Jean-Gabriel Gill-Couture
89e5e104dc
fleet-deploy: - Rename harmony-fleet-release binary to harmony-fleet-publish - Route all deploy settings through ConfigClient (env → OpenBao → prompt) instead of bespoke flags; seed FleetDeploySecrets via OpenBao - Rename HARMONY_SECRET_NAMESPACE to HARMONY_CONFIG_NAMESPACE - Append -chart to the Helm chart artifact name so it no longer collides with the Docker image in Harbor (application/vnd.cncf.helm.config.v1+json) harmony_cli: - Switch from log to tracing for structured output - Defer topology prep so --list and declined runs are no-ops - Drop ANSI colour codes around log emojis - Init cli logger in fleet deploy binary openbao: - Scope unseal-keys cache file per instance - Example gains setup capability and updated README roadmap: - Add unified CLI design document (ROADMAP/13-unified-cli.md) - Update v0.3 fleet platform plan Squashed commit of the following: commit36d9d9aaecMerge:12c8d9cfe7148aa8Author: johnride <jg@nationtech.io> Date: Mon Jun 1 15:42:56 2026 +0000 Merge pull request 'fix: fleet operator chart name was conflicting with the container name. Append -chart to the chart name' (#317) from fix/fleet-operator-chart-name into chore/rename-release-to-publish Reviewed-on: #317 commite7148aa85fAuthor: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Mon Jun 1 11:35:15 2026 -0400 fix: fleet operator chart name was conflicting with the container name. Append -chart to the chart name commit12c8d9cfa0Author: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Mon Jun 1 11:12:23 2026 -0400 feat: Init cli logger in fleet deploy commitedb62668b6Author: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sun May 31 12:56:36 2026 -0400 doc: Roadmap entry for cli design and implementation commitf2ecccb4abAuthor: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sun May 31 12:32:19 2026 -0400 refactor(fleet-deploy): rename harmony-fleet-release to harmony-fleet-publish Deploy/publish wording is more intuitive than deploy/release. commit2e9052b217Author: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sun May 31 10:12:54 2026 -0400 fix(openbao): remove extra blank line in example Pre-existing formatting issue caught by cargo fmt --check. commitf7299ebe2bAuthor: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sun May 31 09:13:39 2026 -0400 refactor(fleet-deploy): rename HARMONY_SECRET_NAMESPACE to HARMONY_CONFIG_NAMESPACE The env var name was a misnomer — ConfigClient resolves both config and secrets, not just secrets. The struct field was already config_namespace. Legacy SecretManager keeps the old var; this forces migration to ConfigClient for new code. commitd39aa15152Author: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sun May 31 09:06:20 2026 -0400 feat: fleet deploy uses configuration from configclient for all settings, update the 0_3 plan commit57d056fcedAuthor: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sat May 30 11:07:03 2026 -0400 fix(openbao): scope unseal-keys cache file per instance The root token + unseal keys were written to a single fixed `~/.local/share/harmony/openbao/unseal-keys.json`, so deploying a second OpenBao instance (different namespace/release) overwrote the first's keys — after which the first could never be unsealed. Key the file by namespace+release (`unseal-keys-<ns>-<release>.json`); `cached_root_token` now takes the `OpenbaoInstance` to read the right one. commit44aa83199aAuthor: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sat May 30 11:05:30 2026 -0400 fix(harmony_cli): drop ANSI colour codes around log emojis `console::style(emoji).green()/.yellow()/.red()/.blue()` embedded raw ANSI escapes in the message string. `console` force-emits them off its own TTY detection, which disagrees with the tracing writer, so they leaked as literal `\x1b[..m` garbage around the emoji. Emit plain emojis — the glyph already conveys status and the tracing fmt layer still colours the level. commit4fef957edbAuthor: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sat May 30 08:40:54 2026 -0400 feat: Example openbao now can do openbao setup and better readme commitaf3205d353Author: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sat May 30 05:55:49 2026 -0400 refactor(harmony_cli): defer topology prep so --list/declined runs are no-ops `Maestro::initialize` (hence `topology.ensure_ready()`) ran before `init`'s `--list` / confirmation short-circuits, so merely listing a binary's scores — or declining to run them — still prepared the topology (cert-manager install, etc.). Build the maestro unprepared and call `prepare_topology()` only once we commit to interpreting. Expose `Maestro::prepare_topology`; add tests proving `--list` skips prep while the run path triggers it. commit199e285e52Author: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Sat May 30 05:04:34 2026 -0400 feat: Use tracing instead of logger in harmon_cli and work on fleet_staging_install refactor to use harmony_cli properly, still some more work to do commitfac83d853dAuthor: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Fri May 29 22:39:39 2026 -0400 refactor(fleet-staging): use tracing instead of println for output Swap env_logger for tracing_subscriber (its fmt bridges the framework's log:: deploy-progress output) and route the install banner + step logs through tracing::info! — no raw println. commit0400e9d454Author: Jean-Gabriel Gill-Couture <jg@nationtech.io> Date: Fri May 29 20:25:22 2026 -0400 feat(fleet-staging): add OpenBao + seed FleetDeploySecrets; route operator creds through the deploy crate fleet_staging_install now deploys OpenBao (co-located in fleet-staging, cert-manager TLS at secrets-stg.<base>), configures it (fleet-deployer read policy), and seeds the operator's FleetDeploySecrets so the operator can be upgraded alone via 'harmony-fleet-deploy --from-tag'. Behavior of the existing bring-up is unchanged. Credential-TOML construction moved out of the example into OperatorCredentials::zitadel_jwt (deploy crate) so all callers share it. New openbao::cached_root_token() lets the seed reuse the root token setup already cached. Seeding mirrors the harmony_sso port-forward pattern.
74 lines
2.9 KiB
Markdown
74 lines
2.9 KiB
Markdown
# Fleet operator — release & deploy
|
|
|
|
How the operator ships: build + publish a versioned image and helm
|
|
chart, then `harmony apply` (a plain `helm upgrade --install` of that
|
|
published chart). No Argo, no GitOps controller — Harmony owns the loop
|
|
(ADR-012-2). CD is **roll-forward only**: to back out a bad release,
|
|
deploy a previous good version.
|
|
|
|
## 1. Cut a release (automated on tag)
|
|
|
|
```sh
|
|
git tag harmony-fleet-operator-v0.0.2 && git push --tags
|
|
```
|
|
|
|
The `harmony-fleet-operator` workflow builds the image and the hydrated
|
|
helm chart and pushes both to `hub.nationtech.io` at `0.0.2`. No human
|
|
touches a Dockerfile, chart, or registry.
|
|
|
|
Laptop fallback (does exactly what the workflow's job does):
|
|
|
|
```sh
|
|
# docker + helm must be logged in to hub.nationtech.io first.
|
|
cargo run --release -p harmony-fleet-deploy --bin harmony-fleet-publish -- \
|
|
--from-tag harmony-fleet-operator-v0.0.2
|
|
|
|
# build + package only, no push (local k3d smoke-test):
|
|
cargo run -p harmony-fleet-deploy --bin harmony-fleet-publish -- \
|
|
--from-tag harmony-fleet-operator-v0.0.2 --no-push
|
|
```
|
|
|
|
## 2. Deploy a published version to staging (manual, for now)
|
|
|
|
Push to staging is manual until headless OpenBao auth (Zitadel machine
|
|
identity) lands; secrets still come from shared OpenBao config. Point at
|
|
your staging kube context and OpenBao, then run the operator deploy:
|
|
|
|
```sh
|
|
export OPENBAO_URL=<your OpenBao URL>
|
|
export OPENBAO_TOKEN=<scoped read token for secret/<ns>/*>
|
|
harmony-fleet-deploy --filter FleetOperatorScore \
|
|
--from-tag <release-tag> --namespace fleet-staging --yes
|
|
```
|
|
|
|
It installs the published
|
|
`oci://hub.nationtech.io/harmony/harmony-fleet-operator-chart:<version>` chart;
|
|
the version is parsed from the tag in Rust (the tag is the only source
|
|
of truth). Same command bootstraps and upgrades; re-running the same tag
|
|
is a no-op. Auth is Zitadel-SSO-only: the operator gets its zitadel-jwt
|
|
`operator_credentials_toml` from `FleetDeploySecrets` in OpenBao (no
|
|
user/pass on the published-chart path). For manual deploy, store that
|
|
config **without** a `kubeconfig` field so your own kube context is used.
|
|
|
|
## 3. Roll forward
|
|
|
|
Re-run with a newer (or previous-good) tag. `helm upgrade --install`
|
|
applies it and fails loudly if convergence fails — no automatic
|
|
rollback. Fix the spec, bump, re-run.
|
|
|
|
## Automated vs. manual
|
|
|
|
| Step | Where |
|
|
|---|---|
|
|
| Build + push image + chart on tag | CI (`release` job, on tag) |
|
|
| Push to staging + roll forward | Manual (operator runs the deploy) |
|
|
|
|
## Future: in-cluster CD (blocked on headless OpenBao auth)
|
|
|
|
Once `harmony_config` can authenticate to OpenBao headlessly (Zitadel
|
|
machine identity), these exports become a `deploy-staging` workflow on an
|
|
in-cluster, permissionless Gitea runner that pulls a `fleet-deployer`
|
|
`kubeconfig` + operator credentials from OpenBao at job time (provisioned
|
|
via a `TenantScore` with one extra egress CIDR to the OpenBao/Zitadel
|
|
ingress). Production-gated promotion is a later step (ADR-012-2).
|