER_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-            given_host(
-                &ANOTHER_HOST_ID,
-                vec![
-                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                    LAST_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-        ]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![
-            (
-                HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: EXISTING_INTERFACE.clone(),
-                            port: PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: ANOTHER_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-            (
-                ANOTHER_HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: ANOTHER_HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: YET_ANOTHER_PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: LAST_EXISTING_INTERFACE.clone(),
-                            port: LAST_PORT.clone(),
-                        },
-                    ],
+                    }],
                 },
             ),
         ]);
     }
 
     #[tokio::test]
-    async fn multiple_hosts_should_configure_one_port_channel_per_host() {
-        let score = given_score(vec![
-            given_host(
-                &HOST_ID,
-                vec![
-                    EXISTING_INTERFACE.clone(),
-                    ANOTHER_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-            given_host(
-                &ANOTHER_HOST_ID,
-                vec![
-                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                    LAST_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-        ]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![
-            (
-                HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: EXISTING_INTERFACE.clone(),
-                            port: PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: ANOTHER_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-            (
-                ANOTHER_HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: ANOTHER_HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: YET_ANOTHER_PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: LAST_EXISTING_INTERFACE.clone(),
-                            port: LAST_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-        ]);
-    }
-
-    #[tokio::test]
-    async fn port_not_found_for_mac_address_should_not_configure_host() {
+    async fn port_not_found_for_mac_address_should_not_configure_interface() {
         let score = given_score(vec![given_host(&HOST_ID, vec![UNKNOWN_INTERFACE.clone()])]);
         let topology = TopologyWithSwitch::new_port_not_found();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
-    }
-
-    #[tokio::test]
-    async fn only_one_port_found_for_multiple_mac_addresses_should_not_configure_host() {
-        let score = given_score(vec![given_host(
-            &HOST_ID,
-            vec![EXISTING_INTERFACE.clone(), UNKNOWN_INTERFACE.clone()],
-        )]);
-        let topology = TopologyWithSwitch::new_single_port_found();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).is_empty();
     }
 
     fn given_score(hosts: Vec<PhysicalHost>) -> HostNetworkConfigurationScore {
@@ -591,48 +326,26 @@ mod tests {
         }
     }
 
-    #[derive(Debug)]
     struct TopologyWithSwitch {
         available_ports: Arc<Mutex<Vec<PortLocation>>>,
-        configured_port_channels: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
+        configured_host_networks: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
         switch_setup: Arc<Mutex<bool>>,
-        network_manager_setup: Arc<Mutex<bool>>,
-        configured_bonds: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
     }
 
     impl TopologyWithSwitch {
         fn new() -> Self {
             Self {
-                available_ports: Arc::new(Mutex::new(vec![
-                    PORT.clone(),
-                    ANOTHER_PORT.clone(),
-                    YET_ANOTHER_PORT.clone(),
-                    LAST_PORT.clone(),
-                ])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
+                available_ports: Arc::new(Mutex::new(vec![PORT.clone(), ANOTHER_PORT.clone()])),
+                configured_host_networks: Arc::new(Mutex::new(vec![])),
                 switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
             }
         }
 
         fn new_port_not_found() -> Self {
             Self {
                 available_ports: Arc::new(Mutex::new(vec![])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
+                configured_host_networks: Arc::new(Mutex::new(vec![])),
                 switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
-            }
-        }
-
-        fn new_single_port_found() -> Self {
-            Self {
-                available_ports: Arc::new(Mutex::new(vec![PORT.clone()])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
-                switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
             }
         }
     }
@@ -648,22 +361,6 @@ mod tests {
         }
     }
 
-    #[async_trait]
-    impl NetworkManager for TopologyWithSwitch {
-        async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-            let mut network_manager_installed = self.network_manager_setup.lock().unwrap();
-            *network_manager_installed = true;
-            Ok(())
-        }
-
-        async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-            let mut configured_bonds = self.configured_bonds.lock().unwrap();
-            configured_bonds.push((config.host_id.clone(), config.clone()));
-
-            Ok(())
-        }
-    }
-
     #[async_trait]
     impl Switch for TopologyWithSwitch {
         async fn setup_switch(&self) -> Result<(), SwitchError> {
@@ -683,12 +380,13 @@ mod tests {
             Ok(Some(ports.remove(0)))
         }
 
-        async fn configure_port_channel(
+        async fn configure_host_network(
             &self,
-            config: &HostNetworkConfig,
+            host: &PhysicalHost,
+            config: HostNetworkConfig,
         ) -> Result<(), SwitchError> {
-            let mut configured_port_channels = self.configured_port_channels.lock().unwrap();
-            configured_port_channels.push((config.host_id.clone(), config.clone()));
+            let mut configured_host_networks = self.configured_host_networks.lock().unwrap();
+            configured_host_networks.push((host.id.clone(), config.clone()));
 
             Ok(())
         }

harmony/src/modules/okd/installation.rs

@@ -50,7 +50,7 @@
 use crate::{
     modules::okd::{
         OKDSetup01InventoryScore, OKDSetup02BootstrapScore, OKDSetup03ControlPlaneScore,
-        OKDSetup04WorkersScore, OKDSetup05SanityCheckScore, OKDSetupPersistNetworkBondScore,
+        OKDSetup04WorkersScore, OKDSetup05SanityCheckScore,
         bootstrap_06_installation_report::OKDSetup06InstallationReportScore,
     },
     score::Score,
@@ -65,7 +65,6 @@ impl OKDInstallationPipeline {
             Box::new(OKDSetup01InventoryScore::new()),
             Box::new(OKDSetup02BootstrapScore::new()),
             Box::new(OKDSetup03ControlPlaneScore::new()),
-            Box::new(OKDSetupPersistNetworkBondScore::new()),
             Box::new(OKDSetup04WorkersScore::new()),
             Box::new(OKDSetup05SanityCheckScore::new()),
             Box::new(OKDSetup06InstallationReportScore::new()),

harmony/src/modules/okd/mod.rs

@@ -6,14 +6,11 @@ mod bootstrap_05_sanity_check;
 mod bootstrap_06_installation_report;
 pub mod bootstrap_dhcp;
 pub mod bootstrap_load_balancer;
-pub mod bootstrap_okd_node;
-mod bootstrap_persist_network_bond;
 pub mod dhcp;
 pub mod dns;
 pub mod installation;
 pub mod ipxe;
 pub mod load_balancer;
-pub mod okd_node;
 pub mod templates;
 pub mod upgrade;
 pub use bootstrap_01_prepare::*;
@@ -22,6 +19,5 @@ pub use bootstrap_03_control_plane::*;
 pub use bootstrap_04_workers::*;
 pub use bootstrap_05_sanity_check::*;
 pub use bootstrap_06_installation_report::*;
-pub use bootstrap_persist_network_bond::*;
 pub mod crd;
 pub mod host_network;

harmony/src/modules/okd/okd_node.rs

@@ -1,54 +0,0 @@
-use crate::topology::{HAClusterTopology, LogicalHost};
-
-pub trait OKDRoleProperties {
-    fn ignition_file(&self) -> &'static str;
-    fn required_hosts(&self) -> usize;
-    fn logical_hosts<'a>(&self, t: &'a HAClusterTopology) -> &'a Vec<LogicalHost>;
-}
-
-pub struct BootstrapRole;
-pub struct ControlPlaneRole;
-pub struct WorkerRole;
-pub struct StorageRole;
-
-impl OKDRoleProperties for BootstrapRole {
-    fn ignition_file(&self) -> &'static str {
-        "bootstrap.ign"
-    }
-
-    fn required_hosts(&self) -> usize {
-        1
-    }
-
-    fn logical_hosts<'a>(&self, t: &'a HAClusterTopology) -> &'a Vec<LogicalHost> {
-        todo!()
-    }
-}
-
-impl OKDRoleProperties for ControlPlaneRole {
-    fn ignition_file(&self) -> &'static str {
-        "master.ign"
-    }
-
-    fn required_hosts(&self) -> usize {
-        3
-    }
-
-    fn logical_hosts<'a>(&self, t: &'a HAClusterTopology) -> &'a Vec<LogicalHost> {
-        &t.control_plane
-    }
-}
-
-impl OKDRoleProperties for WorkerRole {
-    fn ignition_file(&self) -> &'static str {
-        "worker.ign"
-    }
-
-    fn required_hosts(&self) -> usize {
-        2
-    }
-
-    fn logical_hosts<'a>(&self, t: &'a HAClusterTopology) -> &'a Vec<LogicalHost> {
-        &t.workers
-    }
-}

harmony/src/modules/prometheus/k8s_prometheus_alerting_score.rs

@@ -12,8 +12,7 @@ use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::C
 use crate::modules::monitoring::kube_prometheus::crd::crd_default_rules::build_default_application_rules;
 use crate::modules::monitoring::kube_prometheus::crd::crd_grafana::{
     Grafana, GrafanaDashboard, GrafanaDashboardSpec, GrafanaDatasource, GrafanaDatasourceConfig,
-    GrafanaDatasourceJsonData, GrafanaDatasourceSpec, GrafanaSecretKeyRef, GrafanaSpec,
-    GrafanaValueFrom, GrafanaValueSource,
+    GrafanaDatasourceSpec, GrafanaSpec,
 };
 use crate::modules::monitoring::kube_prometheus::crd::crd_prometheus_rules::{
     PrometheusRule, PrometheusRuleSpec, RuleGroup,
@@ -40,7 +39,7 @@ use crate::{
 };
 use harmony_types::id::Id;
 
-use super::prometheus::PrometheusMonitoring;
+use super::prometheus::PrometheusApplicationMonitoring;
 
 #[derive(Clone, Debug, Serialize)]
 pub struct K8sPrometheusCRDAlertingScore {
@@ -50,7 +49,7 @@ pub struct K8sPrometheusCRDAlertingScore {
     pub prometheus_rules: Vec<RuleGroup>,
 }
 
-impl<T: Topology + K8sclient + PrometheusMonitoring<CRDPrometheus>> Score<T>
+impl<T: Topology + K8sclient + PrometheusApplicationMonitoring<CRDPrometheus>> Score<T>
     for K8sPrometheusCRDAlertingScore
 {
     fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
@@ -76,7 +75,7 @@ pub struct K8sPrometheusCRDAlertingInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + K8sclient + PrometheusMonitoring<CRDPrometheus>> Interpret<T>
+impl<T: Topology + K8sclient + PrometheusApplicationMonitoring<CRDPrometheus>> Interpret<T>
     for K8sPrometheusCRDAlertingInterpret
 {
     async fn execute(
@@ -467,13 +466,10 @@ impl K8sPrometheusCRDAlertingInterpret {
             match_labels: label.clone(),
             match_expressions: vec![],
         };
+        let mut json_data = BTreeMap::new();
+        json_data.insert("timeInterval".to_string(), "5s".to_string());
         let namespace = self.sender.namespace.clone();
-        let json_data = GrafanaDatasourceJsonData {
-            time_interval: Some("5s".to_string()),
-            http_header_name1: None,
-            tls_skip_verify: Some(true),
-            oauth_pass_thru: Some(true),
-        };
+
         let json = build_default_dashboard(&namespace);
 
         let graf_data_source = GrafanaDatasource {
@@ -499,11 +495,7 @@ impl K8sPrometheusCRDAlertingInterpret {
                         "http://prometheus-operated.{}.svc.cluster.local:9090",
                         self.sender.namespace.clone()
                     ),
-                    secure_json_data: None,
-                    is_default: None,
-                    editable: None,
                 },
-                values_from: None,
             },
         };
 
@@ -524,9 +516,7 @@ impl K8sPrometheusCRDAlertingInterpret {
             spec: GrafanaDashboardSpec {
                 resync_period: Some("30s".to_string()),
                 instance_selector: labels.clone(),
-                json: Some(json),
-                grafana_com: None,
-                datasources: None,
+                json,
             },
         };
 

harmony/src/modules/prometheus/prometheus.rs

@@ -9,17 +9,11 @@ use crate::{
 };
 
 #[async_trait]
-pub trait PrometheusMonitoring<S: AlertSender> {
+pub trait PrometheusApplicationMonitoring<S: AlertSender> {
     async fn install_prometheus(
         &self,
         sender: &S,
         inventory: &Inventory,
         receivers: Option<Vec<Box<dyn AlertReceiver<S>>>>,
     ) -> Result<PreparationOutcome, PreparationError>;
-
-    async fn ensure_prometheus_operator(
-        &self,
-        sender: &S,
-        inventory: &Inventory,
-    ) -> Result<PreparationOutcome, PreparationError>;
 }

harmony/src/modules/prometheus/rhob_alerting_score.rs

@@ -38,7 +38,7 @@ use crate::{
 };
 use harmony_types::id::Id;
 
-use super::prometheus::PrometheusMonitoring;
+use super::prometheus::PrometheusApplicationMonitoring;
 
 #[derive(Clone, Debug, Serialize)]
 pub struct RHOBAlertingScore {
@@ -48,8 +48,8 @@ pub struct RHOBAlertingScore {
     pub prometheus_rules: Vec<RuleGroup>,
 }
 
-impl<T: Topology + K8sclient + Ingress + PrometheusMonitoring<RHOBObservability>> Score<T>
-    for RHOBAlertingScore
+impl<T: Topology + K8sclient + Ingress + PrometheusApplicationMonitoring<RHOBObservability>>
+    Score<T> for RHOBAlertingScore
 {
     fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
         Box::new(RHOBAlertingInterpret {
@@ -74,8 +74,8 @@ pub struct RHOBAlertingInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + K8sclient + Ingress + PrometheusMonitoring<RHOBObservability>> Interpret<T>
-    for RHOBAlertingInterpret
+impl<T: Topology + K8sclient + Ingress + PrometheusApplicationMonitoring<RHOBObservability>>
+    Interpret<T> for RHOBAlertingInterpret
 {
     async fn execute(
         &self,

harmony_cli/src/cli_reporter.rs

@@ -40,7 +40,7 @@ pub fn init() {
                 HarmonyEvent::HarmonyFinished => {
                     if !details.is_empty() {
                         println!(
-                            "\n{} All done! Here's a few info for you:",
+                            "\n{} All done! Here's what's next for you:",
                             theme::EMOJI_SUMMARY
                         );
                         for detail in details.iter() {

harmony_types/src/net.rs

@@ -1,6 +1,6 @@
 use serde::{Deserialize, Serialize};
 
-#[derive(Copy, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord)]
 pub struct MacAddress(pub [u8; 6]);
 
 impl MacAddress {
@@ -19,14 +19,6 @@ impl From<&MacAddress> for String {
     }
 }
 
-impl std::fmt::Debug for MacAddress {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_tuple("MacAddress")
-            .field(&String::from(self))
-            .finish()
-    }
-}
-
 impl std::fmt::Display for MacAddress {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(&String::from(self))

opnsense-config-xml/src/data/haproxy.rs

@@ -106,37 +106,11 @@ pub struct HAProxy {
     pub groups: MaybeString,
     pub users: MaybeString,
     pub cpus: MaybeString,
-    pub resolvers: HAProxyResolvers,
+    pub resolvers: MaybeString,
     pub mailers: MaybeString,
     pub maintenance: Maintenance,
 }
 
-#[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
-pub struct HAProxyResolvers {
-    #[yaserde(rename = "resolver")]
-    pub resolver: Option<Resolver>,
-}
-
-#[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
-pub struct Resolver {
-    pub id: String,
-    pub enabled: i32,
-    pub name: String,
-    pub description: MaybeString,
-    pub nameservers: String,
-    pub parse_resolv_conf: String,
-    pub resolve_retries: i32,
-    pub timeout_resolve: String,
-    pub timeout_retry: String,
-    pub accepted_payload_size: MaybeString,
-    pub hold_valid: MaybeString,
-    pub hold_obsolete: MaybeString,
-    pub hold_refused: MaybeString,
-    pub hold_nx: MaybeString,
-    pub hold_timeout: MaybeString,
-    pub hold_other: MaybeString,
-}
-
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
 pub struct Maintenance {
     #[yaserde(rename = "cronjobs")]

opnsense-config-xml/src/data/interfaces.rs

@@ -9,7 +9,7 @@ pub struct Interface {
     pub physical_interface_name: String,
     pub descr: Option<MaybeString>,
     pub mtu: Option<MaybeString>,
-    pub enable: Option<MaybeString>,
+    pub enable: MaybeString,
     pub lock: Option<MaybeString>,
     #[yaserde(rename = "spoofmac")]
     pub spoof_mac: Option<MaybeString>,
@@ -134,15 +134,19 @@ mod test {
   <interfaces>
     <paul>
       <if></if>
+      <enable/>
     </paul>
     <anotherpaul>
       <if></if>
+      <enable/>
     </anotherpaul>
     <thirdone>
       <if></if>
+      <enable/>
     </thirdone>
     <andgofor4>
       <if></if>
+      <enable/>
     </andgofor4>
   </interfaces>
   <bar>foo</bar>

opnsense-config-xml/src/data/opnsense.rs

@@ -136,7 +136,6 @@ pub struct Rule {
     pub updated: Option<Updated>,
     pub created: Option<Created>,
     pub disabled: Option<MaybeString>,
-    pub log: Option<u32>,
 }
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
@@ -217,7 +216,7 @@ pub struct System {
     pub maximumfrags: Option<MaybeString>,
     pub aliasesresolveinterval: Option<MaybeString>,
     pub maximumtableentries: Option<MaybeString>,
-    pub language: Option<String>,
+    pub language: String,
     pub dnsserver: Option<MaybeString>,
     pub dns1gw: Option<String>,
     pub dns2gw: Option<String>,
@@ -1141,7 +1140,6 @@ pub struct UnboundGeneral {
     pub local_zone_type: String,
     pub outgoing_interface: MaybeString,
     pub enable_wpad: MaybeString,
-    pub safesearch: MaybeString,
 }
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
@@ -1195,15 +1193,15 @@ pub struct Acls {
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
 pub struct Dnsbl {
-    pub enabled: Option<i32>,
-    pub safesearch: Option<MaybeString>,
+    pub enabled: i32,
+    pub safesearch: MaybeString,
     #[yaserde(rename = "type")]
-    pub r#type: Option<MaybeString>,
-    pub lists: Option<MaybeString>,
-    pub whitelists: Option<MaybeString>,
-    pub blocklists: Option<MaybeString>,
-    pub wildcards: Option<MaybeString>,
-    pub address: Option<MaybeString>,
+    pub r#type: MaybeString,
+    pub lists: MaybeString,
+    pub whitelists: MaybeString,
+    pub blocklists: MaybeString,
+    pub wildcards: MaybeString,
+    pub address: MaybeString,
     pub nxdomain: Option<i32>,
 }
 
@@ -1231,7 +1229,6 @@ pub struct Host {
     pub ttl: Option<MaybeString>,
     pub server: String,
     pub description: Option<String>,
-    pub txtdata: MaybeString,
 }
 
 impl Host {
@@ -1247,7 +1244,6 @@ impl Host {
             ttl: Some(MaybeString::default()),
             mx: MaybeString::default(),
             description: None,
-            txtdata: MaybeString::default(),
         }
     }
 }
@@ -1295,7 +1291,6 @@ pub struct WireguardServerItem {
     pub gateway: MaybeString,
     pub carp_depend_on: MaybeString,
     pub peers: String,
-    pub debug: MaybeString,
     pub endpoint: MaybeString,
     pub peer_dns: MaybeString,
 }

opnsense-config/src/tests/data/config-25.7-dnsmasq-static-host.xml

@@ -612,7 +612,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad>0</enable_wpad>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity>0</hideidentity>

opnsense-config/src/tests/data/config-full-1.xml

@@ -2003,7 +2003,6 @@
         <cacheflush/>
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
-        <safesearch/>
         <enable_wpad/>
       </general>
       <advanced>
@@ -2072,7 +2071,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
         <host uuid="dd593e95-02bc-476f-8610-fa1ee454e950">
           <enabled>1</enabled>
@@ -2083,7 +2081,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
         <host uuid="e1606f96-dd38-471f-a3d7-ad25e41e810d">
           <enabled>1</enabled>
@@ -2094,7 +2091,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
       </hosts>
       <aliases/>
@@ -2121,7 +2117,6 @@
             <endpoint/>
             <peer_dns/>
             <carp_depend_on/>
-            <debug/>
             <peers>03031aec-2e84-462e-9eab-57762dde667a,98e6ca3d-1de9-449b-be80-77022221b509,67c0ace5-e802-4d2b-a536-f8b7a2db6f99,74b60fff-7844-4097-9966-f1c2b1ad29ff,3de82ad5-bc1b-4b91-9598-f906e58ac937,a95e6b5e-24a4-40b5-bb41-b79e784f6f1c,6c9a12c6-c1ca-4c14-866b-975406a30590,c33b308b-7125-4688-9561-989ace8787b5,e43f004a-23bf-4027-8fb0-953fbb40479f</peers>
           </server>
         </servers>

opnsense-config/src/tests/data/config-full-25.7-dnsmasq-options.xml

@@ -614,7 +614,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad>0</enable_wpad>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity>0</hideidentity>

opnsense-config/src/tests/data/config-full-25.7-dummy-dnsmasq-options.xml

@@ -750,7 +750,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad>0</enable_wpad>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity>0</hideidentity>

opnsense-config/src/tests/data/config-full-25.7.xml

@@ -709,7 +709,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad>0</enable_wpad>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity>0</hideidentity>

opnsense-config/src/tests/data/config-full-ncd0.xml

@@ -951,7 +951,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad/>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity>0</hideidentity>

opnsense-config/src/tests/data/config-opnsense-25.1.xml

@@ -808,7 +808,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad/>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity/>

opnsense-config/src/tests/data/config-structure-with-dhcp-staticmap-entry.xml

@@ -726,7 +726,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad/>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity>0</hideidentity>
@@ -794,7 +793,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
         <host uuid="dd593e95-02bc-476f-8610-fa1ee454e950">
           <enabled>1</enabled>
@@ -805,7 +803,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
         <host uuid="e1606f96-dd38-471f-a3d7-ad25e41e810d">
           <enabled>1</enabled>
@@ -816,7 +813,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
       </hosts>
       <aliases/>
@@ -842,7 +838,6 @@
             <gateway/>
             <carp_depend_on/>
             <peers>03031aec-2e84-462e-9eab-57762dde667a,98e6ca3d-1de9-449b-be80-77022221b509,67c0ace5-e802-4d2b-a536-f8b7a2db6f99,74b60fff-7844-4097-9966-f1c2b1ad29ff,3de82ad5-bc1b-4b91-9598-f906e58ac937,a95e6b5e-24a4-40b5-bb41-b79e784f6f1c,6c9a12c6-c1ca-4c14-866b-975406a30590,c33b308b-7125-4688-9561-989ace8787b5,e43f004a-23bf-4027-8fb0-953fbb40479f</peers>
-            <debug/>
             <endpoint/>
             <peer_dns/>
           </server>

opnsense-config/src/tests/data/config-structure.xml

@@ -718,7 +718,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad/>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity>0</hideidentity>
@@ -786,7 +785,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
         <host uuid="dd593e95-02bc-476f-8610-fa1ee454e950">
           <enabled>1</enabled>
@@ -797,7 +795,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
         <host uuid="e1606f96-dd38-471f-a3d7-ad25e41e810d">
           <enabled>1</enabled>
@@ -808,7 +805,6 @@
           <mx/>
           <server>192.168.20.161</server>
           <description>Some app local</description>
-          <txtdata/>
         </host>
       </hosts>
       <aliases/>
@@ -836,7 +832,6 @@
             <gateway/>
             <carp_depend_on/>
             <peers>03031aec-2e84-462e-9eab-57762dde667a,98e6ca3d-1de9-449b-be80-77022221b509,67c0ace5-e802-4d2b-a536-f8b7a2db6f99,74b60fff-7844-4097-9966-f1c2b1ad29ff,3de82ad5-bc1b-4b91-9598-f906e58ac937,a95e6b5e-24a4-40b5-bb41-b79e784f6f1c,6c9a12c6-c1ca-4c14-866b-975406a30590,c33b308b-7125-4688-9561-989ace8787b5,e43f004a-23bf-4027-8fb0-953fbb40479f</peers>
-            <debug/>
           </server>
         </servers>
       </server>

opnsense-config/src/tests/data/config-vm-test.xml

@@ -869,7 +869,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad/>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity/>

opnsense-config/src/tests/data/config-vm-test_cheat_descr.xml

@@ -862,7 +862,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad/>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity/>

opnsense-config/src/tests/data/config-vm-test_linted.xml

@@ -869,7 +869,6 @@
         <local_zone_type>transparent</local_zone_type>
         <outgoing_interface/>
         <enable_wpad/>
-        <safesearch/>
       </general>
       <advanced>
         <hideidentity/>