feat: example OpenshiftClusterAlertScore

Reviewed-on: #170

examples/application_monitoring_with_tenant/src/main.rs

@@ -27,7 +27,6 @@ async fn main() {
     };
     let application = Arc::new(RustWebapp {
         name: "example-monitoring".to_string(),
-        dns: "example-monitoring.harmony.mcd".to_string(),
         project_root: PathBuf::from("./examples/rust/webapp"),
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/okd_cluster_alerts/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "example-okd-cluster-alerts"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+harmony_secret = { path = "../../harmony_secret" }
+harmony_secret_derive = { path = "../../harmony_secret_derive" }
+cidr = { workspace = true }
+tokio = { workspace = true }
+harmony_macros = { path = "../../harmony_macros" }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
+serde.workspace = true
+brocade = { path = "../../brocade" }

examples/okd_cluster_alerts/src/main.rs

@@ -0,0 +1,26 @@
+use harmony::{
+    inventory::Inventory,
+    modules::monitoring::{
+        alert_channel::discord_alert_channel::DiscordWebhook,
+        okd::cluster_monitoring::OpenshiftClusterAlertScore,
+    },
+    topology::K8sAnywhereTopology,
+};
+use harmony_macros::hurl;
+
+#[tokio::main]
+async fn main() {
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(OpenshiftClusterAlertScore {
+            receivers: vec![Box::new(DiscordWebhook {
+                name: "Webhook example".to_string(),
+                url: hurl!("http://something.o"),
+            })],
+        })],
+        None,
+    )
+    .await
+    .unwrap();
+}

examples/rhob_application_monitoring/src/main.rs

@@ -16,7 +16,6 @@ use harmony_types::net::Url;
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "test-rhob-monitoring".to_string(),
-        dns: "test-rhob-monitoring.harmony.mcd".to_string(),
         project_root: PathBuf::from("./webapp"), // Relative from 'harmony-path' param
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/rust/src/main.rs

@@ -19,7 +19,6 @@ use harmony_macros::hurl;
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "harmony-example-rust-webapp".to_string(),
-        dns: "harmony-example-rust-webapp.harmony.mcd".to_string(),
         project_root: PathBuf::from("./webapp"),
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/try_rust_webapp/files_to_add/main.rs

@@ -2,11 +2,12 @@ use harmony::{
     inventory::Inventory,
     modules::{
         application::{
-            features::{rhob_monitoring::Monitoring, PackagingDeployment}, ApplicationScore, RustWebFramework, RustWebapp
+            ApplicationScore, RustWebFramework, RustWebapp,
+            features::{PackagingDeployment, rhob_monitoring::Monitoring},
         },
         monitoring::alert_channel::discord_alert_channel::DiscordWebhook,
     },
-    topology::{K8sAnywhereTopology, LocalhostTopology},
+    topology::K8sAnywhereTopology,
 };
 use harmony_macros::hurl;
 use std::{path::PathBuf, sync::Arc};
@@ -21,8 +22,8 @@ async fn main() {
     });
 
     let discord_webhook = DiscordWebhook {
-        name: "harmony-demo".to_string(),
-        url: hurl!("https://discord.com/api/webhooks/1415391405681021050/V6KzV41vQ7yvbn7BchejRu9C8OANxy0i2ESZOz2nvCxG8xAY3-2i3s5MS38k568JKTzH"),
+        name: "harmony_demo".to_string(),
+        url: hurl!("http://not_a_url.com"),
     };
 
     let app = ApplicationScore {

examples/try_rust_webapp/src/main.rs

@@ -3,7 +3,7 @@ use harmony::{
     modules::{
         application::{
             ApplicationScore, RustWebFramework, RustWebapp,
-            features::{PackagingDeployment, rhob_monitoring::Monitoring},
+            features::{Monitoring, PackagingDeployment},
         },
         monitoring::alert_channel::discord_alert_channel::DiscordWebhook,
     },
@@ -16,7 +16,6 @@ use std::{path::PathBuf, sync::Arc};
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "harmony-example-tryrust".to_string(),
-        dns: "tryrust.example.harmony.mcd".to_string(),
         project_root: PathBuf::from("./tryrust.org"), // <== Project root, in this case it is a
         // submodule
         framework: Some(RustWebFramework::Leptos),

harmony/src/domain/topology/k8s.rs

@@ -1,10 +1,12 @@
-use std::{collections::HashMap, time::Duration};
+use std::time::Duration;
 
 use derive_new::new;
 use k8s_openapi::{
     ClusterResourceScope, NamespaceResourceScope,
-    api::{apps::v1::Deployment, core::v1::Pod},
-    apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition,
+    api::{
+        apps::v1::Deployment,
+        core::v1::{Pod, ServiceAccount},
+    },
     apimachinery::pkg::version::Info,
 };
 use kube::{
@@ -22,7 +24,7 @@ use kube::{
 };
 use log::{debug, error, info, trace};
 use serde::{Serialize, de::DeserializeOwned};
-use serde_json::{json, Value};
+use serde_json::json;
 use similar::TextDiff;
 use tokio::{io::AsyncReadExt, time::sleep};
 
@@ -58,146 +60,9 @@ impl K8sClient {
         })
     }
 
-     // Returns true if any deployment in the given namespace matching the label selector
-    // has status.availableReplicas > 0 (or condition Available=True).
-    pub async fn has_healthy_deployment_with_label(
-        &self,
-        namespace: &str,
-        label_selector: &str,
-    ) -> Result<bool, Error> {
-        let api: Api<Deployment> = Api::namespaced(self.client.clone(), namespace);
-        let lp = ListParams::default().labels(label_selector);
-        let list = api.list(&lp).await?;
-        for d in list.items {
-            // Check AvailableReplicas > 0 or Available condition
-            let available = d
-                .status
-                .as_ref()
-                .and_then(|s| s.available_replicas)
-                .unwrap_or(0);
-            if available > 0 {
-                return Ok(true);
-            }
-            // Fallback: scan conditions
-            if let Some(conds) = d.status.as_ref().and_then(|s| s.conditions.as_ref()) {
-                if conds.iter().any(|c| {
-                    c.type_ == "Available"
-                        && c.status == "True"
-                }) {
-                    return Ok(true);
-                }
-            }
-        }
-        Ok(false)
-    }
-
-    // Cluster-wide: returns namespaces that have at least one healthy deployment
-    // matching the label selector (equivalent to kubectl -A -l ...).
-    pub async fn list_namespaces_with_healthy_deployments(
-        &self,
-        label_selector: &str,
-    ) -> Result<Vec<String>, Error> {
-        let api: Api<Deployment> = Api::all(self.client.clone());
-        let lp = ListParams::default().labels(label_selector);
-        let list = api.list(&lp).await?;
-
-        let mut healthy_ns: HashMap<String, bool> = HashMap::new();
-        for d in list.items {
-            let ns = match d.metadata.namespace.clone() {
-                Some(n) => n,
-                None => continue,
-            };
-            let available = d
-                .status
-                .as_ref()
-                .and_then(|s| s.available_replicas)
-                .unwrap_or(0);
-            let is_healthy = if available > 0 {
-                true
-            } else {
-                d.status
-                    .as_ref()
-                    .and_then(|s| s.conditions.as_ref())
-                    .map(|conds| {
-                        conds.iter().any(|c| {
-                            c.type_ == "Available"
-                                && c.status == "True"
-                        })
-                    })
-                    .unwrap_or(false)
-            };
-            if is_healthy {
-                healthy_ns.insert(ns, true);
-            }
-        }
-
-        Ok(healthy_ns.into_keys().collect())
-    }
-
-    // Get the application-controller ServiceAccount name (fallback to default)
-    pub async fn get_argocd_controller_sa_name(&self, ns: &str) -> Result<String, Error> {
-        let api: Api<Deployment> = Api::namespaced(self.client.clone(), ns);
-        let lp = ListParams::default().labels("app.kubernetes.io/component=controller");
-        let list = api.list(&lp).await?;
-        if let Some(dep) = list.items.get(0) {
-            if let Some(sa) = dep
-                .spec
-                .as_ref()
-                .and_then(|ds| ds.template.spec.as_ref())
-                .and_then(|ps| ps.service_account_name.clone())
-            {
-                return Ok(sa);
-            }
-        }
-        Ok("argocd-application-controller".to_string())
-    }
-
-    // List ClusterRoleBindings dynamically and return as JSON values
-    pub async fn list_clusterrolebindings_json(&self) -> Result<Vec<Value>, Error> {
-        let gvk = kube::api::GroupVersionKind::gvk(
-            "rbac.authorization.k8s.io",
-            "v1",
-            "ClusterRoleBinding",
-        );
-        let ar = kube::api::ApiResource::from_gvk(&gvk);
-        let api: Api<kube::api::DynamicObject> = Api::all_with(self.client.clone(), &ar);
-        let crbs = api.list(&ListParams::default()).await?;
-        let mut out = Vec::new();
-        for o in crbs {
-            let v = serde_json::to_value(&o).unwrap_or(Value::Null);
-            out.push(v);
-        }
-        Ok(out)
-    }
-
-    // Determine if Argo controller in ns has cluster-wide permissions via CRBs
-    // TODO This does not belong in the generic k8s client, should be refactored at some point
-    pub async fn is_argocd_cluster_wide(&self, ns: &str) -> Result<bool, Error> {
-        let sa = self.get_argocd_controller_sa_name(ns).await?;
-        let crbs = self.list_clusterrolebindings_json().await?;
-        let sa_user = format!("system:serviceaccount:{}:{}", ns, sa);
-        for crb in crbs {
-            if let Some(subjects) = crb.get("subjects").and_then(|s| s.as_array()) {
-                for subj in subjects {
-                    let kind = subj.get("kind").and_then(|v| v.as_str()).unwrap_or("");
-                    let name = subj.get("name").and_then(|v| v.as_str()).unwrap_or("");
-                    let subj_ns = subj.get("namespace").and_then(|v| v.as_str()).unwrap_or("");
-                    if (kind == "ServiceAccount" && name == sa && subj_ns == ns)
-                        || (kind == "User" && name == sa_user)
-                    {
-                        return Ok(true);
-                    }
-                }
-            }
-        }
-        Ok(false)
-    }
-
-    pub async fn has_crd(&self, name: &str) -> Result<bool, Error> {
-        let api: Api<CustomResourceDefinition> = Api::all(self.client.clone());
-        let lp = ListParams::default().fields(&format!("metadata.name={}", name));
-        let crds = api.list(&lp).await?;
-        Ok(!crds.items.is_empty())
+    pub async fn service_account_api(&self, namespace: &str) -> Api<ServiceAccount> {
+        let api: Api<ServiceAccount> = Api::namespaced(self.client.clone(), namespace);
+        api
     }
 
     pub async fn get_apiserver_version(&self) -> Result<Info, Error> {
@@ -226,6 +91,23 @@ impl K8sClient {
         Ok(resource.get(name).await?)
     }
 
+    pub async fn get_secret_json_value(
+        &self,
+        name: &str,
+        namespace: Option<&str>,
+    ) -> Result<DynamicObject, Error> {
+        self.get_resource_json_value(
+            name,
+            namespace,
+            &GroupVersionKind {
+                group: "".to_string(),
+                version: "v1".to_string(),
+                kind: "Secret".to_string(),
+            },
+        )
+        .await
+    }
+
     pub async fn get_deployment(
         &self,
         name: &str,

harmony/src/domain/topology/k8s_anywhere.rs

@@ -1,8 +1,13 @@
-use std::{process::Command, sync::Arc};
+use std::{collections::BTreeMap, process::Command, sync::Arc};
 
 use async_trait::async_trait;
-use kube::api::GroupVersionKind;
-use log::{debug, info, trace, warn};
+use base64::{Engine, engine::general_purpose};
+use k8s_openapi::api::{
+    core::v1::Secret,
+    rbac::v1::{ClusterRoleBinding, RoleRef, Subject},
+};
+use kube::api::{DynamicObject, GroupVersionKind, ObjectMeta};
+use log::{debug, info, warn};
 use serde::Serialize;
 use tokio::sync::OnceCell;
 
@@ -12,14 +17,26 @@ use crate::{
     inventory::Inventory,
     modules::{
         k3d::K3DInstallationScore,
-        monitoring::kube_prometheus::crd::{
-            crd_alertmanager_config::CRDPrometheus,
-            prometheus_operator::prometheus_operator_helm_chart_score,
-            rhob_alertmanager_config::RHOBObservability,
+        k8s::ingress::{K8sIngressScore, PathType},
+        monitoring::{
+            grafana::{grafana::Grafana, helm::helm_grafana::grafana_helm_chart_score},
+            kube_prometheus::crd::{
+                crd_alertmanager_config::CRDPrometheus,
+                crd_grafana::{
+                    Grafana as GrafanaCRD, GrafanaCom, GrafanaDashboard,
+                    GrafanaDashboardDatasource, GrafanaDashboardSpec, GrafanaDatasource,
+                    GrafanaDatasourceConfig, GrafanaDatasourceJsonData,
+                    GrafanaDatasourceSecureJsonData, GrafanaDatasourceSpec, GrafanaSpec,
+                },
+                crd_prometheuses::LabelSelector,
+                prometheus_operator::prometheus_operator_helm_chart_score,
+                rhob_alertmanager_config::RHOBObservability,
+                service_monitor::ServiceMonitor,
+            },
         },
         prometheus::{
             k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
-            prometheus::PrometheusApplicationMonitoring, rhob_alerting_score::RHOBAlertingScore,
+            prometheus::PrometheusMonitoring, rhob_alerting_score::RHOBAlertingScore,
         },
     },
     score::Score,
@@ -71,7 +88,6 @@ pub struct K8sAnywhereTopology {
 #[async_trait]
 impl K8sclient for K8sAnywhereTopology {
     async fn k8s_client(&self) -> Result<Arc<K8sClient>, String> {
-        trace!("getting k8s client");
         let state = match self.k8s_state.get() {
             Some(state) => state,
             None => return Err("K8s state not initialized yet".to_string()),
@@ -87,41 +103,172 @@ impl K8sclient for K8sAnywhereTopology {
 }
 
 #[async_trait]
-impl PrometheusApplicationMonitoring<CRDPrometheus> for K8sAnywhereTopology {
+impl Grafana for K8sAnywhereTopology {
+    async fn ensure_grafana_operator(
+        &self,
+        inventory: &Inventory,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        debug!("ensure grafana operator");
+        let client = self.k8s_client().await.unwrap();
+        let grafana_gvk = GroupVersionKind {
+            group: "grafana.integreatly.org".to_string(),
+            version: "v1beta1".to_string(),
+            kind: "Grafana".to_string(),
+        };
+        let name = "grafanas.grafana.integreatly.org";
+        let ns = "grafana";
+
+        let grafana_crd = client
+            .get_resource_json_value(name, Some(ns), &grafana_gvk)
+            .await;
+        match grafana_crd {
+            Ok(_) => {
+                return Ok(PreparationOutcome::Success {
+                    details: "Found grafana CRDs in cluster".to_string(),
+                });
+            }
+
+            Err(_) => {
+                return self
+                    .install_grafana_operator(inventory, Some("grafana"))
+                    .await;
+            }
+        };
+    }
+    async fn install_grafana(&self) -> Result<PreparationOutcome, PreparationError> {
+        let ns = "grafana";
+
+        let mut label = BTreeMap::new();
+
+        label.insert("dashboards".to_string(), "grafana".to_string());
+
+        let label_selector = LabelSelector {
+            match_labels: label.clone(),
+            match_expressions: vec![],
+        };
+
+        let client = self.k8s_client().await?;
+
+        let grafana = self.build_grafana(ns, &label);
+
+        client.apply(&grafana, Some(ns)).await?;
+        //TODO change this to a ensure ready or something better than just a timeout
+        client
+            .wait_until_deployment_ready(
+                "grafana-grafana-deployment".to_string(),
+                Some("grafana"),
+                Some(30),
+            )
+            .await?;
+
+        let sa_name = "grafana-grafana-sa";
+        let token_secret_name = "grafana-sa-token-secret";
+
+        let sa_token_secret = self.build_sa_token_secret(token_secret_name, sa_name, ns);
+
+        client.apply(&sa_token_secret, Some(ns)).await?;
+        let secret_gvk = GroupVersionKind {
+            group: "".to_string(),
+            version: "v1".to_string(),
+            kind: "Secret".to_string(),
+        };
+
+        let secret = client
+            .get_resource_json_value(token_secret_name, Some(ns), &secret_gvk)
+            .await?;
+
+        let token = format!(
+            "Bearer {}",
+            self.extract_and_normalize_token(&secret).unwrap()
+        );
+
+        debug!("creating grafana clusterrole binding");
+
+        let clusterrolebinding =
+            self.build_cluster_rolebinding(sa_name, "cluster-monitoring-view", ns);
+
+        client.apply(&clusterrolebinding, Some(ns)).await?;
+
+        debug!("creating grafana datasource crd");
+
+        let thanos_url = format!(
+            "https://{}",
+            self.get_domain("thanos-querier-openshift-monitoring")
+                .await
+                .unwrap()
+        );
+
+        let thanos_openshift_datasource = self.build_grafana_datasource(
+            "thanos-openshift-monitoring",
+            ns,
+            &label_selector,
+            &thanos_url,
+            &token,
+        );
+
+        client.apply(&thanos_openshift_datasource, Some(ns)).await?;
+
+        debug!("creating grafana dashboard crd");
+        let dashboard = self.build_grafana_dashboard(ns, &label_selector);
+
+        client.apply(&dashboard, Some(ns)).await?;
+        debug!("creating grafana ingress");
+        let grafana_ingress = self.build_grafana_ingress(ns).await;
+
+        grafana_ingress
+            .interpret(&Inventory::empty(), self)
+            .await
+            .map_err(|e| PreparationError::new(e.to_string()))?;
+
+        Ok(PreparationOutcome::Success {
+            details: "Installed grafana composants".to_string(),
+        })
+    }
+}
+
+#[async_trait]
+impl PrometheusMonitoring<CRDPrometheus> for K8sAnywhereTopology {
     async fn install_prometheus(
         &self,
         sender: &CRDPrometheus,
-        inventory: &Inventory,
-        receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
+        _inventory: &Inventory,
+        _receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        let client = self.k8s_client().await?;
+
+        for monitor in sender.service_monitor.iter() {
+            client
+                .apply(monitor, Some(&sender.namespace))
+                .await
+                .map_err(|e| PreparationError::new(e.to_string()))?;
+        }
+        Ok(PreparationOutcome::Success {
+            details: "successfuly installed prometheus components".to_string(),
+        })
+    }
+
+    async fn ensure_prometheus_operator(
+        &self,
+        sender: &CRDPrometheus,
+        _inventory: &Inventory,
     ) -> Result<PreparationOutcome, PreparationError> {
         let po_result = self.ensure_prometheus_operator(sender).await?;
 
-        if po_result == PreparationOutcome::Noop {
-            debug!("Skipping Prometheus CR installation due to missing operator.");
-            return Ok(po_result);
-        }
-
-        let result = self
-            .get_k8s_prometheus_application_score(sender.clone(), receivers)
-            .await
-            .interpret(inventory, self)
-            .await;
-
-        match result {
-            Ok(outcome) => match outcome.status {
-                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
-                    details: outcome.message,
-                }),
-                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
-                _ => Err(PreparationError::new(outcome.message)),
-            },
-            Err(err) => Err(PreparationError::new(err.to_string())),
+        match po_result {
+            PreparationOutcome::Success { details: _ } => {
+                debug!("Detected prometheus crds operator present in cluster.");
+                return Ok(po_result);
+            }
+            PreparationOutcome::Noop => {
+                debug!("Skipping Prometheus CR installation due to missing operator.");
+                return Ok(po_result);
+            }
         }
     }
 }
 
 #[async_trait]
-impl PrometheusApplicationMonitoring<RHOBObservability> for K8sAnywhereTopology {
+impl PrometheusMonitoring<RHOBObservability> for K8sAnywhereTopology {
     async fn install_prometheus(
         &self,
         sender: &RHOBObservability,
@@ -155,6 +302,14 @@ impl PrometheusApplicationMonitoring<RHOBObservability> for K8sAnywhereTopology
             Err(err) => Err(PreparationError::new(err.to_string())),
         }
     }
+
+    async fn ensure_prometheus_operator(
+        &self,
+        sender: &RHOBObservability,
+        inventory: &Inventory,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        todo!()
+    }
 }
 
 impl Serialize for K8sAnywhereTopology {
@@ -216,6 +371,180 @@ impl K8sAnywhereTopology {
             .await
     }
 
+    fn extract_and_normalize_token(&self, secret: &DynamicObject) -> Option<String> {
+        let token_b64 = secret
+            .data
+            .get("token")
+            .or_else(|| secret.data.get("data").and_then(|d| d.get("token")))
+            .and_then(|v| v.as_str())?;
+
+        let bytes = general_purpose::STANDARD.decode(token_b64).ok()?;
+
+        let s = String::from_utf8(bytes).ok()?;
+
+        let cleaned = s
+            .trim_matches(|c: char| c.is_whitespace() || c == '\0')
+            .to_string();
+        Some(cleaned)
+    }
+
+    pub fn build_cluster_rolebinding(
+        &self,
+        service_account_name: &str,
+        clusterrole_name: &str,
+        ns: &str,
+    ) -> ClusterRoleBinding {
+        ClusterRoleBinding {
+            metadata: ObjectMeta {
+                name: Some(format!("{}-view-binding", service_account_name)),
+                ..Default::default()
+            },
+            role_ref: RoleRef {
+                api_group: "rbac.authorization.k8s.io".into(),
+                kind: "ClusterRole".into(),
+                name: clusterrole_name.into(),
+            },
+            subjects: Some(vec![Subject {
+                kind: "ServiceAccount".into(),
+                name: service_account_name.into(),
+                namespace: Some(ns.into()),
+                ..Default::default()
+            }]),
+        }
+    }
+
+    pub fn build_sa_token_secret(
+        &self,
+        secret_name: &str,
+        service_account_name: &str,
+        ns: &str,
+    ) -> Secret {
+        let mut annotations = BTreeMap::new();
+        annotations.insert(
+            "kubernetes.io/service-account.name".to_string(),
+            service_account_name.to_string(),
+        );
+
+        Secret {
+            metadata: ObjectMeta {
+                name: Some(secret_name.into()),
+                namespace: Some(ns.into()),
+                annotations: Some(annotations),
+                ..Default::default()
+            },
+            type_: Some("kubernetes.io/service-account-token".to_string()),
+            ..Default::default()
+        }
+    }
+
+    fn build_grafana_datasource(
+        &self,
+        name: &str,
+        ns: &str,
+        label_selector: &LabelSelector,
+        url: &str,
+        token: &str,
+    ) -> GrafanaDatasource {
+        let mut json_data = BTreeMap::new();
+        json_data.insert("timeInterval".to_string(), "5s".to_string());
+
+        GrafanaDatasource {
+            metadata: ObjectMeta {
+                name: Some(name.to_string()),
+                namespace: Some(ns.to_string()),
+                ..Default::default()
+            },
+            spec: GrafanaDatasourceSpec {
+                instance_selector: label_selector.clone(),
+                allow_cross_namespace_import: Some(true),
+                values_from: None,
+                datasource: GrafanaDatasourceConfig {
+                    access: "proxy".to_string(),
+                    name: name.to_string(),
+                    r#type: "prometheus".to_string(),
+                    url: url.to_string(),
+                    database: None,
+                    json_data: Some(GrafanaDatasourceJsonData {
+                        time_interval: Some("60s".to_string()),
+                        http_header_name1: Some("Authorization".to_string()),
+                        tls_skip_verify: Some(true),
+                        oauth_pass_thru: Some(true),
+                    }),
+                    secure_json_data: Some(GrafanaDatasourceSecureJsonData {
+                        http_header_value1: Some(format!("Bearer {token}")),
+                    }),
+                    is_default: Some(false),
+                    editable: Some(true),
+                },
+            },
+        }
+    }
+
+    fn build_grafana_dashboard(
+        &self,
+        ns: &str,
+        label_selector: &LabelSelector,
+    ) -> GrafanaDashboard {
+        let graf_dashboard = GrafanaDashboard {
+            metadata: ObjectMeta {
+                name: Some(format!("grafana-dashboard-{}", ns)),
+                namespace: Some(ns.to_string()),
+                ..Default::default()
+            },
+            spec: GrafanaDashboardSpec {
+                resync_period: Some("30s".to_string()),
+                instance_selector: label_selector.clone(),
+                datasources: Some(vec![GrafanaDashboardDatasource {
+                    input_name: "DS_PROMETHEUS".to_string(),
+                    datasource_name: "thanos-openshift-monitoring".to_string(),
+                }]),
+                json: None,
+                grafana_com: Some(GrafanaCom {
+                    id: 17406,
+                    revision: None,
+                }),
+            },
+        };
+        graf_dashboard
+    }
+
+    fn build_grafana(&self, ns: &str, labels: &BTreeMap<String, String>) -> GrafanaCRD {
+        let grafana = GrafanaCRD {
+            metadata: ObjectMeta {
+                name: Some(format!("grafana-{}", ns)),
+                namespace: Some(ns.to_string()),
+                labels: Some(labels.clone()),
+                ..Default::default()
+            },
+            spec: GrafanaSpec {
+                config: None,
+                admin_user: None,
+                admin_password: None,
+                ingress: None,
+                persistence: None,
+                resources: None,
+            },
+        };
+        grafana
+    }
+
+    async fn build_grafana_ingress(&self, ns: &str) -> K8sIngressScore {
+        let domain = self.get_domain(&format!("grafana-{}", ns)).await.unwrap();
+        let name = format!("{}-grafana", ns);
+        let backend_service = format!("grafana-{}-service", ns);
+
+        K8sIngressScore {
+            name: fqdn::fqdn!(&name),
+            host: fqdn::fqdn!(&domain),
+            backend_service: fqdn::fqdn!(&backend_service),
+            port: 3000,
+            path: Some("/".to_string()),
+            path_type: Some(PathType::Prefix),
+            namespace: Some(fqdn::fqdn!(&ns)),
+            ingress_class_name: Some("openshift-default".to_string()),
+        }
+    }
+
     async fn get_cluster_observability_operator_prometheus_application_score(
         &self,
         sender: RHOBObservability,
@@ -233,13 +562,14 @@ impl K8sAnywhereTopology {
         &self,
         sender: CRDPrometheus,
         receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
+        service_monitors: Option<Vec<ServiceMonitor>>,
     ) -> K8sPrometheusCRDAlertingScore {
-        K8sPrometheusCRDAlertingScore {
+        return K8sPrometheusCRDAlertingScore {
             sender,
             receivers: receivers.unwrap_or_default(),
-            service_monitors: vec![],
+            service_monitors: service_monitors.unwrap_or_default(),
             prometheus_rules: vec![],
-        }
+        };
     }
 
     async fn openshift_ingress_operator_available(&self) -> Result<(), PreparationError> {
@@ -507,6 +837,30 @@ impl K8sAnywhereTopology {
             details: "prometheus operator present in cluster".into(),
         })
     }
+
+    async fn install_grafana_operator(
+        &self,
+        inventory: &Inventory,
+        ns: Option<&str>,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        let namespace = ns.unwrap_or("grafana");
+        info!("installing grafana operator in ns {namespace}");
+        let tenant = self.get_k8s_tenant_manager()?.get_tenant_config().await;
+        let mut namespace_scope = false;
+        if tenant.is_some() {
+            namespace_scope = true;
+        }
+        let _grafana_operator_score = grafana_helm_chart_score(namespace, namespace_scope)
+            .interpret(inventory, self)
+            .await
+            .map_err(|e| PreparationError::new(e.to_string()));
+        Ok(PreparationOutcome::Success {
+            details: format!(
+                "Successfully installed grafana operator in ns {}",
+                ns.unwrap()
+            ),
+        })
+    }
 }
 
 #[derive(Clone, Debug)]
@@ -621,56 +975,36 @@ impl TenantManager for K8sAnywhereTopology {
 
 #[async_trait]
 impl Ingress for K8sAnywhereTopology {
+    //TODO this is specifically for openshift/okd which violates the k8sanywhere idea
     async fn get_domain(&self, service: &str) -> Result<String, PreparationError> {
-        use log::{trace, debug, warn};
-
         let client = self.k8s_client().await?;
 
         if let Some(Some(k8s_state)) = self.k8s_state.get() {
             match k8s_state.source {
-                K8sSource::LocalK3d => {
-                    // Local developer UX
-                    return Ok(format!("{service}.local.k3d"));
-                }
+                K8sSource::LocalK3d => Ok(format!("{service}.local.k3d")),
                 K8sSource::Kubeconfig => {
-                    trace!("K8sSource is kubeconfig; attempting to detect domain");
+                    self.openshift_ingress_operator_available().await?;
 
-                    // 1) Try OpenShift IngressController domain (backward compatible)
-                    if self.openshift_ingress_operator_available().await.is_ok() {
-                        trace!("OpenShift ingress operator detected; using IngressController");
-                        let gvk = GroupVersionKind {
-                            group: "operator.openshift.io".into(),
-                            version: "v1".into(),
-                            kind: "IngressController".into(),
-                        };
-                        let ic = client
-                            .get_resource_json_value("default", Some("openshift-ingress-operator"), &gvk)
-                            .await
-                            .map_err(|_| PreparationError::new("Failed to fetch IngressController".to_string()))?;
+                    let gvk = GroupVersionKind {
+                        group: "operator.openshift.io".into(),
+                        version: "v1".into(),
+                        kind: "IngressController".into(),
+                    };
+                    let ic = client
+                        .get_resource_json_value(
+                            "default",
+                            Some("openshift-ingress-operator"),
+                            &gvk,
+                        )
+                        .await
+                        .map_err(|_| {
+                            PreparationError::new("Failed to fetch IngressController".to_string())
+                        })?;
 
-                        if let Some(domain) = ic.data["status"]["domain"].as_str() {
-                            return Ok(format!("{service}.{domain}"));
-                        } else {
-                            warn!("OpenShift IngressController present but no status.domain set");
-                        }
-                    } else {
-                        trace!("OpenShift ingress operator not detected; trying generic Kubernetes");
+                    match ic.data["status"]["domain"].as_str() {
+                        Some(domain) => Ok(format!("{service}.{domain}")),
+                        None => Err(PreparationError::new("Could not find domain".to_string())),
                     }
-
-                    // 2) Try NGINX Ingress Controller common setups
-                    // 2.a) Well-known namespace/name for the controller Service
-                    //      - upstream default: namespace "ingress-nginx", service "ingress-nginx-controller"
-                    //      - some distros: "ingress-nginx-controller" svc in "ingress-nginx" ns
-                    // If found with LoadBalancer ingress hostname, use its base domain.
-                    if let Some(domain) = try_nginx_lb_domain(&client).await? {
-                        return Ok(format!("{service}.{domain}"));
-                    }
-
-                    // 3) Fallback: internal cluster DNS suffix (service.namespace.svc.cluster.local)
-                    // We don't have tenant namespace here, so we fallback to 'default' with a warning.
-                    warn!("Could not determine external ingress domain; falling back to internal-only DNS");
-                    let internal = format!("{service}.default.svc.cluster.local");
-                    Ok(internal)
                 }
             }
         } else {
@@ -680,57 +1014,3 @@ impl Ingress for K8sAnywhereTopology {
         }
     }
 }
-
-async fn try_nginx_lb_domain(client: &K8sClient) -> Result<Option<String>, PreparationError> {
-    use log::{trace, debug};
-
-    // Try common service path: svc/ingress-nginx-controller in ns/ingress-nginx
-    let svc_gvk = GroupVersionKind {
-        group: "".into(), // core
-        version: "v1".into(),
-        kind: "Service".into(),
-    };
-
-    let candidates = [
-        ("ingress-nginx", "ingress-nginx-controller"),
-        ("ingress-nginx", "ingress-nginx-controller-internal"),
-        ("ingress-nginx", "ingress-nginx"), // some charts name the svc like this
-        ("kube-system", "ingress-nginx-controller"), // less common but seen
-    ];
-
-    for (ns, name) in candidates {
-        trace!("Checking NGINX Service {ns}/{name} for LoadBalancer hostname");
-        if let Ok(svc) = client.get_resource_json_value(ns, Some(name), &svc_gvk).await {
-            let lb_hosts = svc.data["status"]["loadBalancer"]["ingress"].as_array().cloned().unwrap_or_default();
-            for entry in lb_hosts {
-                if let Some(host) = entry.get("hostname").and_then(|v| v.as_str()) {
-                    debug!("Found NGINX LB hostname: {host}");
-                    if let Some(domain) = extract_base_domain(host) {
-                        return Ok(Some(domain.to_string()));
-                    } else {
-                        return Ok(Some(host.to_string())); // already a domain
-                    }
-                }
-                if let Some(ip) = entry.get("ip").and_then(|v| v.as_str()) {
-                    // If only an IP is exposed, we can't create a hostname; return None to keep searching
-                    debug!("NGINX LB exposes IP {ip} (no hostname); skipping");
-                }
-            }
-        }
-    }
-
-    Ok(None)
-}
-
-fn extract_base_domain(host: &str) -> Option<String> {
-    // For a host like a1b2c3d4e5f6abcdef.elb.amazonaws.com -> base domain elb.amazonaws.com
-    // For a managed DNS like xyz.example.com -> base domain example.com (keep 2+ labels)
-    // Heuristic: keep last 2 labels by default; special-case known multi-label TLDs if needed.
-    let parts: Vec<&str> = host.split('.').collect();
-    if parts.len() >= 2 {
-        // Very conservative: last 2 labels
-        Some(parts[parts.len() - 2..].join("."))
-    } else {
-        None
-    }
-}

harmony/src/domain/topology/mod.rs

@@ -186,7 +186,7 @@ impl TopologyState {
     }
 }
 
-#[derive(Debug, PartialEq)]
+#[derive(Debug)]
 pub enum DeploymentTarget {
     LocalDev,
     Staging,

harmony/src/domain/topology/oberservability/monitoring.rs

@@ -1,6 +1,7 @@
 use std::any::Any;
 
 use async_trait::async_trait;
+use kube::api::DynamicObject;
 use log::debug;
 
 use crate::{
@@ -31,6 +32,7 @@ impl<S: AlertSender + Installable<T>, T: Topology> Interpret<T> for AlertingInte
         inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
+        debug!("hit sender configure for AlertingInterpret");
         self.sender.configure(inventory, topology).await?;
         for receiver in self.receivers.iter() {
             receiver.install(&self.sender).await?;
@@ -75,6 +77,14 @@ pub trait AlertReceiver<S: AlertSender>: std::fmt::Debug + Send + Sync {
     fn name(&self) -> String;
     fn clone_box(&self) -> Box<dyn AlertReceiver<S>>;
     fn as_any(&self) -> &dyn Any;
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver;
+}
+
+#[derive(Debug)]
+pub struct AlertManagerReceiver {
+    pub receiver_config: serde_json::Value,
+    // FIXME we should not leak k8s here. DynamicObject is k8s specific
+    pub additional_ressources: Vec<DynamicObject>,
 }
 
 #[async_trait]
@@ -86,4 +96,5 @@ pub trait AlertRule<S: AlertSender>: std::fmt::Debug + Send + Sync {
 #[async_trait]
 pub trait ScrapeTarget<S: AlertSender>: std::fmt::Debug + Send + Sync {
     async fn install(&self, sender: &S) -> Result<Outcome, InterpretError>;
+    fn clone_box(&self) -> Box<dyn ScrapeTarget<S>>;
 }

harmony/src/infra/kube.rs

@@ -0,0 +1,182 @@
+use k8s_openapi::Resource as K8sResource;
+use kube::api::{ApiResource, DynamicObject, GroupVersionKind};
+use kube::core::TypeMeta;
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use serde_json::Value;
+
+/// Convert a typed Kubernetes resource `K` into a `DynamicObject`.
+///
+/// Requirements:
+/// - `K` must be a k8s_openapi resource (provides static GVK via `Resource`).
+/// - `K` must have standard Kubernetes shape (metadata + payload fields).
+///
+/// Notes:
+/// - We set `types` (apiVersion/kind) and copy `metadata`.
+/// - We place the remaining top-level fields into `obj.data` as JSON.
+/// - Scope is not encoded on the object itself; you still need the corresponding
+///   `DynamicResource` (derived from K::group/version/kind) when constructing an Api.
+///
+/// Example usage:
+///   let dyn_obj = kube_resource_to_dynamic(secret)?;
+///   let api: Api<DynamicObject> = Api::namespaced_with(client, "ns", &dr);
+///   api.patch(&dyn_obj.name_any(), &PatchParams::apply("mgr"), &Patch::Apply(dyn_obj)).await?;
+pub fn kube_resource_to_dynamic<K>(res: &K) -> Result<DynamicObject, String>
+where
+    K: K8sResource + Serialize + DeserializeOwned,
+{
+    // Serialize the typed resource to JSON so we can split metadata and payload
+    let mut v = serde_json::to_value(res).map_err(|e| format!("Failed to serialize : {e}"))?;
+    let obj = v
+        .as_object_mut()
+        .ok_or_else(|| "expected object JSON".to_string())?;
+
+    // Extract and parse metadata into kube::core::ObjectMeta
+    let metadata_value = obj
+        .remove("metadata")
+        .ok_or_else(|| "missing metadata".to_string())?;
+    let metadata: kube::core::ObjectMeta = serde_json::from_value(metadata_value)
+        .map_err(|e| format!("Failed to deserialize : {e}"))?;
+
+    // Name is required for DynamicObject::new; prefer metadata.name
+    let name = metadata
+        .name
+        .clone()
+        .ok_or_else(|| "metadata.name is required".to_string())?;
+
+    // Remaining fields (spec/status/data/etc.) become the dynamic payload
+    let payload = Value::Object(obj.clone());
+
+    // Construct the DynamicObject
+    let mut dyn_obj = DynamicObject::new(
+        &name,
+        &ApiResource::from_gvk(&GroupVersionKind::gvk(K::GROUP, K::VERSION, K::KIND)),
+    );
+    dyn_obj.types = Some(TypeMeta {
+        api_version: api_version_for::<K>(),
+        kind: K::KIND.into(),
+    });
+
+    // Preserve namespace/labels/annotations/etc.
+    dyn_obj.metadata = metadata;
+
+    // Attach payload
+    dyn_obj.data = payload;
+
+    Ok(dyn_obj)
+}
+
+/// Helper: compute apiVersion string ("group/version" or "v1" for core).
+fn api_version_for<K>() -> String
+where
+    K: K8sResource,
+{
+    let group = K::GROUP;
+    let version = K::VERSION;
+    if group.is_empty() {
+        version.to_string() // core/v1 => "v1"
+    } else {
+        format!("{}/{}", group, version)
+    }
+}
+#[cfg(test)]
+mod test {
+    use super::*;
+    use k8s_openapi::api::{
+        apps::v1::{Deployment, DeploymentSpec},
+        core::v1::{PodTemplateSpec, Secret},
+    };
+    use kube::api::ObjectMeta;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn secret_to_dynamic_roundtrip() {
+        // Create a sample Secret resource
+        let mut secret = Secret {
+            metadata: ObjectMeta {
+                name: Some("my-secret".to_string()),
+                ..Default::default()
+            },
+            type_: Some("kubernetes.io/service-account-token".to_string()),
+            ..Default::default()
+        };
+
+        // Convert to DynamicResource
+        let dynamic: DynamicObject =
+            kube_resource_to_dynamic(&secret).expect("Failed to convert Secret to DynamicResource");
+
+        // Serialize both the original and dynamic resources to Value
+        let original_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
+        let dynamic_value =
+            serde_json::to_value(&dynamic).expect("Failed to serialize DynamicResource");
+
+        // Assert that they are identical
+        assert_eq!(original_value, dynamic_value);
+
+        secret.metadata.namespace = Some("false".to_string());
+        let modified_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
+        assert_ne!(modified_value, dynamic_value);
+    }
+
+    #[test]
+    fn deployment_to_dynamic_roundtrip() {
+        // Create a sample Deployment with nested structures
+        let mut deployment = Deployment {
+            metadata: ObjectMeta {
+                name: Some("my-deployment".to_string()),
+                labels: Some({
+                    let mut map = std::collections::BTreeMap::new();
+                    map.insert("app".to_string(), "nginx".to_string());
+                    map
+                }),
+                ..Default::default()
+            },
+            spec: Some(DeploymentSpec {
+                replicas: Some(3),
+                selector: Default::default(),
+                template: PodTemplateSpec {
+                    metadata: Some(ObjectMeta {
+                        labels: Some({
+                            let mut map = std::collections::BTreeMap::new();
+                            map.insert("app".to_string(), "nginx".to_string());
+                            map
+                        }),
+                        ..Default::default()
+                    }),
+                    spec: Some(Default::default()), // PodSpec with empty containers for simplicity
+                },
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+
+        let dynamic = kube_resource_to_dynamic(&deployment).expect("Failed to convert Deployment");
+
+        let original_value = serde_json::to_value(&deployment).unwrap();
+        let dynamic_value = serde_json::to_value(&dynamic).unwrap();
+
+        assert_eq!(original_value, dynamic_value);
+
+        assert_eq!(
+            dynamic.data.get("spec").unwrap().get("replicas").unwrap(),
+            3
+        );
+        assert_eq!(
+            dynamic
+                .data
+                .get("spec")
+                .unwrap()
+                .get("template")
+                .unwrap()
+                .get("metadata")
+                .unwrap()
+                .get("labels")
+                .unwrap()
+                .get("app")
+                .unwrap()
+                .as_str()
+                .unwrap(),
+            "nginx".to_string()
+        );
+    }
+}

harmony/src/infra/mod.rs

@@ -3,5 +3,6 @@ pub mod executors;
 pub mod hp_ilo;
 pub mod intel_amt;
 pub mod inventory;
+pub mod kube;
 pub mod opnsense;
 mod sqlx;

harmony/src/infra/opnsense/dns.rs

@@ -10,7 +10,7 @@ use super::OPNSenseFirewall;
 
 #[async_trait]
 impl DnsServer for OPNSenseFirewall {
-    async fn register_hosts(&self, _hosts: Vec<DnsRecord>) -> Result<(), ExecutorError> {
+    async fn register_hosts(&self, hosts: Vec<DnsRecord>) -> Result<(), ExecutorError> {
         todo!("Refactor this to use dnsmasq")
         // let mut writable_opnsense = self.opnsense_config.write().await;
         // let mut dns = writable_opnsense.dns();
@@ -68,7 +68,7 @@ impl DnsServer for OPNSenseFirewall {
         self.host.clone()
     }
 
-    async fn register_dhcp_leases(&self, _register: bool) -> Result<(), ExecutorError> {
+    async fn register_dhcp_leases(&self, register: bool) -> Result<(), ExecutorError> {
         todo!("Refactor this to use dnsmasq")
         // let mut writable_opnsense = self.opnsense_config.write().await;
         // let mut dns = writable_opnsense.dns();

harmony/src/modules/application/features/argo_types.rs

@@ -21,7 +21,7 @@ pub struct Helm {
     pub skip_schema_validation: Option<bool>,
     pub version: Option<String>,
     pub kube_version: Option<String>,
-    // pub api_versions: Vec<String>,
+    pub api_versions: Vec<String>,
     pub namespace: Option<String>,
 }
 
@@ -105,7 +105,7 @@ impl Default for ArgoApplication {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    // api_versions: vec![],
+                    api_versions: vec![],
                     namespace: None,
                 },
                 path: "".to_string(),
@@ -155,7 +155,7 @@ impl From<CDApplicationConfig> for ArgoApplication {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    // api_versions: vec![],
+                    api_versions: vec![],
                     namespace: None,
                 },
             },
@@ -181,11 +181,13 @@ impl From<CDApplicationConfig> for ArgoApplication {
 }
 
 impl ArgoApplication {
-    pub fn to_yaml(&self, target_namespace: Option<&str>) -> serde_yaml::Value {
+    pub fn to_yaml(&self) -> serde_yaml::Value {
         let name = &self.name;
-        let default_ns = "argocd".to_string();
-        let namespace: &str =
-            target_namespace.unwrap_or(self.namespace.as_ref().unwrap_or(&default_ns));
+        let namespace = if let Some(ns) = self.namespace.as_ref() {
+            ns
+        } else {
+            "argocd"
+        };
         let project = &self.project;
 
         let yaml_str = format!(
@@ -283,7 +285,7 @@ mod tests {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    // api_versions: vec![],
+                    api_versions: vec![],
                     namespace: None,
                 },
                 path: "".to_string(),
@@ -343,7 +345,7 @@ spec:
 
         assert_eq!(
             expected_yaml_output.trim(),
-            serde_yaml::to_string(&app.clone().to_yaml(None))
+            serde_yaml::to_string(&app.clone().to_yaml())
                 .unwrap()
                 .trim()
         );

harmony/src/modules/application/features/helm_argocd_score.rs

@@ -1,21 +1,22 @@
 use async_trait::async_trait;
 use harmony_macros::hurl;
 use kube::{Api, api::GroupVersionKind};
-use log::{debug, info, trace, warn};
+use log::{debug, warn};
 use non_blank_string_rs::NonBlankString;
 use serde::Serialize;
-use std::{str::FromStr, sync::Arc};
+use serde::de::DeserializeOwned;
+use std::{process::Command, str::FromStr, sync::Arc};
 
 use crate::{
     data::Version,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
-    modules::{
-        argocd::{ArgoDeploymentType, detect_argo_deployment_type},
-        helm::chart::{HelmChartScore, HelmRepository},
-    },
+    modules::helm::chart::{HelmChartScore, HelmRepository},
     score::Score,
-    topology::{HelmCommand, K8sclient, Topology, ingress::Ingress, k8s::K8sClient},
+    topology::{
+        HelmCommand, K8sclient, PreparationError, PreparationOutcome, Topology, ingress::Ingress,
+        k8s::K8sClient,
+    },
 };
 use harmony_types::id::Id;
 
@@ -24,7 +25,6 @@ use super::ArgoApplication;
 #[derive(Debug, Serialize, Clone)]
 pub struct ArgoHelmScore {
     pub namespace: String,
-    // TODO: remove and rely on topology (it now knows the flavor)
     pub openshift: bool,
     pub argo_apps: Vec<ArgoApplication>,
 }
@@ -55,101 +55,29 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
         inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
-        trace!("Starting ArgoInterpret execution {self:?}");
-        let k8s_client: Arc<K8sClient> = topology.k8s_client().await?;
-        trace!("Got k8s client");
-        let desired_ns = self.score.namespace.clone();
-
-        debug!("ArgoInterpret detecting cluster configuration");
-        let svc = format!("argo-{}", desired_ns);
+        let k8s_client = topology.k8s_client().await?;
+        let svc = format!("argo-{}", self.score.namespace.clone());
         let domain = topology.get_domain(&svc).await?;
-        debug!("Resolved Argo service domain for '{}': {}", svc, domain);
+        let helm_score =
+            argo_helm_chart_score(&self.score.namespace, self.score.openshift, &domain);
 
-        // Detect current Argo deployment type
-        let current = detect_argo_deployment_type(&k8s_client, &desired_ns).await?;
-        info!("Detected Argo deployment type: {:?}", current);
+        helm_score.interpret(inventory, topology).await?;
 
-        // Decide control namespace and whether we must install
-        let (control_ns, must_install) = match current.clone() {
-            ArgoDeploymentType::NotInstalled => {
-                info!(
-                    "Argo CD not installed. Will install via Helm into namespace '{}'.",
-                    desired_ns
-                );
-                (desired_ns.clone(), true)
-            }
-            ArgoDeploymentType::AvailableInDesiredNamespace(ns) => {
-                info!(
-                    "Argo CD already installed by Harmony in '{}'. Skipping install.",
-                    ns
-                );
-                (ns, false)
-            }
-            ArgoDeploymentType::InstalledClusterWide(ns) => {
-                info!(
-                    "Argo CD installed cluster-wide in namespace '{}'.",
-                    ns
-                );
-                (ns, false)
-            }
-            ArgoDeploymentType::InstalledNamespaceScoped(ns) => {
-                // TODO we could support this use case by installing a new argo instance. But that
-                // means handling a few cases that are out of scope for now :
-                // - Wether argo operator is installed
-                // - Managing CRD versions compatibility
-                // - Potentially handling the various k8s flavors and setups we might encounter
-                //
-                // There is a possibility that the helm chart already handles most or even all of these use cases but they are out of scope for now.
-                let msg = format!(
-                    "Argo CD found in '{}' but it is namespace-scoped and not supported for attachment yet.",
-                    ns
-                );
-                warn!("{}", msg);
-                return Err(InterpretError::new(msg));
-            }
-        };
-
-        info!("ArgoCD will be installed : {must_install} . Current argocd status : {current:?} ");
-
-        if must_install {
-            let helm_score = argo_helm_chart_score(&desired_ns, self.score.openshift, &domain);
-            info!(
-                "Installing Argo CD via Helm into namespace '{}' ...",
-                desired_ns
-            );
-            helm_score.interpret(inventory, topology).await?;
-            info!("Argo CD install complete in '{}'.", desired_ns);
-        }
-
-        let yamls: Vec<serde_yaml::Value> = self
-            .argo_apps
-            .iter()
-            .map(|a| a.to_yaml(Some(&control_ns)))
-            .collect();
-        info!(
-            "Applying {} Argo application object(s) into control namespace '{}'.",
-            yamls.len(),
-            control_ns
-        );
         k8s_client
-            .apply_yaml_many(&yamls, Some(control_ns.as_str()))
+            .apply_yaml_many(&self.argo_apps.iter().map(|a| a.to_yaml()).collect(), None)
             .await
-            .map_err(|e| InterpretError::new(format!("Failed applying Argo CRs: {e}")))?;
+            .unwrap();
 
         Ok(Outcome::success_with_details(
             format!(
                 "ArgoCD {} {}",
                 self.argo_apps.len(),
-                if self.argo_apps.len() == 1 {
-                    "application"
-                } else {
-                    "applications"
+                match self.argo_apps.len() {
+                    1 => "application",
+                    _ => "applications",
                 }
             ),
-            vec![
-                format!("control_namespace={}", control_ns),
-                format!("argo ui: http://{}", domain),
-            ],
+            vec![format!("argo application: http://{}", domain)],
         ))
     }
 
@@ -158,7 +86,7 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
     }
 
     fn get_version(&self) -> Version {
-        Version::from("0.1.0").unwrap()
+        todo!()
     }
 
     fn get_status(&self) -> InterpretStatus {
@@ -166,7 +94,39 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
     }
 
     fn get_children(&self) -> Vec<Id> {
-        vec![]
+        todo!()
+    }
+}
+
+impl ArgoInterpret {
+    pub async fn get_host_domain(
+        &self,
+        client: Arc<K8sClient>,
+        openshift: bool,
+    ) -> Result<String, InterpretError> {
+        //This should be the job of the topology to determine if we are in
+        //openshift, potentially we need on openshift topology the same way we create a
+        //localhosttopology
+        match openshift {
+            true => {
+                let gvk = GroupVersionKind {
+                    group: "operator.openshift.io".into(),
+                    version: "v1".into(),
+                    kind: "IngressController".into(),
+                };
+                let ic = client
+                    .get_resource_json_value("default", Some("openshift-ingress-operator"), &gvk)
+                    .await?;
+
+                match ic.data["status"]["domain"].as_str() {
+                    Some(domain) => return Ok(domain.to_string()),
+                    None => return Err(InterpretError::new("Could not find domain".to_string())),
+                }
+            }
+            false => {
+                todo!()
+            }
+        };
     }
 }
 

harmony/src/modules/application/features/monitoring.rs

@@ -2,7 +2,11 @@ use crate::modules::application::{
     Application, ApplicationFeature, InstallationError, InstallationOutcome,
 };
 use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
+use crate::modules::monitoring::grafana::grafana::Grafana;
 use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus;
+use crate::modules::monitoring::kube_prometheus::crd::service_monitor::{
+    ServiceMonitor, ServiceMonitorSpec,
+};
 use crate::topology::MultiTargetTopology;
 use crate::topology::ingress::Ingress;
 use crate::{
@@ -14,7 +18,7 @@ use crate::{
     topology::{HelmCommand, K8sclient, Topology, tenant::TenantManager},
 };
 use crate::{
-    modules::prometheus::prometheus::PrometheusApplicationMonitoring,
+    modules::prometheus::prometheus::PrometheusMonitoring,
     topology::oberservability::monitoring::AlertReceiver,
 };
 use async_trait::async_trait;
@@ -22,6 +26,7 @@ use base64::{Engine as _, engine::general_purpose};
 use harmony_secret::SecretManager;
 use harmony_secret_derive::Secret;
 use harmony_types::net::Url;
+use kube::api::ObjectMeta;
 use log::{debug, info};
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
@@ -40,7 +45,8 @@ impl<
         + TenantManager
         + K8sclient
         + MultiTargetTopology
-        + PrometheusApplicationMonitoring<CRDPrometheus>
+        + PrometheusMonitoring<CRDPrometheus>
+        + Grafana
         + Ingress
         + std::fmt::Debug,
 > ApplicationFeature<T> for Monitoring
@@ -57,10 +63,20 @@ impl<
             .unwrap_or_else(|| self.application.name());
         let domain = topology.get_domain("ntfy").await.unwrap();
 
+        let app_service_monitor = ServiceMonitor {
+            metadata: ObjectMeta {
+                name: Some(self.application.name()),
+                namespace: Some(namespace.clone()),
+                ..Default::default()
+            },
+            spec: ServiceMonitorSpec::default(),
+        };
+
         let mut alerting_score = ApplicationMonitoringScore {
             sender: CRDPrometheus {
                 namespace: namespace.clone(),
                 client: topology.k8s_client().await.unwrap(),
+                service_monitor: vec![app_service_monitor],
             },
             application: self.application.clone(),
             receivers: self.alert_receiver.clone(),

harmony/src/modules/application/features/packaging_deployment.rs

@@ -10,11 +10,12 @@ use crate::{
     data::Version,
     inventory::Inventory,
     modules::application::{
-        features::{ArgoApplication, ArgoHelmScore}, webapp::Webapp, ApplicationFeature, HelmPackage, InstallationError, InstallationOutcome, OCICompliant
+        ApplicationFeature, HelmPackage, InstallationError, InstallationOutcome, OCICompliant,
+        features::{ArgoApplication, ArgoHelmScore},
     },
     score::Score,
     topology::{
-        ingress::Ingress, DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, Topology
+        DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, Topology, ingress::Ingress,
     },
 };
 
@@ -46,11 +47,11 @@ use crate::{
 /// - ArgoCD to install/upgrade/rollback/inspect k8s resources
 /// - Kubernetes for runtime orchestration
 #[derive(Debug, Default, Clone)]
-pub struct PackagingDeployment<A: OCICompliant + HelmPackage + Webapp> {
+pub struct PackagingDeployment<A: OCICompliant + HelmPackage> {
     pub application: Arc<A>,
 }
 
-impl<A: OCICompliant + HelmPackage + Webapp> PackagingDeployment<A> {
+impl<A: OCICompliant + HelmPackage> PackagingDeployment<A> {
     async fn deploy_to_local_k3d(
         &self,
         app_name: String,
@@ -136,7 +137,7 @@ impl<A: OCICompliant + HelmPackage + Webapp> PackagingDeployment<A> {
 
 #[async_trait]
 impl<
-    A: OCICompliant + HelmPackage + Webapp + Clone + 'static,
+    A: OCICompliant + HelmPackage + Clone + 'static,
     T: Topology + HelmCommand + MultiTargetTopology + K8sclient + Ingress + 'static,
 > ApplicationFeature<T> for PackagingDeployment<A>
 {
@@ -145,15 +146,10 @@ impl<
         topology: &T,
     ) -> Result<InstallationOutcome, InstallationError> {
         let image = self.application.image_name();
-
-        let domain = if topology.current_target() == DeploymentTarget::Production {
-            self.application.dns()
-        } else {
- topology
+        let domain = topology
             .get_domain(&self.application.name())
             .await
-            .map_err(|e| e.to_string())?
-        };
+            .map_err(|e| e.to_string())?;
 
         // TODO Write CI/CD workflow files
         // we can autotedect the CI type using the remote url (default to github action for github
@@ -198,7 +194,7 @@ impl<
                     openshift: true,
                     argo_apps: vec![ArgoApplication::from(CDApplicationConfig {
                         // helm pull oci://hub.nationtech.io/harmony/harmony-example-rust-webapp-chart --version 0.1.0
-                        version: Version::from("0.2.1").unwrap(),
+                        version: Version::from("0.1.0").unwrap(),
                         helm_chart_repo_url: "hub.nationtech.io/harmony".to_string(),
                         helm_chart_name: format!("{}-chart", self.application.name()),
                         values_overrides: None,

harmony/src/modules/application/features/rhob_monitoring.rs

@@ -3,6 +3,7 @@ use std::sync::Arc;
 use crate::modules::application::{
     Application, ApplicationFeature, InstallationError, InstallationOutcome,
 };
+use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
 use crate::modules::monitoring::application_monitoring::rhobs_application_monitoring_score::ApplicationRHOBMonitoringScore;
 
 use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::RHOBObservability;
@@ -17,7 +18,7 @@ use crate::{
     topology::{HelmCommand, K8sclient, Topology, tenant::TenantManager},
 };
 use crate::{
-    modules::prometheus::prometheus::PrometheusApplicationMonitoring,
+    modules::prometheus::prometheus::PrometheusMonitoring,
     topology::oberservability::monitoring::AlertReceiver,
 };
 use async_trait::async_trait;
@@ -41,7 +42,7 @@ impl<
         + MultiTargetTopology
         + Ingress
         + std::fmt::Debug
-        + PrometheusApplicationMonitoring<RHOBObservability>,
+        + PrometheusMonitoring<RHOBObservability>,
 > ApplicationFeature<T> for Monitoring
 {
     async fn ensure_installed(

harmony/src/modules/application/mod.rs

@@ -2,7 +2,6 @@ mod feature;
 pub mod features;
 pub mod oci;
 mod rust;
-mod webapp;
 use std::sync::Arc;
 
 pub use feature::*;

harmony/src/modules/application/rust.rs

@@ -16,7 +16,6 @@ use tar::{Builder, Header};
 use walkdir::WalkDir;
 
 use crate::config::{REGISTRY_PROJECT, REGISTRY_URL};
-use crate::modules::application::webapp::Webapp;
 use crate::{score::Score, topology::Topology};
 
 use super::{Application, ApplicationFeature, ApplicationInterpret, HelmPackage, OCICompliant};
@@ -61,10 +60,6 @@ pub struct RustWebapp {
     pub project_root: PathBuf,
     pub service_port: u32,
     pub framework: Option<RustWebFramework>,
-    /// Host name that will be used in production environment.
-    ///
-    /// This is the place to put the public host name if this is a public facing webapp.
-    pub dns: String,
 }
 
 impl Application for RustWebapp {
@@ -73,12 +68,6 @@ impl Application for RustWebapp {
     }
 }
 
-impl Webapp for RustWebapp {
-    fn dns(&self) -> String {
-        self.dns.clone()
-    }
-}
-
 #[async_trait]
 impl HelmPackage for RustWebapp {
     async fn build_push_helm_package(
@@ -205,10 +194,10 @@ impl RustWebapp {
                     Some(body_full(tar_data.into())),
                 );
 
-                while let Some(msg) = image_build_stream.next().await {
+                while let Some(mut msg) = image_build_stream.next().await {
                     trace!("Got bollard msg {msg:?}");
                     match msg {
-                        Ok(msg) => {
+                        Ok(mut msg) => {
                             if let Some(progress) = msg.progress_detail {
                                 info!(
                                     "Build progress {}/{}",
@@ -268,6 +257,7 @@ impl RustWebapp {
                 ".harmony_generated",
                 "harmony",
                 "node_modules",
+                "Dockerfile.harmony",
             ];
             let mut entries: Vec<_> = WalkDir::new(project_root)
                 .into_iter()
@@ -471,53 +461,52 @@ impl RustWebapp {
 
         let (image_repo, image_tag) = image_url.rsplit_once(':').unwrap_or((image_url, "latest"));
 
-        let app_name = &self.name;
-        let service_port = self.service_port;
         // Create Chart.yaml
         let chart_yaml = format!(
             r#"
 apiVersion: v2
-name: {chart_name}
-description: A Helm chart for the {app_name} web application.
+name: {}
+description: A Helm chart for the {} web application.
 type: application
-version: 0.2.1
-appVersion: "{image_tag}"
+version: 0.1.0
+appVersion: "{}"
 "#,
+            chart_name, self.name, image_tag
         );
         fs::write(chart_dir.join("Chart.yaml"), chart_yaml)?;
 
         // Create values.yaml
         let values_yaml = format!(
             r#"
-# Default values for {chart_name}.
+# Default values for {}.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
 replicaCount: 1
 
 image:
-  repository: {image_repo}
+  repository: {}
   pullPolicy: IfNotPresent
   # Overridden by the chart's appVersion
-  tag: "{image_tag}"
+  tag: "{}"
 
 service:
   type: ClusterIP
-  port: {service_port}
+  port: {}
 
 ingress:
   enabled: true
-  tls: true
   # Annotations for cert-manager to handle SSL.
   annotations:
     # Add other annotations like nginx ingress class if needed
     # kubernetes.io/ingress.class: nginx
   hosts:
-    - host: {domain}
+    - host: {}
       paths:
         - path: /
           pathType: ImplementationSpecific
 "#,
+            chart_name, image_repo, image_tag, self.service_port, domain,
         );
         fs::write(chart_dir.join("values.yaml"), values_yaml)?;
 
@@ -594,11 +583,7 @@ spec:
         );
         fs::write(templates_dir.join("deployment.yaml"), deployment_yaml)?;
 
-        let service_port = self.service_port;
-
         // Create templates/ingress.yaml
-        // TODO get issuer name and tls config from topology as it may be different from one
-        // cluster to another, also from one version to another
         let ingress_yaml = format!(
             r#"
 {{{{- if $.Values.ingress.enabled -}}}}
@@ -611,11 +596,13 @@ metadata:
 spec:
   {{{{- if $.Values.ingress.tls }}}}
   tls:
-    - secretName: {{{{ include "chart.fullname" . }}}}-tls
-      hosts:
-        {{{{- range $.Values.ingress.hosts }}}}
-        - {{{{ .host | quote }}}}
+    {{{{- range $.Values.ingress.tls }}}}
+    - hosts:
+        {{{{- range .hosts }}}}
+        - {{{{ . | quote }}}}
         {{{{- end }}}}
+      secretName: {{{{ .secretName }}}}
+    {{{{- end }}}}
   {{{{- end }}}}
   rules:
     {{{{- range $.Values.ingress.hosts }}}}
@@ -629,11 +616,12 @@ spec:
               service:
                 name: {{{{ include "chart.fullname" $ }}}}
                 port:
-                  number: {{{{ $.Values.service.port | default {service_port} }}}}
+                  number: {{{{ $.Values.service.port | default {} }}}}
           {{{{- end }}}}
     {{{{- end }}}}
 {{{{- end }}}}
 "#,
+            self.service_port
         );
         fs::write(templates_dir.join("ingress.yaml"), ingress_yaml)?;
 

harmony/src/modules/application/webapp.rs

@@ -1,7 +0,0 @@
-use super::Application;
-use async_trait::async_trait;
-
-#[async_trait]
-pub trait Webapp: Application {
-    fn dns(&self) -> String;
-}

harmony/src/modules/argocd/mod.rs

@@ -1,203 +0,0 @@
-use std::sync::Arc;
-
-use log::{debug, info};
-
-use crate::{interpret::InterpretError, topology::k8s::K8sClient};
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum ArgoScope {
-    ClusterWide(String),
-    NamespaceScoped(String),
-}
-
-#[derive(Clone, Debug)]
-pub struct DiscoveredArgo {
-    pub control_namespace: String,
-    pub scope: ArgoScope,
-    pub has_crds: bool,
-    pub has_applicationset: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum ArgoDeploymentType {
-    NotInstalled,
-    AvailableInDesiredNamespace(String),
-    InstalledClusterWide(String),
-    InstalledNamespaceScoped(String),
-}
-
-pub async fn discover_argo_all(
-    k8s: &Arc<K8sClient>,
-) -> Result<Vec<DiscoveredArgo>, InterpretError> {
-    use log::{debug, info, trace, warn};
-
-    trace!("Starting Argo discovery");
-
-    // CRDs
-    let mut has_crds = true;
-    let required_crds = vec!["applications.argoproj.io", "appprojects.argoproj.io"];
-    trace!("Checking required Argo CRDs: {:?}", required_crds);
-
-    for crd in required_crds {
-        trace!("Verifying CRD presence: {crd}");
-        let crd_exists = k8s.has_crd(crd).await.map_err(|e| {
-            InterpretError::new(format!("Failed to verify existence of CRD {crd}: {e}"))
-        })?;
-
-        debug!("CRD {crd} exists: {crd_exists}");
-        if !crd_exists {
-            info!(
-                "Missing Argo CRD {crd}, looks like Argo CD is not installed (or partially installed)"
-            );
-            has_crds = false;
-            break;
-        }
-    }
-
-    trace!(
-        "Listing namespaces with healthy Argo CD deployments using selector app.kubernetes.io/part-of=argocd"
-    );
-    let mut candidate_namespaces = k8s
-        .list_namespaces_with_healthy_deployments("app.kubernetes.io/part-of=argocd")
-        .await
-        .map_err(|e| InterpretError::new(format!("List healthy argocd deployments: {e}")))?;
-    trace!(
-        "Listing namespaces with healthy Argo CD deployments using selector app.kubernetes.io/name=argo-cd"
-    );
-    candidate_namespaces.append(
-        &mut k8s
-            .list_namespaces_with_healthy_deployments("app.kubernetes.io/name=argo-cd")
-            .await
-            .map_err(|e| InterpretError::new(format!("List healthy argocd deployments: {e}")))?,
-    );
-
-    debug!(
-        "Discovered {} candidate namespace(s) for Argo CD: {:?}",
-        candidate_namespaces.len(),
-        candidate_namespaces
-    );
-
-    let mut found = Vec::new();
-    for ns in candidate_namespaces {
-        trace!("Evaluating namespace '{ns}' for Argo CD instance");
-
-        // Require the application-controller to be healthy (sanity check)
-        trace!(
-            "Checking healthy deployment with label app.kubernetes.io/name=argocd-application-controller in namespace '{ns}'"
-        );
-        let controller_ok = k8s
-            .has_healthy_deployment_with_label(
-                &ns,
-                "app.kubernetes.io/name=argocd-application-controller",
-            )
-            .await
-            .unwrap_or_else(|e| {
-                warn!(
-                    "Error while checking application-controller health in namespace '{ns}': {e}"
-                );
-                false
-            }) || k8s
-            .has_healthy_deployment_with_label(
-                &ns,
-                "app.kubernetes.io/component=controller",
-            )
-            .await
-            .unwrap_or_else(|e| {
-                warn!(
-                    "Error while checking application-controller health in namespace '{ns}': {e}"
-                );
-                false
-            });
-        debug!("Namespace '{ns}': application-controller healthy = {controller_ok}");
-
-        if !controller_ok {
-            trace!("Skipping namespace '{ns}' because application-controller is not healthy");
-            continue;
-        }
-
-        trace!("Determining Argo CD scope for namespace '{ns}' (cluster-wide vs namespace-scoped)");
-        let scope = match k8s.is_argocd_cluster_wide(&ns).await {
-            Ok(true) => {
-                debug!("Namespace '{ns}' identified as cluster-wide Argo CD control plane");
-                ArgoScope::ClusterWide(ns.to_string())
-            }
-            Ok(false) => {
-                debug!("Namespace '{ns}' identified as namespace-scoped Argo CD control plane");
-                ArgoScope::NamespaceScoped(ns.to_string())
-            }
-            Err(e) => {
-                warn!(
-                    "Failed to determine Argo CD scope for namespace '{ns}': {e}. Assuming namespace-scoped."
-                );
-                ArgoScope::NamespaceScoped(ns.to_string())
-            }
-        };
-
-        trace!("Checking optional ApplicationSet CRD (applicationsets.argoproj.io)");
-        let has_applicationset = match k8s.has_crd("applicationsets.argoproj.io").await {
-            Ok(v) => {
-                debug!("applicationsets.argoproj.io present: {v}");
-                v
-            }
-            Err(e) => {
-                warn!("Failed to check applicationsets.argoproj.io CRD: {e}. Assuming absent.");
-                false
-            }
-        };
-
-        let argo = DiscoveredArgo {
-            control_namespace: ns.clone(),
-            scope,
-            has_crds,
-            has_applicationset,
-        };
-
-        debug!("Discovered Argo instance in '{ns}': {argo:?}");
-        found.push(argo);
-    }
-
-    if found.is_empty() {
-        info!("No Argo CD installations discovered");
-    } else {
-        info!(
-            "Argo CD discovery complete: {} instance(s) found",
-            found.len()
-        );
-    }
-
-    Ok(found)
-}
-
-pub async fn detect_argo_deployment_type(
-    k8s: &Arc<K8sClient>,
-    desired_namespace: &str,
-) -> Result<ArgoDeploymentType, InterpretError> {
-    let discovered = discover_argo_all(k8s).await?;
-    debug!("Discovered argo instances {discovered:?}");
-
-    if discovered.is_empty() {
-        return Ok(ArgoDeploymentType::NotInstalled);
-    }
-
-    if let Some(d) = discovered
-        .iter()
-        .find(|d| d.control_namespace == desired_namespace)
-    {
-        return Ok(ArgoDeploymentType::AvailableInDesiredNamespace(
-            d.control_namespace.clone(),
-        ));
-    }
-
-    if let Some(d) = discovered
-        .iter()
-        .find(|d| matches!(d.scope, ArgoScope::ClusterWide(_)))
-    {
-        return Ok(ArgoDeploymentType::InstalledClusterWide(
-            d.control_namespace.clone(),
-        ));
-    }
-
-    Ok(ArgoDeploymentType::InstalledNamespaceScoped(
-        discovered[0].control_namespace.clone(),
-    ))
-}

harmony/src/modules/inventory/mod.rs

@@ -90,12 +90,12 @@ impl<T: Topology> Interpret<T> for DiscoverInventoryAgentInterpret {
                             // refactoring to do it now
                             let harmony_inventory_agent::hwinfo::PhysicalHost {
                                 storage_drives,
-                                storage_controller: _,
+                                storage_controller,
                                 memory_modules,
                                 cpus,
-                                chipset: _,
+                                chipset,
                                 network_interfaces,
-                                management_interface: _,
+                                management_interface,
                                 host_uuid,
                             } = host;
 

harmony/src/modules/mod.rs

@@ -17,4 +17,3 @@ pub mod prometheus;
 pub mod storage;
 pub mod tenant;
 pub mod tftp;
-pub mod argocd;

harmony/src/modules/monitoring/alert_channel/discord_alert_channel.rs

@@ -3,7 +3,8 @@ use std::collections::BTreeMap;
 
 use async_trait::async_trait;
 use k8s_openapi::api::core::v1::Secret;
-use kube::api::ObjectMeta;
+use kube::Resource;
+use kube::api::{DynamicObject, ObjectMeta};
 use log::debug;
 use serde::Serialize;
 use serde_json::json;
@@ -13,6 +14,8 @@ use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::{
     AlertmanagerConfig, AlertmanagerConfigSpec, CRDPrometheus,
 };
 use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::RHOBObservability;
+use crate::modules::monitoring::okd::OpenshiftClusterAlertSender;
+use crate::topology::oberservability::monitoring::AlertManagerReceiver;
 use crate::{
     interpret::{InterpretError, Outcome},
     modules::monitoring::{
@@ -32,10 +35,8 @@ pub struct DiscordWebhook {
     pub url: Url,
 }
 
-#[async_trait]
-impl AlertReceiver<RHOBObservability> for DiscordWebhook {
-    async fn install(&self, sender: &RHOBObservability) -> Result<Outcome, InterpretError> {
-        let ns = sender.namespace.clone();
+impl DiscordWebhook {
+    fn get_receiver_config(&self) -> AlertManagerReceiver {
         let secret_name = format!("{}-secret", self.name.clone());
         let webhook_key = format!("{}", self.url.clone());
 
@@ -52,26 +53,74 @@ impl AlertReceiver<RHOBObservability> for DiscordWebhook {
             ..Default::default()
         };
 
-        let _ = sender.client.apply(&secret, Some(&ns)).await;
+        AlertManagerReceiver {
+            additional_ressources: vec![],
+
+            receiver_config: json!({
+                "name": self.name,
+                "discordConfigs": [
+                    {
+                    "apiURL": {
+                        "name": secret_name,
+                        "key":  "webhook-url",
+                    },
+                    "title": "{{ template \"discord.default.title\" . }}",
+                    "message": "{{ template \"discord.default.message\" . }}"
+                    }
+                ]
+            }),
+        }
+    }
+}
+
+#[async_trait]
+impl AlertReceiver<OpenshiftClusterAlertSender> for DiscordWebhook {
+    async fn install(
+        &self,
+        sender: &OpenshiftClusterAlertSender,
+    ) -> Result<Outcome, InterpretError> {
+        todo!()
+    }
+
+    fn name(&self) -> String {
+        todo!()
+    }
+
+    fn clone_box(&self) -> Box<dyn AlertReceiver<OpenshiftClusterAlertSender>> {
+        Box::new(self.clone())
+    }
+
+    fn as_any(&self) -> &dyn Any {
+        todo!()
+    }
+
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        self.get_receiver_config()
+    }
+}
+
+#[async_trait]
+impl AlertReceiver<RHOBObservability> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
+
+    async fn install(&self, sender: &RHOBObservability) -> Result<Outcome, InterpretError> {
+        let ns = sender.namespace.clone();
+
+        let config = self.get_receiver_config();
+        for resource in config.additional_ressources.iter() {
+            todo!("can I apply a dynamicresource");
+            // sender.client.apply(resource, Some(&ns)).await;
+        }
+
         let spec = crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::AlertmanagerConfigSpec {
             data: json!({
                 "route": {
                     "receiver": self.name,
                 },
                 "receivers": [
-                    {
-                        "name": self.name,
-                        "discordConfigs": [
-                            {
-                            "apiURL": {
-                                "name": secret_name,
-                                "key":  "webhook-url",
-                            },
-                            "title": "{{ template \"discord.default.title\" . }}",
-                            "message": "{{ template \"discord.default.message\" . }}"
-                            }
-                        ]
-                    }
+                    config.receiver_config
                 ]
             }),
         };
@@ -122,6 +171,9 @@ impl AlertReceiver<RHOBObservability> for DiscordWebhook {
 
 #[async_trait]
 impl AlertReceiver<CRDPrometheus> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &CRDPrometheus) -> Result<Outcome, InterpretError> {
         let ns = sender.namespace.clone();
         let secret_name = format!("{}-secret", self.name.clone());
@@ -200,6 +252,9 @@ impl AlertReceiver<CRDPrometheus> for DiscordWebhook {
 
 #[async_trait]
 impl AlertReceiver<Prometheus> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &Prometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }
@@ -226,6 +281,9 @@ impl PrometheusReceiver for DiscordWebhook {
 
 #[async_trait]
 impl AlertReceiver<KubePrometheus> for DiscordWebhook {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &KubePrometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }

harmony/src/modules/monitoring/alert_channel/webhook_receiver.rs

@@ -19,7 +19,7 @@ use crate::{
         },
         prometheus::prometheus::{Prometheus, PrometheusReceiver},
     },
-    topology::oberservability::monitoring::AlertReceiver,
+    topology::oberservability::monitoring::{AlertManagerReceiver, AlertReceiver},
 };
 use harmony_types::net::Url;
 
@@ -31,6 +31,9 @@ pub struct WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<RHOBObservability> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &RHOBObservability) -> Result<Outcome, InterpretError> {
         let spec = crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::AlertmanagerConfigSpec {
             data: json!({
@@ -97,6 +100,9 @@ impl AlertReceiver<RHOBObservability> for WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<CRDPrometheus> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &CRDPrometheus) -> Result<Outcome, InterpretError> {
         let spec = crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::AlertmanagerConfigSpec {
             data: json!({
@@ -158,6 +164,9 @@ impl AlertReceiver<CRDPrometheus> for WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<Prometheus> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &Prometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }
@@ -184,6 +193,9 @@ impl PrometheusReceiver for WebhookReceiver {
 
 #[async_trait]
 impl AlertReceiver<KubePrometheus> for WebhookReceiver {
+    fn as_alertmanager_receiver(&self) -> AlertManagerReceiver {
+        todo!()
+    }
     async fn install(&self, sender: &KubePrometheus) -> Result<Outcome, InterpretError> {
         sender.install_receiver(self).await
     }

harmony/src/modules/monitoring/application_monitoring/application_monitoring_score.rs

@@ -1,21 +1,23 @@
 use std::sync::Arc;
 
-use async_trait::async_trait;
+use log::debug;
 use serde::Serialize;
 
 use crate::{
-    data::Version,
-    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
-    inventory::Inventory,
+    interpret::Interpret,
     modules::{
         application::Application,
-        monitoring::kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus,
-        prometheus::prometheus::PrometheusApplicationMonitoring,
+        monitoring::{
+            grafana::grafana::Grafana, kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus,
+        },
+        prometheus::prometheus::PrometheusMonitoring,
     },
     score::Score,
-    topology::{PreparationOutcome, Topology, oberservability::monitoring::AlertReceiver},
+    topology::{
+        K8sclient, Topology,
+        oberservability::monitoring::{AlertReceiver, AlertingInterpret, ScrapeTarget},
+    },
 };
-use harmony_types::id::Id;
 
 #[derive(Debug, Clone, Serialize)]
 pub struct ApplicationMonitoringScore {
@@ -24,12 +26,16 @@ pub struct ApplicationMonitoringScore {
     pub receivers: Vec<Box<dyn AlertReceiver<CRDPrometheus>>>,
 }
 
-impl<T: Topology + PrometheusApplicationMonitoring<CRDPrometheus>> Score<T>
+impl<T: Topology + PrometheusMonitoring<CRDPrometheus> + K8sclient + Grafana> Score<T>
     for ApplicationMonitoringScore
 {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(ApplicationMonitoringInterpret {
-            score: self.clone(),
+        debug!("creating alerting interpret");
+        Box::new(AlertingInterpret {
+            sender: self.sender.clone(),
+            receivers: self.receivers.clone(),
+            rules: vec![],
+            scrape_targets: None,
         })
     }
 
@@ -40,55 +46,3 @@ impl<T: Topology + PrometheusApplicationMonitoring<CRDPrometheus>> Score<T>
         )
     }
 }
-
-#[derive(Debug)]
-pub struct ApplicationMonitoringInterpret {
-    score: ApplicationMonitoringScore,
-}
-
-#[async_trait]
-impl<T: Topology + PrometheusApplicationMonitoring<CRDPrometheus>> Interpret<T>
-    for ApplicationMonitoringInterpret
-{
-    async fn execute(
-        &self,
-        inventory: &Inventory,
-        topology: &T,
-    ) -> Result<Outcome, InterpretError> {
-        let result = topology
-            .install_prometheus(
-                &self.score.sender,
-                inventory,
-                Some(self.score.receivers.clone()),
-            )
-            .await;
-
-        match result {
-            Ok(outcome) => match outcome {
-                PreparationOutcome::Success { details: _ } => {
-                    Ok(Outcome::success("Prometheus installed".into()))
-                }
-                PreparationOutcome::Noop => {
-                    Ok(Outcome::noop("Prometheus installation skipped".into()))
-                }
-            },
-            Err(err) => Err(InterpretError::from(err)),
-        }
-    }
-
-    fn get_name(&self) -> InterpretName {
-        InterpretName::ApplicationMonitoring
-    }
-
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-}

harmony/src/modules/monitoring/application_monitoring/rhobs_application_monitoring_score.rs

@@ -12,7 +12,7 @@ use crate::{
         monitoring::kube_prometheus::crd::{
             crd_alertmanager_config::CRDPrometheus, rhob_alertmanager_config::RHOBObservability,
         },
-        prometheus::prometheus::PrometheusApplicationMonitoring,
+        prometheus::prometheus::PrometheusMonitoring,
     },
     score::Score,
     topology::{PreparationOutcome, Topology, oberservability::monitoring::AlertReceiver},
@@ -26,7 +26,7 @@ pub struct ApplicationRHOBMonitoringScore {
     pub receivers: Vec<Box<dyn AlertReceiver<RHOBObservability>>>,
 }
 
-impl<T: Topology + PrometheusApplicationMonitoring<RHOBObservability>> Score<T>
+impl<T: Topology + PrometheusMonitoring<RHOBObservability>> Score<T>
     for ApplicationRHOBMonitoringScore
 {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
@@ -49,7 +49,7 @@ pub struct ApplicationRHOBMonitoringInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + PrometheusApplicationMonitoring<RHOBObservability>> Interpret<T>
+impl<T: Topology + PrometheusMonitoring<RHOBObservability>> Interpret<T>
     for ApplicationRHOBMonitoringInterpret
 {
     async fn execute(

harmony/src/modules/monitoring/grafana/grafana.rs

@@ -0,0 +1,17 @@
+use async_trait::async_trait;
+use k8s_openapi::Resource;
+
+use crate::{
+    inventory::Inventory,
+    topology::{PreparationError, PreparationOutcome},
+};
+
+#[async_trait]
+pub trait Grafana {
+    async fn ensure_grafana_operator(
+        &self,
+        inventory: &Inventory,
+    ) -> Result<PreparationOutcome, PreparationError>;
+
+    async fn install_grafana(&self) -> Result<PreparationOutcome, PreparationError>;
+}

harmony/src/modules/monitoring/grafana/helm/helm_grafana.rs

@@ -1,27 +1,28 @@
+use harmony_macros::hurl;
 use non_blank_string_rs::NonBlankString;
-use std::str::FromStr;
+use std::{collections::HashMap, str::FromStr};
 
-use crate::modules::helm::chart::HelmChartScore;
-
-pub fn grafana_helm_chart_score(ns: &str) -> HelmChartScore {
-    let values = r#"
-rbac:
-  namespaced: true
-sidecar:
-  dashboards:
-    enabled: true
-        "#
-    .to_string();
+use crate::modules::helm::chart::{HelmChartScore, HelmRepository};
 
+pub fn grafana_helm_chart_score(ns: &str, namespace_scope: bool) -> HelmChartScore {
+    let mut values_overrides = HashMap::new();
+    values_overrides.insert(
+        NonBlankString::from_str("namespaceScope").unwrap(),
+        namespace_scope.to_string(),
+    );
     HelmChartScore {
         namespace: Some(NonBlankString::from_str(ns).unwrap()),
-        release_name: NonBlankString::from_str("grafana").unwrap(),
-        chart_name: NonBlankString::from_str("oci://ghcr.io/grafana/helm-charts/grafana").unwrap(),
+        release_name: NonBlankString::from_str("grafana-operator").unwrap(),
+        chart_name: NonBlankString::from_str("grafana/grafana-operator").unwrap(),
         chart_version: None,
-        values_overrides: None,
-        values_yaml: Some(values.to_string()),
+        values_overrides: Some(values_overrides),
+        values_yaml: None,
         create_namespace: true,
         install_only: true,
-        repository: None,
+        repository: Some(HelmRepository::new(
+            "grafana".to_string(),
+            hurl!("https://grafana.github.io/helm-charts"),
+            true,
+        )),
     }
 }

harmony/src/modules/monitoring/grafana/mod.rs

@@ -1 +1,2 @@
+pub mod grafana;
 pub mod helm;

harmony/src/modules/monitoring/kube_prometheus/crd/crd_alertmanager_config.rs

@@ -1,12 +1,25 @@
 use std::sync::Arc;
 
+use async_trait::async_trait;
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::topology::{
-    k8s::K8sClient,
-    oberservability::monitoring::{AlertReceiver, AlertSender},
+use crate::{
+    interpret::{InterpretError, Outcome},
+    inventory::Inventory,
+    modules::{
+        monitoring::{
+            grafana::grafana::Grafana, kube_prometheus::crd::service_monitor::ServiceMonitor,
+        },
+        prometheus::prometheus::PrometheusMonitoring,
+    },
+    topology::{
+        K8sclient, Topology,
+        installable::Installable,
+        k8s::K8sClient,
+        oberservability::monitoring::{AlertReceiver, AlertSender, ScrapeTarget},
+    },
 };
 
 #[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
@@ -26,6 +39,7 @@ pub struct AlertmanagerConfigSpec {
 pub struct CRDPrometheus {
     pub namespace: String,
     pub client: Arc<K8sClient>,
+    pub service_monitor: Vec<ServiceMonitor>,
 }
 
 impl AlertSender for CRDPrometheus {
@@ -40,6 +54,12 @@ impl Clone for Box<dyn AlertReceiver<CRDPrometheus>> {
     }
 }
 
+impl Clone for Box<dyn ScrapeTarget<CRDPrometheus>> {
+    fn clone(&self) -> Self {
+        self.clone_box()
+    }
+}
+
 impl Serialize for Box<dyn AlertReceiver<CRDPrometheus>> {
     fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
     where
@@ -48,3 +68,24 @@ impl Serialize for Box<dyn AlertReceiver<CRDPrometheus>> {
         todo!()
     }
 }
+
+#[async_trait]
+impl<T: Topology + K8sclient + PrometheusMonitoring<CRDPrometheus> + Grafana> Installable<T>
+    for CRDPrometheus
+{
+    async fn configure(&self, inventory: &Inventory, topology: &T) -> Result<(), InterpretError> {
+        topology.ensure_grafana_operator(inventory).await?;
+        topology.ensure_prometheus_operator(self, inventory).await?;
+        Ok(())
+    }
+
+    async fn ensure_installed(
+        &self,
+        inventory: &Inventory,
+        topology: &T,
+    ) -> Result<(), InterpretError> {
+        topology.install_grafana().await?;
+        topology.install_prometheus(&self, inventory, None).await?;
+        Ok(())
+    }
+}

harmony/src/modules/monitoring/kube_prometheus/crd/crd_grafana.rs

@@ -103,9 +103,34 @@ pub struct GrafanaDashboardSpec {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub resync_period: Option<String>,
 
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub datasources: Option<Vec<GrafanaDashboardDatasource>>,
+
     pub instance_selector: LabelSelector,
 
-    pub json: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub json: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub grafana_com: Option<GrafanaCom>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaDashboardDatasource {
+    pub input_name: String,
+    pub datasource_name: String,
+}
+
+// ------------------------------------------------------------------------------------------------
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaCom {
+    pub id: u32,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub revision: Option<u32>,
 }
 
 // ------------------------------------------------------------------------------------------------
@@ -126,20 +151,79 @@ pub struct GrafanaDatasourceSpec {
     pub allow_cross_namespace_import: Option<bool>,
 
     pub datasource: GrafanaDatasourceConfig,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub values_from: Option<Vec<GrafanaValueFrom>>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaValueFrom {
+    pub target_path: String,
+    pub value_from: GrafanaValueSource,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaValueSource {
+    pub secret_key_ref: GrafanaSecretKeyRef,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaSecretKeyRef {
+    pub name: String,
+    pub key: String,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct GrafanaDatasourceConfig {
     pub access: String,
-    pub database: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub json_data: Option<BTreeMap<String, String>>,
+    pub database: Option<String>,
     pub name: String,
     pub r#type: String,
     pub url: String,
+    /// Represents jsonData in the GrafanaDatasource spec
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub json_data: Option<GrafanaDatasourceJsonData>,
+
+    /// Represents secureJsonData (secrets)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub secure_json_data: Option<GrafanaDatasourceSecureJsonData>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub is_default: Option<bool>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub editable: Option<bool>,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaDatasourceJsonData {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub time_interval: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub http_header_name1: Option<String>,
+
+    /// Disable TLS skip verification (false = verify)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tls_skip_verify: Option<bool>,
+
+    /// Auth type - set to "forward" for OpenShift OAuth identity
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub oauth_pass_thru: Option<bool>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaDatasourceSecureJsonData {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub http_header_value1: Option<String>,
+}
 // ------------------------------------------------------------------------------------------------
 
 #[derive(Serialize, Deserialize, Debug, Clone, JsonSchema, Default)]

harmony/src/modules/monitoring/kube_prometheus/crd/rhob_monitoring_stack.rs

@@ -1,8 +1,12 @@
+use std::collections::BTreeMap;
+
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::LabelSelector;
+use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::{
+    LabelSelector, PrometheusSpec,
+};
 
 /// MonitoringStack CRD for monitoring.rhobs/v1alpha1
 #[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]

harmony/src/modules/monitoring/okd/cluster_monitoring.rs

@@ -0,0 +1,139 @@
+use base64::prelude::*;
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use harmony_types::id::Id;
+use kube::api::DynamicObject;
+use log::{debug, info, trace};
+use serde::Serialize;
+
+use crate::{
+    data::Version,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
+    modules::{
+        application::Application,
+        monitoring::{
+            grafana::grafana::Grafana,
+            kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus,
+            okd::OpenshiftClusterAlertSender,
+        },
+        prometheus::prometheus::PrometheusMonitoring,
+    },
+    score::Score,
+    topology::{
+        K8sclient, Topology,
+        k8s::K8sClient,
+        oberservability::monitoring::{AlertReceiver, AlertingInterpret, ScrapeTarget},
+    },
+};
+
+impl Clone for Box<dyn AlertReceiver<OpenshiftClusterAlertSender>> {
+    fn clone(&self) -> Self {
+        self.clone_box()
+    }
+}
+
+impl Serialize for Box<dyn AlertReceiver<OpenshiftClusterAlertSender>> {
+    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        todo!()
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct OpenshiftClusterAlertScore {
+    pub receivers: Vec<Box<dyn AlertReceiver<OpenshiftClusterAlertSender>>>,
+}
+
+impl<T: Topology + K8sclient> Score<T> for OpenshiftClusterAlertScore {
+    fn name(&self) -> String {
+        "ClusterAlertScore".to_string()
+    }
+
+    #[doc(hidden)]
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        Box::new(OpenshiftClusterAlertInterpret {
+            receivers: self.receivers.clone(),
+        })
+    }
+}
+
+#[derive(Debug)]
+pub struct OpenshiftClusterAlertInterpret {
+    receivers: Vec<Box<dyn AlertReceiver<OpenshiftClusterAlertSender>>>,
+}
+
+#[async_trait]
+impl<T: Topology + K8sclient> Interpret<T> for OpenshiftClusterAlertInterpret {
+    async fn execute(
+        &self,
+        _inventory: &Inventory,
+        topology: &T,
+    ) -> Result<Outcome, InterpretError> {
+        let client = topology.k8s_client().await?;
+
+        let secret: DynamicObject = client
+            .get_secret_json_value("alertmanager-main", Some("openshift-monitoring"))
+            .await?;
+        trace!("Got secret {secret:?}");
+
+        let data: serde_json::Value = secret.data;
+
+        // TODO : get config in base64 by drilling into the value
+        let config_b64 = match data.get("alertmanager.yaml") {
+            Some(value) => value.as_str().unwrap_or(""),
+            None => "",
+        };
+
+        // TODO : base64 decode it
+        let config_bytes = BASE64_STANDARD.decode(config_b64).unwrap_or_default();
+
+        // TODO : use serde_yaml to deserialize the string
+        let am_config: serde_yaml::Value =
+            serde_yaml::from_str(&String::from_utf8(config_bytes).unwrap_or_default())
+                .unwrap_or_default();
+
+        // Merge current alert receivers from this config with self.receivers
+        if let Some(existing_receivers) = am_config.get("receivers") {
+            for receiver in existing_receivers.as_sequence().unwrap_or(&vec![]) {
+                match serde_json::to_string(receiver) {
+                    Ok(yaml_str) => {
+                        // TODO: validate that each receiver implements to_alertmanager_yaml()
+                        // and compare with our receivers
+                        info!("Found existing receiver config: {}", yaml_str);
+                    }
+                    Err(e) => debug!("Failed to serialize receiver: {}", e),
+                }
+            }
+        }
+
+        for custom_receiver in &self.receivers {
+            trace!("Processing custom receiver");
+            debug!(
+                "Custom receiver YAML output: {:?}",
+                custom_receiver.as_alertmanager_receiver()
+            );
+        }
+
+        Ok(Outcome::success(todo!("whats up")))
+    }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("OpenshiftClusterAlertInterpret")
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}

harmony/src/modules/monitoring/okd/config.rs

@@ -0,0 +1,90 @@
+use std::{collections::BTreeMap, sync::Arc};
+
+use crate::{
+    interpret::{InterpretError, Outcome},
+    topology::k8s::K8sClient,
+};
+use k8s_openapi::api::core::v1::ConfigMap;
+use kube::api::ObjectMeta;
+
+pub(crate) struct Config;
+
+impl Config {
+    pub async fn create_cluster_monitoring_config_cm(
+        client: &Arc<K8sClient>,
+    ) -> Result<Outcome, InterpretError> {
+        let mut data = BTreeMap::new();
+        data.insert(
+            "config.yaml".to_string(),
+            r#"
+enableUserWorkload: true
+alertmanagerMain:
+  enableUserAlertmanagerConfig: true
+"#
+            .to_string(),
+        );
+
+        let cm = ConfigMap {
+            metadata: ObjectMeta {
+                name: Some("cluster-monitoring-config".to_string()),
+                namespace: Some("openshift-monitoring".to_string()),
+                ..Default::default()
+            },
+            data: Some(data),
+            ..Default::default()
+        };
+        client.apply(&cm, Some("openshift-monitoring")).await?;
+
+        Ok(Outcome::success(
+            "updated cluster-monitoring-config-map".to_string(),
+        ))
+    }
+
+    pub async fn create_user_workload_monitoring_config_cm(
+        client: &Arc<K8sClient>,
+    ) -> Result<Outcome, InterpretError> {
+        let mut data = BTreeMap::new();
+        data.insert(
+            "config.yaml".to_string(),
+            r#"
+alertmanager: 
+  enabled: true
+  enableAlertmanagerConfig: true
+"#
+            .to_string(),
+        );
+        let cm = ConfigMap {
+            metadata: ObjectMeta {
+                name: Some("user-workload-monitoring-config".to_string()),
+                namespace: Some("openshift-user-workload-monitoring".to_string()),
+                ..Default::default()
+            },
+            data: Some(data),
+            ..Default::default()
+        };
+        client
+            .apply(&cm, Some("openshift-user-workload-monitoring"))
+            .await?;
+
+        Ok(Outcome::success(
+            "updated openshift-user-monitoring-config-map".to_string(),
+        ))
+    }
+
+    pub async fn verify_user_workload(client: &Arc<K8sClient>) -> Result<Outcome, InterpretError> {
+        let namespace = "openshift-user-workload-monitoring";
+        let alertmanager_name = "alertmanager-user-workload-0";
+        let prometheus_name = "prometheus-user-workload-0";
+        client
+            .wait_for_pod_ready(alertmanager_name, Some(namespace))
+            .await?;
+        client
+            .wait_for_pod_ready(prometheus_name, Some(namespace))
+            .await?;
+
+        Ok(Outcome::success(format!(
+            "pods: {}, {} ready in ns: {}",
+            alertmanager_name, prometheus_name, namespace
+        )))
+    }
+}

harmony/src/modules/monitoring/okd/enable_user_workload.rs

@@ -1,16 +1,13 @@
-use std::{collections::BTreeMap, sync::Arc};
-
 use crate::{
     data::Version,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
+    modules::monitoring::okd::config::Config,
     score::Score,
-    topology::{K8sclient, Topology, k8s::K8sClient},
+    topology::{K8sclient, Topology},
 };
 use async_trait::async_trait;
 use harmony_types::id::Id;
-use k8s_openapi::api::core::v1::ConfigMap;
-use kube::api::ObjectMeta;
 use serde::Serialize;
 
 #[derive(Clone, Debug, Serialize)]
@@ -37,10 +34,9 @@ impl<T: Topology + K8sclient> Interpret<T> for OpenshiftUserWorkloadMonitoringIn
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
         let client = topology.k8s_client().await.unwrap();
-        self.update_cluster_monitoring_config_cm(&client).await?;
-        self.update_user_workload_monitoring_config_cm(&client)
-            .await?;
-        self.verify_user_workload(&client).await?;
+        Config::create_cluster_monitoring_config_cm(&client).await?;
+        Config::create_user_workload_monitoring_config_cm(&client).await?;
+        Config::verify_user_workload(&client).await?;
         Ok(Outcome::success(
             "successfully enabled user-workload-monitoring".to_string(),
         ))
@@ -62,88 +58,3 @@ impl<T: Topology + K8sclient> Interpret<T> for OpenshiftUserWorkloadMonitoringIn
         todo!()
     }
 }
-
-impl OpenshiftUserWorkloadMonitoringInterpret {
-    pub async fn update_cluster_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-enableUserWorkload: true
-alertmanagerMain:
-  enableUserAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("cluster-monitoring-config".to_string()),
-                namespace: Some("openshift-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client.apply(&cm, Some("openshift-monitoring")).await?;
-
-        Ok(Outcome::success(
-            "updated cluster-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn update_user_workload_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-alertmanager: 
-  enabled: true
-  enableAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("user-workload-monitoring-config".to_string()),
-                namespace: Some("openshift-user-workload-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client
-            .apply(&cm, Some("openshift-user-workload-monitoring"))
-            .await?;
-
-        Ok(Outcome::success(
-            "updated openshift-user-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn verify_user_workload(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let namespace = "openshift-user-workload-monitoring";
-        let alertmanager_name = "alertmanager-user-workload-0";
-        let prometheus_name = "prometheus-user-workload-0";
-        client
-            .wait_for_pod_ready(alertmanager_name, Some(namespace))
-            .await?;
-        client
-            .wait_for_pod_ready(prometheus_name, Some(namespace))
-            .await?;
-
-        Ok(Outcome::success(format!(
-            "pods: {}, {} ready in ns: {}",
-            alertmanager_name, prometheus_name, namespace
-        )))
-    }
-}

harmony/src/modules/monitoring/okd/mod.rs

@@ -1 +1,14 @@
+use crate::topology::oberservability::monitoring::AlertSender;
+
+pub mod cluster_monitoring;
+pub(crate) mod config;
 pub mod enable_user_workload;
+
+#[derive(Debug)]
+pub struct OpenshiftClusterAlertSender;
+
+impl AlertSender for OpenshiftClusterAlertSender {
+    fn name(&self) -> String {
+        "OpenshiftClusterAlertSender".to_string()
+    }
+}

harmony/src/modules/monitoring/prometheus/prometheus.rs

@@ -114,7 +114,7 @@ impl Prometheus {
         };
 
         if let Some(ns) = namespace.as_deref() {
-            grafana_helm_chart_score(ns)
+            grafana_helm_chart_score(ns, false)
                 .interpret(inventory, topology)
                 .await
         } else {

harmony/src/modules/monitoring/scrape_target/server.rs

@@ -73,4 +73,8 @@ impl ScrapeTarget<CRDPrometheus> for Server {
             self.name.clone()
         )))
     }
+
+    fn clone_box(&self) -> Box<dyn ScrapeTarget<CRDPrometheus>> {
+        Box::new(self.clone())
+    }
 }

harmony/src/modules/prometheus/k8s_prometheus_alerting_score.rs

@@ -12,7 +12,8 @@ use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::C
 use crate::modules::monitoring::kube_prometheus::crd::crd_default_rules::build_default_application_rules;
 use crate::modules::monitoring::kube_prometheus::crd::crd_grafana::{
     Grafana, GrafanaDashboard, GrafanaDashboardSpec, GrafanaDatasource, GrafanaDatasourceConfig,
-    GrafanaDatasourceSpec, GrafanaSpec,
+    GrafanaDatasourceJsonData, GrafanaDatasourceSpec, GrafanaSecretKeyRef, GrafanaSpec,
+    GrafanaValueFrom, GrafanaValueSource,
 };
 use crate::modules::monitoring::kube_prometheus::crd::crd_prometheus_rules::{
     PrometheusRule, PrometheusRuleSpec, RuleGroup,
@@ -39,7 +40,7 @@ use crate::{
 };
 use harmony_types::id::Id;
 
-use super::prometheus::PrometheusApplicationMonitoring;
+use super::prometheus::PrometheusMonitoring;
 
 #[derive(Clone, Debug, Serialize)]
 pub struct K8sPrometheusCRDAlertingScore {
@@ -49,7 +50,7 @@ pub struct K8sPrometheusCRDAlertingScore {
     pub prometheus_rules: Vec<RuleGroup>,
 }
 
-impl<T: Topology + K8sclient + PrometheusApplicationMonitoring<CRDPrometheus>> Score<T>
+impl<T: Topology + K8sclient + PrometheusMonitoring<CRDPrometheus>> Score<T>
     for K8sPrometheusCRDAlertingScore
 {
     fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
@@ -75,7 +76,7 @@ pub struct K8sPrometheusCRDAlertingInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + K8sclient + PrometheusApplicationMonitoring<CRDPrometheus>> Interpret<T>
+impl<T: Topology + K8sclient + PrometheusMonitoring<CRDPrometheus>> Interpret<T>
     for K8sPrometheusCRDAlertingInterpret
 {
     async fn execute(
@@ -466,10 +467,13 @@ impl K8sPrometheusCRDAlertingInterpret {
             match_labels: label.clone(),
             match_expressions: vec![],
         };
-        let mut json_data = BTreeMap::new();
-        json_data.insert("timeInterval".to_string(), "5s".to_string());
         let namespace = self.sender.namespace.clone();
-
+        let json_data = GrafanaDatasourceJsonData {
+            time_interval: Some("5s".to_string()),
+            http_header_name1: None,
+            tls_skip_verify: Some(true),
+            oauth_pass_thru: Some(true),
+        };
         let json = build_default_dashboard(&namespace);
 
         let graf_data_source = GrafanaDatasource {
@@ -495,7 +499,11 @@ impl K8sPrometheusCRDAlertingInterpret {
                         "http://prometheus-operated.{}.svc.cluster.local:9090",
                         self.sender.namespace.clone()
                     ),
+                    secure_json_data: None,
+                    is_default: None,
+                    editable: None,
                 },
+                values_from: None,
             },
         };
 
@@ -516,7 +524,9 @@ impl K8sPrometheusCRDAlertingInterpret {
             spec: GrafanaDashboardSpec {
                 resync_period: Some("30s".to_string()),
                 instance_selector: labels.clone(),
-                json,
+                json: Some(json),
+                grafana_com: None,
+                datasources: None,
             },
         };
 

harmony/src/modules/prometheus/prometheus.rs

@@ -9,11 +9,17 @@ use crate::{
 };
 
 #[async_trait]
-pub trait PrometheusApplicationMonitoring<S: AlertSender> {
+pub trait PrometheusMonitoring<S: AlertSender> {
     async fn install_prometheus(
         &self,
         sender: &S,
         inventory: &Inventory,
         receivers: Option<Vec<Box<dyn AlertReceiver<S>>>>,
     ) -> Result<PreparationOutcome, PreparationError>;
+
+    async fn ensure_prometheus_operator(
+        &self,
+        sender: &S,
+        inventory: &Inventory,
+    ) -> Result<PreparationOutcome, PreparationError>;
 }

harmony/src/modules/prometheus/rhob_alerting_score.rs

@@ -38,7 +38,7 @@ use crate::{
 };
 use harmony_types::id::Id;
 
-use super::prometheus::PrometheusApplicationMonitoring;
+use super::prometheus::PrometheusMonitoring;
 
 #[derive(Clone, Debug, Serialize)]
 pub struct RHOBAlertingScore {
@@ -48,8 +48,8 @@ pub struct RHOBAlertingScore {
     pub prometheus_rules: Vec<RuleGroup>,
 }
 
-impl<T: Topology + K8sclient + Ingress + PrometheusApplicationMonitoring<RHOBObservability>>
-    Score<T> for RHOBAlertingScore
+impl<T: Topology + K8sclient + Ingress + PrometheusMonitoring<RHOBObservability>> Score<T>
+    for RHOBAlertingScore
 {
     fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
         Box::new(RHOBAlertingInterpret {
@@ -74,8 +74,8 @@ pub struct RHOBAlertingInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + K8sclient + Ingress + PrometheusApplicationMonitoring<RHOBObservability>>
-    Interpret<T> for RHOBAlertingInterpret
+impl<T: Topology + K8sclient + Ingress + PrometheusMonitoring<RHOBObservability>> Interpret<T>
+    for RHOBAlertingInterpret
 {
     async fn execute(
         &self,