feat: example OpenshiftClusterAlertScore

Cargo.lock

@@ -1835,21 +1835,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "example-operatorhub-catalogsource"
-version = "0.1.0"
-dependencies = [
- "cidr",
- "env_logger",
- "harmony",
- "harmony_cli",
- "harmony_macros",
- "harmony_types",
- "log",
- "tokio",
- "url",
-]
-
 [[package]]
 name = "example-opnsense"
 version = "0.1.0"

adr/015-higher-order-topologies.md

@@ -1,114 +0,0 @@
-# Architecture Decision Record: Higher-Order Topologies
-
-**Initial Author:** Jean-Gabriel Gill-Couture  
-**Initial Date:** 2025-12-08  
-**Last Updated Date:** 2025-12-08  
-
-## Status
-
-Implemented
-
-## Context
-
-Harmony models infrastructure as **Topologies** (deployment targets like `K8sAnywhereTopology`, `LinuxHostTopology`) implementing **Capabilities** (tech traits like `PostgreSQL`, `Docker`).
-
-**Higher-Order Topologies** (e.g., `FailoverTopology<T>`) compose/orchestrate capabilities *across* multiple underlying topologies (e.g., primary+replica `T`).
-
-Naive design requires manual `impl Capability for HigherOrderTopology<T>` *per T per capability*, causing:
-- **Impl explosion**: N topologies × M capabilities = N×M boilerplate.
-- **ISP violation**: Topologies forced to impl unrelated capabilities.
-- **Maintenance hell**: New topology needs impls for *all* orchestrated capabilities; new capability needs impls for *all* topologies/higher-order.
-- **Barrier to extension**: Users can't easily add topologies without todos/panics.
-
-This makes scaling Harmony impractical as ecosystem grows.
-
-## Decision
-
-Use **blanket trait impls** on higher-order topologies to *automatically* derive orchestration:
-
-````rust
-/// Higher-Order Topology: Orchestrates capabilities across sub-topologies.
-pub struct FailoverTopology<T> {
-    /// Primary sub-topology.
-    primary: T,
-    /// Replica sub-topology.
-    replica: T,
-}
-
-/// Automatically provides PostgreSQL failover for *any* `T: PostgreSQL`.
-/// Delegates to primary for queries; orchestrates deploy across both.
-#[async_trait]
-impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        // Deploy primary; extract certs/endpoint;
-        // deploy replica with pg_basebackup + TLS passthrough.
-        // (Full impl logged/elaborated.)
-    }
-
-    // Delegate queries to primary.
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        self.primary.get_replication_certs(cluster_name).await
-    }
-    // ...
-}
-
-/// Similarly for other capabilities.
-#[async_trait]
-impl<T: Docker> Docker for FailoverTopology<T> {
-    // Failover Docker orchestration.
-}
-````
-
-**Key properties:**
-- **Auto-derivation**: `Failover<K8sAnywhere>` gets `PostgreSQL` iff `K8sAnywhere: PostgreSQL`.
-- **No boilerplate**: One blanket impl per capability *per higher-order type*.
-
-## Rationale
-
-- **Composition via generics**: Rust trait solver auto-selects impls; zero runtime cost.
-- **Compile-time safety**: Missing `T: Capability` → compile error (no panics).
-- **Scalable**: O(capabilities) impls per higher-order; new `T` auto-works.
-- **ISP-respecting**: Capabilities only surface if sub-topology provides.
-- **Centralized logic**: Orchestration (e.g., cert propagation) in one place.
-
-**Example usage:**
-````rust
-// ✅ Works: K8sAnywhere: PostgreSQL → Failover provides failover PG
-let pg_failover: FailoverTopology<K8sAnywhereTopology> = ...;
-pg_failover.deploy_pg(config).await;
-
-// ✅ Works: LinuxHost: Docker → Failover provides failover Docker
-let docker_failover: FailoverTopology<LinuxHostTopology> = ...;
-docker_failover.deploy_docker(...).await;
-
-// ❌ Compile fail: K8sAnywhere !: Docker
-let invalid: FailoverTopology<K8sAnywhereTopology>;
-invalid.deploy_docker(...); // `T: Docker` bound unsatisfied
-````
-
-## Consequences
-
-**Pros:**
-- **Extensible**: New topology `AWSTopology: PostgreSQL` → instant `Failover<AWSTopology>: PostgreSQL`.
-- **Lean**: No useless impls (e.g., no `K8sAnywhere: Docker`).
-- **Observable**: Logs trace every step.
-
-**Cons:**
-- **Monomorphization**: Generics generate code per T (mitigated: few Ts).
-- **Delegation opacity**: Relies on rustdoc/logs for internals.
-
-## Alternatives considered
-
-| Approach | Pros | Cons |
-|----------|------|------|
-| **Manual per-T impls**<br>`impl PG for Failover<K8s> {..}`<br>`impl PG for Failover<Linux> {..}` | Explicit control | N×M explosion; violates ISP; hard to extend. |
-| **Dynamic trait objects**<br>`Box<dyn AnyCapability>` | Runtime flex | Perf hit; type erasure; error-prone dispatch. |
-| **Mega-topology trait**<br>All-in-one `OrchestratedTopology` | Simple wiring | Monolithic; poor composition. |
-| **Registry dispatch**<br>Runtime capability lookup | Decoupled | Complex; no compile safety; perf/debug overhead. |
-
-**Selected**: Blanket impls leverage Rust generics for safe, zero-cost composition.
-
-## Additional Notes
-
-- Applies to `MultisiteTopology<T>`, `ShardedTopology<T>`, etc.
-- `FailoverTopology` in `failover.rs` is first implementation.

adr/015-higher-order-topologies/example.rs

@@ -1,153 +0,0 @@
-//! Example of Higher-Order Topologies in Harmony.
-//! Demonstrates how `FailoverTopology<T>` automatically provides failover for *any* capability
-//! supported by a sub-topology `T` via blanket trait impls.
-//! 
-//! Key insight: No manual impls per T or capability -- scales effortlessly.
-//! Users can:
-//! - Write new `Topology` (impl capabilities on a struct).
-//! - Compose with `FailoverTopology` (gets capabilities if T has them).
-//! - Compile fails if capability missing (safety).
-
-use async_trait::async_trait;
-use tokio;
-
-/// Capability trait: Deploy and manage PostgreSQL.
-#[async_trait]
-pub trait PostgreSQL {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String>;
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String>;
-}
-
-/// Capability trait: Deploy Docker.
-#[async_trait]
-pub trait Docker {
-    async fn deploy_docker(&self) -> Result<String, String>;
-}
-
-/// Configuration for PostgreSQL deployments.
-#[derive(Clone)]
-pub struct PostgreSQLConfig;
-
-/// Replication certificates.
-#[derive(Clone)]
-pub struct ReplicationCerts;
-
-/// Concrete topology: Kubernetes Anywhere (supports PostgreSQL).
-#[derive(Clone)]
-pub struct K8sAnywhereTopology;
-
-#[async_trait]
-impl PostgreSQL for K8sAnywhereTopology {
-    async fn deploy(&self, _config: &PostgreSQLConfig) -> Result<String, String> {
-        // Real impl: Use k8s helm chart, operator, etc.
-        Ok("K8sAnywhere PostgreSQL deployed".to_string())
-    }
-
-    async fn get_replication_certs(&self, _cluster_name: &str) -> Result<ReplicationCerts, String> {
-        Ok(ReplicationCerts)
-    }
-}
-
-/// Concrete topology: Linux Host (supports Docker).
-#[derive(Clone)]
-pub struct LinuxHostTopology;
-
-#[async_trait]
-impl Docker for LinuxHostTopology {
-    async fn deploy_docker(&self) -> Result<String, String> {
-        // Real impl: Install/configure Docker on host.
-        Ok("LinuxHost Docker deployed".to_string())
-    }
-}
-
-/// Higher-Order Topology: Composes multiple sub-topologies (primary + replica).
-/// Automatically derives *all* capabilities of `T` with failover orchestration.
-/// 
-/// - If `T: PostgreSQL`, then `FailoverTopology<T>: PostgreSQL` (blanket impl).
-/// - Same for `Docker`, etc. No boilerplate!
-/// - Compile-time safe: Missing `T: Capability` → error.
-#[derive(Clone)]
-pub struct FailoverTopology<T> {
-    /// Primary sub-topology.
-    pub primary: T,
-    /// Replica sub-topology.
-    pub replica: T,
-}
-
-/// Blanket impl: Failover PostgreSQL if T provides PostgreSQL.
-/// Delegates reads to primary; deploys to both.
-#[async_trait]
-impl<T: PostgreSQL + Send + Sync + Clone> PostgreSQL for FailoverTopology<T> {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        // Orchestrate: Deploy primary first, then replica (e.g., via pg_basebackup).
-        let primary_result = self.primary.deploy(config).await?;
-        let replica_result = self.replica.deploy(config).await?;
-        Ok(format!("Failover PG deployed: {} | {}", primary_result, replica_result))
-    }
-
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        // Delegate to primary (replica follows).
-        self.primary.get_replication_certs(cluster_name).await
-    }
-}
-
-/// Blanket impl: Failover Docker if T provides Docker.
-#[async_trait]
-impl<T: Docker + Send + Sync + Clone> Docker for FailoverTopology<T> {
-    async fn deploy_docker(&self) -> Result<String, String> {
-        // Orchestrate across primary + replica.
-        let primary_result = self.primary.deploy_docker().await?;
-        let replica_result = self.replica.deploy_docker().await?;
-        Ok(format!("Failover Docker deployed: {} | {}", primary_result, replica_result))
-    }
-}
-
-#[tokio::main]
-async fn main() {
-    let config = PostgreSQLConfig;
-
-    println!("=== ✅ PostgreSQL Failover (K8sAnywhere supports PG) ===");
-    let pg_failover = FailoverTopology {
-        primary: K8sAnywhereTopology,
-        replica: K8sAnywhereTopology,
-    };
-    let result = pg_failover.deploy(&config).await.unwrap();
-    println!("Result: {}", result);
-
-    println!("\n=== ✅ Docker Failover (LinuxHost supports Docker) ===");
-    let docker_failover = FailoverTopology {
-        primary: LinuxHostTopology,
-        replica: LinuxHostTopology,
-    };
-    let result = docker_failover.deploy_docker().await.unwrap();
-    println!("Result: {}", result);
-
-    println!("\n=== ❌ Would fail to compile (K8sAnywhere !: Docker) ===");
-    // let invalid = FailoverTopology {
-    //     primary: K8sAnywhereTopology,
-    //     replica: K8sAnywhereTopology,
-    // };
-    // invalid.deploy_docker().await.unwrap(); // Error: `K8sAnywhereTopology: Docker` not satisfied!
-    // Very clear error message :
-    // error[E0599]: the method `deploy_docker` exists for struct `FailoverTopology<K8sAnywhereTopology>`, but its trait bounds were not satisfied
-    //   --> src/main.rs:90:9
-    //    |
-    //  4 | pub struct FailoverTopology<T> {
-    //    | ------------------------------ method `deploy_docker` not found for this struct because it doesn't satisfy `FailoverTopology<K8sAnywhereTopology>: Docker`
-    // ...
-    // 37 | struct K8sAnywhereTopology;
-    //    | -------------------------- doesn't satisfy `K8sAnywhereTopology: Docker`
-    // ...
-    // 90 | invalid.deploy_docker(); // `T: Docker` bound unsatisfied
-    //    |         ^^^^^^^^^^^^^ method cannot be called on `FailoverTopology<K8sAnywhereTopology>` due to unsatisfied trait bounds
-    //    |
-    // note: trait bound `K8sAnywhereTopology: Docker` was not satisfied
-    //   --> src/main.rs:61:9
-    //    |
-    // 61 | impl<T: Docker + Send + Sync> Docker for FailoverTopology<T> {
-    //    |         ^^^^^^                ------     -------------------
-    //    |         |
-    //    |         unsatisfied trait bound introduced here
-    // note: the trait `Docker` must be implemented
-}
-

brocade/src/lib.rs

@@ -31,7 +31,6 @@ pub struct BrocadeOptions {
 pub struct TimeoutConfig {
     pub shell_ready: Duration,
     pub command_execution: Duration,
-    pub command_output: Duration,
     pub cleanup: Duration,
     pub message_wait: Duration,
 }
@@ -41,7 +40,6 @@ impl Default for TimeoutConfig {
         Self {
             shell_ready: Duration::from_secs(10),
             command_execution: Duration::from_secs(60), // Commands like `deploy` (for a LAG) can take a while
-            command_output: Duration::from_secs(5), // Delay to start logging "waiting for command output"
             cleanup: Duration::from_secs(10),
             message_wait: Duration::from_millis(500),
         }

brocade/src/network_operating_system.rs

@@ -3,7 +3,6 @@ use std::str::FromStr;
 use async_trait::async_trait;
 use harmony_types::switch::{PortDeclaration, PortLocation};
 use log::{debug, info};
-use regex::Regex;
 
 use crate::{
     BrocadeClient, BrocadeInfo, Error, ExecutionMode, InterSwitchLink, InterfaceInfo,
@@ -104,37 +103,13 @@ impl NetworkOperatingSystemClient {
         };
 
         Some(Ok(InterfaceInfo {
-            name: format!("{interface_type} {port_location}"),
+            name: format!("{} {}", interface_type, port_location),
             port_location,
             interface_type,
             operating_mode,
             status,
         }))
     }
-
-    fn map_configure_interfaces_error(&self, err: Error) -> Error {
-        debug!("[Brocade] {err}");
-
-        if let Error::CommandError(message) = &err {
-            if message.contains("switchport")
-                && message.contains("Cannot configure aggregator member")
-            {
-                let re = Regex::new(r"\(conf-if-([a-zA-Z]+)-([\d/]+)\)#").unwrap();
-
-                if let Some(caps) = re.captures(message) {
-                    let interface_type = &caps[1];
-                    let port_location = &caps[2];
-                    let interface = format!("{interface_type} {port_location}");
-
-                    return Error::CommandError(format!(
-                        "Cannot configure interface '{interface}', it is a member of a port-channel (LAG)"
-                    ));
-                }
-            }
-        }
-
-        err
-    }
 }
 
 #[async_trait]
@@ -222,10 +197,11 @@ impl BrocadeClient for NetworkOperatingSystemClient {
             commands.push("exit".into());
         }
 
+        commands.push("write memory".into());
+
         self.shell
             .run_commands(commands, ExecutionMode::Regular)
-            .await
-            .map_err(|err| self.map_configure_interfaces_error(err))?;
+            .await?;
 
         info!("[Brocade] Interfaces configured.");
 
@@ -237,7 +213,7 @@ impl BrocadeClient for NetworkOperatingSystemClient {
 
         let output = self
             .shell
-            .run_command("show port-channel summary", ExecutionMode::Regular)
+            .run_command("show port-channel", ExecutionMode::Regular)
             .await?;
 
         let used_ids: Vec<u8> = output
@@ -272,12 +248,7 @@ impl BrocadeClient for NetworkOperatingSystemClient {
         ports: &[PortLocation],
     ) -> Result<(), Error> {
         info!(
-            "[Brocade] Configuring port-channel '{channel_id} {channel_name}' with ports: {}",
-            ports
-                .iter()
-                .map(|p| format!("{p}"))
-                .collect::<Vec<String>>()
-                .join(", ")
+            "[Brocade] Configuring port-channel '{channel_name} {channel_id}' with ports: {ports:?}"
         );
 
         let interfaces = self.get_interfaces().await?;
@@ -305,6 +276,8 @@ impl BrocadeClient for NetworkOperatingSystemClient {
             commands.push("exit".into());
         }
 
+        commands.push("write memory".into());
+
         self.shell
             .run_commands(commands, ExecutionMode::Regular)
             .await?;
@@ -321,6 +294,7 @@ impl BrocadeClient for NetworkOperatingSystemClient {
             "configure terminal".into(),
             format!("no interface port-channel {}", channel_name),
             "exit".into(),
+            "write memory".into(),
         ];
 
         self.shell

brocade/src/shell.rs

@@ -211,7 +211,7 @@ impl BrocadeSession {
         let mut output = Vec::new();
         let start = Instant::now();
         let read_timeout = Duration::from_millis(500);
-        let log_interval = Duration::from_secs(5);
+        let log_interval = Duration::from_secs(3);
         let mut last_log = Instant::now();
 
         loop {
@@ -221,9 +221,7 @@ impl BrocadeSession {
                 ));
             }
 
-            if start.elapsed() > self.options.timeouts.command_output
-                && last_log.elapsed() > log_interval
-            {
+            if start.elapsed() > Duration::from_secs(5) && last_log.elapsed() > log_interval {
                 info!("[Brocade] Waiting for command output...");
                 last_log = Instant::now();
             }
@@ -278,7 +276,7 @@ impl BrocadeSession {
         let output_lower = output.to_lowercase();
         if ERROR_PATTERNS.iter().any(|&p| output_lower.contains(p)) {
             return Err(Error::CommandError(format!(
-                "Command error: {}",
+                "Command '{command}' failed: {}",
                 output.trim()
             )));
         }

docs/modules/Multisite_PostgreSQL.md

@@ -1,105 +0,0 @@
-# Design Document: Harmony PostgreSQL Module
-
-**Status:** Draft
-**Last Updated:** 2025-12-01
-**Context:** Multi-site Data Replication & Orchestration
-
-## 1. Overview
-
-The Harmony PostgreSQL Module provides a high-level abstraction for deploying and managing high-availability PostgreSQL clusters across geographically distributed Kubernetes/OKD sites.
-
-Instead of manually configuring complex replication slots, firewalls, and operator settings on each cluster, users define a single intent (a **Score**), and Harmony orchestrates the underlying infrastructure (the **Arrangement**) to establish a Primary-Replica architecture.
-
-Currently, the implementation relies on the **CloudNativePG (CNPG)** operator as the backing engine.
-
-## 2. Architecture
-
-### 2.1 The Abstraction Model
-Following **ADR 003 (Infrastructure Abstraction)**, Harmony separates the *intent* from the *implementation*.
-
-1.  **The Score (Intent):** The user defines a `MultisitePostgreSQL` resource. This describes *what* is needed (e.g., "A Postgres 15 cluster with 10GB storage, Primary on Site A, Replica on Site B").
-2.  **The Interpret (Action):** Harmony MultisitePostgreSQLInterpret processes this Score and orchestrates the deployment on both sites to reach the state defined in the Score.
-3.  **The Capability (Implementation):** The PostgreSQL Capability is implemented by the K8sTopology and the interpret can deploy it, configure it and fetch information about it. The concrete implementation will rely on the mature CloudnativePG operator to manage all the Kubernetes resources required.
-
-### 2.2 Network Connectivity (TLS Passthrough)
-
-One of the critical challenges in multi-site orchestration is secure connectivity between clusters that may have dynamic IPs or strict firewalls.
-
-To solve this, we utilize **OKD/OpenShift Routes with TLS Passthrough**.
-
-*   **Mechanism:** The Primary site exposes a `Route` configured for `termination: passthrough`.
-*   **Routing:** The OpenShift HAProxy router inspects the **SNI (Server Name Indication)** header of the incoming TCP connection to route traffic to the correct PostgreSQL Pod.
-*   **Security:** SSL is **not** terminated at the ingress router. The encrypted stream is passed directly to the PostgreSQL instance. Mutual TLS (mTLS) authentication is handled natively by CNPG between the Primary and Replica instances.
-*   **Dynamic IPs:** Because connections are established via DNS hostnames (the Route URL), this architecture is resilient to dynamic IP changes at the Primary site.
-
-#### Traffic Flow Diagram
-
-```text
-[ Site B: Replica ]                 [ Site A: Primary ]
-      |                                     |
-(CNPG Instance) --[Encrypted TCP]--> (OKD HAProxy Router)
-      |           (Port 443)                |
-      |                                     |
-      |                            [SNI Inspection]
-      |                                     |
-      |                                     v
-      |                            (PostgreSQL Primary Pod)
-      |                                   (Port 5432)
-```
-
-## 3. Design Decisions
-
-### Why CloudNativePG?
-We selected CloudNativePG because it relies exclusively on standard Kubernetes primitives and uses the native PostgreSQL replication protocol (WAL shipping/Streaming). This aligns with Harmony's goal of being "K8s Native."
-
-### Why TLS Passthrough instead of VPN/NodePort?
-*   **NodePort:** Requires static IPs and opening non-standard ports on the firewall, which violates our security constraints.
-*   **VPN (e.g., Wireguard/Tailscale):** While secure, it introduces significant complexity (sidecars, key management) and external dependencies.
-*   **TLS Passthrough:** Leverages the existing Ingress/Router infrastructure already present in OKD. It requires zero additional software and respects multi-tenancy (Routes are namespaced).
-
-### Configuration Philosophy (YAGNI)
-The current design exposes a **generic configuration surface**. Users can configure standard parameters (Storage size, CPU/Memory requests, Postgres version).
-
-**We explicitly do not expose advanced CNPG or PostgreSQL configurations at this stage.**
-
-*   **Reasoning:** We aim to keep the API surface small and manageable.
-*   **Future Path:** We plan to implement a "pass-through" mechanism to allow sending raw config maps or custom parameters to the underlying engine (CNPG) *only when a concrete use case arises*. Until then, we adhere to the **YAGNI (You Ain't Gonna Need It)** principle to avoid premature optimization and API bloat.
-
-## 4. Usage Guide
-
-To deploy a multi-site cluster, apply the `MultisitePostgreSQL` resource to the Harmony Control Plane.
-
-### Example Manifest
-
-```yaml
-apiVersion: harmony.io/v1alpha1
-kind: MultisitePostgreSQL
-metadata:
-  name: finance-db
-  namespace: tenant-a
-spec:
-  version: "15"
-  storage: "10Gi"
-  resources:
-    requests:
-      cpu: "500m"
-      memory: "1Gi"
-  
-  # Topology Definition
-  topology:
-    primary:
-      site: "site-paris" # The name of the cluster in Harmony
-    replicas:
-      - site: "site-newyork"
-```
-
-### What happens next?
-1.  Harmony detects the CR.
-2.  **On Site Paris:** It deploys a CNPG Cluster (Primary) and creates a Passthrough Route `postgres-finance-db.apps.site-paris.example.com`.
-3.  **On Site New York:** It deploys a CNPG Cluster (Replica) configured with `externalClusters` pointing to the Paris Route.
-4.  Data begins replicating immediately over the encrypted channel.
-
-## 5. Troubleshooting
-
-*   **Connection Refused:** Ensure the Primary site's Route is successfully admitted by the Ingress Controller.
-*   **Certificate Errors:** CNPG manages mTLS automatically. If errors persist, ensure the CA secrets were correctly propagated by Harmony from Primary to Replica namespaces.

examples/nanodc/src/main.rs

@@ -1,6 +1,6 @@
 use std::{
     net::{IpAddr, Ipv4Addr},
-    sync::{Arc, OnceLock},
+    sync::Arc,
 };
 
 use brocade::BrocadeOptions;
@@ -61,7 +61,6 @@ async fn main() {
     let gateway_ipv4 = Ipv4Addr::new(192, 168, 33, 1);
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     let topology = harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "ncd0.harmony.mcd".to_string(), // TODO this must be set manually correctly
         // when setting up the opnsense firewall
         router: Arc::new(UnmanagedRouter::new(
@@ -107,7 +106,6 @@ async fn main() {
             },
         ],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     };
 
     let inventory = Inventory {

examples/okd_cluster_alerts/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "example-postgresql"
+name = "example-okd-cluster-alerts"
 edition = "2024"
 version.workspace = true
 readme.workspace = true
@@ -10,9 +10,13 @@ publish = false
 harmony = { path = "../../harmony" }
 harmony_cli = { path = "../../harmony_cli" }
 harmony_types = { path = "../../harmony_types" }
+harmony_secret = { path = "../../harmony_secret" }
+harmony_secret_derive = { path = "../../harmony_secret_derive" }
 cidr = { workspace = true }
 tokio = { workspace = true }
 harmony_macros = { path = "../../harmony_macros" }
 log = { workspace = true }
 env_logger = { workspace = true }
 url = { workspace = true }
+serde.workspace = true
+brocade = { path = "../../brocade" }

examples/okd_cluster_alerts/src/main.rs

@@ -0,0 +1,26 @@
+use harmony::{
+    inventory::Inventory,
+    modules::monitoring::{
+        alert_channel::discord_alert_channel::DiscordWebhook,
+        okd::cluster_monitoring::OpenshiftClusterAlertScore,
+    },
+    topology::K8sAnywhereTopology,
+};
+use harmony_macros::hurl;
+
+#[tokio::main]
+async fn main() {
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(OpenshiftClusterAlertScore {
+            receivers: vec![Box::new(DiscordWebhook {
+                name: "Webhook example".to_string(),
+                url: hurl!("http://something.o"),
+            })],
+        })],
+        None,
+    )
+    .await
+    .unwrap();
+}

examples/okd_installation/src/topology.rs

@@ -9,10 +9,7 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{
-    net::IpAddr,
-    sync::{Arc, OnceLock},
-};
+use std::{net::IpAddr, sync::Arc};
 
 #[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
 struct OPNSenseFirewallConfig {
@@ -62,7 +59,6 @@ pub async fn get_topology() -> HAClusterTopology {
     let gateway_ipv4 = ipv4!("192.168.1.1");
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "demo.harmony.mcd".to_string(),
         router: Arc::new(UnmanagedRouter::new(
             gateway_ip,
@@ -84,7 +80,6 @@ pub async fn get_topology() -> HAClusterTopology {
         },
         workers: vec![],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     }
 }
 

examples/okd_pxe/src/topology.rs

@@ -10,10 +10,7 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{
-    net::IpAddr,
-    sync::{Arc, OnceLock},
-};
+use std::{net::IpAddr, sync::Arc};
 
 pub async fn get_topology() -> HAClusterTopology {
     let firewall = harmony::topology::LogicalHost {
@@ -57,7 +54,6 @@ pub async fn get_topology() -> HAClusterTopology {
     let gateway_ipv4 = ipv4!("192.168.1.1");
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "demo.harmony.mcd".to_string(),
         router: Arc::new(UnmanagedRouter::new(
             gateway_ip,
@@ -79,7 +75,6 @@ pub async fn get_topology() -> HAClusterTopology {
         },
         workers: vec![],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     }
 }
 

examples/operatorhub_catalog/Cargo.toml

@@ -1,18 +0,0 @@
-[package]
-name = "example-operatorhub-catalogsource"
-edition = "2024"
-version.workspace = true
-readme.workspace = true
-license.workspace = true
-publish = false
-
-[dependencies]
-harmony = { path = "../../harmony" }
-harmony_cli = { path = "../../harmony_cli" }
-harmony_types = { path = "../../harmony_types" }
-cidr = { workspace = true }
-tokio = { workspace = true }
-harmony_macros = { path = "../../harmony_macros" }
-log = { workspace = true }
-env_logger = { workspace = true }
-url = { workspace = true }

examples/operatorhub_catalog/src/main.rs

@@ -1,22 +0,0 @@
-use std::str::FromStr;
-
-use harmony::{
-    inventory::Inventory,
-    modules::{k8s::apps::OperatorHubCatalogSourceScore, postgresql::CloudNativePgOperatorScore},
-    topology::K8sAnywhereTopology,
-};
-
-#[tokio::main]
-async fn main() {
-    let operatorhub_catalog = OperatorHubCatalogSourceScore::default();
-    let cnpg_operator = CloudNativePgOperatorScore::default();
-
-    harmony_cli::run(
-        Inventory::autoload(),
-        K8sAnywhereTopology::from_env(),
-        vec![Box::new(operatorhub_catalog), Box::new(cnpg_operator)],
-        None,
-    )
-    .await
-    .unwrap();
-}

examples/opnsense/src/main.rs

@@ -1,6 +1,6 @@
 use std::{
     net::{IpAddr, Ipv4Addr},
-    sync::{Arc, OnceLock},
+    sync::Arc,
 };
 
 use brocade::BrocadeOptions;
@@ -57,7 +57,6 @@ async fn main() {
     let gateway_ipv4 = Ipv4Addr::new(10, 100, 8, 1);
     let gateway_ip = IpAddr::V4(gateway_ipv4);
     let topology = harmony::topology::HAClusterTopology {
-        kubeconfig: None,
         domain_name: "demo.harmony.mcd".to_string(),
         router: Arc::new(UnmanagedRouter::new(
             gateway_ip,
@@ -79,7 +78,6 @@ async fn main() {
         },
         workers: vec![],
         switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
     };
 
     let inventory = Inventory {

examples/postgresql/src/main.rs

@@ -1,22 +0,0 @@
-use harmony::{
-    inventory::Inventory, modules::postgresql::PostgreSQLScore, topology::K8sAnywhereTopology,
-};
-
-#[tokio::main]
-async fn main() {
-    let postgresql = PostgreSQLScore {
-        name: "harmony-postgres-example".to_string(), // Override default name
-        namespace: "harmony-postgres-example".to_string(),
-        ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
-                             // "default" namespace, 1 instance, 1Gi storage
-    };
-
-    harmony_cli::run(
-        Inventory::autoload(),
-        K8sAnywhereTopology::from_env(),
-        vec![Box::new(postgresql)],
-        None,
-    )
-    .await
-    .unwrap();
-}

examples/public_postgres/Cargo.toml

@@ -1,18 +0,0 @@
-[package]
-name = "example-public-postgres"
-edition = "2024"
-version.workspace = true
-readme.workspace = true
-license.workspace = true
-publish = false
-
-[dependencies]
-harmony = { path = "../../harmony" }
-harmony_cli = { path = "../../harmony_cli" }
-harmony_types = { path = "../../harmony_types" }
-cidr = { workspace = true }
-tokio = { workspace = true }
-harmony_macros = { path = "../../harmony_macros" }
-log = { workspace = true }
-env_logger = { workspace = true }
-url = { workspace = true }

examples/public_postgres/src/main.rs

@@ -1,35 +0,0 @@
-use harmony::{
-    inventory::Inventory,
-    modules::postgresql::{PostgreSQLConnectionScore, PostgreSQLScore, PublicPostgreSQLScore},
-    topology::K8sAnywhereTopology,
-};
-
-#[tokio::main]
-async fn main() {
-    let postgres = PublicPostgreSQLScore {
-        postgres_score: PostgreSQLScore {
-            name: "harmony-postgres-example".to_string(), // Override default name
-            namespace: "harmony-public-postgres".to_string(),
-            ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
-                                 // "default" namespace, 1 instance, 1Gi storage
-        },
-        hostname: "postgrestest.sto1.nationtech.io".to_string(),
-    };
-
-    let test_connection = PostgreSQLConnectionScore {
-        name: "harmony-postgres-example".to_string(),
-        namespace: "harmony-public-postgres".to_string(),
-        cluster_name: "harmony-postgres-example".to_string(),
-        hostname: Some("postgrestest.sto1.nationtech.io".to_string()),
-        port_override: Some(443),
-    };
-
-    harmony_cli::run(
-        Inventory::autoload(),
-        K8sAnywhereTopology::from_env(),
-        vec![Box::new(postgres), Box::new(test_connection)],
-        None,
-    )
-    .await
-    .unwrap();
-}

harmony/src/domain/interpret/mod.rs

@@ -152,12 +152,6 @@ pub struct InterpretError {
     msg: String,
 }
 
-impl From<InterpretError> for String {
-    fn from(e: InterpretError) -> String {
-        format!("InterpretError : {}", e.msg)
-    }
-}
-
 impl std::fmt::Display for InterpretError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(&self.msg)

harmony/src/domain/topology/failover.rs

@@ -1,19 +0,0 @@
-use async_trait::async_trait;
-
-use crate::topology::{PreparationError, PreparationOutcome, Topology};
-
-pub struct FailoverTopology<T> {
-    pub primary: T,
-    pub replica: T,
-}
-
-#[async_trait]
-impl<T: Send + Sync> Topology for FailoverTopology<T> {
-    fn name(&self) -> &str {
-        "FailoverTopology"
-    }
-
-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
-        todo!()
-    }
-}

harmony/src/domain/topology/ha_cluster.rs

@@ -1,25 +1,32 @@
 use async_trait::async_trait;
 use harmony_macros::ip;
 use harmony_types::{
-    id::Id,
     net::{MacAddress, Url},
     switch::PortLocation,
 };
+use k8s_openapi::api::core::v1::Namespace;
+use kube::api::ObjectMeta;
 use log::debug;
 use log::info;
 
-use crate::infra::network_manager::OpenShiftNmStateNetworkManager;
+use crate::data::FileContent;
+use crate::executors::ExecutorError;
+use crate::hardware::PhysicalHost;
+use crate::modules::okd::crd::{
+    InstallPlanApproval, OperatorGroup, OperatorGroupSpec, Subscription, SubscriptionSpec,
+    nmstate::{self, NMState, NodeNetworkConfigurationPolicy, NodeNetworkConfigurationPolicySpec},
+};
 use crate::topology::PxeOptions;
-use crate::{data::FileContent, executors::ExecutorError};
 
 use super::{
     DHCPStaticEntry, DhcpServer, DnsRecord, DnsRecordType, DnsServer, Firewall, HostNetworkConfig,
-    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost, NetworkError,
-    NetworkManager, PreparationError, PreparationOutcome, Router, Switch, SwitchClient,
-    SwitchError, TftpServer, Topology, k8s::K8sClient,
+    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost,
+    PreparationError, PreparationOutcome, Router, Switch, SwitchClient, SwitchError, TftpServer,
+    Topology, k8s::K8sClient,
 };
 
-use std::sync::{Arc, OnceLock};
+use std::collections::BTreeMap;
+use std::sync::Arc;
 
 #[derive(Debug, Clone)]
 pub struct HAClusterTopology {
@@ -35,8 +42,6 @@ pub struct HAClusterTopology {
     pub bootstrap_host: LogicalHost,
     pub control_plane: Vec<LogicalHost>,
     pub workers: Vec<LogicalHost>,
-    pub kubeconfig: Option<String>,
-    pub network_manager: OnceLock<Arc<dyn NetworkManager>>,
 }
 
 #[async_trait]
@@ -55,17 +60,9 @@ impl Topology for HAClusterTopology {
 #[async_trait]
 impl K8sclient for HAClusterTopology {
     async fn k8s_client(&self) -> Result<Arc<K8sClient>, String> {
-        match &self.kubeconfig {
-            None => Ok(Arc::new(
-                K8sClient::try_default().await.map_err(|e| e.to_string())?,
-            )),
-            Some(kubeconfig) => {
-                let Some(client) = K8sClient::from_kubeconfig(kubeconfig).await else {
-                    return Err("Failed to create k8s client".to_string());
-                };
-                Ok(Arc::new(client))
-            }
-        }
+        Ok(Arc::new(
+            K8sClient::try_default().await.map_err(|e| e.to_string())?,
+        ))
     }
 }
 
@@ -90,12 +87,208 @@ impl HAClusterTopology {
             .to_string()
     }
 
-    pub async fn network_manager(&self) -> &dyn NetworkManager {
-        let k8s_client = self.k8s_client().await.unwrap();
+    async fn ensure_nmstate_operator_installed(&self) -> Result<(), String> {
+        // FIXME: Find a way to check nmstate is already available (get pod -n openshift-nmstate)
+        debug!("Installing NMState operator...");
+        let k8s_client = self.k8s_client().await?;
 
-        self.network_manager
-            .get_or_init(|| Arc::new(OpenShiftNmStateNetworkManager::new(k8s_client.clone())))
-            .as_ref()
+        let nmstate_namespace = Namespace {
+            metadata: ObjectMeta {
+                name: Some("openshift-nmstate".to_string()),
+                finalizers: Some(vec!["kubernetes".to_string()]),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+        debug!("Creating NMState namespace: {nmstate_namespace:#?}");
+        k8s_client
+            .apply(&nmstate_namespace, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        let nmstate_operator_group = OperatorGroup {
+            metadata: ObjectMeta {
+                name: Some("openshift-nmstate".to_string()),
+                namespace: Some("openshift-nmstate".to_string()),
+                ..Default::default()
+            },
+            spec: OperatorGroupSpec {
+                target_namespaces: vec!["openshift-nmstate".to_string()],
+            },
+        };
+        debug!("Creating NMState operator group: {nmstate_operator_group:#?}");
+        k8s_client
+            .apply(&nmstate_operator_group, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        let nmstate_subscription = Subscription {
+            metadata: ObjectMeta {
+                name: Some("kubernetes-nmstate-operator".to_string()),
+                namespace: Some("openshift-nmstate".to_string()),
+                ..Default::default()
+            },
+            spec: SubscriptionSpec {
+                channel: Some("stable".to_string()),
+                install_plan_approval: Some(InstallPlanApproval::Automatic),
+                name: "kubernetes-nmstate-operator".to_string(),
+                source: "redhat-operators".to_string(),
+                source_namespace: "openshift-marketplace".to_string(),
+            },
+        };
+        debug!("Subscribing to NMState Operator: {nmstate_subscription:#?}");
+        k8s_client
+            .apply(&nmstate_subscription, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        let nmstate = NMState {
+            metadata: ObjectMeta {
+                name: Some("nmstate".to_string()),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+        debug!("Creating NMState: {nmstate:#?}");
+        k8s_client
+            .apply(&nmstate, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        Ok(())
+    }
+
+    fn get_next_bond_id(&self) -> u8 {
+        42 // FIXME: Find a better way to declare the bond id
+    }
+
+    async fn configure_bond(
+        &self,
+        host: &PhysicalHost,
+        config: &HostNetworkConfig,
+    ) -> Result<(), SwitchError> {
+        self.ensure_nmstate_operator_installed()
+            .await
+            .map_err(|e| {
+                SwitchError::new(format!(
+                    "Can't configure bond, NMState operator not available: {e}"
+                ))
+            })?;
+
+        let bond_config = self.create_bond_configuration(host, config);
+        debug!("Configuring bond for host {host:?}: {bond_config:#?}");
+        self.k8s_client()
+            .await
+            .unwrap()
+            .apply(&bond_config, None)
+            .await
+            .unwrap();
+
+        todo!()
+    }
+
+    fn create_bond_configuration(
+        &self,
+        host: &PhysicalHost,
+        config: &HostNetworkConfig,
+    ) -> NodeNetworkConfigurationPolicy {
+        let host_name = host.id.clone();
+
+        let bond_id = self.get_next_bond_id();
+        let bond_name = format!("bond{bond_id}");
+        let mut bond_mtu: Option<u32> = None;
+        let mut bond_mac_address: Option<String> = None;
+        let mut bond_ports = Vec::new();
+        let mut interfaces: Vec<nmstate::InterfaceSpec> = Vec::new();
+
+        for switch_port in &config.switch_ports {
+            let interface_name = switch_port.interface.name.clone();
+
+            interfaces.push(nmstate::InterfaceSpec {
+                name: interface_name.clone(),
+                description: Some(format!("Member of bond {bond_name}")),
+                r#type: "ethernet".to_string(),
+                state: "up".to_string(),
+                mtu: Some(switch_port.interface.mtu),
+                mac_address: Some(switch_port.interface.mac_address.to_string()),
+                ipv4: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                ipv6: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                link_aggregation: None,
+                ..Default::default()
+            });
+
+            bond_ports.push(interface_name);
+
+            // Use the first port's details for the bond mtu and mac address
+            if bond_mtu.is_none() {
+                bond_mtu = Some(switch_port.interface.mtu);
+            }
+            if bond_mac_address.is_none() {
+                bond_mac_address = Some(switch_port.interface.mac_address.to_string());
+            }
+        }
+
+        interfaces.push(nmstate::InterfaceSpec {
+            name: bond_name.clone(),
+            description: Some(format!("Network bond for host {host_name}")),
+            r#type: "bond".to_string(),
+            state: "up".to_string(),
+            mtu: bond_mtu,
+            mac_address: bond_mac_address,
+            ipv4: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            ipv6: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                autoconf: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            link_aggregation: Some(nmstate::BondSpec {
+                mode: "802.3ad".to_string(),
+                ports: bond_ports,
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+
+        NodeNetworkConfigurationPolicy {
+            metadata: ObjectMeta {
+                name: Some(format!("{host_name}-bond-config")),
+                ..Default::default()
+            },
+            spec: NodeNetworkConfigurationPolicySpec {
+                node_selector: Some(BTreeMap::from([(
+                    "kubernetes.io/hostname".to_string(),
+                    host_name.to_string(),
+                )])),
+                desired_state: nmstate::DesiredStateSpec { interfaces },
+            },
+        }
+    }
+
+    async fn configure_port_channel(
+        &self,
+        host: &PhysicalHost,
+        config: &HostNetworkConfig,
+    ) -> Result<(), SwitchError> {
+        debug!("Configuring port channel: {config:#?}");
+        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
+
+        self.switch_client
+            .configure_port_channel(&format!("Harmony_{}", host.id), switch_ports)
+            .await
+            .map_err(|e| SwitchError::new(format!("Failed to configure switch: {e}")))?;
+
+        Ok(())
     }
 
     pub fn autoload() -> Self {
@@ -106,7 +299,6 @@ impl HAClusterTopology {
         };
 
         Self {
-            kubeconfig: None,
             domain_name: "DummyTopology".to_string(),
             router: dummy_infra.clone(),
             load_balancer: dummy_infra.clone(),
@@ -119,7 +311,6 @@ impl HAClusterTopology {
             bootstrap_host: dummy_host,
             control_plane: vec![],
             workers: vec![],
-            network_manager: OnceLock::new(),
         }
     }
 }
@@ -277,40 +468,25 @@ impl HttpServer for HAClusterTopology {
 #[async_trait]
 impl Switch for HAClusterTopology {
     async fn setup_switch(&self) -> Result<(), SwitchError> {
-        self.switch_client.setup().await.map(|_| ())
+        self.switch_client.setup().await?;
+        Ok(())
     }
 
     async fn get_port_for_mac_address(
         &self,
         mac_address: &MacAddress,
     ) -> Result<Option<PortLocation>, SwitchError> {
-        self.switch_client.find_port(mac_address).await
+        let port = self.switch_client.find_port(mac_address).await?;
+        Ok(port)
     }
 
-    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
-        debug!("Configuring port channel: {config:#?}");
-        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
-
-        self.switch_client
-            .configure_port_channel(&format!("Harmony_{}", config.host_id), switch_ports)
-            .await
-            .map_err(|e| SwitchError::new(format!("Failed to configure port-channel: {e}")))?;
-
-        Ok(())
-    }
-}
-
-#[async_trait]
-impl NetworkManager for HAClusterTopology {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-        self.network_manager()
-            .await
-            .ensure_network_manager_installed()
-            .await
-    }
-
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-        self.network_manager().await.configure_bond(config).await
+    async fn configure_host_network(
+        &self,
+        host: &PhysicalHost,
+        config: HostNetworkConfig,
+    ) -> Result<(), SwitchError> {
+        self.configure_bond(host, &config).await?;
+        self.configure_port_channel(host, &config).await
     }
 }
 

harmony/src/domain/topology/k8s.rs

@@ -5,18 +5,15 @@ use k8s_openapi::{
     ClusterResourceScope, NamespaceResourceScope,
     api::{
         apps::v1::Deployment,
-        core::v1::{Node, Pod, ServiceAccount},
+        core::v1::{Pod, ServiceAccount},
     },
     apimachinery::pkg::version::Info,
 };
 use kube::{
     Client, Config, Discovery, Error, Resource,
-    api::{
-        Api, AttachParams, DeleteParams, ListParams, ObjectList, Patch, PatchParams, ResourceExt,
-    },
+    api::{Api, AttachParams, DeleteParams, ListParams, Patch, PatchParams, ResourceExt},
     config::{KubeConfigOptions, Kubeconfig},
     core::ErrorResponse,
-    discovery::{ApiCapabilities, Scope},
     error::DiscoveryError,
     runtime::reflector::Lookup,
 };
@@ -25,12 +22,11 @@ use kube::{
     api::{ApiResource, GroupVersionKind},
     runtime::wait::await_condition,
 };
-use log::{debug, error, trace, warn};
+use log::{debug, error, info, trace};
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::json;
 use similar::TextDiff;
 use tokio::{io::AsyncReadExt, time::sleep};
-use url::Url;
 
 #[derive(new, Clone)]
 pub struct K8sClient {
@@ -92,8 +88,7 @@ impl K8sClient {
         } else {
             Api::default_namespaced_with(self.client.clone(), &gvk)
         };
-
-        resource.get(name).await
+        Ok(resource.get(name).await?)
     }
 
     pub async fn get_deployment(
@@ -108,9 +103,8 @@ impl K8sClient {
             debug!("getting default namespace deployment");
             Api::default_namespaced(self.client.clone())
         };
-
         debug!("getting deployment {} in ns {}", name, namespace.unwrap());
-        deps.get_opt(name).await
+        Ok(deps.get_opt(name).await?)
     }
 
     pub async fn get_pod(&self, name: &str, namespace: Option<&str>) -> Result<Option<Pod>, Error> {
@@ -119,8 +113,7 @@ impl K8sClient {
         } else {
             Api::default_namespaced(self.client.clone())
         };
-
-        pods.get_opt(name).await
+        Ok(pods.get_opt(name).await?)
     }
 
     pub async fn scale_deployment(
@@ -163,9 +156,9 @@ impl K8sClient {
 
     pub async fn wait_until_deployment_ready(
         &self,
-        name: &str,
+        name: String,
         namespace: Option<&str>,
-        timeout: Option<Duration>,
+        timeout: Option<u64>,
     ) -> Result<(), String> {
         let api: Api<Deployment>;
 
@@ -175,9 +168,9 @@ impl K8sClient {
             api = Api::default_namespaced(self.client.clone());
         }
 
-        let establish = await_condition(api, name, conditions::is_deployment_completed());
-        let timeout = timeout.unwrap_or(Duration::from_secs(120));
-        let res = tokio::time::timeout(timeout, establish).await;
+        let establish = await_condition(api, name.as_str(), conditions::is_deployment_completed());
+        let t = timeout.unwrap_or(300);
+        let res = tokio::time::timeout(std::time::Duration::from_secs(t), establish).await;
 
         if res.is_ok() {
             Ok(())
@@ -267,7 +260,7 @@ impl K8sClient {
 
                 if let Some(s) = status.status {
                     let mut stdout_buf = String::new();
-                    if let Some(mut stdout) = process.stdout() {
+                    if let Some(mut stdout) = process.stdout().take() {
                         stdout
                             .read_to_string(&mut stdout_buf)
                             .await
@@ -373,14 +366,14 @@ impl K8sClient {
                 Ok(current) => {
                     trace!("Received current value {current:#?}");
                     // The resource exists, so we calculate and display a diff.
-                    println!("\nPerforming dry-run for resource: '{name}'");
+                    println!("\nPerforming dry-run for resource: '{}'", name);
                     let mut current_yaml = serde_yaml::to_value(&current).unwrap_or_else(|_| {
                         panic!("Could not serialize current value : {current:#?}")
                     });
                     if current_yaml.is_mapping() && current_yaml.get("status").is_some() {
                         let map = current_yaml.as_mapping_mut().unwrap();
                         let removed = map.remove_entry("status");
-                        trace!("Removed status {removed:?}");
+                        trace!("Removed status {:?}", removed);
                     } else {
                         trace!(
                             "Did not find status entry for current object {}/{}",
@@ -409,14 +402,14 @@ impl K8sClient {
                             similar::ChangeTag::Insert => "+",
                             similar::ChangeTag::Equal => " ",
                         };
-                        print!("{sign}{change}");
+                        print!("{}{}", sign, change);
                     }
                     // In a dry run, we return the new resource state that would have been applied.
                     Ok(resource.clone())
                 }
                 Err(Error::Api(ErrorResponse { code: 404, .. })) => {
                     // The resource does not exist, so the "diff" is the entire new resource.
-                    println!("\nPerforming dry-run for new resource: '{name}'");
+                    println!("\nPerforming dry-run for new resource: '{}'", name);
                     println!(
                         "Resource does not exist. It would be created with the following content:"
                     );
@@ -425,14 +418,14 @@ impl K8sClient {
 
                     // Print each line of the new resource with a '+' prefix.
                     for line in new_yaml.lines() {
-                        println!("+{line}");
+                        println!("+{}", line);
                     }
                     // In a dry run, we return the new resource state that would have been created.
                     Ok(resource.clone())
                 }
                 Err(e) => {
                     // Another API error occurred.
-                    error!("Failed to get resource '{name}': {e}");
+                    error!("Failed to get resource '{}': {}", name, e);
                     Err(e)
                 }
             }
@@ -447,24 +440,11 @@ impl K8sClient {
     where
         K: Resource + Clone + std::fmt::Debug + DeserializeOwned + serde::Serialize,
         <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as Resource>::DynamicType: Default,
+        <K as kube::Resource>::DynamicType: Default,
     {
         let mut result = Vec::new();
         for r in resource.iter() {
-            let apply_result = self.apply(r, ns).await;
-            if apply_result.is_err() {
-                // NOTE : We should be careful about this one, it may leak sensitive information in
-                // logs
-                // Maybe just reducing it to debug would be enough as we already know debug logs
-                // are unsafe.
-                // But keeping it at warn makes it much easier to understand what is going on. So be it for now.
-                warn!(
-                    "Failed to apply k8s resource : {}",
-                    serde_json::to_string_pretty(r).map_err(|e| Error::SerdeError(e))?
-                );
-            }
-
-            result.push(apply_result?);
+            result.push(self.apply(r, ns).await?);
         }
 
         Ok(result)
@@ -525,7 +505,10 @@ impl K8sClient {
 
         // 6. Apply the object to the cluster using Server-Side Apply.
         //    This will create the resource if it doesn't exist, or update it if it does.
-        println!("Applying '{name}' in namespace '{namespace}'...",);
+        println!(
+            "Applying Argo Application '{}' in namespace '{}'...",
+            name, namespace
+        );
         let patch_params = PatchParams::apply("harmony"); // Use a unique field manager name
         let result = api.patch(name, &patch_params, &Patch::Apply(&obj)).await?;
 
@@ -534,103 +517,7 @@ impl K8sClient {
         Ok(())
     }
 
-    /// Apply a resource from a URL
-    ///
-    /// It is the equivalent of `kubectl apply -f <url>`
-    pub async fn apply_url(&self, url: Url, ns: Option<&str>) -> Result<(), Error> {
-        let patch_params = PatchParams::apply("harmony");
-        let discovery = kube::Discovery::new(self.client.clone()).run().await?;
-
-        let yaml = reqwest::get(url)
-            .await
-            .expect("Could not get URL")
-            .text()
-            .await
-            .expect("Could not get content from URL");
-
-        for doc in multidoc_deserialize(&yaml).expect("failed to parse YAML from file") {
-            let obj: DynamicObject =
-                serde_yaml::from_value(doc).expect("cannot apply without valid YAML");
-            let namespace = obj.metadata.namespace.as_deref().or(ns);
-            let type_meta = obj
-                .types
-                .as_ref()
-                .expect("cannot apply object without valid TypeMeta");
-            let gvk = GroupVersionKind::try_from(type_meta)
-                .expect("cannot apply object without valid GroupVersionKind");
-            let name = obj.name_any();
-
-            if let Some((ar, caps)) = discovery.resolve_gvk(&gvk) {
-                let api = get_dynamic_api(ar, caps, self.client.clone(), namespace, false);
-                trace!(
-                    "Applying {}: \n{}",
-                    gvk.kind,
-                    serde_yaml::to_string(&obj).expect("Failed to serialize YAML")
-                );
-                let data: serde_json::Value =
-                    serde_json::to_value(&obj).expect("Failed to serialize JSON");
-                let _r = api.patch(&name, &patch_params, &Patch::Apply(data)).await?;
-                debug!("applied {} {}", gvk.kind, name);
-            } else {
-                warn!("Cannot apply document for unknown {gvk:?}");
-            }
-        }
-
-        Ok(())
-    }
-
-    /// Gets a single named resource of a specific type `K`.
-    ///
-    /// This function uses the `ApplyStrategy` trait to correctly determine
-    /// whether to look in a specific namespace or in the entire cluster.
-    ///
-    /// Returns `Ok(None)` if the resource is not found (404).
-    pub async fn get_resource<K>(
-        &self,
-        name: &str,
-        namespace: Option<&str>,
-    ) -> Result<Option<K>, Error>
-    where
-        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
-        <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as kube::Resource>::DynamicType: Default,
-    {
-        let api: Api<K> =
-            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
-
-        api.get_opt(name).await
-    }
-
-    /// Lists all resources of a specific type `K`.
-    ///
-    /// This function uses the `ApplyStrategy` trait to correctly determine
-    /// whether to list from a specific namespace or from the entire cluster.
-    pub async fn list_resources<K>(
-        &self,
-        namespace: Option<&str>,
-        list_params: Option<ListParams>,
-    ) -> Result<ObjectList<K>, Error>
-    where
-        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
-        <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as kube::Resource>::DynamicType: Default,
-    {
-        let api: Api<K> =
-            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
-
-        let list_params = list_params.unwrap_or_default();
-        api.list(&list_params).await
-    }
-
-    /// Fetches a list of all Nodes in the cluster.
-    pub async fn get_nodes(
-        &self,
-        list_params: Option<ListParams>,
-    ) -> Result<ObjectList<Node>, Error> {
-        self.list_resources(None, list_params).await
-    }
-
-    pub async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
+    pub(crate) async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
         let k = match Kubeconfig::read_from(path) {
             Ok(k) => k,
             Err(e) => {
@@ -649,31 +536,6 @@ impl K8sClient {
     }
 }
 
-fn get_dynamic_api(
-    resource: ApiResource,
-    capabilities: ApiCapabilities,
-    client: Client,
-    ns: Option<&str>,
-    all: bool,
-) -> Api<DynamicObject> {
-    if capabilities.scope == Scope::Cluster || all {
-        Api::all_with(client, &resource)
-    } else if let Some(namespace) = ns {
-        Api::namespaced_with(client, namespace, &resource)
-    } else {
-        Api::default_namespaced_with(client, &resource)
-    }
-}
-
-fn multidoc_deserialize(data: &str) -> Result<Vec<serde_yaml::Value>, serde_yaml::Error> {
-    use serde::Deserialize;
-    let mut docs = vec![];
-    for de in serde_yaml::Deserializer::from_str(data) {
-        docs.push(serde_yaml::Value::deserialize(de)?);
-    }
-    Ok(docs)
-}
-
 pub trait ApplyStrategy<K: Resource> {
     fn get_api(client: &Client, ns: Option<&str>) -> Api<K>;
 }

harmony/src/domain/topology/k8s_anywhere.rs

@@ -1,8 +1,7 @@
-use std::{collections::BTreeMap, process::Command, sync::Arc, time::Duration};
+use std::{collections::BTreeMap, process::Command, sync::Arc};
 
 use async_trait::async_trait;
 use base64::{Engine, engine::general_purpose};
-use harmony_types::rfc1123::Rfc1123Name;
 use k8s_openapi::api::{
     core::v1::Secret,
     rbac::v1::{ClusterRoleBinding, RoleRef, Subject},
@@ -35,17 +34,16 @@ use crate::{
                 service_monitor::ServiceMonitor,
             },
         },
-        okd::route::OKDTlsPassthroughScore,
         prometheus::{
             k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
             prometheus::PrometheusMonitoring, rhob_alerting_score::RHOBAlertingScore,
         },
     },
     score::Score,
-    topology::{TlsRoute, TlsRouter, ingress::Ingress},
+    topology::ingress::Ingress,
 };
 
-use super::super::{
+use super::{
     DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, PreparationError,
     PreparationOutcome, Topology,
     k8s::K8sClient,
@@ -104,31 +102,6 @@ impl K8sclient for K8sAnywhereTopology {
     }
 }
 
-#[async_trait]
-impl TlsRouter for K8sAnywhereTopology {
-    async fn install_route(&self, route: TlsRoute) -> Result<(), String> {
-        let distro = self
-            .get_k8s_distribution()
-            .await
-            .map_err(|e| format!("Could not get k8s distribution {e}"))?;
-
-        match distro {
-            KubernetesDistribution::OpenshiftFamily => {
-                OKDTlsPassthroughScore {
-                    name: Rfc1123Name::try_from(route.backend_info_string().as_str())?,
-                    route,
-                }
-                .interpret(&Inventory::empty(), self)
-                .await?;
-                Ok(())
-            }
-            KubernetesDistribution::K3sFamily | KubernetesDistribution::Default => Err(format!(
-                "Distribution not supported yet for Tlsrouter {distro:?}"
-            )),
-        }
-    }
-}
-
 #[async_trait]
 impl Grafana for K8sAnywhereTopology {
     async fn ensure_grafana_operator(
@@ -182,9 +155,9 @@ impl Grafana for K8sAnywhereTopology {
         //TODO change this to a ensure ready or something better than just a timeout
         client
             .wait_until_deployment_ready(
-                "grafana-grafana-deployment",
+                "grafana-grafana-deployment".to_string(),
                 Some("grafana"),
-                Some(Duration::from_secs(30)),
+                Some(30),
             )
             .await?;
 
@@ -370,7 +343,6 @@ impl K8sAnywhereTopology {
     pub async fn get_k8s_distribution(&self) -> Result<&KubernetesDistribution, PreparationError> {
         self.k8s_distribution
             .get_or_try_init(async || {
-                debug!("Trying to detect k8s distribution");
                 let client = self.k8s_client().await.unwrap();
 
                 let discovery = client.discovery().await.map_err(|e| {
@@ -386,17 +358,14 @@ impl K8sAnywhereTopology {
                     .groups()
                     .any(|g| g.name() == "project.openshift.io")
                 {
-                    info!("Found KubernetesDistribution OpenshiftFamily");
                     return Ok(KubernetesDistribution::OpenshiftFamily);
                 }
 
                 // K3d / K3s
                 if version.git_version.contains("k3s") {
-                    info!("Found KubernetesDistribution K3sFamily");
                     return Ok(KubernetesDistribution::K3sFamily);
                 }
 
-                info!("Could not identify KubernetesDistribution, using Default");
                 return Ok(KubernetesDistribution::Default);
             })
             .await

harmony/src/domain/topology/k8s_anywhere/mod.rs

@@ -1,3 +0,0 @@
-mod k8s_anywhere;
-mod postgres;
-pub use k8s_anywhere::*;

harmony/src/domain/topology/k8s_anywhere/postgres.rs

@@ -1,37 +0,0 @@
-use async_trait::async_trait;
-
-use crate::{
-    modules::postgresql::capability::{
-        PostgreSQL, PostgreSQLConfig, PostgreSQLEndpoint, ReplicationCerts,
-    },
-    topology::K8sAnywhereTopology,
-};
-
-#[async_trait]
-impl PostgreSQL for K8sAnywhereTopology {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        todo!()
-    }
-
-    /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
-    /// Abstracts away storage/retrieval details (e.g., secrets, files).
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        todo!()
-    }
-
-    /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String> {
-        todo!()
-    }
-
-    /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
-    /// Returns None if no public endpoint (internal-only cluster).
-    /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
-    /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
-    async fn get_public_endpoint(
-        &self,
-        cluster_name: &str,
-    ) -> Result<Option<PostgreSQLEndpoint>, String> {
-        todo!()
-    }
-}

harmony/src/domain/topology/mod.rs

@@ -1,7 +1,5 @@
-mod failover;
 mod ha_cluster;
 pub mod ingress;
-pub use failover::*;
 use harmony_types::net::IpAddress;
 mod host_binding;
 mod http;
@@ -15,7 +13,7 @@ pub use k8s_anywhere::*;
 pub use localhost::*;
 pub mod k8s;
 mod load_balancer;
-pub mod router;
+mod router;
 mod tftp;
 use async_trait::async_trait;
 pub use ha_cluster::*;

harmony/src/domain/topology/network.rs

@@ -9,13 +9,12 @@ use std::{
 use async_trait::async_trait;
 use derive_new::new;
 use harmony_types::{
-    id::Id,
     net::{IpAddress, MacAddress},
     switch::PortLocation,
 };
 use serde::Serialize;
 
-use crate::executors::ExecutorError;
+use crate::{executors::ExecutorError, hardware::PhysicalHost};
 
 use super::{LogicalHost, k8s::K8sClient};
 
@@ -183,37 +182,6 @@ impl FromStr for DnsRecordType {
     }
 }
 
-#[async_trait]
-pub trait NetworkManager: Debug + Send + Sync {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError>;
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError>;
-}
-
-#[derive(Debug, Clone, new)]
-pub struct NetworkError {
-    msg: String,
-}
-
-impl fmt::Display for NetworkError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(&self.msg)
-    }
-}
-
-impl Error for NetworkError {}
-
-impl From<kube::Error> for NetworkError {
-    fn from(value: kube::Error) -> Self {
-        NetworkError::new(value.to_string())
-    }
-}
-
-impl From<String> for NetworkError {
-    fn from(value: String) -> Self {
-        NetworkError::new(value)
-    }
-}
-
 #[async_trait]
 pub trait Switch: Send + Sync {
     async fn setup_switch(&self) -> Result<(), SwitchError>;
@@ -223,12 +191,15 @@ pub trait Switch: Send + Sync {
         mac_address: &MacAddress,
     ) -> Result<Option<PortLocation>, SwitchError>;
 
-    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError>;
+    async fn configure_host_network(
+        &self,
+        host: &PhysicalHost,
+        config: HostNetworkConfig,
+    ) -> Result<(), SwitchError>;
 }
 
 #[derive(Clone, Debug, PartialEq)]
 pub struct HostNetworkConfig {
-    pub host_id: Id,
     pub switch_ports: Vec<SwitchPort>,
 }
 

harmony/src/domain/topology/oberservability/monitoring.rs

@@ -1,6 +1,7 @@
 use std::any::Any;
 
 use async_trait::async_trait;
+use kube::api::DynamicObject;
 use log::debug;
 
 use crate::{
@@ -76,6 +77,14 @@ pub trait AlertReceiver<S: AlertSender>: std::fmt::Debug + Send + Sync {
     fn name(&self) -> String;
     fn clone_box(&self) -> Box<dyn AlertReceiver<S>>;
     fn as_any(&self) -> &dyn Any;
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver;
+}
+
+#[derive(Debug)]
+pub struct AlertManagerReceiver {
+    pub receiver_config: serde_json::Value,
+    // FIXME we should not leak k8s here. DynamicObject is k8s specific
+    pub additional_ressources: Vec<DynamicObject>,
 }
 
 #[async_trait]

harmony/src/domain/topology/router.rs

@@ -1,20 +1,11 @@
-use async_trait::async_trait;
 use cidr::Ipv4Cidr;
 use derive_new::new;
-use serde::Serialize;
 
 use super::{IpAddress, LogicalHost};
 
-/// Basic network router abstraction (L3 IP routing/gateway).
-/// Distinguished from TlsRouter (L4 TLS passthrough).
 pub trait Router: Send + Sync {
-    /// Gateway IP address for this subnet/router.
     fn get_gateway(&self) -> IpAddress;
-
-    /// CIDR block managed by this router.
     fn get_cidr(&self) -> Ipv4Cidr;
-
-    /// Logical host associated with this router.
     fn get_host(&self) -> LogicalHost;
 }
 
@@ -47,67 +38,3 @@ impl Router for UnmanagedRouter {
         todo!()
     }
 }
-
-/// Desired state config for a TLS passthrough route.
-/// Forwards external TLS (port 443) → backend service:target_port (no termination at router).
-/// Inspired by CNPG multisite: exposes `-rw`/`-ro` services publicly via OKD Route/HAProxy/K8s
-/// Gateway etc.
-///
-/// # Example
-/// ```
-/// use harmony::topology::router::TlsRoute;
-/// let postgres_rw = TlsRoute {
-///     hostname: "postgres-cluster-example.public.domain.io".to_string(),
-///     backend: "postgres-cluster-example-rw".to_string(),  // k8s Service or HAProxy upstream
-///     target_port: 5432,
-/// };
-/// ```
-#[derive(Clone, Debug, Serialize)]
-pub struct TlsRoute {
-    /// Public hostname clients connect to (TLS SNI, port 443 implicit).
-    /// Router matches this for passthrough forwarding.
-    pub hostname: String,
-
-    /// Backend/host identifier (k8s Service, HAProxy upstream, IP/FQDN, etc.).
-    pub backend: String,
-
-    /// Backend TCP port (Postgres: 5432).
-    pub target_port: u16,
-
-    /// The environment in which it lives.
-    /// TODO clarify how we handle this in higher level abstractions. The namespace name is a
-    /// direct mapping to k8s but that could be misleading for other implementations.
-    pub namespace: String,
-}
-
-  impl  TlsRoute {
-      pub fn to_string_short(&self) -> String {
-          format!("{}-{}:{}", self.hostname, self.backend, self.target_port)
-      }
-
-      pub fn backend_info_string(&self) -> String {
-          format!("{}:{}", self.backend, self.target_port)
-      }
-  }
-
-/// Installs and queries TLS passthrough routes (L4 TCP/SNI forwarding, no TLS termination).
-/// Agnostic to impl: OKD Route, AWS NLB+HAProxy, k3s Envoy Gateway, Apache ProxyPass.
-/// Used by PostgreSQL capability to expose CNPG clusters multisite (site1 → site2 replication).
-///
-/// # Usage
-/// ```ignore
-/// use harmony::topology::router::TlsRoute;
-/// // After CNPG deploy, expose RW endpoint
-/// async fn route() {
-///     let topology = okd_topology();
-///     let route = TlsRoute { /* ... */ };
-///     topology.install_route(route).await;  // OKD Route, HAProxy reload, etc.
-/// }
-/// ```
-#[async_trait]
-pub trait TlsRouter: Send + Sync {
-    /// Provisions the route (idempotent where possible).
-    /// Example: OKD Route{ host, to: backend:target_port, tls: {passthrough} };
-    ///          HAProxy frontend→backend \"postgres-upstream\".
-    async fn install_route(&self, config: TlsRoute) -> Result<(), String>;
-}

harmony/src/infra/inventory/mod.rs

@@ -11,7 +11,7 @@ pub struct InventoryRepositoryFactory;
 impl InventoryRepositoryFactory {
     pub async fn build() -> Result<Box<dyn InventoryRepository>, RepoError> {
         Ok(Box::new(
-            SqliteInventoryRepository::new(&DATABASE_URL).await?,
+            SqliteInventoryRepository::new(&(*DATABASE_URL)).await?,
         ))
     }
 }

harmony/src/infra/mod.rs

@@ -4,6 +4,5 @@ pub mod hp_ilo;
 pub mod intel_amt;
 pub mod inventory;
 pub mod kube;
-pub mod network_manager;
 pub mod opnsense;
 mod sqlx;

harmony/src/infra/network_manager.rs

@@ -1,264 +0,0 @@
-use std::{
-    collections::{BTreeMap, HashSet},
-    sync::Arc,
-};
-
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use k8s_openapi::api::core::v1::Node;
-use kube::{
-    ResourceExt,
-    api::{ObjectList, ObjectMeta},
-};
-use log::{debug, info};
-
-use crate::{
-    modules::okd::crd::nmstate,
-    topology::{HostNetworkConfig, NetworkError, NetworkManager, k8s::K8sClient},
-};
-
-/// TODO document properly the non-intuitive behavior or "roll forward only" of nmstate in general
-/// It is documented in nmstate official doc, but worth mentionning here :
-///
-/// - You create a bond, nmstate will apply it
-/// - You delete de bond from nmstate, it will NOT delete it
-/// - To delete it you have to update it with configuration set to null
-pub struct OpenShiftNmStateNetworkManager {
-    k8s_client: Arc<K8sClient>,
-}
-
-impl std::fmt::Debug for OpenShiftNmStateNetworkManager {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("OpenShiftNmStateNetworkManager").finish()
-    }
-}
-
-#[async_trait]
-impl NetworkManager for OpenShiftNmStateNetworkManager {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-        debug!("Installing NMState controller...");
-        // TODO use operatorhub maybe?
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/nmstate.io_nmstates.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState namespace...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/namespace.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState service account...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/service_account.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState role...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState role binding...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role_binding.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState operator...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/operator.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        self.k8s_client
-            .wait_until_deployment_ready("nmstate-operator", Some("nmstate"), None)
-            .await?;
-
-        let nmstate = nmstate::NMState {
-            metadata: ObjectMeta {
-                name: Some("nmstate".to_string()),
-                ..Default::default()
-            },
-            ..Default::default()
-        };
-        debug!(
-            "Creating NMState:\n{}",
-            serde_yaml::to_string(&nmstate).unwrap()
-        );
-        self.k8s_client.apply(&nmstate, None).await?;
-
-        Ok(())
-    }
-
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-        let hostname = self.get_hostname(&config.host_id).await.map_err(|e| {
-            NetworkError::new(format!(
-                "Can't configure bond, can't get hostname for host '{}': {e}",
-                config.host_id
-            ))
-        })?;
-        let bond_id = self.get_next_bond_id(&hostname).await.map_err(|e| {
-            NetworkError::new(format!(
-                "Can't configure bond, can't get an available bond id for host '{}': {e}",
-                config.host_id
-            ))
-        })?;
-        let bond_config = self.create_bond_configuration(&hostname, &bond_id, config);
-
-        debug!(
-            "Applying NMState bond config for host {}:\n{}",
-            config.host_id,
-            serde_yaml::to_string(&bond_config).unwrap(),
-        );
-        self.k8s_client
-            .apply(&bond_config, None)
-            .await
-            .map_err(|e| NetworkError::new(format!("Failed to configure bond: {e}")))?;
-
-        Ok(())
-    }
-}
-
-impl OpenShiftNmStateNetworkManager {
-    pub fn new(k8s_client: Arc<K8sClient>) -> Self {
-        Self { k8s_client }
-    }
-
-    fn create_bond_configuration(
-        &self,
-        host: &str,
-        bond_name: &str,
-        config: &HostNetworkConfig,
-    ) -> nmstate::NodeNetworkConfigurationPolicy {
-        info!("Configuring bond '{bond_name}' for host '{host}'...");
-
-        let mut bond_mtu: Option<u32> = None;
-        let mut copy_mac_from: Option<String> = None;
-        let mut bond_ports = Vec::new();
-        let mut interfaces: Vec<nmstate::Interface> = Vec::new();
-
-        for switch_port in &config.switch_ports {
-            let interface_name = switch_port.interface.name.clone();
-
-            interfaces.push(nmstate::Interface {
-                name: interface_name.clone(),
-                description: Some(format!("Member of bond {bond_name}")),
-                r#type: nmstate::InterfaceType::Ethernet,
-                state: "up".to_string(),
-                ipv4: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                ipv6: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                link_aggregation: None,
-                ..Default::default()
-            });
-
-            bond_ports.push(interface_name.clone());
-
-            // Use the first port's details for the bond mtu and mac address
-            if bond_mtu.is_none() {
-                bond_mtu = Some(switch_port.interface.mtu);
-            }
-            if copy_mac_from.is_none() {
-                copy_mac_from = Some(interface_name);
-            }
-        }
-
-        interfaces.push(nmstate::Interface {
-            name: bond_name.to_string(),
-            description: Some(format!("HARMONY - Network bond for host {host}")),
-            r#type: nmstate::InterfaceType::Bond,
-            state: "up".to_string(),
-            copy_mac_from,
-            ipv4: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            ipv6: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                autoconf: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            link_aggregation: Some(nmstate::BondSpec {
-                mode: "802.3ad".to_string(),
-                ports: bond_ports,
-                ..Default::default()
-            }),
-            ..Default::default()
-        });
-
-        nmstate::NodeNetworkConfigurationPolicy {
-            metadata: ObjectMeta {
-                name: Some(format!("{host}-bond-config")),
-                ..Default::default()
-            },
-            spec: nmstate::NodeNetworkConfigurationPolicySpec {
-                node_selector: Some(BTreeMap::from([(
-                    "kubernetes.io/hostname".to_string(),
-                    host.to_string(),
-                )])),
-                desired_state: nmstate::NetworkState {
-                    interfaces,
-                    ..Default::default()
-                },
-            },
-        }
-    }
-
-    async fn get_hostname(&self, host_id: &Id) -> Result<String, String> {
-        let nodes: ObjectList<Node> = self
-            .k8s_client
-            .list_resources(None, None)
-            .await
-            .map_err(|e| format!("Failed to list nodes: {e}"))?;
-
-        let Some(node) = nodes.iter().find(|n| {
-            n.status
-                .as_ref()
-                .and_then(|s| s.node_info.as_ref())
-                .map(|i| i.system_uuid == host_id.to_string())
-                .unwrap_or(false)
-        }) else {
-            return Err(format!("No node found for host '{host_id}'"));
-        };
-
-        node.labels()
-            .get("kubernetes.io/hostname")
-            .ok_or(format!(
-                "Node '{host_id}' has no kubernetes.io/hostname label"
-            ))
-            .cloned()
-    }
-
-    async fn get_next_bond_id(&self, hostname: &str) -> Result<String, String> {
-        let network_state: Option<nmstate::NodeNetworkState> = self
-            .k8s_client
-            .get_resource(hostname, None)
-            .await
-            .map_err(|e| format!("Failed to list nodes: {e}"))?;
-
-        let interfaces = vec![];
-        let existing_bonds: Vec<&nmstate::Interface> = network_state
-            .as_ref()
-            .and_then(|network_state| network_state.status.current_state.as_ref())
-            .map_or(&interfaces, |current_state| &current_state.interfaces)
-            .iter()
-            .filter(|i| i.r#type == nmstate::InterfaceType::Bond)
-            .collect();
-
-        let used_ids: HashSet<u32> = existing_bonds
-            .iter()
-            .filter_map(|i| {
-                i.name
-                    .strip_prefix("bond")
-                    .and_then(|id| id.parse::<u32>().ok())
-            })
-            .collect();
-
-        let next_id = (0..).find(|id| !used_ids.contains(id)).unwrap();
-        Ok(format!("bond{next_id}"))
-    }
-}

harmony/src/modules/inventory/discovery.rs

@@ -74,11 +74,7 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
 
             match ans {
                 Ok(choice) => {
-                    info!(
-                        "Selected {} as the {:?} node.",
-                        choice.summary(),
-                        self.score.role
-                    );
+                    info!("Selected {} as the bootstrap node.", choice.summary());
                     host_repo
                         .save_role_mapping(&self.score.role, &choice)
                         .await?;
@@ -94,7 +90,10 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
                         "Failed to select node for role {:?} : {}",
                         self.score.role, e
                     );
-                    return Err(InterpretError::new(format!("Could not select host : {e}")));
+                    return Err(InterpretError::new(format!(
+                        "Could not select host : {}",
+                        e.to_string()
+                    )));
                 }
             }
         }

harmony/src/modules/k8s/apps/crd/catalogsources_operators_coreos_com.rs

@@ -1,157 +0,0 @@
-use std::collections::BTreeMap;
-
-use k8s_openapi::{
-    api::core::v1::{Affinity, Toleration},
-    apimachinery::pkg::apis::meta::v1::ObjectMeta,
-};
-use kube::CustomResource;
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-
-#[derive(CustomResource, Deserialize, Serialize, Clone, Debug)]
-#[kube(
-    group = "operators.coreos.com",
-    version = "v1alpha1",
-    kind = "CatalogSource",
-    plural = "catalogsources",
-    namespaced = true,
-    schema = "disabled"
-)]
-#[serde(rename_all = "camelCase")]
-pub struct CatalogSourceSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub address: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config_map: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub grpc_pod_config: Option<GrpcPodConfig>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub icon: Option<Icon>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub image: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub priority: Option<i64>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub publisher: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub run_as_root: Option<bool>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub secrets: Option<Vec<String>>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_type: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub update_strategy: Option<UpdateStrategy>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct GrpcPodConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub affinity: Option<Affinity>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub extract_content: Option<ExtractContent>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub memory_target: Option<Value>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub node_selector: Option<BTreeMap<String, String>>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub priority_class_name: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub security_context_config: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tolerations: Option<Vec<Toleration>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct ExtractContent {
-    pub cache_dir: String,
-    pub catalog_dir: String,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct Icon {
-    pub base64data: String,
-    pub mediatype: String,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct UpdateStrategy {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub registry_poll: Option<RegistryPoll>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct RegistryPoll {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub interval: Option<String>,
-}
-
-impl Default for CatalogSource {
-    fn default() -> Self {
-        Self {
-            metadata: ObjectMeta::default(),
-            spec: CatalogSourceSpec {
-                address: None,
-                config_map: None,
-                description: None,
-                display_name: None,
-                grpc_pod_config: None,
-                icon: None,
-                image: None,
-                priority: None,
-                publisher: None,
-                run_as_root: None,
-                secrets: None,
-                source_type: None,
-                update_strategy: None,
-            },
-        }
-    }
-}
-
-impl Default for CatalogSourceSpec {
-    fn default() -> Self {
-        Self {
-            address: None,
-            config_map: None,
-            description: None,
-            display_name: None,
-            grpc_pod_config: None,
-            icon: None,
-            image: None,
-            priority: None,
-            publisher: None,
-            run_as_root: None,
-            secrets: None,
-            source_type: None,
-            update_strategy: None,
-        }
-    }
-}

harmony/src/modules/k8s/apps/crd/mod.rs

@@ -1,4 +0,0 @@
-mod catalogsources_operators_coreos_com;
-pub use catalogsources_operators_coreos_com::*;
-mod subscriptions_operators_coreos_com;
-pub use subscriptions_operators_coreos_com::*;

harmony/src/modules/k8s/apps/crd/subscriptions_operators_coreos_com.rs

@@ -1,68 +0,0 @@
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
-use kube::CustomResource;
-use serde::{Deserialize, Serialize};
-
-#[derive(CustomResource, Deserialize, Serialize, Clone, Debug)]
-#[kube(
-    group = "operators.coreos.com",
-    version = "v1alpha1",
-    kind = "Subscription",
-    plural = "subscriptions",
-    namespaced = true,
-    schema = "disabled"
-)]
-#[serde(rename_all = "camelCase")]
-pub struct SubscriptionSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub channel: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<SubscriptionConfig>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub install_plan_approval: Option<String>,
-
-    pub name: String,
-
-    pub source: String,
-
-    pub source_namespace: String,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub starting_csv: Option<String>,
-}
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct SubscriptionConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub env: Option<Vec<k8s_openapi::api::core::v1::EnvVar>>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub node_selector: Option<std::collections::BTreeMap<String, String>>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tolerations: Option<Vec<k8s_openapi::api::core::v1::Toleration>>,
-}
-
-impl Default for Subscription {
-    fn default() -> Self {
-        Subscription {
-            metadata: ObjectMeta::default(),
-            spec: SubscriptionSpec::default(),
-        }
-    }
-}
-
-impl Default for SubscriptionSpec {
-    fn default() -> SubscriptionSpec {
-        SubscriptionSpec {
-            name: String::new(),
-            source: String::new(),
-            source_namespace: String::new(),
-            channel: None,
-            config: None,
-            install_plan_approval: None,
-            starting_csv: None,
-        }
-    }
-}

harmony/src/modules/k8s/apps/mod.rs

@@ -1,3 +0,0 @@
-mod operatorhub;
-pub use operatorhub::*;
-pub mod crd;

harmony/src/modules/k8s/apps/operatorhub.rs

@@ -1,107 +0,0 @@
-// Write operatorhub catalog score
-// for now this will only support on OKD with the default catalog and operatorhub setup and does not verify OLM state or anything else. Very opinionated and bare-bones to start
-
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
-use serde::Serialize;
-
-use crate::interpret::Interpret;
-use crate::modules::k8s::apps::crd::{
-    CatalogSource, CatalogSourceSpec, RegistryPoll, UpdateStrategy,
-};
-use crate::modules::k8s::resource::K8sResourceScore;
-use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-
-/// Installs the CatalogSource in a cluster which already has the required services and CRDs installed.
-///
-/// ```rust
-/// use harmony::modules::k8s::apps::OperatorHubCatalogSourceScore;
-///
-/// let score = OperatorHubCatalogSourceScore::default();
-/// ```
-///
-/// Required services:
-/// - catalog-operator
-/// - olm-operator
-///
-/// They are installed by default with OKD/Openshift
-///
-/// **Warning** : this initial implementation does not manage the dependencies. They must already
-/// exist in the cluster.
-#[derive(Debug, Clone, Serialize)]
-pub struct OperatorHubCatalogSourceScore {
-    pub name: String,
-    pub namespace: String,
-    pub image: String,
-}
-
-impl OperatorHubCatalogSourceScore {
-    pub fn new(name: &str, namespace: &str, image: &str) -> Self {
-        Self {
-            name: name.to_string(),
-            namespace: namespace.to_string(),
-            image: image.to_string(),
-        }
-    }
-}
-
-impl Default for OperatorHubCatalogSourceScore {
-    /// This default implementation will create this k8s resource :
-    ///
-    /// ```yaml
-    /// apiVersion: operators.coreos.com/v1alpha1
-    /// kind: CatalogSource
-    /// metadata:
-    ///   name: operatorhubio-catalog
-    ///   namespace: openshift-marketplace
-    /// spec:
-    ///   sourceType: grpc
-    ///   image: quay.io/operatorhubio/catalog:latest
-    ///   displayName: Operatorhub Operators
-    ///   publisher: OperatorHub.io
-    ///   updateStrategy:
-    ///     registryPoll:
-    ///       interval: 60m
-    /// ```
-    fn default() -> Self {
-        OperatorHubCatalogSourceScore {
-            name: "operatorhubio-catalog".to_string(),
-            namespace: "openshift-marketplace".to_string(),
-            image: "quay.io/operatorhubio/catalog:latest".to_string(),
-        }
-    }
-}
-
-impl<T: Topology + K8sclient> Score<T> for OperatorHubCatalogSourceScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let metadata = ObjectMeta {
-            name: Some(self.name.clone()),
-            namespace: Some(self.namespace.clone()),
-            ..ObjectMeta::default()
-        };
-
-        let spec = CatalogSourceSpec {
-            source_type: Some("grpc".to_string()),
-            image: Some(self.image.clone()),
-            display_name: Some("Operatorhub Operators".to_string()),
-            publisher: Some("OperatorHub.io".to_string()),
-            update_strategy: Some(UpdateStrategy {
-                registry_poll: Some(RegistryPoll {
-                    interval: Some("60m".to_string()),
-                }),
-            }),
-            ..CatalogSourceSpec::default()
-        };
-
-        let catalog_source = CatalogSource {
-            metadata,
-            spec: spec,
-        };
-
-        K8sResourceScore::single(catalog_source, Some(self.namespace.clone())).create_interpret()
-    }
-
-    fn name(&self) -> String {
-        format!("OperatorHubCatalogSourceScore({})", self.name)
-    }
-}

harmony/src/modules/k8s/mod.rs

@@ -1,4 +1,3 @@
-pub mod apps;
 pub mod deployment;
 pub mod ingress;
 pub mod namespace;

harmony/src/modules/k8s/resource.rs

@@ -38,15 +38,13 @@ impl<
         + 'static
         + Send
         + Clone,
-    T: Topology + K8sclient,
+    T: Topology,
 > Score<T> for K8sResourceScore<K>
 where
     <K as kube::Resource>::DynamicType: Default,
 {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(K8sResourceInterpret {
-            score: self.clone(),
-        })
+        todo!()
     }
 
     fn name(&self) -> String {
@@ -79,33 +77,7 @@ where
         _inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
-        // TODO improve this log
-        let resource_names: Vec<String> = self
-            .score
-            .resource
-            .iter()
-            .map(|r| {
-                format!(
-                    "{}{}",
-                    r.meta()
-                        .name
-                        .as_ref()
-                        .map(|n| format!("{n}"))
-                        .unwrap_or_default(),
-                    r.meta()
-                        .namespace
-                        .as_ref()
-                        .map(|ns| format!("@{}", ns))
-                        .unwrap_or_default()
-                )
-            })
-            .collect();
-
-        info!(
-            "Applying {} resources : {}",
-            resource_names.len(),
-            resource_names.join(", ")
-        );
+        info!("Applying {} resources", self.score.resource.len());
         topology
             .k8s_client()
             .await

harmony/src/modules/mod.rs

@@ -11,10 +11,8 @@ pub mod k8s;
 pub mod lamp;
 pub mod load_balancer;
 pub mod monitoring;
-pub mod network;
 pub mod okd;
 pub mod opnsense;
-pub mod postgresql;
 pub mod prometheus;
 pub mod storage;
 pub mod tenant;

harmony/src/modules/monitoring/alert_channel/discord_alert_channel.rs

@@ -3,7 +3,8 @@ use std::collections::BTreeMap;
 
 use async_trait::async_trait;
 use k8s_openapi::api::core::v1::Secret;
-use kube::api::ObjectMeta;
+use kube::Resource;
+use kube::api::{DynamicObject, ObjectMeta};
 use log::debug;
 use serde::Serialize;
 use serde_json::json;
@@ -13,6 +14,8 @@ use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::{
     AlertmanagerConfig, AlertmanagerConfigSpec, CRDPrometheus,
 };
 use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::RHOBObservability;
+use crate::modules::monitoring::okd::OpenshiftClusterAlertSender;
+use crate::topology::oberservability::monitoring::AlertManagerReceiver;
 use crate::{
     interpret::{InterpretError, Outcome},
     modules::monitoring::{
@@ -32,10 +35,8 @@ pub struct DiscordWebhook {
     pub url: Url,
 }
 
-#[async_trait]
-impl AlertReceiver<RHOBObservability> for DiscordWebhook {
-    async fn install(&self, sender: &RHOBObservability) -> Result<Outcome, InterpretError> {
-        let ns = sender.namespace.clone();
+impl DiscordWebhook {
+    fn get_receiver_config(&self) -> AlertManagerReceiver {
         let secret_name = format!("{}-secret", self.name.clone());
         let webhook_key = format!("{}", self.url.clone());
 
@@ -52,26 +53,74 @@ impl AlertReceiver<RHOBObservability> for DiscordWebhook {
             ..Default::default()
         };
 
-        let _ = sender.client.apply(&secret, Some(&ns)).await;
+        AlertManagerReceiver {
+            additional_ressources: vec![],
+
+            receiver_config: json!({
+                "name": self.name,
+                "discordConfigs": [
+                    {
+                    "apiURL": {
+                        "name": secret_name,
+                        "key":  "webhook-url",
+                    },
+                    "title": "{{ template \"discord.default.title\" . }}",
+                    "message": "{{ template \"discord.default.message\" . }}"
+                    }
+                ]
+            }),
+        }
+    }
+}
+
+#[async_trait]
+impl AlertReceiver<OpenshiftClusterAlertSender> for DiscordWebhook {
+    async fn install(
+        &self,
+        sender: &OpenshiftClusterAlertSender,
+    ) -> Result<Outcome, InterpretError> {
+        todo!()
+    }
+
+    fn name(&self) -> String {
+        todo!()
+    }
+
+    fn clone_box(&self) -> Box<dyn AlertReceiver<OpenshiftClusterAlertSender>> {
+        Box::new(self.clone())
+    }
+
+    fn as_any(&self) -> &dyn Any {
+        todo!()
+    }
+
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        self.get_receiver_config()
+    }
+}
+
+#[async_trait]
+impl AlertReceiver<RHOBObservability> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
+
+    async fn install(&self, sender: &RHOBObservability) -> Result<Outcome, InterpretError> {
+        let ns = sender.namespace.clone();
+
+        let config = self.get_receiver_config();
+        for resource in config.additional_ressources.iter() {
+            todo!("can I apply a dynamicresource");
+            // sender.client.apply(resource, Some(&ns)).await;
+        }
+
         let spec = crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::AlertmanagerConfigSpec {
             data: json!({
                 "route": {
                     "receiver": self.name,
                 },
                 "receivers": [
-                    {
-                        "name": self.name,
-                        "discordConfigs": [
-                            {
-                            "apiURL": {
-                                "name": secret_name,
-                                "key":  "webhook-url",
-                            },
-                            "title": "{{ template \"discord.default.title\" . }}",
-                            "message": "{{ template \"discord.default.message\" . }}"
-                            }
-                        ]
-                    }
+                    config.receiver_config
                 ]
             }),
         };
@@ -122,6 +171,9 @@ impl AlertReceiver<RHOBObservability> for DiscordWebhook {
 
 #[async_trait]
 impl AlertReceiver<CRDPrometheus> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &CRDPrometheus) -> Result<Outcome, InterpretError> {
         let ns = sender.namespace.clone();
         let secret_name = format!("{}-secret", self.name.clone());
@@ -200,6 +252,9 @@ impl AlertReceiver<CRDPrometheus> for DiscordWebhook {
 
 #[async_trait]
 impl AlertReceiver<Prometheus> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &Prometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }
@@ -226,6 +281,9 @@ impl PrometheusReceiver for DiscordWebhook {
 
 #[async_trait]
 impl AlertReceiver<KubePrometheus> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &KubePrometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }

harmony/src/modules/monitoring/alert_channel/webhook_receiver.rs

@@ -19,7 +19,7 @@ use crate::{
         },
         prometheus::prometheus::{Prometheus, PrometheusReceiver},
     },
-    topology::oberservability::monitoring::AlertReceiver,
+    topology::oberservability::monitoring::{AlertManagerReceiver, AlertReceiver},
 };
 use harmony_types::net::Url;
 
@@ -31,6 +31,9 @@ pub struct WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<RHOBObservability> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &RHOBObservability) -> Result<Outcome, InterpretError> {
         let spec = crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::AlertmanagerConfigSpec {
             data: json!({
@@ -97,6 +100,9 @@ impl AlertReceiver<RHOBObservability> for WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<CRDPrometheus> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &CRDPrometheus) -> Result<Outcome, InterpretError> {
         let spec = crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::AlertmanagerConfigSpec {
             data: json!({
@@ -158,6 +164,9 @@ impl AlertReceiver<CRDPrometheus> for WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<Prometheus> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &Prometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }
@@ -184,6 +193,9 @@ impl PrometheusReceiver for WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<KubePrometheus> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &KubePrometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }

harmony/src/modules/monitoring/ntfy/ntfy.rs

@@ -100,7 +100,11 @@ impl<T: Topology + HelmCommand + K8sclient + MultiTargetTopology> Interpret<T> f
 
         info!("deploying ntfy...");
         client
-            .wait_until_deployment_ready("ntfy", Some(self.score.namespace.as_str()), None)
+            .wait_until_deployment_ready(
+                "ntfy".to_string(),
+                Some(self.score.namespace.as_str()),
+                None,
+            )
             .await?;
         info!("ntfy deployed");
 

harmony/src/modules/monitoring/okd/cluster_monitoring.rs

@@ -0,0 +1,139 @@
+use base64::prelude::*;
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use harmony_types::id::Id;
+use kube::api::DynamicObject;
+use log::{debug, info, trace};
+use serde::Serialize;
+
+use crate::{
+    data::Version,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
+    modules::{
+        application::Application,
+        monitoring::{
+            grafana::grafana::Grafana,
+            kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus,
+            okd::OpenshiftClusterAlertSender,
+        },
+        prometheus::prometheus::PrometheusMonitoring,
+    },
+    score::Score,
+    topology::{
+        K8sclient, Topology,
+        k8s::K8sClient,
+        oberservability::monitoring::{AlertReceiver, AlertingInterpret, ScrapeTarget},
+    },
+};
+
+impl Clone for Box<dyn AlertReceiver<OpenshiftClusterAlertSender>> {
+    fn clone(&self) -> Self {
+        self.clone_box()
+    }
+}
+
+impl Serialize for Box<dyn AlertReceiver<OpenshiftClusterAlertSender>> {
+    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        todo!()
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct OpenshiftClusterAlertScore {
+    pub receivers: Vec<Box<dyn AlertReceiver<OpenshiftClusterAlertSender>>>,
+}
+
+impl<T: Topology + K8sclient> Score<T> for OpenshiftClusterAlertScore {
+    fn name(&self) -> String {
+        "ClusterAlertScore".to_string()
+    }
+
+    #[doc(hidden)]
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        Box::new(OpenshiftClusterAlertInterpret {
+            receivers: self.receivers.clone(),
+        })
+    }
+}
+
+#[derive(Debug)]
+pub struct OpenshiftClusterAlertInterpret {
+    receivers: Vec<Box<dyn AlertReceiver<OpenshiftClusterAlertSender>>>,
+}
+
+#[async_trait]
+impl<T: Topology + K8sclient> Interpret<T> for OpenshiftClusterAlertInterpret {
+    async fn execute(
+        &self,
+        _inventory: &Inventory,
+        topology: &T,
+    ) -> Result<Outcome, InterpretError> {
+        let client = topology.k8s_client().await?;
+
+        let secret: DynamicObject = client
+            .get_secret_json_value("alertmanager-main", Some("openshift-monitoring"))
+            .await?;
+        trace!("Got secret {secret:?}");
+
+        let data: serde_json::Value = secret.data;
+
+        // TODO : get config in base64 by drilling into the value
+        let config_b64 = match data.get("alertmanager.yaml") {
+            Some(value) => value.as_str().unwrap_or(""),
+            None => "",
+        };
+
+        // TODO : base64 decode it
+        let config_bytes = BASE64_STANDARD.decode(config_b64).unwrap_or_default();
+
+        // TODO : use serde_yaml to deserialize the string
+        let am_config: serde_yaml::Value =
+            serde_yaml::from_str(&String::from_utf8(config_bytes).unwrap_or_default())
+                .unwrap_or_default();
+
+        // Merge current alert receivers from this config with self.receivers
+        if let Some(existing_receivers) = am_config.get("receivers") {
+            for receiver in existing_receivers.as_sequence().unwrap_or(&vec![]) {
+                match serde_json::to_string(receiver) {
+                    Ok(yaml_str) => {
+                        // TODO: validate that each receiver implements to_alertmanager_yaml()
+                        // and compare with our receivers
+                        info!("Found existing receiver config: {}", yaml_str);
+                    }
+                    Err(e) => debug!("Failed to serialize receiver: {}", e),
+                }
+            }
+        }
+
+        for custom_receiver in &self.receivers {
+            trace!("Processing custom receiver");
+            debug!(
+                "Custom receiver YAML output: {:?}",
+                custom_receiver.as_alertmanager_receiver()
+            );
+        }
+
+        Ok(Outcome::success(todo!("whats up")))
+    }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("OpenshiftClusterAlertInterpret")
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}

harmony/src/modules/monitoring/okd/config.rs

@@ -0,0 +1,90 @@
+use std::{collections::BTreeMap, sync::Arc};
+
+use crate::{
+    interpret::{InterpretError, Outcome},
+    topology::k8s::K8sClient,
+};
+use k8s_openapi::api::core::v1::ConfigMap;
+use kube::api::ObjectMeta;
+
+pub(crate) struct Config;
+
+impl Config {
+    pub async fn create_cluster_monitoring_config_cm(
+        client: &Arc<K8sClient>,
+    ) -> Result<Outcome, InterpretError> {
+        let mut data = BTreeMap::new();
+        data.insert(
+            "config.yaml".to_string(),
+            r#"
+enableUserWorkload: true
+alertmanagerMain:
+  enableUserAlertmanagerConfig: true
+"#
+            .to_string(),
+        );
+
+        let cm = ConfigMap {
+            metadata: ObjectMeta {
+                name: Some("cluster-monitoring-config".to_string()),
+                namespace: Some("openshift-monitoring".to_string()),
+                ..Default::default()
+            },
+            data: Some(data),
+            ..Default::default()
+        };
+        client.apply(&cm, Some("openshift-monitoring")).await?;
+
+        Ok(Outcome::success(
+            "updated cluster-monitoring-config-map".to_string(),
+        ))
+    }
+
+    pub async fn create_user_workload_monitoring_config_cm(
+        client: &Arc<K8sClient>,
+    ) -> Result<Outcome, InterpretError> {
+        let mut data = BTreeMap::new();
+        data.insert(
+            "config.yaml".to_string(),
+            r#"
+alertmanager: 
+  enabled: true
+  enableAlertmanagerConfig: true
+"#
+            .to_string(),
+        );
+        let cm = ConfigMap {
+            metadata: ObjectMeta {
+                name: Some("user-workload-monitoring-config".to_string()),
+                namespace: Some("openshift-user-workload-monitoring".to_string()),
+                ..Default::default()
+            },
+            data: Some(data),
+            ..Default::default()
+        };
+        client
+            .apply(&cm, Some("openshift-user-workload-monitoring"))
+            .await?;
+
+        Ok(Outcome::success(
+            "updated openshift-user-monitoring-config-map".to_string(),
+        ))
+    }
+
+    pub async fn verify_user_workload(client: &Arc<K8sClient>) -> Result<Outcome, InterpretError> {
+        let namespace = "openshift-user-workload-monitoring";
+        let alertmanager_name = "alertmanager-user-workload-0";
+        let prometheus_name = "prometheus-user-workload-0";
+        client
+            .wait_for_pod_ready(alertmanager_name, Some(namespace))
+            .await?;
+        client
+            .wait_for_pod_ready(prometheus_name, Some(namespace))
+            .await?;
+
+        Ok(Outcome::success(format!(
+            "pods: {}, {} ready in ns: {}",
+            alertmanager_name, prometheus_name, namespace
+        )))
+    }
+}

harmony/src/modules/monitoring/okd/enable_user_workload.rs

@@ -1,16 +1,13 @@
-use std::{collections::BTreeMap, sync::Arc};
-
 use crate::{
     data::Version,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
+    modules::monitoring::okd::config::Config,
     score::Score,
-    topology::{K8sclient, Topology, k8s::K8sClient},
+    topology::{K8sclient, Topology},
 };
 use async_trait::async_trait;
 use harmony_types::id::Id;
-use k8s_openapi::api::core::v1::ConfigMap;
-use kube::api::ObjectMeta;
 use serde::Serialize;
 
 #[derive(Clone, Debug, Serialize)]
@@ -37,10 +34,9 @@ impl<T: Topology + K8sclient> Interpret<T> for OpenshiftUserWorkloadMonitoringIn
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
         let client = topology.k8s_client().await.unwrap();
-        self.update_cluster_monitoring_config_cm(&client).await?;
-        self.update_user_workload_monitoring_config_cm(&client)
-            .await?;
-        self.verify_user_workload(&client).await?;
+        Config::create_cluster_monitoring_config_cm(&client).await?;
+        Config::create_user_workload_monitoring_config_cm(&client).await?;
+        Config::verify_user_workload(&client).await?;
         Ok(Outcome::success(
             "successfully enabled user-workload-monitoring".to_string(),
         ))
@@ -62,88 +58,3 @@ impl<T: Topology + K8sclient> Interpret<T> for OpenshiftUserWorkloadMonitoringIn
         todo!()
     }
 }
-
-impl OpenshiftUserWorkloadMonitoringInterpret {
-    pub async fn update_cluster_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-enableUserWorkload: true
-alertmanagerMain:
-  enableUserAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("cluster-monitoring-config".to_string()),
-                namespace: Some("openshift-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client.apply(&cm, Some("openshift-monitoring")).await?;
-
-        Ok(Outcome::success(
-            "updated cluster-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn update_user_workload_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-alertmanager: 
-  enabled: true
-  enableAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("user-workload-monitoring-config".to_string()),
-                namespace: Some("openshift-user-workload-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client
-            .apply(&cm, Some("openshift-user-workload-monitoring"))
-            .await?;
-
-        Ok(Outcome::success(
-            "updated openshift-user-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn verify_user_workload(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let namespace = "openshift-user-workload-monitoring";
-        let alertmanager_name = "alertmanager-user-workload-0";
-        let prometheus_name = "prometheus-user-workload-0";
-        client
-            .wait_for_pod_ready(alertmanager_name, Some(namespace))
-            .await?;
-        client
-            .wait_for_pod_ready(prometheus_name, Some(namespace))
-            .await?;
-
-        Ok(Outcome::success(format!(
-            "pods: {}, {} ready in ns: {}",
-            alertmanager_name, prometheus_name, namespace
-        )))
-    }
-}

harmony/src/modules/monitoring/okd/mod.rs

@@ -1 +1,14 @@
+use crate::topology::oberservability::monitoring::AlertSender;
+
+pub mod cluster_monitoring;
+pub(crate) mod config;
 pub mod enable_user_workload;
+
+#[derive(Debug)]
+pub struct OpenshiftClusterAlertSender;
+
+impl AlertSender for OpenshiftClusterAlertSender {
+    fn name(&self) -> String {
+        "OpenshiftClusterAlertSender".to_string()
+    }
+}

harmony/src/modules/network/mod.rs

@@ -1,2 +0,0 @@
-mod tls_router;
-pub use tls_router::*;

harmony/src/modules/network/tls_router.rs

@@ -1,91 +0,0 @@
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use serde::Serialize;
-
-use crate::data::Version;
-use crate::domain::topology::router::{TlsRoute, TlsRouter};
-use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
-use crate::inventory::Inventory;
-use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-
-/// Score for provisioning a TLS passthrough route.
-/// Exposes backend services via TLS passthrough (L4 TCP/SNI forwarding).
-/// Agnostic to underlying router impl (OKD Route, HAProxy, Envoy, etc.).
-///
-/// TlsPassthroughScore relies on the TlsRouter Capability for its entire functionnality,
-/// the implementation depends entirely on how the Topology implements it.
-///
-/// # Usage
-/// ```
-/// use harmony::modules::network::TlsPassthroughScore;
-/// use harmony::topology::router::TlsRoute;
-/// let score = TlsPassthroughScore {
-///     route: TlsRoute {
-///     backend: "postgres-cluster-rw".to_string(),
-///     hostname: "postgres-rw.example.com".to_string(),
-///     target_port: 5432,
-///   },
-/// };
-/// ```
-///
-/// # Hint
-///
-/// **This TlsPassthroughScore should be used whenever possible.** It is effectively
-/// an abstraction over the concept of tls passthrough, and it will allow much more flexible
-/// usage over multiple types of Topology than using a lower level module such as
-/// OKDTlsPassthroughScore.
-///
-/// On the other hand, some implementation specific options might not be available or practical
-/// to use through this high level TlsPassthroughScore.
-#[derive(Debug, Clone, Serialize)]
-pub struct TlsPassthroughScore {
-    pub route: TlsRoute,
-}
-
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for TlsPassthroughScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(TlsPassthroughInterpret {
-            tls_route: self.route.clone(),
-        })
-    }
-
-    fn name(&self) -> String {
-        format!(
-            "TlsRouterScore({}:{} → {})",
-            self.route.backend, self.route.target_port, self.route.hostname
-        )
-    }
-}
-
-/// Custom interpret: provisions the TLS passthrough route on the topology.
-#[derive(Debug, Clone)]
-struct TlsPassthroughInterpret {
-    tls_route: TlsRoute,
-}
-
-#[async_trait]
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for TlsPassthroughInterpret {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("TlsRouterInterpret")
-    }
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-    async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
-        topo.install_route(self.tls_route.clone())
-            .await
-            .map_err(|e| InterpretError::new(e.to_string()))?;
-
-        Ok(Outcome::success(format!(
-            "TLS route installed: {} → {}:{}",
-            self.tls_route.hostname, self.tls_route.backend, self.tls_route.target_port
-        )))
-    }
-}

harmony/src/modules/okd/bootstrap_03_control_plane.rs

@@ -5,8 +5,10 @@ use crate::{
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::{HostRole, Inventory},
     modules::{
-        dhcp::DhcpHostBindingScore, http::IPxeMacBootFileScore,
-        inventory::DiscoverHostForRoleScore, okd::templates::BootstrapIpxeTpl,
+        dhcp::DhcpHostBindingScore,
+        http::IPxeMacBootFileScore,
+        inventory::DiscoverHostForRoleScore,
+        okd::{host_network::HostNetworkConfigurationScore, templates::BootstrapIpxeTpl},
     },
     score::Score,
     topology::{HAClusterTopology, HostBinding},
@@ -203,6 +205,28 @@ impl OKDSetup03ControlPlaneInterpret {
 
         Ok(())
     }
+
+    /// Placeholder for automating network bonding configuration.
+    async fn persist_network_bond(
+        &self,
+        inventory: &Inventory,
+        topology: &HAClusterTopology,
+        hosts: &Vec<PhysicalHost>,
+    ) -> Result<(), InterpretError> {
+        info!("[ControlPlane] Ensuring persistent bonding");
+        let score = HostNetworkConfigurationScore {
+            hosts: hosts.clone(),
+        };
+        score.interpret(inventory, topology).await?;
+
+        inquire::Confirm::new(
+            "Network configuration for control plane nodes is not automated yet. Configure it manually if needed.",
+        )
+        .prompt()
+        .map_err(|e| InterpretError::new(format!("User prompt failed: {e}")))?;
+
+        Ok(())
+    }
 }
 
 #[async_trait]
@@ -241,6 +265,10 @@ impl Interpret<HAClusterTopology> for OKDSetup03ControlPlaneInterpret {
         // 4. Reboot the nodes to start the OS installation.
         self.reboot_targets(&nodes).await?;
 
+        // 5. Placeholder for post-boot network configuration (e.g., bonding).
+        self.persist_network_bond(inventory, topology, &nodes)
+            .await?;
+
         // TODO: Implement a step to wait for the control plane nodes to join the cluster
         // and for the cluster operators to become available. This would be similar to
         // the `wait-for bootstrap-complete` command.

harmony/src/modules/okd/bootstrap_persist_network_bond.rs

@@ -1,130 +0,0 @@
-use crate::{
-    data::Version,
-    hardware::PhysicalHost,
-    infra::inventory::InventoryRepositoryFactory,
-    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
-    inventory::{HostRole, Inventory},
-    modules::okd::host_network::HostNetworkConfigurationScore,
-    score::Score,
-    topology::HAClusterTopology,
-};
-use async_trait::async_trait;
-use derive_new::new;
-use harmony_types::id::Id;
-use log::info;
-use serde::Serialize;
-
-// -------------------------------------------------------------------------------------------------
-// Persist Network Bond
-// - Persist bonding via NMState
-// - Persist port channels on the Switch
-// -------------------------------------------------------------------------------------------------
-
-#[derive(Debug, Clone, Serialize, new)]
-pub struct OKDSetupPersistNetworkBondScore {}
-
-impl Score<HAClusterTopology> for OKDSetupPersistNetworkBondScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<HAClusterTopology>> {
-        Box::new(OKDSetupPersistNetworkBondInterpet::new())
-    }
-
-    fn name(&self) -> String {
-        "OKDSetupPersistNetworkBondScore".to_string()
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct OKDSetupPersistNetworkBondInterpet {
-    version: Version,
-    status: InterpretStatus,
-}
-
-impl OKDSetupPersistNetworkBondInterpet {
-    pub fn new() -> Self {
-        let version = Version::from("1.0.0").unwrap();
-        Self {
-            version,
-            status: InterpretStatus::QUEUED,
-        }
-    }
-
-    /// Ensures that three physical hosts are discovered and available for the ControlPlane role.
-    /// It will trigger discovery if not enough hosts are found.
-    async fn get_nodes(
-        &self,
-        _inventory: &Inventory,
-        _topology: &HAClusterTopology,
-    ) -> Result<Vec<PhysicalHost>, InterpretError> {
-        const REQUIRED_HOSTS: usize = 3;
-        let repo = InventoryRepositoryFactory::build().await?;
-        let control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
-
-        if control_plane_hosts.len() < REQUIRED_HOSTS {
-            Err(InterpretError::new(format!(
-                "OKD Requires at least {} control plane hosts, but only found {}. Cannot proceed.",
-                REQUIRED_HOSTS,
-                control_plane_hosts.len()
-            )))
-        } else {
-            // Take exactly the number of required hosts to ensure consistency.
-            Ok(control_plane_hosts
-                .into_iter()
-                .take(REQUIRED_HOSTS)
-                .collect())
-        }
-    }
-
-    async fn persist_network_bond(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-        hosts: &Vec<PhysicalHost>,
-    ) -> Result<(), InterpretError> {
-        info!("Ensuring persistent bonding");
-
-        let score = HostNetworkConfigurationScore {
-            hosts: hosts.clone(),
-        };
-        score.interpret(inventory, topology).await?;
-
-        Ok(())
-    }
-}
-
-#[async_trait]
-impl Interpret<HAClusterTopology> for OKDSetupPersistNetworkBondInterpet {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("OKDSetupPersistNetworkBondInterpet")
-    }
-
-    fn get_version(&self) -> Version {
-        self.version.clone()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        self.status.clone()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        vec![]
-    }
-
-    async fn execute(
-        &self,
-        inventory: &Inventory,
-        topology: &HAClusterTopology,
-    ) -> Result<Outcome, InterpretError> {
-        let nodes = self.get_nodes(inventory, topology).await?;
-
-        let res = self.persist_network_bond(inventory, topology, &nodes).await;
-
-        match res {
-            Ok(_) => Ok(Outcome::success(
-                "Network bond successfully persisted".into(),
-            )),
-            Err(_) => Err(InterpretError::new(
-                "Failed to persist network bond".to_string(),
-            )),
-        }
-    }
-}

harmony/src/modules/okd/crd/mod.rs

@@ -1,2 +1,41 @@
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
 pub mod nmstate;
-pub mod route;
+
+#[derive(CustomResource, Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[kube(
+    group = "operators.coreos.com",
+    version = "v1",
+    kind = "OperatorGroup",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct OperatorGroupSpec {
+    pub target_namespaces: Vec<String>,
+}
+
+#[derive(CustomResource, Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[kube(
+    group = "operators.coreos.com",
+    version = "v1alpha1",
+    kind = "Subscription",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct SubscriptionSpec {
+    pub name: String,
+    pub source: String,
+    pub source_namespace: String,
+    pub channel: Option<String>,
+    pub install_plan_approval: Option<InstallPlanApproval>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
+pub enum InstallPlanApproval {
+    #[serde(rename = "Automatic")]
+    Automatic,
+    #[serde(rename = "Manual")]
+    Manual,
+}

harmony/src/modules/okd/crd/nmstate.rs

@@ -1,22 +1,14 @@
 use std::collections::BTreeMap;
 
-use k8s_openapi::{ClusterResourceScope, Resource};
-use kube::{CustomResource, api::ObjectMeta};
+use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
 #[derive(CustomResource, Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[kube(
-    group = "nmstate.io",
-    version = "v1",
-    kind = "NMState",
-    plural = "nmstates",
-    namespaced = false
-)]
+#[kube(group = "nmstate.io", version = "v1", kind = "NMState", namespaced)]
 #[serde(rename_all = "camelCase")]
 pub struct NMStateSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub probe_configuration: Option<ProbeConfig>,
 }
 
@@ -48,350 +40,55 @@ pub struct ProbeDns {
     group = "nmstate.io",
     version = "v1",
     kind = "NodeNetworkConfigurationPolicy",
-    namespaced = false
+    namespaced
 )]
 #[serde(rename_all = "camelCase")]
 pub struct NodeNetworkConfigurationPolicySpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub node_selector: Option<BTreeMap<String, String>>,
-    pub desired_state: NetworkState,
-}
-
-// Currently, kube-rs derive doesn't support resources without a `spec` field, so we have
-// to implement it ourselves.
-//
-// Ref:
-// - https://github.com/kube-rs/kube/issues/1763
-// - https://github.com/kube-rs/kube/discussions/1762
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct NodeNetworkState {
-    metadata: ObjectMeta,
-    pub status: NodeNetworkStateStatus,
-}
-
-impl Resource for NodeNetworkState {
-    const API_VERSION: &'static str = "nmstate.io/v1beta1";
-    const GROUP: &'static str = "nmstate.io";
-    const VERSION: &'static str = "v1beta1";
-    const KIND: &'static str = "NodeNetworkState";
-    const URL_PATH_SEGMENT: &'static str = "nodenetworkstates";
-    type Scope = ClusterResourceScope;
-}
-
-impl k8s_openapi::Metadata for NodeNetworkState {
-    type Ty = ObjectMeta;
-
-    fn metadata(&self) -> &Self::Ty {
-        &self.metadata
-    }
-
-    fn metadata_mut(&mut self) -> &mut Self::Ty {
-        &mut self.metadata
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct NodeNetworkStateStatus {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub current_state: Option<NetworkState>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub handler_nmstate_version: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_network_manager_version: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub last_successful_update_time: Option<String>,
-}
-
-/// The NetworkState is the top-level struct, representing the entire
-/// desired or current network state.
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-#[serde(deny_unknown_fields)]
-pub struct NetworkState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hostname: Option<HostNameState>,
-    #[serde(rename = "dns-resolver", skip_serializing_if = "Option::is_none")]
-    pub dns: Option<DnsState>,
-    #[serde(rename = "route-rules", skip_serializing_if = "Option::is_none")]
-    pub rules: Option<RouteRuleState>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub routes: Option<RouteState>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub interfaces: Vec<Interface>,
-    #[serde(rename = "ovs-db", skip_serializing_if = "Option::is_none")]
-    pub ovsdb: Option<OvsDbGlobalConfig>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ovn: Option<OvnConfiguration>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct HostNameState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<String>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct DnsState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<DnsResolverConfig>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<DnsResolverConfig>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct DnsResolverConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub search: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub server: Option<Vec<String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteRuleState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<Vec<RouteRule>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<Vec<RouteRule>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<Vec<Route>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<Vec<Route>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteRule {
-    #[serde(rename = "ip-from", skip_serializing_if = "Option::is_none")]
-    pub ip_from: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub priority: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub route_table: Option<u32>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct Route {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub destination: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metric: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_hop_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_hop_interface: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub table_id: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mtu: Option<u32>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvsDbGlobalConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_ids: Option<BTreeMap<String, String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub other_config: Option<BTreeMap<String, String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvnConfiguration {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bridge_mappings: Option<Vec<OvnBridgeMapping>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvnBridgeMapping {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub localnet: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bridge: Option<String>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(untagged)]
-#[serde(rename_all = "kebab-case")]
-pub enum StpSpec {
-    Bool(bool),
-    Options(StpOptions),
+    pub desired_state: DesiredStateSpec,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct LldpState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled: Option<bool>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvsDb {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_ids: Option<BTreeMap<String, String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub other_config: Option<BTreeMap<String, String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct PatchState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub peer: Option<String>,
+pub struct DesiredStateSpec {
+    pub interfaces: Vec<InterfaceSpec>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct Interface {
+pub struct InterfaceSpec {
     pub name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
-    pub r#type: InterfaceType,
+    pub r#type: String,
     pub state: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub copy_mac_from: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub controller: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ipv4: Option<IpStackSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ipv6: Option<IpStackSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ethernet: Option<EthernetSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub link_aggregation: Option<BondSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vlan: Option<VlanSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vxlan: Option<VxlanSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_vtap: Option<MacVtapSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_vlan: Option<MacVlanSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub infiniband: Option<InfinibandSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub linux_bridge: Option<LinuxBridgeSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    #[serde(alias = "bridge")]
     pub ovs_bridge: Option<OvsBridgeSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ethtool: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub accept_all_mac_addresses: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub identifier: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub lldp: Option<LldpState>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub permanent_mac_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub min_mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mptcp: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub profile_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wait_ip: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ovs_db: Option<OvsDb>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub driver: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub patch: Option<PatchState>,
-}
-
-#[derive(Deserialize, Serialize, Clone, PartialEq, Eq, PartialOrd, Ord, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub enum InterfaceType {
-    #[serde(rename = "unknown")]
-    Unknown,
-    #[serde(rename = "dummy")]
-    Dummy,
-    #[serde(rename = "loopback")]
-    Loopback,
-    #[serde(rename = "linux-bridge")]
-    LinuxBridge,
-    #[serde(rename = "ovs-bridge")]
-    OvsBridge,
-    #[serde(rename = "ovs-interface")]
-    OvsInterface,
-    #[serde(rename = "bond")]
-    Bond,
-    #[serde(rename = "ipvlan")]
-    IpVlan,
-    #[serde(rename = "vlan")]
-    Vlan,
-    #[serde(rename = "vxlan")]
-    Vxlan,
-    #[serde(rename = "mac-vlan")]
-    Macvlan,
-    #[serde(rename = "mac-vtap")]
-    Macvtap,
-    #[serde(rename = "ethernet")]
-    Ethernet,
-    #[serde(rename = "infiniband")]
-    Infiniband,
-    #[serde(rename = "vrf")]
-    Vrf,
-    #[serde(rename = "veth")]
-    Veth,
-    #[serde(rename = "ipsec")]
-    Ipsec,
-    #[serde(rename = "hsr")]
-    Hrs,
-}
-
-impl Default for InterfaceType {
-    fn default() -> Self {
-        Self::Loopback
-    }
+    pub ethtool: Option<EthtoolSpec>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct IpStackSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub dhcp: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub autoconf: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub address: Option<Vec<IpAddressSpec>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_dns: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_gateway: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_routes: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub dhcp_client_id: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub dhcp_duid: Option<String>,
 }
 
@@ -405,11 +102,8 @@ pub struct IpAddressSpec {
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct EthernetSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub speed: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub duplex: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_negotiation: Option<bool>,
 }
 
@@ -417,9 +111,7 @@ pub struct EthernetSpec {
 #[serde(rename_all = "kebab-case")]
 pub struct BondSpec {
     pub mode: String,
-    #[serde(alias = "port")]
     pub ports: Vec<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub options: Option<BTreeMap<String, Value>>,
 }
 
@@ -428,7 +120,6 @@ pub struct BondSpec {
 pub struct VlanSpec {
     pub base_iface: String,
     pub id: u16,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub protocol: Option<String>,
 }
 
@@ -438,11 +129,8 @@ pub struct VxlanSpec {
     pub base_iface: String,
     pub id: u32,
     pub remote: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub local: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub learning: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub destination_port: Option<u16>,
 }
 
@@ -451,7 +139,6 @@ pub struct VxlanSpec {
 pub struct MacVtapSpec {
     pub base_iface: String,
     pub mode: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub promiscuous: Option<bool>,
 }
 
@@ -460,7 +147,6 @@ pub struct MacVtapSpec {
 pub struct MacVlanSpec {
     pub base_iface: String,
     pub mode: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub promiscuous: Option<bool>,
 }
 
@@ -475,35 +161,25 @@ pub struct InfinibandSpec {
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgeSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub options: Option<LinuxBridgeOptions>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ports: Option<Vec<LinuxBridgePort>>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgeOptions {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_ageing_time: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub multicast_snooping: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub stp: Option<StpOptions>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct StpOptions {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub forward_delay: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub hello_time: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub max_age: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub priority: Option<u16>,
 }
 
@@ -511,20 +187,15 @@ pub struct StpOptions {
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgePort {
     pub name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vlan: Option<LinuxBridgePortVlan>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct LinuxBridgePortVlan {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mode: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub trunk_tags: Option<Vec<VlanTag>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub tag: Option<u16>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub enable_native: Option<bool>,
 }
 
@@ -532,7 +203,6 @@ pub struct LinuxBridgePortVlan {
 #[serde(rename_all = "kebab-case")]
 pub struct VlanTag {
     pub id: u16,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub id_range: Option<VlanIdRange>,
 }
 
@@ -546,35 +216,36 @@ pub struct VlanIdRange {
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct OvsBridgeSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub options: Option<OvsBridgeOptions>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub ports: Option<Vec<OvsPortSpec>>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct OvsBridgeOptions {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stp: Option<StpSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stp: Option<bool>,
     pub rstp: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub mcast_snooping_enable: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub datapath: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub fail_mode: Option<String>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct OvsPortSpec {
     pub name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub link_aggregation: Option<BondSpec>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub vlan: Option<LinuxBridgePortVlan>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     pub r#type: Option<String>,
 }
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct EthtoolSpec {
+    // TODO: Properly describe this spec (https://nmstate.io/devel/yaml_api.html#ethtool)
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct EthtoolFecSpec {
+    pub auto: Option<bool>,
+    pub mode: Option<String>,
+}

harmony/src/modules/okd/crd/route.rs

@@ -1,287 +0,0 @@
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::{ListMeta, ObjectMeta, Time};
-use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
-use k8s_openapi::{NamespaceResourceScope, Resource};
-use serde::{Deserialize, Serialize};
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct LocalObjectReference {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct Route {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub api_version: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub kind: Option<String>,
-    pub metadata: ObjectMeta,
-
-    pub spec: RouteSpec,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<RouteStatus>,
-}
-
-impl Resource for Route {
-    const API_VERSION: &'static str = "route.openshift.io/v1";
-    const GROUP: &'static str = "route.openshift.io";
-    const VERSION: &'static str = "v1";
-    const KIND: &'static str = "Route";
-    const URL_PATH_SEGMENT: &'static str = "routes";
-    type Scope = NamespaceResourceScope;
-}
-
-impl k8s_openapi::Metadata for Route {
-    type Ty = ObjectMeta;
-
-    fn metadata(&self) -> &Self::Ty {
-        &self.metadata
-    }
-
-    fn metadata_mut(&mut self) -> &mut Self::Ty {
-        &mut self.metadata
-    }
-}
-
-impl Default for Route {
-    fn default() -> Self {
-        Route {
-            api_version: Some("route.openshift.io/v1".to_string()),
-            kind: Some("Route".to_string()),
-            metadata: ObjectMeta::default(),
-            spec: RouteSpec::default(),
-            status: None,
-        }
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteList {
-    pub metadata: ListMeta,
-    pub items: Vec<Route>,
-}
-
-impl Default for RouteList {
-    fn default() -> Self {
-        Self {
-            metadata: ListMeta::default(),
-            items: Vec::new(),
-        }
-    }
-}
-
-impl Resource for RouteList {
-    const API_VERSION: &'static str = "route.openshift.io/v1";
-    const GROUP: &'static str = "route.openshift.io";
-    const VERSION: &'static str = "v1";
-    const KIND: &'static str = "RouteList";
-    const URL_PATH_SEGMENT: &'static str = "routes";
-    type Scope = NamespaceResourceScope;
-}
-
-impl k8s_openapi::Metadata for RouteList {
-    type Ty = ListMeta;
-
-    fn metadata(&self) -> &Self::Ty {
-        &self.metadata
-    }
-
-    fn metadata_mut(&mut self) -> &mut Self::Ty {
-        &mut self.metadata
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub alternate_backends: Option<Vec<RouteTargetReference>>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub http_headers: Option<RouteHTTPHeaders>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub port: Option<RoutePort>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub subdomain: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tls: Option<TLSConfig>,
-
-    pub to: RouteTargetReference,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wildcard_policy: Option<String>,
-}
-impl Default for RouteSpec {
-    fn default() -> RouteSpec {
-        RouteSpec {
-            alternate_backends: None,
-            host: None,
-            http_headers: None,
-            path: None,
-            port: None,
-            subdomain: None,
-            tls: None,
-            to: RouteTargetReference::default(),
-            wildcard_policy: None,
-        }
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteTargetReference {
-    pub kind: String,
-    pub name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub weight: Option<i32>,
-}
-impl Default for RouteTargetReference {
-    fn default() -> RouteTargetReference {
-        RouteTargetReference {
-            kind: String::default(),
-            name: String::default(),
-            weight: None,
-        }
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RoutePort {
-    pub target_port: u16,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct TLSConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ca_certificate: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub certificate: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub destination_ca_certificate: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_certificate: Option<LocalObjectReference>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub insecure_edge_termination_policy: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub key: Option<String>,
-
-    pub termination: String,
-}
-
-impl Default for TLSConfig {
-    fn default() -> Self {
-        Self {
-            ca_certificate: None,
-            certificate: None,
-            destination_ca_certificate: None,
-            external_certificate: None,
-            insecure_edge_termination_policy: None,
-            key: None,
-            termination: "edge".to_string(),
-        }
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteStatus {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ingress: Option<Vec<RouteIngress>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteIngress {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub router_canonical_hostname: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub router_name: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wildcard_policy: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub conditions: Option<Vec<RouteIngressCondition>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteIngressCondition {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub last_transition_time: Option<Time>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-
-    pub status: String,
-    #[serde(rename = "type")]
-    pub condition_type: String,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteHTTPHeader {
-    pub name: String,
-    pub action: RouteHTTPHeaderActionUnion,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteHTTPHeaderActionUnion {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub set: Option<RouteSetHTTPHeader>,
-
-    #[serde(rename = "type")]
-    pub action_type: String,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteSetHTTPHeader {
-    pub value: String,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteHTTPHeaderActions {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub request: Option<Vec<RouteHTTPHeader>>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub response: Option<Vec<RouteHTTPHeader>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct RouteHTTPHeaders {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub actions: Option<RouteHTTPHeaderActions>,
-}

harmony/src/modules/okd/host_network.rs

@@ -1,6 +1,6 @@
 use async_trait::async_trait;
 use harmony_types::id::Id;
-use log::{info, warn};
+use log::{debug, info};
 use serde::Serialize;
 
 use crate::{
@@ -9,7 +9,7 @@ use crate::{
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
     score::Score,
-    topology::{HostNetworkConfig, NetworkInterface, NetworkManager, Switch, SwitchPort, Topology},
+    topology::{HostNetworkConfig, NetworkInterface, Switch, SwitchPort, Topology},
 };
 
 #[derive(Debug, Clone, Serialize)]
@@ -17,7 +17,7 @@ pub struct HostNetworkConfigurationScore {
     pub hosts: Vec<PhysicalHost>,
 }
 
-impl<T: Topology + NetworkManager + Switch> Score<T> for HostNetworkConfigurationScore {
+impl<T: Topology + Switch> Score<T> for HostNetworkConfigurationScore {
     fn name(&self) -> String {
         "HostNetworkConfigurationScore".into()
     }
@@ -35,91 +35,34 @@ pub struct HostNetworkConfigurationInterpret {
 }
 
 impl HostNetworkConfigurationInterpret {
-    async fn configure_network_for_host<T: Topology + NetworkManager + Switch>(
+    async fn configure_network_for_host<T: Topology + Switch>(
         &self,
         topology: &T,
         host: &PhysicalHost,
-        current_host: &usize,
-        total_hosts: &usize,
-    ) -> Result<HostNetworkConfig, InterpretError> {
-        if host.network.is_empty() {
-            info!("[Host {current_host}/{total_hosts}] No interfaces to configure, skipping");
-            return Ok(HostNetworkConfig {
-                host_id: host.id.clone(),
-                switch_ports: vec![],
-            });
-        }
-        if host.network.len() == 1 {
-            info!("[Host {current_host}/{total_hosts}] Only one interface to configure, skipping");
-            return Ok(HostNetworkConfig {
-                host_id: host.id.clone(),
-                switch_ports: vec![],
-            });
-        }
-
-        let switch_ports = self
-            .collect_switch_ports_for_host(topology, host, current_host, total_hosts)
-            .await?;
-
-        let config = HostNetworkConfig {
-            host_id: host.id.clone(),
-            switch_ports,
-        };
-
-        if config.switch_ports.len() > 1 {
-            info!(
-                "[Host {current_host}/{total_hosts}] Found {} ports for {} interfaces",
-                config.switch_ports.len(),
-                host.network.len()
-            );
-
-            info!("[Host {current_host}/{total_hosts}] Configuring host network...");
-            topology.configure_bond(&config).await.map_err(|e| {
-                InterpretError::new(format!("Failed to configure host network: {e}"))
-            })?;
+    ) -> Result<(), InterpretError> {
+        let switch_ports = self.collect_switch_ports_for_host(topology, host).await?;
+        if !switch_ports.is_empty() {
             topology
-                .configure_port_channel(&config)
+                .configure_host_network(host, HostNetworkConfig { switch_ports })
                 .await
-                .map_err(|e| {
-                    InterpretError::new(format!("Failed to configure host network: {e}"))
-                })?;
-        } else if config.switch_ports.is_empty() {
-            info!(
-                "[Host {current_host}/{total_hosts}] No ports found for {} interfaces, skipping",
-                host.network.len()
-            );
-        } else {
-            warn!(
-                "[Host {current_host}/{total_hosts}] Found a single port for {} interfaces, skipping",
-                host.network.len()
-            );
+                .map_err(|e| InterpretError::new(format!("Failed to configure host: {e}")))?;
         }
 
-        Ok(config)
+        Ok(())
     }
 
     async fn collect_switch_ports_for_host<T: Topology + Switch>(
         &self,
         topology: &T,
         host: &PhysicalHost,
-        current_host: &usize,
-        total_hosts: &usize,
     ) -> Result<Vec<SwitchPort>, InterpretError> {
         let mut switch_ports = vec![];
 
-        if host.network.is_empty() {
-            return Ok(switch_ports);
-        }
-
-        info!("[Host {current_host}/{total_hosts}] Collecting ports on switch...");
         for network_interface in &host.network {
             let mac_address = network_interface.mac_address;
 
             match topology.get_port_for_mac_address(&mac_address).await {
                 Ok(Some(port)) => {
-                    info!(
-                        "[Host {current_host}/{total_hosts}] Found port '{port}' for '{mac_address}'"
-                    );
                     switch_ports.push(SwitchPort {
                         interface: NetworkInterface {
                             name: network_interface.name.clone(),
@@ -130,7 +73,7 @@ impl HostNetworkConfigurationInterpret {
                         port,
                     });
                 }
-                Ok(None) => {}
+                Ok(None) => debug!("No port found for host '{}', skipping", host.id),
                 Err(e) => {
                     return Err(InterpretError::new(format!(
                         "Failed to get port for host '{}': {}",
@@ -142,42 +85,10 @@ impl HostNetworkConfigurationInterpret {
 
         Ok(switch_ports)
     }
-
-    fn format_host_configuration(&self, configs: Vec<HostNetworkConfig>) -> Vec<String> {
-        let mut report = vec![
-            "Network Configuration Report".to_string(),
-            "------------------------------------------------------------------".to_string(),
-        ];
-
-        for config in configs {
-            if config.switch_ports.is_empty() {
-                report.push(format!(
-                    "⏭️ Host {}: SKIPPED (No matching switch ports found)",
-                    config.host_id
-                ));
-            } else {
-                let mappings: Vec<String> = config
-                    .switch_ports
-                    .iter()
-                    .map(|p| format!("[{} -> {}]", p.interface.name, p.port))
-                    .collect();
-
-                report.push(format!(
-                    "✅ Host {}: Bonded {} port(s) {}",
-                    config.host_id,
-                    config.switch_ports.len(),
-                    mappings.join(", ")
-                ));
-            }
-        }
-        report
-            .push("------------------------------------------------------------------".to_string());
-        report
-    }
 }
 
 #[async_trait]
-impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
+impl<T: Topology + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
     fn get_name(&self) -> InterpretName {
         InterpretName::Custom("HostNetworkConfigurationInterpret")
     }
@@ -203,45 +114,27 @@ impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigur
             return Ok(Outcome::noop("No hosts to configure".into()));
         }
 
-        let host_count = self.score.hosts.len();
-        info!("Started network configuration for {host_count} host(s)...",);
+        info!(
+            "Started network configuration for {} host(s)...",
+            self.score.hosts.len()
+        );
 
-        info!("Setting up NetworkManager...",);
-        topology
-            .ensure_network_manager_installed()
-            .await
-            .map_err(|e| InterpretError::new(format!("NetworkManager setup failed: {e}")))?;
-
-        info!("Setting up switch with sane defaults...");
         topology
             .setup_switch()
             .await
             .map_err(|e| InterpretError::new(format!("Switch setup failed: {e}")))?;
-        info!("Switch ready");
-
-        let mut current_host = 1;
-        let mut host_configurations = vec![];
 
+        let mut configured_host_count = 0;
         for host in &self.score.hosts {
-            let host_configuration = self
-                .configure_network_for_host(topology, host, &current_host, &host_count)
-                .await?;
-
-            host_configurations.push(host_configuration);
-            current_host += 1;
+            self.configure_network_for_host(topology, host).await?;
+            configured_host_count += 1;
         }
 
-        if current_host > 1 {
-            let details = self.format_host_configuration(host_configurations);
-
-            Ok(Outcome::success_with_details(
-                format!(
-                    "Configured {}/{} host(s)",
-                    current_host - 1,
-                    self.score.hosts.len()
-                ),
-                details,
-            ))
+        if configured_host_count > 0 {
+            Ok(Outcome::success(format!(
+                "Configured {configured_host_count}/{} host(s)",
+                self.score.hosts.len()
+            )))
         } else {
             Ok(Outcome::noop("No hosts configured".into()))
         }
@@ -257,8 +150,7 @@ mod tests {
     use crate::{
         hardware::HostCategory,
         topology::{
-            HostNetworkConfig, NetworkError, PreparationError, PreparationOutcome, SwitchError,
-            SwitchPort,
+            HostNetworkConfig, PreparationError, PreparationOutcome, SwitchError, SwitchPort,
         },
     };
     use std::{
@@ -283,18 +175,6 @@ mod tests {
             speed_mbps: None,
             mtu: 1,
         };
-        pub static ref YET_ANOTHER_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
-            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F3".to_string()).unwrap(),
-            name: "interface-3".into(),
-            speed_mbps: None,
-            mtu: 1,
-        };
-        pub static ref LAST_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
-            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F4".to_string()).unwrap(),
-            name: "interface-4".into(),
-            speed_mbps: None,
-            mtu: 1,
-        };
         pub static ref UNKNOWN_INTERFACE: NetworkInterface = NetworkInterface {
             mac_address: MacAddress::try_from("11:22:33:44:55:61".to_string()).unwrap(),
             name: "unknown-interface".into(),
@@ -303,8 +183,6 @@ mod tests {
         };
         pub static ref PORT: PortLocation = PortLocation(1, 0, 42);
         pub static ref ANOTHER_PORT: PortLocation = PortLocation(2, 0, 42);
-        pub static ref YET_ANOTHER_PORT: PortLocation = PortLocation(1, 0, 45);
-        pub static ref LAST_PORT: PortLocation = PortLocation(2, 0, 45);
     }
 
     #[tokio::test]
@@ -320,33 +198,27 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn should_setup_network_manager() {
+    async fn host_with_one_mac_address_should_create_bond_with_one_interface() {
         let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
         let score = given_score(vec![host]);
         let topology = TopologyWithSwitch::new();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let network_manager_setup = topology.network_manager_setup.lock().unwrap();
-        assert_that!(*network_manager_setup).is_true();
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![(
+            HOST_ID.clone(),
+            HostNetworkConfig {
+                switch_ports: vec![SwitchPort {
+                    interface: EXISTING_INTERFACE.clone(),
+                    port: PORT.clone(),
+                }],
+            },
+        )]);
     }
 
     #[tokio::test]
-    async fn host_with_one_mac_address_should_skip_host_configuration() {
-        let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
-        let score = given_score(vec![host]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-    }
-
-    #[tokio::test]
-    async fn host_with_multiple_mac_addresses_should_configure_one_bond_with_all_interfaces() {
+    async fn host_with_multiple_mac_addresses_should_create_one_bond_with_all_interfaces() {
         let score = given_score(vec![given_host(
             &HOST_ID,
             vec![
@@ -358,11 +230,10 @@ mod tests {
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![(
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![(
             HOST_ID.clone(),
             HostNetworkConfig {
-                host_id: HOST_ID.clone(),
                 switch_ports: vec![
                     SwitchPort {
                         interface: EXISTING_INTERFACE.clone(),
@@ -378,183 +249,47 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn host_with_multiple_mac_addresses_should_configure_one_port_channel_with_all_interfaces()
-     {
-        let score = given_score(vec![given_host(
-            &HOST_ID,
-            vec![
-                EXISTING_INTERFACE.clone(),
-                ANOTHER_EXISTING_INTERFACE.clone(),
-            ],
-        )]);
+    async fn multiple_hosts_should_create_one_bond_per_host() {
+        let score = given_score(vec![
+            given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]),
+            given_host(&ANOTHER_HOST_ID, vec![ANOTHER_EXISTING_INTERFACE.clone()]),
+        ]);
         let topology = TopologyWithSwitch::new();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![(
-            HOST_ID.clone(),
-            HostNetworkConfig {
-                host_id: HOST_ID.clone(),
-                switch_ports: vec![
-                    SwitchPort {
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![
+            (
+                HOST_ID.clone(),
+                HostNetworkConfig {
+                    switch_ports: vec![SwitchPort {
                         interface: EXISTING_INTERFACE.clone(),
                         port: PORT.clone(),
-                    },
-                    SwitchPort {
+                    }],
+                },
+            ),
+            (
+                ANOTHER_HOST_ID.clone(),
+                HostNetworkConfig {
+                    switch_ports: vec![SwitchPort {
                         interface: ANOTHER_EXISTING_INTERFACE.clone(),
                         port: ANOTHER_PORT.clone(),
-                    },
-                ],
-            },
-        )]);
-    }
-
-    #[tokio::test]
-    async fn multiple_hosts_should_configure_one_bond_per_host() {
-        let score = given_score(vec![
-            given_host(
-                &HOST_ID,
-                vec![
-                    EXISTING_INTERFACE.clone(),
-                    ANOTHER_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-            given_host(
-                &ANOTHER_HOST_ID,
-                vec![
-                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                    LAST_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-        ]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![
-            (
-                HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: EXISTING_INTERFACE.clone(),
-                            port: PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: ANOTHER_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-            (
-                ANOTHER_HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: ANOTHER_HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: YET_ANOTHER_PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: LAST_EXISTING_INTERFACE.clone(),
-                            port: LAST_PORT.clone(),
-                        },
-                    ],
+                    }],
                 },
             ),
         ]);
     }
 
     #[tokio::test]
-    async fn multiple_hosts_should_configure_one_port_channel_per_host() {
-        let score = given_score(vec![
-            given_host(
-                &HOST_ID,
-                vec![
-                    EXISTING_INTERFACE.clone(),
-                    ANOTHER_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-            given_host(
-                &ANOTHER_HOST_ID,
-                vec![
-                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                    LAST_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-        ]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![
-            (
-                HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: EXISTING_INTERFACE.clone(),
-                            port: PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: ANOTHER_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-            (
-                ANOTHER_HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: ANOTHER_HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: YET_ANOTHER_PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: LAST_EXISTING_INTERFACE.clone(),
-                            port: LAST_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-        ]);
-    }
-
-    #[tokio::test]
-    async fn port_not_found_for_mac_address_should_not_configure_host() {
+    async fn port_not_found_for_mac_address_should_not_configure_interface() {
         let score = given_score(vec![given_host(&HOST_ID, vec![UNKNOWN_INTERFACE.clone()])]);
         let topology = TopologyWithSwitch::new_port_not_found();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
-    }
-
-    #[tokio::test]
-    async fn only_one_port_found_for_multiple_mac_addresses_should_not_configure_host() {
-        let score = given_score(vec![given_host(
-            &HOST_ID,
-            vec![EXISTING_INTERFACE.clone(), UNKNOWN_INTERFACE.clone()],
-        )]);
-        let topology = TopologyWithSwitch::new_single_port_found();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).is_empty();
     }
 
     fn given_score(hosts: Vec<PhysicalHost>) -> HostNetworkConfigurationScore {
@@ -591,48 +326,26 @@ mod tests {
         }
     }
 
-    #[derive(Debug)]
     struct TopologyWithSwitch {
         available_ports: Arc<Mutex<Vec<PortLocation>>>,
-        configured_port_channels: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
+        configured_host_networks: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
         switch_setup: Arc<Mutex<bool>>,
-        network_manager_setup: Arc<Mutex<bool>>,
-        configured_bonds: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
     }
 
     impl TopologyWithSwitch {
         fn new() -> Self {
             Self {
-                available_ports: Arc::new(Mutex::new(vec![
-                    PORT.clone(),
-                    ANOTHER_PORT.clone(),
-                    YET_ANOTHER_PORT.clone(),
-                    LAST_PORT.clone(),
-                ])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
+                available_ports: Arc::new(Mutex::new(vec![PORT.clone(), ANOTHER_PORT.clone()])),
+                configured_host_networks: Arc::new(Mutex::new(vec![])),
                 switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
             }
         }
 
         fn new_port_not_found() -> Self {
             Self {
                 available_ports: Arc::new(Mutex::new(vec![])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
+                configured_host_networks: Arc::new(Mutex::new(vec![])),
                 switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
-            }
-        }
-
-        fn new_single_port_found() -> Self {
-            Self {
-                available_ports: Arc::new(Mutex::new(vec![PORT.clone()])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
-                switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
             }
         }
     }
@@ -648,22 +361,6 @@ mod tests {
         }
     }
 
-    #[async_trait]
-    impl NetworkManager for TopologyWithSwitch {
-        async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-            let mut network_manager_installed = self.network_manager_setup.lock().unwrap();
-            *network_manager_installed = true;
-            Ok(())
-        }
-
-        async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-            let mut configured_bonds = self.configured_bonds.lock().unwrap();
-            configured_bonds.push((config.host_id.clone(), config.clone()));
-
-            Ok(())
-        }
-    }
-
     #[async_trait]
     impl Switch for TopologyWithSwitch {
         async fn setup_switch(&self) -> Result<(), SwitchError> {
@@ -683,12 +380,13 @@ mod tests {
             Ok(Some(ports.remove(0)))
         }
 
-        async fn configure_port_channel(
+        async fn configure_host_network(
             &self,
-            config: &HostNetworkConfig,
+            host: &PhysicalHost,
+            config: HostNetworkConfig,
         ) -> Result<(), SwitchError> {
-            let mut configured_port_channels = self.configured_port_channels.lock().unwrap();
-            configured_port_channels.push((config.host_id.clone(), config.clone()));
+            let mut configured_host_networks = self.configured_host_networks.lock().unwrap();
+            configured_host_networks.push((host.id.clone(), config.clone()));
 
             Ok(())
         }

harmony/src/modules/okd/installation.rs

@@ -50,7 +50,7 @@
 use crate::{
     modules::okd::{
         OKDSetup01InventoryScore, OKDSetup02BootstrapScore, OKDSetup03ControlPlaneScore,
-        OKDSetup04WorkersScore, OKDSetup05SanityCheckScore, OKDSetupPersistNetworkBondScore,
+        OKDSetup04WorkersScore, OKDSetup05SanityCheckScore,
         bootstrap_06_installation_report::OKDSetup06InstallationReportScore,
     },
     score::Score,
@@ -65,7 +65,6 @@ impl OKDInstallationPipeline {
             Box::new(OKDSetup01InventoryScore::new()),
             Box::new(OKDSetup02BootstrapScore::new()),
             Box::new(OKDSetup03ControlPlaneScore::new()),
-            Box::new(OKDSetupPersistNetworkBondScore::new()),
             Box::new(OKDSetup04WorkersScore::new()),
             Box::new(OKDSetup05SanityCheckScore::new()),
             Box::new(OKDSetup06InstallationReportScore::new()),

harmony/src/modules/okd/mod.rs

@@ -6,13 +6,11 @@ mod bootstrap_05_sanity_check;
 mod bootstrap_06_installation_report;
 pub mod bootstrap_dhcp;
 pub mod bootstrap_load_balancer;
-mod bootstrap_persist_network_bond;
 pub mod dhcp;
 pub mod dns;
 pub mod installation;
 pub mod ipxe;
 pub mod load_balancer;
-pub mod route;
 pub mod templates;
 pub mod upgrade;
 pub use bootstrap_01_prepare::*;
@@ -21,6 +19,5 @@ pub use bootstrap_03_control_plane::*;
 pub use bootstrap_04_workers::*;
 pub use bootstrap_05_sanity_check::*;
 pub use bootstrap_06_installation_report::*;
-pub use bootstrap_persist_network_bond::*;
 pub mod crd;
 pub mod host_network;

harmony/src/modules/okd/route.rs

@@ -1,101 +0,0 @@
-// TODO
-// Write OKDRouteScore : This is the real one which will apply the k8s resource and expose all
-// relevant option to Harmony's various use cases
-//
-// Write OKDTlsPassthroughScore : This one will use an OKDRouteScore under the hood and simply fill
-// in all settings to make this route a TlsPassthrough
-//
-// These scores are meant to be used by an OKD based topology to provide Capabilities like
-// TlsRouter
-//
-// The first use case to serve here is the postgresql multisite setup, so exposing only the
-// settings relevant to this use case is enough at first, following YAGNI.
-//
-// These scores are not intended to be used directly by a user, unless the user knows that he will
-// always be dealing only with okd/openshift compatible topologies and is ready to manage the
-// additional maintenance burden that comes with a lower level functionnality.
-
-use harmony_types::rfc1123::Rfc1123Name;
-use kube::api::ObjectMeta;
-use serde::Serialize;
-
-use crate::modules::k8s::resource::K8sResourceScore;
-use crate::modules::okd::crd::route::{
-    Route, RoutePort, RouteSpec, RouteTargetReference, TLSConfig,
-};
-use crate::score::Score;
-use crate::topology::{K8sclient, TlsRoute, Topology};
-
-#[derive(Debug, Clone, Serialize)]
-pub struct OKDRouteScore {
-    pub name: String,
-    pub namespace: String,
-    pub spec: RouteSpec,
-}
-
-impl OKDRouteScore {
-    pub fn new(name: &str, namespace: &str, spec: RouteSpec) -> Self {
-        Self {
-            name: name.to_string(),
-            namespace: namespace.to_string(),
-            spec,
-        }
-    }
-}
-
-impl<T: Topology + K8sclient> Score<T> for OKDRouteScore {
-    fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
-        let route = Route {
-            metadata: ObjectMeta {
-                name: Some(self.name.clone()),
-                namespace: Some(self.namespace.clone()),
-                ..ObjectMeta::default()
-            },
-            spec: self.spec.clone(),
-            ..Default::default()
-        };
-        K8sResourceScore::single(route, Some(self.namespace.clone())).create_interpret()
-    }
-
-    fn name(&self) -> String {
-        format!("OKDRouteScore({})", self.name)
-    }
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct OKDTlsPassthroughScore {
-    pub route: TlsRoute,
-    pub name: Rfc1123Name,
-}
-
-impl<T: Topology + K8sclient> Score<T> for OKDTlsPassthroughScore {
-    fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
-        let passthrough_spec = RouteSpec {
-            host: Some(self.route.hostname.clone()),
-            wildcard_policy: Some("None".to_string()),
-            to: RouteTargetReference {
-                kind: "Service".to_string(),
-                name: self.route.backend.clone(),
-                weight: Some(100),
-            },
-            port: Some(RoutePort {
-                target_port: self.route.target_port,
-            }),
-            tls: Some(TLSConfig {
-                termination: "passthrough".to_string(),
-                insecure_edge_termination_policy: Some("None".to_string()),
-                ..Default::default()
-            }),
-            ..Default::default()
-        };
-        let route_score = OKDRouteScore::new(&self.name.to_string(), &self.route.namespace, passthrough_spec);
-        route_score.create_interpret()
-    }
-
-    fn name(&self) -> String {
-        format!(
-            "OKDTlsPassthroughScore({}:{}/{} → {})",
-            self.route.backend, self.route.target_port, self.route.namespace, self.route.hostname
-        )
-    }
-}

harmony/src/modules/postgresql/capability.rs

@@ -1,85 +0,0 @@
-use async_trait::async_trait;
-use harmony_types::storage::StorageSize;
-use serde::Serialize;
-use std::collections::HashMap;
-
-#[async_trait]
-pub trait PostgreSQL: Send + Sync {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String>;
-
-    /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
-    /// Abstracts away storage/retrieval details (e.g., secrets, files).
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String>;
-
-    /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String>;
-
-    /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
-    /// Returns None if no public endpoint (internal-only cluster).
-    /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
-    /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
-    async fn get_public_endpoint(
-        &self,
-        cluster_name: &str,
-    ) -> Result<Option<PostgreSQLEndpoint>, String>;
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct PostgreSQLConfig {
-    pub cluster_name: String,
-    pub instances: u32,
-    pub storage_size: StorageSize,
-    pub role: PostgreSQLClusterRole,
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub enum PostgreSQLClusterRole {
-    Primary,
-    Replica(ReplicaConfig),
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct ReplicaConfig {
-    /// Name of the primary cluster this replica will sync from
-    pub primary_cluster_name: String,
-    /// Certs extracted from primary via Topology::get_replication_certs()
-    pub replication_certs: ReplicationCerts,
-    /// Bootstrap method (e.g., pg_basebackup from primary)
-    pub bootstrap: BootstrapConfig,
-    /// External cluster connection details for CNPG spec.externalClusters
-    pub external_cluster: ExternalClusterConfig,
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct BootstrapConfig {
-    pub strategy: BootstrapStrategy,
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub enum BootstrapStrategy {
-    PgBasebackup,
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct ExternalClusterConfig {
-    /// Name used in CNPG externalClusters list
-    pub name: String,
-    /// Connection params (host/port set by multisite logic, sslmode='verify-ca', etc.)
-    pub connection_parameters: HashMap<String, String>,
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct ReplicationCerts {
-    /// PEM-encoded CA cert from primary
-    pub ca_cert_pem: String,
-    /// PEM-encoded streaming_replica client cert (tls.crt)
-    pub streaming_replica_cert_pem: String,
-    /// PEM-encoded streaming_replica client key (tls.key)
-    pub streaming_replica_key_pem: String,
-}
-
-#[derive(Clone, Debug)]
-pub struct PostgreSQLEndpoint {
-    pub host: String,
-    pub port: u16,
-}

harmony/src/modules/postgresql/cnpg/crd.rs

@@ -1,58 +0,0 @@
-use kube::{CustomResource, api::ObjectMeta};
-use serde::{Deserialize, Serialize};
-
-#[derive(CustomResource, Deserialize, Serialize, Clone, Debug)]
-#[kube(
-    group = "postgresql.cnpg.io",
-    version = "v1",
-    kind = "Cluster",
-    plural = "clusters",
-    namespaced = true,
-    schema = "disabled"
-)]
-#[serde(rename_all = "camelCase")]
-pub struct ClusterSpec {
-    pub instances: i32,
-    pub image_name: Option<String>,
-    pub storage: Storage,
-    pub bootstrap: Bootstrap,
-}
-
-impl Default for Cluster {
-    fn default() -> Self {
-        Cluster {
-            metadata: ObjectMeta::default(),
-            spec: ClusterSpec::default(),
-        }
-    }
-}
-
-impl Default for ClusterSpec {
-    fn default() -> Self {
-        Self {
-            instances: 1,
-            image_name: None,
-            storage: Storage::default(),
-            bootstrap: Bootstrap::default(),
-        }
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default)]
-#[serde(rename_all = "camelCase")]
-pub struct Storage {
-    pub size: String,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default)]
-#[serde(rename_all = "camelCase")]
-pub struct Bootstrap {
-    pub initdb: Initdb,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default)]
-#[serde(rename_all = "camelCase")]
-pub struct Initdb {
-    pub database: String,
-    pub owner: String,
-}

harmony/src/modules/postgresql/cnpg/mod.rs

@@ -1,2 +0,0 @@
-mod crd;
-pub use crd::*;

harmony/src/modules/postgresql/failover.rs

@@ -1,125 +0,0 @@
-use async_trait::async_trait;
-use log::debug;
-use log::info;
-use std::collections::HashMap;
-
-use crate::{
-    modules::postgresql::capability::{
-        BootstrapConfig, BootstrapStrategy, ExternalClusterConfig, PostgreSQL,
-        PostgreSQLClusterRole, PostgreSQLConfig, PostgreSQLEndpoint, ReplicaConfig,
-        ReplicationCerts,
-    },
-    topology::FailoverTopology,
-};
-
-#[async_trait]
-impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        info!(
-            "Starting deployment of failover topology '{}'",
-            config.cluster_name
-        );
-
-        let primary_config = PostgreSQLConfig {
-            cluster_name: config.cluster_name.clone(),
-            instances: config.instances,
-            storage_size: config.storage_size.clone(),
-            role: PostgreSQLClusterRole::Primary,
-        };
-
-        info!(
-            "Deploying primary cluster '{{}}' ({} instances, {:?} storage)",
-            primary_config.cluster_name, primary_config.storage_size
-        );
-
-        let primary_cluster_name = self.primary.deploy(&primary_config).await?;
-
-        info!("Primary cluster '{primary_cluster_name}' deployed successfully");
-
-        info!("Retrieving replication certificates for primary '{primary_cluster_name}'");
-
-        let certs = self
-            .primary
-            .get_replication_certs(&primary_cluster_name)
-            .await?;
-
-        info!("Replication certificates retrieved successfully");
-
-        info!("Retrieving public endpoint for primary '{primary_cluster_name}");
-
-        let endpoint = self
-            .primary
-            .get_public_endpoint(&primary_cluster_name)
-            .await?
-            .ok_or_else(|| "No public endpoint configured on primary cluster".to_string())?;
-
-        info!(
-            "Public endpoint '{}:{}' retrieved for primary",
-            endpoint.host, endpoint.port
-        );
-
-        info!("Configuring replica connection parameters and bootstrap");
-
-        let mut connection_parameters = HashMap::new();
-        connection_parameters.insert("host".to_string(), endpoint.host);
-        connection_parameters.insert("port".to_string(), endpoint.port.to_string());
-        connection_parameters.insert("dbname".to_string(), "postgres".to_string());
-        connection_parameters.insert("user".to_string(), "streaming_replica".to_string());
-        connection_parameters.insert("sslmode".to_string(), "verify-ca".to_string());
-        connection_parameters.insert("sslnegotiation".to_string(), "direct".to_string());
-
-        debug!("Replica connection parameters: {:?}", connection_parameters);
-
-        let external_cluster = ExternalClusterConfig {
-            name: primary_cluster_name.clone(),
-            connection_parameters,
-        };
-
-        let bootstrap_config = BootstrapConfig {
-            strategy: BootstrapStrategy::PgBasebackup,
-        };
-
-        let replica_cluster_config = ReplicaConfig {
-            primary_cluster_name: primary_cluster_name.clone(),
-            replication_certs: certs,
-            bootstrap: bootstrap_config,
-            external_cluster,
-        };
-
-        let replica_config = PostgreSQLConfig {
-            cluster_name: format!("{}-replica", primary_cluster_name),
-            instances: config.instances,
-            storage_size: config.storage_size.clone(),
-            role: PostgreSQLClusterRole::Replica(replica_cluster_config),
-        };
-
-        info!(
-            "Deploying replica cluster '{}' ({} instances, {:?} storage) on replica topology",
-            replica_config.cluster_name, replica_config.instances, replica_config.storage_size
-        );
-
-        self.replica.deploy(&replica_config).await?;
-
-        info!(
-            "Replica cluster '{}' deployed successfully; failover topology '{}' ready",
-            replica_config.cluster_name, config.cluster_name
-        );
-
-        Ok(primary_cluster_name)
-    }
-
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        self.primary.get_replication_certs(cluster_name).await
-    }
-
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String> {
-        self.primary.get_endpoint(cluster_name).await
-    }
-
-    async fn get_public_endpoint(
-        &self,
-        cluster_name: &str,
-    ) -> Result<Option<PostgreSQLEndpoint>, String> {
-        self.primary.get_public_endpoint(cluster_name).await
-    }
-}

harmony/src/modules/postgresql/mod.rs

@@ -1,13 +0,0 @@
-pub mod capability;
-mod score;
-mod score_connect;
-pub use score_connect::*;
-pub use score::*;
-mod score_public;
-pub use score_public::*;
-
-pub mod failover;
-mod operator;
-pub use operator::*;
-
-pub mod cnpg;

harmony/src/modules/postgresql/operator.rs

@@ -1,102 +0,0 @@
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
-use serde::Serialize;
-
-use crate::interpret::Interpret;
-use crate::modules::k8s::apps::crd::{Subscription, SubscriptionSpec};
-use crate::modules::k8s::resource::K8sResourceScore;
-use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-
-/// Install the CloudNativePg (CNPG) Operator via an OperatorHub `Subscription`.
-///
-/// This Score creates a a `Subscription` Custom Resource in the specified namespace.
-///
-/// The default implementation pulls the `cloudnative-pg` operator from the
-/// `operatorhubio-catalog` source.
-///
-/// # Goals
-/// - Deploy the CNPG Operator to manage PostgreSQL clusters in OpenShift/OKD environments.
-///
-/// # Usage
-/// ```
-/// use harmony::modules::postgresql::CloudNativePgOperatorScore;
-/// let score = CloudNativePgOperatorScore::default();
-/// ```
-///
-/// Or, you can take control of most relevant fiedls this way :
-///
-/// ```
-/// use harmony::modules::postgresql::CloudNativePgOperatorScore;
-///
-/// let score = CloudNativePgOperatorScore {
-///     namespace: "custom-cnpg-namespace".to_string(),
-///     channel: "unstable-i-want-bleedingedge-v498437".to_string(),
-///     install_plan_approval: "Manual".to_string(),
-///     source: "operatorhubio-catalog-but-different".to_string(),
-///     source_namespace: "i-customize-everything-marketplace".to_string(),
-/// };
-/// ```
-///
-/// # Limitations
-/// - **OperatorHub dependency**: Requires OperatorHub catalog sources (e.g., `operatorhubio-catalog` in `openshift-marketplace`).
-/// - **OKD/OpenShift assumption**: Catalog/source names and namespaces are hardcoded for OKD-like setups; adjust for upstream OpenShift.
-/// - **Hardcoded values in Default implementation**: Operator name (`cloudnative-pg`), channel (`stable-v1`), automatic install plan approval.
-/// - **No config options**: Does not support custom `SubscriptionConfig` (env vars, node selectors, tolerations).
-/// - **Single namespace**: Targets one namespace per score instance.
-#[derive(Debug, Clone, Serialize)]
-pub struct CloudNativePgOperatorScore {
-    pub namespace: String,
-    pub channel: String,
-    pub install_plan_approval: String,
-    pub source: String,
-    pub source_namespace: String,
-}
-
-impl Default for CloudNativePgOperatorScore {
-    fn default() -> Self {
-        Self {
-            namespace: "openshift-operators".to_string(),
-            channel: "stable-v1".to_string(),
-            install_plan_approval: "Automatic".to_string(),
-            source: "operatorhubio-catalog".to_string(),
-            source_namespace: "openshift-marketplace".to_string(),
-        }
-    }
-}
-
-impl CloudNativePgOperatorScore {
-    pub fn new(namespace: &str) -> Self {
-        Self {
-            namespace: namespace.to_string(),
-            ..Default::default()
-        }
-    }
-}
-
-impl<T: Topology + K8sclient> Score<T> for CloudNativePgOperatorScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let metadata = ObjectMeta {
-            name: Some("cloudnative-pg".to_string()),
-            namespace: Some(self.namespace.clone()),
-            ..ObjectMeta::default()
-        };
-
-        let spec = SubscriptionSpec {
-            channel: Some(self.channel.clone()),
-            config: None,
-            install_plan_approval: Some(self.install_plan_approval.clone()),
-            name: "cloudnative-pg".to_string(),
-            source: self.source.clone(),
-            source_namespace: self.source_namespace.clone(),
-            starting_csv: None,
-        };
-
-        let subscription = Subscription { metadata, spec };
-
-        K8sResourceScore::single(subscription, Some(self.namespace.clone())).create_interpret()
-    }
-
-    fn name(&self) -> String {
-        format!("CloudNativePgOperatorScore({})", self.namespace)
-    }
-}

harmony/src/modules/postgresql/score.rs

@@ -1,93 +0,0 @@
-use serde::Serialize;
-
-use crate::interpret::Interpret;
-use crate::modules::k8s::resource::K8sResourceScore;
-use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
-use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
-
-/// Deploys an opinionated, highly available PostgreSQL cluster managed by CNPG.
-///
-/// # Goals
-/// - Production-ready Postgres HA (3 instances), persistent storage, app DB.
-///
-/// # Usage
-/// ```
-/// use harmony::modules::postgresql::PostgreSQLScore;
-/// let score = PostgreSQLScore::new("my-app-ns");
-/// ```
-///
-/// # Limitations (Happy Path)
-/// - Requires CNPG operator installed (use CloudNativePgOperatorScore).
-/// - No backups, monitoring, extensions configured.
-///
-/// TODO : refactor this to declare a clean dependency on cnpg operator. Then cnpg operator will
-/// self-deploy either using operatorhub or helm chart depending on k8s flavor. This is cnpg
-/// specific behavior
-#[derive(Debug, Clone, Serialize)]
-pub struct PostgreSQLScore {
-    pub name: String,
-    /// **Note :** on OpenShfit based clusters, the namespace `default` has security
-    /// settings incompatible with the default CNPG behavior.
-    pub namespace: String,
-    pub instances: i32,
-    pub storage_size: String,
-    pub image_name: Option<String>,
-}
-
-impl Default for PostgreSQLScore {
-    fn default() -> Self {
-        Self {
-            name: "harmony-pg".to_string(),
-            // We are using the namespace harmony by default since some clusters (openshift family)
-            // have incompatible configuration of the default namespace with cnpg
-            namespace: "harmony".to_string(),
-            instances: 1,
-            storage_size: "1Gi".to_string(),
-            image_name: None, // This lets cnpg use its default image
-        }
-    }
-}
-
-impl PostgreSQLScore {
-    pub fn new(namespace: &str) -> Self {
-        Self {
-            namespace: namespace.to_string(),
-            ..Default::default()
-        }
-    }
-}
-
-impl<T: Topology + K8sclient> Score<T> for PostgreSQLScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let metadata = ObjectMeta {
-            name: Some(self.name.clone()),
-            namespace: Some(self.namespace.clone()),
-            ..ObjectMeta::default()
-        };
-
-        let spec = ClusterSpec {
-            instances: self.instances,
-            image_name: self.image_name.clone(),
-            storage: Storage {
-                size: self.storage_size.clone(),
-            },
-            bootstrap: Bootstrap {
-                initdb: Initdb {
-                    database: "app".to_string(),
-                    owner: "app".to_string(),
-                },
-            },
-            ..ClusterSpec::default()
-        };
-
-        let cluster = Cluster { metadata, spec };
-
-        K8sResourceScore::single(cluster, Some(self.namespace.clone())).create_interpret()
-    }
-
-    fn name(&self) -> String {
-        format!("PostgreSQLScore({})", self.namespace)
-    }
-}

harmony/src/modules/postgresql/score_connect.rs

@@ -1,442 +0,0 @@
-use async_trait::async_trait;
-use k8s_openapi::ByteString;
-use k8s_openapi::api::core::v1::Secret;
-use log::{debug, error, info, trace};
-use serde::Serialize;
-use std::collections::BTreeMap;
-use std::path::{Path, PathBuf};
-use tokio::process::Command;
-
-use crate::data::Version;
-use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
-use crate::inventory::Inventory;
-use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-use harmony_types::id::Id;
-
-/// PostgreSQLConnectionScore tests PostgreSQL database connectivity and performance metrics
-/// for databases exposed via public endpoints. This score is specifically designed to verify
-/// that PostgreSQL instances installed using the PublicPostgreSQLScore can be accessed by external clients.
-///
-/// The score performs the following tests:
-/// 1. Verifies TLS/SSL connection using CA certificates from Kubernetes secrets
-/// 2. Tests basic connectivity to the database
-/// 3. (Optional, when db permissions are setup) Collects comprehensive performance metrics including :
-///    - Database size and schema usage statistics
-///    - Active connections and query activity
-///    - Performance metrics (transactions per second, cache hit ratio)
-///    - Index usage and table statistics
-///    - Configuration parameters
-///
-/// The implementation uses a Docker container running PostgreSQL client tools to execute
-/// the connection test, ensuring consistent behavior across different environments.
-///
-/// # Kubernetes Secrets Required
-///
-/// The score requires two Kubernetes secrets in the target namespace:
-/// - `{cluster_name}-app`: Contains connection parameters (host, port, username, password, dbname)
-/// - `{cluster_name}-ca`: Contains CA certificate (ca.crt) for TLS verification
-///
-/// # Usage
-///
-/// ```rust
-/// use harmony::modules::postgresql::PostgreSQLConnectionScore;
-///
-/// let score = PostgreSQLConnectionScore::new(
-///     "default",
-///     "my-postgres-cluster",
-///     None
-/// );
-/// ```
-///
-/// # Parameters
-///
-/// - `namespace`: Kubernetes namespace where the PostgreSQL secrets are located
-/// - `cluster_name`: Name of the PostgreSQL cluster (used to construct secret names)
-/// - `hostname_override`: Optional hostname override for connection testing
-/// - `port_override`: Optional port override for connection testing
-#[derive(Debug, Clone, Serialize)]
-pub struct PostgreSQLConnectionScore {
-    pub name: String,
-    pub namespace: String,
-    pub cluster_name: String,
-    pub hostname: Option<String>,
-    pub port_override: Option<u16>,
-}
-
-fn decode_secret(data: &BTreeMap<String, ByteString>, key: &str) -> Result<String, InterpretError> {
-    let val = data
-        .get(key)
-        .ok_or_else(|| InterpretError::new(format!("Secret missing key {}", key)))?;
-    String::from_utf8(val.0.clone())
-        .map_err(|e| InterpretError::new(format!("Failed to decode {}: {}", key, e)))
-}
-
-impl PostgreSQLConnectionScore {
-    pub fn new(namespace: &str, cluster_name: &str, hostname_override: Option<String>) -> Self {
-        Self {
-            name: format!("postgres-connection-{}", cluster_name),
-            namespace: namespace.to_string(),
-            cluster_name: cluster_name.to_string(),
-            hostname: hostname_override,
-            port_override: None,
-        }
-    }
-}
-
-impl<T: Topology + K8sclient + Send + Sync> Score<T> for PostgreSQLConnectionScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(PostgreSQLConnectionInterpret {
-            score: self.clone(),
-        })
-    }
-
-    fn name(&self) -> String {
-        format!("PostgreSQLConnectionScore : {}", self.name)
-    }
-}
-
-#[derive(Debug, Clone)]
-struct PostgreSQLConnectionInterpret {
-    score: PostgreSQLConnectionScore,
-}
-
-impl PostgreSQLConnectionInterpret {
-    async fn fetch_app_secret<T: K8sclient>(&self, topo: &T) -> Result<Secret, InterpretError> {
-        let app_secret_name = format!("{}-app", self.score.cluster_name);
-        info!("Fetching app secret {}", app_secret_name);
-
-        let k8s_client = topo.k8s_client().await?;
-        k8s_client
-            .get_resource(&app_secret_name, Some(&self.score.namespace))
-            .await
-            .map_err(|e| InterpretError::new(format!("Failed to get app secret: {e}")))?
-            .ok_or_else(|| InterpretError::new(format!("App secret {} not found", app_secret_name)))
-    }
-
-    async fn fetch_ca_secret<T: K8sclient>(&self, topo: &T) -> Result<Secret, InterpretError> {
-        let ca_secret_name = format!("{}-ca", self.score.cluster_name);
-        info!("Fetching CA secret {}", ca_secret_name);
-
-        let k8s_client = topo.k8s_client().await?;
-        k8s_client
-            .get_resource(&ca_secret_name, Some(&self.score.namespace))
-            .await
-            .map_err(|e| InterpretError::new(format!("Failed to get CA secret: {e}")))?
-            .ok_or_else(|| InterpretError::new(format!("CA secret {} not found", ca_secret_name)))
-    }
-
-    fn get_secret_data(
-        &self,
-        secret: &Secret,
-        secret_type: &str,
-    ) -> Result<BTreeMap<String, ByteString>, InterpretError> {
-        secret
-            .data
-            .as_ref()
-            .ok_or_else(|| InterpretError::new(format!("{} secret has no data", secret_type)))
-            .map(|b| b.clone())
-    }
-
-    fn create_temp_dir(&self) -> Result<tempfile::TempDir, InterpretError> {
-        tempfile::Builder::new()
-            .prefix("pg-connection-test-")
-            .tempdir()
-            .map_err(|e| InterpretError::new(format!("Failed to create temp directory: {e}")))
-    }
-
-    fn write_ca_cert(
-        &self,
-        temp_dir: &Path,
-        ca_data: &BTreeMap<String, ByteString>,
-    ) -> Result<PathBuf, InterpretError> {
-        let ca_crt = ca_data
-            .get("ca.crt")
-            .ok_or_else(|| InterpretError::new("CA secret missing ca.crt".to_string()))?;
-        let ca_file = temp_dir.join("ca.crt");
-
-        std::fs::write(&ca_file, &ca_crt.0)
-            .map_err(|e| InterpretError::new(format!("Failed to write CA cert: {e}")))?;
-
-        Ok(ca_file)
-    }
-
-    fn get_host(&self, data: &BTreeMap<String, ByteString>) -> Result<String, InterpretError> {
-        self.score
-            .hostname
-            .clone()
-            .or_else(|| decode_secret(data, "host").ok())
-            .ok_or_else(|| {
-                InterpretError::new("No hostname found in secret or override".to_string())
-            })
-    }
-
-    fn get_port(&self, data: &BTreeMap<String, ByteString>) -> Result<u16, InterpretError> {
-        self.score
-            .port_override
-            .or_else(|| {
-                decode_secret(data, "port")
-                    .ok()
-                    .and_then(|p| p.parse().ok())
-            })
-            .ok_or_else(|| InterpretError::new("Port not found in secret or override".to_string()))
-    }
-
-    fn create_test_script(&self, temp_dir: &Path) -> Result<PathBuf, InterpretError> {
-        let script_path = temp_dir.join("test_connection.sh");
-
-        let script_content = postgres_scipt_content();
-        std::fs::write(&script_path, script_content)
-            .map_err(|e| InterpretError::new(format!("Failed to write test script: {e}")))?;
-        debug!("Wrote script content : \n{script_content}");
-
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            let mut perms = std::fs::metadata(&script_path)
-                .map_err(|e| InterpretError::new(format!("Failed to get script metadata: {e}")))?
-                .permissions();
-            perms.set_mode(0o755);
-            std::fs::set_permissions(&script_path, perms).map_err(|e| {
-                InterpretError::new(format!("Failed to set script permissions: {e}"))
-            })?;
-        }
-
-        Ok(script_path)
-    }
-
-    async fn run_docker_test(
-        &self,
-        temp_dir: &Path,
-        cmd: &str,
-        password: &str,
-    ) -> Result<Outcome, InterpretError> {
-        info!("Running connection test in Docker container...");
-        let container_cmd = format!("PGPASSWORD={} /tmp/test_connection.sh {}", password, cmd);
-        debug!("Starting docker container with cmd : {container_cmd}");
-
-        let mut cmd = Command::new("docker");
-        cmd.arg("run")
-            .arg("--rm")
-            .arg("-i")
-            .arg("-v")
-            .arg(format!("{}/:/tmp", temp_dir.display()))
-            .arg("--workdir")
-            .arg("/tmp")
-            .arg("--entrypoint")
-            .arg("/bin/sh")
-            .arg("postgres:latest")
-            .arg("-c")
-            .arg(container_cmd)
-            .env("PGPASSWORD", password)
-            .stdout(std::process::Stdio::inherit())
-            .stderr(std::process::Stdio::inherit());
-        debug!("Running Command {cmd:?}");
-        let output = cmd
-            .spawn()
-            .map_err(|e| InterpretError::new(format!("Failed to spawn docker container: {e}")))?
-            .wait_with_output()
-            .await
-            .map_err(|e| {
-                InterpretError::new(format!("Failed to wait for docker container: {e}"))
-            })?;
-
-        if output.status.success() {
-            info!("Successfully connected to PostgreSQL!");
-            Ok(Outcome::success("Connection successful".to_string()))
-        } else {
-            let stdout = String::from_utf8_lossy(&output.stdout);
-            let stderr = String::from_utf8_lossy(&output.stderr);
-            error!("Connection failed: stdout:\n{stdout}\nstderr:\n{stderr}");
-            Err(InterpretError::new(format!(
-                "Connection failed: stdout:\n{stdout}\nstderr:\n{stderr}",
-            )))
-        }
-    }
-}
-
-#[async_trait]
-impl<T: Topology + K8sclient + Send + Sync> Interpret<T> for PostgreSQLConnectionInterpret {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("PostgreSQLConnectionInterpret")
-    }
-
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        vec![]
-    }
-
-    async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
-        // Fetch secrets
-        let app_secret = self.fetch_app_secret(topo).await?;
-        trace!("Got app_secret {app_secret:?}");
-        let ca_secret = self.fetch_ca_secret(topo).await?;
-        trace!("Got ca_secret {ca_secret:?}");
-
-        // Get secret data
-        let app_data = self.get_secret_data(&app_secret, "App")?;
-        trace!("Got app_data {app_data:?}");
-        let ca_data = self.get_secret_data(&ca_secret, "CA")?;
-        trace!("Got ca_data {ca_data:?}");
-
-        // Create temp directory
-        let temp_dir = self.create_temp_dir()?;
-        let temp_dir_path = temp_dir.path();
-        debug!("Created temp dir {temp_dir_path:?}");
-
-        // Write CA cert
-        let ca_file = self.write_ca_cert(temp_dir_path, &ca_data)?;
-        debug!("Wrote ca_file {ca_file:?}");
-
-        // Get connection details
-        let username = decode_secret(&app_data, "username")?;
-        let password = decode_secret(&app_data, "password")?;
-        let dbname = decode_secret(&app_data, "dbname")?;
-        let host = self.get_host(&app_data)?;
-        let port = self.get_port(&app_data)?;
-
-        // Create test script
-        let script_path = self.create_test_script(temp_dir_path)?;
-
-        let ca_file_in_container = Path::new("/tmp").join(ca_file.file_name().unwrap());
-        let script_cmd = format!(
-            "{host} {port} {username} {dbname} {}",
-            ca_file_in_container.display()
-        );
-        debug!("Prepared test script in {}", temp_dir_path.display());
-        // Run connection test
-        self.run_docker_test(temp_dir_path, &script_cmd, &password)
-            .await
-    }
-}
-
-fn postgres_scipt_content() -> &'static str {
-    r#"
-#!/bin/sh
-# PostgreSQL connection test and metrics collection script
-
-# Basic connectivity test
-echo "=== CONNECTION TEST ==="
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT 1" > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-    echo "ERROR: Connection failed"
-    exit 1
-fi
-echo "Connection successful"
-
-# Database size metrics
-echo -e "\n=== DATABASE SIZE METRICS ==="
-echo "Total database size (MB):"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT pg_size_pretty(pg_database_size(current_database()))" -t -A
-
-echo "Database size breakdown:"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
-    schema_name,
-    pg_size_pretty(sum(table_size)) as total_size
-FROM (
-    SELECT
-        n.nspname as schema_name,
-        c.relname as table_name,
-        pg_total_relation_size(c.oid) as table_size
-    FROM pg_class c
-    LEFT JOIN pg_namespace n ON n.oid = c.relnamespace
-    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
-    AND c.relkind = 'r'
-) t
-GROUP BY schema_name
-ORDER BY sum(table_size) DESC" -t
-
-# Connection and activity metrics
-echo -e "\n=== CONNECTION & ACTIVITY ==="
-echo "Active connections:"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT count(*) FROM pg_stat_activity" -t -A
-
-echo "Current queries (running longer than 1 second):"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
-    pid,
-    usename,
-    query_start,
-    now() - query_start as duration,
-    state,
-    left(query, 50) as query_preview
-FROM pg_stat_activity
-WHERE state = 'active' AND now() - query_start > interval '1 second'
-ORDER BY duration DESC" -t
-
-# Performance metrics
-echo -e "\n=== PERFORMANCE METRICS ==="
-echo "Database load (transactions per second):"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
-    tps,
-    tps_commit,
-    tps_rollback,
-    blks_read,
-    blks_hit,
-    hit_ratio
-FROM (
-    SELECT
-        xact_commit as tps_commit,
-        xact_rollback as tps_rollback,
-        (xact_commit + xact_rollback) as tps,
-        blks_read,
-        blks_hit,
-        CASE WHEN blks_read + blks_hit = 0 THEN 0 ELSE (blks_hit * 100.0 / (blks_read + blks_hit))::numeric(5,2) END as hit_ratio
-    FROM pg_stat_database
-    WHERE datname = current_database()
-) stats" -t
-
-echo "Current locks:"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
-    count(*) as lock_count,
-    string_agg(mode, ', ' ORDER BY mode) as lock_modes
-FROM pg_locks" -t
-
-# Table statistics
-echo -e "\n=== TABLE STATISTICS ==="
-echo "Most accessed tables:"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
-    relname,
-    seq_scan,
-    idx_scan,
-    n_tup_ins,
-    n_tup_upd,
-    n_tup_del
-FROM pg_stat_user_tables
-ORDER BY seq_scan + idx_scan + n_tup_ins + n_tup_upd + n_tup_del DESC
-LIMIT 10" -t
-
-# Index usage
-echo -e "\n=== INDEX USAGE ==="
-echo "Index usage statistics:"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
-    indexrelname as index_name,
-    idx_scan,
-    idx_tup_read,
-    idx_tup_fetch
-FROM pg_stat_user_indexes
-ORDER BY idx_scan DESC
-LIMIT 5" -t
-
-# Configuration and limits
-echo -e "\n=== CONFIGURATION ==="
-echo "Current database parameters:"
-psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
-    name,
-    setting,
-    unit
-FROM pg_settings
-WHERE category = 'Resource Usage'
-ORDER BY name" -t
-
-echo -e "\n=== TEST COMPLETE ==="
-echo "All metrics collected successfully"
-exit 0
-"#
-}

harmony/src/modules/postgresql/score_public.rs

@@ -1,100 +0,0 @@
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use serde::Serialize;
-
-use crate::data::Version;
-use crate::domain::topology::router::{TlsRoute, TlsRouter};
-use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
-use crate::inventory::Inventory;
-use crate::modules::postgresql::PostgreSQLScore;
-use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-
-/// Deploys a public PostgreSQL cluster: CNPG + TLS passthrough route for RW endpoint.
-/// For failover/multisite: exposes single-instance or small HA Postgres publicly.
-///
-/// Sequence: PostgreSQLScore → TlsRouter::install_route (RW backend).
-///
-/// # Usage
-/// ```
-/// use harmony::modules::postgresql::PublicPostgreSQLScore;
-/// let score = PublicPostgreSQLScore::new("harmony", "pg-rw.example.com");
-/// ```
-#[derive(Debug, Clone, Serialize)]
-pub struct PublicPostgreSQLScore {
-    /// Inner non-public Postgres cluster config.
-    pub postgres_score: PostgreSQLScore,
-    /// Public hostname for RW TLS passthrough (port 443 → cluster-rw:5432).
-    pub hostname: String,
-}
-
-impl PublicPostgreSQLScore {
-    pub fn new(namespace: &str, hostname: &str) -> Self {
-        Self {
-            postgres_score: PostgreSQLScore::new(namespace),
-            hostname: hostname.to_string(),
-        }
-    }
-}
-
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let rw_backend = format!("{}-rw", self.postgres_score.name);
-        let tls_route = TlsRoute {
-            namespace: self.postgres_score.namespace.clone(),
-            hostname: self.hostname.clone(),
-            backend: rw_backend,
-            target_port: 5432,
-        };
-
-        Box::new(PublicPostgreSQLInterpret {
-            postgres_score: self.postgres_score.clone(),
-            tls_route,
-        })
-    }
-
-    fn name(&self) -> String {
-        format!(
-            "PublicPostgreSQLScore({}:{})",
-            self.postgres_score.namespace, self.hostname
-        )
-    }
-}
-
-/// Custom interpret: deploy Postgres then install public TLS route.
-#[derive(Debug, Clone)]
-struct PublicPostgreSQLInterpret {
-    postgres_score: PostgreSQLScore,
-    tls_route: TlsRoute,
-}
-
-#[async_trait]
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicPostgreSQLInterpret {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("PublicPostgreSQLInterpret")
-    }
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-    async fn execute(&self, inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
-        // Deploy CNPG cluster first (creates -rw service)
-        self.postgres_score.interpret(inventory, topo).await?;
-
-        // Expose RW publicly via TLS passthrough
-        topo.install_route(self.tls_route.clone())
-            .await
-            .map_err(|e| InterpretError::new(e))?;
-
-        Ok(Outcome::success(format!(
-            "Public CNPG cluster '{}' deployed with TLS passthrough route '{}'",
-            self.postgres_score.name.clone(),
-            self.tls_route.hostname
-        )))
-    }
-}

harmony_cli/src/cli_reporter.rs

@@ -40,7 +40,7 @@ pub fn init() {
                 HarmonyEvent::HarmonyFinished => {
                     if !details.is_empty() {
                         println!(
-                            "\n{} All done! Here's a few info for you:",
+                            "\n{} All done! Here's what's next for you:",
                             theme::EMOJI_SUMMARY
                         );
                         for detail in details.iter() {

harmony_types/Cargo.toml

@@ -9,4 +9,3 @@ license.workspace = true
 serde.workspace = true
 url.workspace = true
 rand.workspace = true
-serde_json.workspace = true

harmony_types/src/lib.rs

@@ -1,5 +1,3 @@
 pub mod id;
 pub mod net;
-pub mod storage;
 pub mod switch;
-pub mod rfc1123;

harmony_types/src/net.rs

@@ -1,6 +1,6 @@
 use serde::{Deserialize, Serialize};
 
-#[derive(Copy, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord)]
 pub struct MacAddress(pub [u8; 6]);
 
 impl MacAddress {
@@ -19,14 +19,6 @@ impl From<&MacAddress> for String {
     }
 }
 
-impl std::fmt::Debug for MacAddress {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_tuple("MacAddress")
-            .field(&String::from(self))
-            .finish()
-    }
-}
-
 impl std::fmt::Display for MacAddress {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(&String::from(self))

harmony_types/src/rfc1123.rs

@@ -1,232 +0,0 @@
-/// A String that can be used as a subdomain.
-///
-/// This means the name must:
-///
-/// - contain no more than 253 characters
-/// - contain only lowercase alphanumeric characters, '-' or '.'
-/// - start with an alphanumeric character
-/// - end with an alphanumeric character
-///
-/// https://datatracker.ietf.org/doc/html/rfc1123
-///
-/// This is relevant in harmony since most k8s resource names are required to be usable as dns
-/// subdomains.
-///
-/// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/
-#[derive(Debug, Clone)]
-pub struct Rfc1123Name {
-    content: String,
-}
-
-impl TryFrom<&str> for Rfc1123Name {
-    fn try_from(s: &str) -> Result<Self, String> {
-        let mut content = s.to_lowercase();
-
-        // Remove invalid characters
-        content.retain(|c| c.is_ascii_alphanumeric() || c == '-' || c == '.');
-
-        // Enforce max length
-        if content.len() > 253 {
-            content.truncate(253);
-        }
-
-        // Trim leading/trailing dots
-        content = content.trim_matches('.').to_string();
-
-        // Deduplicate consecutive dots
-        loop {
-            let new_content = content.replace("..", ".");
-            if new_content == content {
-                break;
-            }
-            content = new_content;
-        }
-
-        // Trim leading/trailing non-alphanumeric
-        content = content.trim_matches(|c: char| !c.is_ascii_alphanumeric()).to_string();
-
-        if content.is_empty() {
-            return Err(format!("Input '{}' resulted in empty string", s));
-        }
-
-        Ok(Self { content })
-    }
-
-    type Error = String;
-}
-
-
-/// Converts an `Rfc1123Name` into a `String`.
-///
-/// This allows using `Rfc1123Name` in contexts where a `String` is expected.
-impl From<Rfc1123Name> for String {
-    fn from(name: Rfc1123Name) -> Self {
-        name.content
-    }
-}
-
-/// Serializes the `Rfc1123Name` as a string.
-///
-/// This directly serializes the inner `String` content without additional wrapping.
-impl serde::Serialize for Rfc1123Name {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
-        serializer.serialize_str(&self.content)
-    }
-}
-
-/// Deserializes an `Rfc1123Name` from a string.
-///
-/// This directly deserializes into the inner `String` content without additional wrapping.
-impl<'de> serde::Deserialize<'de> for Rfc1123Name {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let content = String::deserialize(deserializer)?;
-        Ok(Self { content })
-    }
-}
-
-/// Displays the `Rfc1123Name` as a string.
-///
-/// This directly displays the inner `String` content without additional wrapping.
-impl std::fmt::Display for Rfc1123Name {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}", self.content)
-    }
-}
-
-
-#[cfg(test)]
-mod tests {
-    use super::Rfc1123Name;
-
-    #[test]
-    fn test_try_from_empty() {
-        let name = Rfc1123Name::try_from("");
-        assert!(name.is_err());
-    }
-
-    #[test]
-    fn test_try_from_valid() {
-        let name = Rfc1123Name::try_from("hello-world").unwrap();
-        assert_eq!(name.content, "hello-world");
-    }
-
-    #[test]
-    fn test_try_from_uppercase() {
-        let name = Rfc1123Name::try_from("Hello-World").unwrap();
-        assert_eq!(name.content, "hello-world");
-    }
-
-    #[test]
-    fn test_try_from_invalid_chars() {
-        let name = Rfc1123Name::try_from("hel@lo#w!or%ld123").unwrap();
-        assert_eq!(name.content, "helloworld123");
-    }
-
-    #[test]
-    fn test_try_from_leading_dot() {
-        let name = Rfc1123Name::try_from(".hello").unwrap();
-        assert_eq!(name.content, "hello");
-    }
-
-    #[test]
-    fn test_try_from_trailing_dot() {
-        let name = Rfc1123Name::try_from("hello.").unwrap();
-        assert_eq!(name.content, "hello");
-    }
-
-    #[test]
-    fn test_try_from_leading_hyphen() {
-        let name = Rfc1123Name::try_from("-hello").unwrap();
-        assert_eq!(name.content, "hello");
-    }
-
-    #[test]
-    fn test_try_from_complicated_string() {
-        let name = Rfc1123Name::try_from("--h--e,}{}12!$#)\np_aulbS\r\t.!@o--._--").unwrap();
-        assert_eq!(name.content, "h--e12paulbs.o");
-    }
-
-    #[test]
-    fn test_try_from_trailing_hyphen() {
-        let name = Rfc1123Name::try_from("hello-").unwrap();
-        assert_eq!(name.content, "hello");
-    }
-
-    #[test]
-    fn test_try_from_single_hyphen() {
-        let name = Rfc1123Name::try_from("-");
-        assert!(name.is_err());
-    }
-
-    #[test]
-    fn test_from_str() {
-        let name: Rfc1123Name = "test-name".try_into().unwrap();
-        assert_eq!(name.content, "test-name");
-    }
-
-    #[test]
-    fn test_into_string() {
-        let name = Rfc1123Name::try_from("test").unwrap();
-        let s: String = name.into();
-        assert_eq!(s, "test");
-    }
-
-    #[test]
-    fn test_compliance() {
-        let inputs = vec![
-            "valid",
-            "in-VALID",
-            ".dots",
-            "-hyphen",
-            "hyphen-",
-            "!!1@",
-            "aaaaaaaaaa",
-            "--abc--",
-            "a.b-c",
-        ];
-
-        for input in inputs {
-            let name = Rfc1123Name::try_from(input).unwrap();
-            let s = &name.content;
-            // Check only allowed characters
-            for c in s.chars() {
-                assert!(c.is_ascii_alphanumeric() || c == '-' || c == '.');
-            }
-            // Check starts and ends with alphanumeric
-            if !s.is_empty() {
-                assert!(s.chars().next().unwrap().is_ascii_alphanumeric());
-                assert!(s.chars().last().unwrap().is_ascii_alphanumeric());
-            }
-        }
-    }
-
-    #[test]
-    fn test_enforces_max_length() {
-        let long_input = "a".repeat(300);
-        let name = Rfc1123Name::try_from(long_input.as_str()).unwrap();
-        assert_eq!(name.content.len(), 253);
-        assert_eq!(name.content, "a".repeat(253));
-    }
-
-    #[test]
-    fn test_truncate_trim_end() {
-        let input = "a".repeat(252) + "-";
-        let name = Rfc1123Name::try_from(input.as_str()).unwrap();
-        assert_eq!(name.content.len(), 252);
-        assert_eq!(name.content, "a".repeat(252));
-    }
-
-    #[test]
-    fn test_dedup_dots() {
-        let input = "a..b...c";
-        let name = Rfc1123Name::try_from(input).unwrap();
-        assert_eq!(name.content, "a.b.c");
-    }
-}
-

harmony_types/src/storage.rs

@@ -1,160 +0,0 @@
-use serde::{Deserialize, Serialize};
-use std::fmt;
-
-#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord, Debug)]
-pub struct StorageSize {
-    size_bytes: u64,
-    #[serde(skip)]
-    display_suffix: Option<String>,
-}
-
-impl StorageSize {
-    pub fn new(size_bytes: u64) -> Self {
-        Self {
-            size_bytes,
-            display_suffix: None,
-        }
-    }
-
-    pub fn b(size: u64) -> Self {
-        Self {
-            size_bytes: size,
-            display_suffix: Some("B".to_string()),
-        }
-    }
-
-    pub fn kb(size: u64) -> Self {
-        Self {
-            size_bytes: size * 1024,
-            display_suffix: Some("KB".to_string()),
-        }
-    }
-
-    pub fn mb(size: u64) -> Self {
-        Self {
-            size_bytes: size * 1024 * 1024,
-            display_suffix: Some("MB".to_string()),
-        }
-    }
-
-    pub fn gb(size: u64) -> Self {
-        Self {
-            size_bytes: size * 1024 * 1024 * 1024,
-            display_suffix: Some("GB".to_string()),
-        }
-    }
-
-    pub fn gi(size: u64) -> Self {
-        Self {
-            size_bytes: size * 1024 * 1024 * 1024,
-            display_suffix: Some("GiB".to_string()),
-        }
-    }
-
-    pub fn tb(size: u64) -> Self {
-        Self {
-            size_bytes: size * 1024 * 1024 * 1024 * 1024,
-            display_suffix: Some("TB".to_string()),
-        }
-    }
-
-    pub fn ti(size: u64) -> Self {
-        Self {
-            size_bytes: size * 1024 * 1024 * 1024 * 1024,
-            display_suffix: Some("TiB".to_string()),
-        }
-    }
-
-    pub fn bytes(&self) -> u64 {
-        self.size_bytes
-    }
-}
-
-impl fmt::Display for StorageSize {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        if let Some(suffix) = &self.display_suffix {
-            write!(f, "{}{}", self.size_bytes, suffix)
-        } else {
-            write!(f, "{}B", self.size_bytes)
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_bytes() {
-        let size = StorageSize::b(123);
-        assert_eq!(size.bytes(), 123);
-        assert_eq!(size.to_string(), "123B");
-    }
-
-    #[test]
-    fn test_kilobytes() {
-        let size = StorageSize::kb(2);
-        assert_eq!(size.bytes(), 2048);
-        assert_eq!(size.to_string(), "2048KB");
-    }
-
-    #[test]
-    fn test_megabytes() {
-        let size = StorageSize::mb(3);
-        assert_eq!(size.bytes(), 3 * 1024 * 1024);
-        assert_eq!(size.to_string(), "3145728MB");
-    }
-
-    #[test]
-    fn test_gigabytes() {
-        let size = StorageSize::gb(4);
-        assert_eq!(size.bytes(), 4 * 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "4294967296GB");
-    }
-
-    #[test]
-    fn test_gibibytes() {
-        let size = StorageSize::gi(1);
-        assert_eq!(size.bytes(), 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "1073741824GiB");
-    }
-
-    #[test]
-    fn test_terabytes() {
-        let size = StorageSize::tb(5);
-        assert_eq!(size.bytes(), 5 * 1024 * 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "5497558138880TB");
-    }
-
-    #[test]
-    fn test_tebibytes() {
-        let size = StorageSize::ti(1);
-        assert_eq!(size.bytes(), 1024 * 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "1099511627776TiB");
-    }
-
-    #[test]
-    fn test_new_without_suffix() {
-        let size = StorageSize::new(999);
-        assert_eq!(size.bytes(), 999);
-        assert_eq!(size.to_string(), "999B");
-    }
-
-    #[test]
-    fn test_serde_roundtrip() {
-        let original = StorageSize::gi(1);
-        let serialized = serde_json::to_string(&original).unwrap();
-        let deserialized: StorageSize = serde_json::from_str(&serialized).unwrap();
-
-        assert_eq!(original.bytes(), deserialized.bytes());
-        // Note: suffix is lost during serialization/deserialization
-        assert_ne!(original.to_string(), deserialized.to_string());
-    }
-
-    #[test]
-    fn test_ord() {
-        let one_gb = StorageSize::gb(1);
-        let one_gi = StorageSize::gi(1);
-        assert!(one_gb < one_gi); // 1GB = 1000MB, 1GiB = 1024MB
-    }
-}

opnsense-config-xml/src/data/interfaces.rs

@@ -9,7 +9,7 @@ pub struct Interface {
     pub physical_interface_name: String,
     pub descr: Option<MaybeString>,
     pub mtu: Option<MaybeString>,
-    pub enable: Option<MaybeString>,
+    pub enable: MaybeString,
     pub lock: Option<MaybeString>,
     #[yaserde(rename = "spoofmac")]
     pub spoof_mac: Option<MaybeString>,
@@ -134,15 +134,19 @@ mod test {
   <interfaces>
     <paul>
       <if></if>
+      <enable/>
     </paul>
     <anotherpaul>
       <if></if>
+      <enable/>
     </anotherpaul>
     <thirdone>
       <if></if>
+      <enable/>
     </thirdone>
     <andgofor4>
       <if></if>
+      <enable/>
     </andgofor4>
   </interfaces>
   <bar>foo</bar>