Add disclaimer demo slide and discord qr code

demos/cncf-k8s-quebec-meetup-september-2025/slides.md

@@ -2,6 +2,12 @@
 theme: uncover
 ---
 
+# Disclaimer :
+
+<img src="./lego_bloc.png" width="400"/>
+
+---
+
 # Voici l'histoire de Petit Poisson
 
 ---
@@ -228,7 +234,7 @@ Demo time
 
 ---
 
-# 🎼 
+### 🎼 
 
 Harmony : [https://git.nationtech.io/nationtech/harmony](https://git.nationtech.io/nationtech/harmony)
 
@@ -238,4 +244,5 @@ Harmony : [https://git.nationtech.io/nationtech/harmony](https://git.nationtech.
 
 LinkedIn : [https://www.linkedin.com/in/jean-gabriel-gill-couture/](https://www.linkedin.com/in/jean-gabriel-gill-couture/)
 
-Courriel : [jg@nationtech.io](mailto:jg@nationtech.io)
+Discord : [https://discord.gg/DNR5sbSm4X](https://discord.gg/DNR5sbSm4X)
+ <img src="./qrcode_discord_nationtech.png" width="120"/>

docs/doc-remove-worker-flag.md

@@ -1,56 +0,0 @@
-## **Remove Worker flag from OKD Control Planes** 
-
-### **Context**
-On OKD user provisioned infrastructure the control plane nodes can have the flag node-role.kubernetes.io/worker which allows non critical workloads to be scheduled on the control-planes
-
-### **Observed Symptoms**
-- After adding HAProxy servers to the backend each back end appears down 
-- Traffic is redirected to the control planes instead of workers
-- The pods router-default are incorrectly applied on the control planes rather than on the workers
-- Pods are being scheduled on the control planes causing cluster instability
-
-```
-  ss -tlnp | grep 80
-```
-- shows process haproxy  is listening at 0.0.0.0:80 on cps
-- same problem for port 443
-- In namespace rook-ceph certain pods are deploted on cps rather than on worker nodes
-
- ### **Cause**
- - when intalling UPI, the roles (master, worker) are not managed by the Machine Config operator and the cps are made schedulable by default.
-
- ### **Diagnostic**
-check node labels:
-```
-   oc get nodes --show-labels | grep control-plane
-```
-Inspecter kubelet configuration:
-
-```
-cat /etc/systemd/system/kubelet.service
-```
-
-find the line:
-```
-   --node-labels=node-role.kubernetes.io/control-plane,node-role.kubernetes.io/master,node-role.kubernetes.io/worker
-```
-   → presence of label worker confirms the problem.
-
-Verify the flag doesnt come from MCO
-```
-   oc get machineconfig | grep rendered-master
-```
-
-**Solution:**
-To make the control planes non schedulable you must patch the cluster scheduler resource
-
-```	
-oc patch scheduler cluster --type merge -p '{"spec":{"mastersSchedulable":false}}'
-```
-after the patch is applied the workloads can be deplaced by draining the nodes
-
-```
-oc adm cordon <cp-node>
-oc adm drain <cp-node> --ignore-daemonsets –delete-emptydir-data
-```
-

harmony/src/domain/topology/k8s.rs

@@ -1,19 +1,13 @@
-use std::time::Duration;
-
 use derive_new::new;
 use k8s_openapi::{
     ClusterResourceScope, NamespaceResourceScope,
-    api::{
-        apps::v1::Deployment,
-        core::v1::{Pod, PodStatus},
-    },
+    api::{apps::v1::Deployment, core::v1::Pod},
 };
 use kube::{
     Client, Config, Error, Resource,
     api::{Api, AttachParams, DeleteParams, ListParams, Patch, PatchParams, ResourceExt},
     config::{KubeConfigOptions, Kubeconfig},
     core::ErrorResponse,
-    error::DiscoveryError,
     runtime::reflector::Lookup,
 };
 use kube::{api::DynamicObject, runtime::conditions};
@@ -25,7 +19,7 @@ use log::{debug, error, trace};
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::{Value, json};
 use similar::TextDiff;
-use tokio::{io::AsyncReadExt, time::sleep};
+use tokio::io::AsyncReadExt;
 
 #[derive(new, Clone)]
 pub struct K8sClient {
@@ -159,41 +153,6 @@ impl K8sClient {
         }
     }
 
-    pub async fn wait_for_pod_ready(
-        &self,
-        pod_name: &str,
-        namespace: Option<&str>,
-    ) -> Result<(), Error> {
-        let mut elapsed = 0;
-        let interval = 5; // seconds between checks
-        let timeout_secs = 120;
-        loop {
-            let pod = self.get_pod(pod_name, namespace).await?;
-
-            if let Some(p) = pod {
-                if let Some(status) = p.status {
-                    if let Some(phase) = status.phase {
-                        if phase.to_lowercase() == "running" {
-                            return Ok(());
-                        }
-                    }
-                }
-            }
-
-            if elapsed >= timeout_secs {
-                return Err(Error::Discovery(DiscoveryError::MissingResource(format!(
-                    "'{}' in ns '{}' did not become ready within {}s",
-                    pod_name,
-                    namespace.unwrap(),
-                    timeout_secs
-                ))));
-            }
-
-            sleep(Duration::from_secs(interval)).await;
-            elapsed += interval;
-        }
-    }
-
     /// Will execute a commond in the first pod found that matches the specified label
     /// '{label}={name}'
     pub async fn exec_app_capture_output(
@@ -460,12 +419,9 @@ impl K8sClient {
             .as_str()
             .expect("couldn't get kind as str");
 
-        let mut it = api_version.splitn(2, '/');
-        let first = it.next().unwrap();
-        let (g, v) = match it.next() {
-            Some(second) => (first, second),
-            None => ("", first),
-        };
+        let split: Vec<&str> = api_version.splitn(2, "/").collect();
+        let g = split[0];
+        let v = split[1];
 
         let gvk = GroupVersionKind::gvk(g, v, kind);
         let api_resource = ApiResource::from_gvk(&gvk);

harmony/src/modules/application/features/helm_argocd_score.rs

@@ -160,9 +160,6 @@ global:
   ## Used for ingresses, certificates, SSO, notifications, etc.
   domain: {domain}
 
-  securityContext: 
-    runAsUser: null
-
   # -- Runtime class name for all components
   runtimeClassName: ""
 
@@ -474,13 +471,6 @@ redis:
   # -- Redis name
   name: redis
 
-  serviceAccount:
-    create: true
-
-  securityContext:
-    runAsUser: null
-
-
   ## Redis image
   image:
     # -- Redis repository

harmony/src/modules/monitoring/mod.rs

@@ -4,5 +4,4 @@ pub mod application_monitoring;
 pub mod grafana;
 pub mod kube_prometheus;
 pub mod ntfy;
-pub mod okd;
 pub mod prometheus;

harmony/src/modules/monitoring/okd/enable_user_workload.rs

@@ -1,149 +0,0 @@
-use std::{collections::BTreeMap, sync::Arc};
-
-use crate::{
-    data::Version,
-    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
-    inventory::Inventory,
-    score::Score,
-    topology::{K8sclient, Topology, k8s::K8sClient},
-};
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use k8s_openapi::api::core::v1::ConfigMap;
-use kube::api::ObjectMeta;
-use serde::Serialize;
-
-#[derive(Clone, Debug, Serialize)]
-pub struct OpenshiftUserWorkloadMonitoring {}
-
-impl<T: Topology + K8sclient> Score<T> for OpenshiftUserWorkloadMonitoring {
-    fn name(&self) -> String {
-        "OpenshiftUserWorkloadMonitoringScore".to_string()
-    }
-
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(OpenshiftUserWorkloadMonitoringInterpret {})
-    }
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct OpenshiftUserWorkloadMonitoringInterpret {}
-
-#[async_trait]
-impl<T: Topology + K8sclient> Interpret<T> for OpenshiftUserWorkloadMonitoringInterpret {
-    async fn execute(
-        &self,
-        _inventory: &Inventory,
-        topology: &T,
-    ) -> Result<Outcome, InterpretError> {
-        let client = topology.k8s_client().await.unwrap();
-        self.update_cluster_monitoring_config_cm(&client).await?;
-        self.update_user_workload_monitoring_config_cm(&client)
-            .await?;
-        self.verify_user_workload(&client).await?;
-        Ok(Outcome::success(
-            "successfully enabled user-workload-monitoring".to_string(),
-        ))
-    }
-
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("OpenshiftUserWorkloadMonitoring")
-    }
-
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-}
-
-impl OpenshiftUserWorkloadMonitoringInterpret {
-    pub async fn update_cluster_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-enableUserWorkload: true
-alertmanagerMain:
-  enableUserAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("cluster-monitoring-config".to_string()),
-                namespace: Some("openshift-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client.apply(&cm, Some("openshift-monitoring")).await?;
-
-        Ok(Outcome::success(
-            "updated cluster-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn update_user_workload_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-alertmanager: 
-  enabled: true
-  enableAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("user-workload-monitoring-config".to_string()),
-                namespace: Some("openshift-user-workload-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client
-            .apply(&cm, Some("openshift-user-workload-monitoring"))
-            .await?;
-
-        Ok(Outcome::success(
-            "updated openshift-user-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn verify_user_workload(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let namespace = "openshift-user-workload-monitoring";
-        let alertmanager_name = "alertmanager-user-workload-0";
-        let prometheus_name = "prometheus-user-workload-0";
-        client
-            .wait_for_pod_ready(alertmanager_name, Some(namespace))
-            .await?;
-        client
-            .wait_for_pod_ready(prometheus_name, Some(namespace))
-            .await?;
-
-        Ok(Outcome::success(format!(
-            "pods: {}, {} ready in ns: {}",
-            alertmanager_name, prometheus_name, namespace
-        )))
-    }
-}

harmony/src/modules/monitoring/okd/mod.rs

@@ -1 +0,0 @@
-pub mod enable_user_workload;

harmony/src/modules/prometheus/rhob_alerting_score.rs

@@ -12,6 +12,9 @@ use std::process::Command;
 use crate::modules::k8s::ingress::{K8sIngressScore, PathType};
 use crate::modules::monitoring::kube_prometheus::crd::grafana_default_dashboard::build_default_dashboard;
 use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::RHOBObservability;
+use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanagers::{
+    Alertmanager, AlertmanagerSpec,
+};
 use crate::modules::monitoring::kube_prometheus::crd::rhob_grafana::{
     Grafana, GrafanaDashboard, GrafanaDashboardSpec, GrafanaDatasource, GrafanaDatasourceConfig,
     GrafanaDatasourceSpec, GrafanaSpec,
@@ -22,8 +25,13 @@ use crate::modules::monitoring::kube_prometheus::crd::rhob_monitoring_stack::{
 use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheus_rules::{
     PrometheusRule, PrometheusRuleSpec, RuleGroup,
 };
-use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::LabelSelector;
+use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::{
+    AlertmanagerEndpoints, LabelSelector, PrometheusSpec, PrometheusSpecAlerting,
+};
 
+use crate::modules::monitoring::kube_prometheus::crd::rhob_role::{
+    build_prom_role, build_prom_rolebinding, build_prom_service_account,
+};
 use crate::modules::monitoring::kube_prometheus::crd::rhob_service_monitor::{
     ServiceMonitor, ServiceMonitorSpec,
 };