idp-templates/template-web-backend-python
Template
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity
28 Commits 1 Branch 0 Tags
235882cc2f8d87e6e9ccee72d70f7d737c7f3f41
Commit Graph
7 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Irving LópezandClaude Opus 4.8 fcd0e28ac3 fix(ci): build-gate skip-graceful si HARBOR_ROBOT_* ausente (GOLDEN-PATH-BUILD-DEPLOY-ORDER-RACE) 
Sync desde coralware/IDP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 13:42:39 -05:00
Irving LópezandClaude Opus 4.8 be0c14b0ee fix(ci): helm-deploy tolerante a cluster no-listo (GOLDEN-PATH-BUILD-DEPLOY-ORDER-RACE) 
Job cluster-gate -> helm-deploy con if needs.cluster-gate.outputs.ready=='true'.
Sincronizado desde coralware/IDP commit a27e153.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 12:59:42 -05:00
ilopezandClaude Opus 4.7 bba5720975 fix(chart): NetworkPolicy egress 0.0.0.0/0 :443+:6443 (RKE2/DO public IP DNAT)
__APP_NAME__ — build & deploy / Calidad + build + push (push) Failing after 15s
Details
__APP_NAME__ — build & deploy / Helm upgrade --install (push) Has been skipped
Details 
Validacion en cluster tenant DO destapo el issue: el Service `kubernetes` en
ns default tiene endpoint a la IP PUBLICA del Droplet:6443, no a una ClusterIP
intra-cluster. kube-proxy DNATea 10.43.0.1:443 -> public-ip:6443. Calico
aplica las NetworkPolicy egress rules contra la IP de DESTINO POST-DNAT, asi
que namespaceSelector "default" no matchea (no hay pod selector aplicable).

ipBlock 0.0.0.0/0 cubre ambos: apiserver public-ip:6443 + Harbor:443.

Trade-off de seguridad menor (egress permitido a IPs externas por 443/6443)
aceptable para Golden Path: las apps web necesitan llegar a apiserver y
posiblemente a HTTPS externos (APIs publicas). Endurecimiento P3 con
egress NetworkPolicy mas granular cuando haya use cases especificos.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-25 10:28:50 -05:00
ilopezandClaude Opus 4.7 81b024edd6 fix(chart): NetworkPolicy como Helm hook weight -8 (no resource normal)
__APP_NAME__ — build & deploy / Calidad + build + push (push) Failing after 14s
Details
__APP_NAME__ — build & deploy / Helm upgrade --install (push) Has been skipped
Details 
Chicken-and-egg encontrado en smoke E2E DO (cluster 91c93c9c):
- ns 'apps' tiene default-deny NetworkPolicy entregada por stack-deployer.
- Job Alembic (pre-install hook) ejecuta InitContainer wait-for-secret que
  hace REST API call al kube-apiserver para chequear Secret.
- La NetworkPolicy del chart (que permite DNS + apiserver egress) estaba como
  RESOURCE NORMAL, asi que solo se aplicaba en la FASE PRINCIPAL del helm
  install, DESPUES de los hooks.
- Resultado: el InitContainer del hook quedaba bloqueado DNS por
  default-deny → curl timeout 240s → helm install fail → NetworkPolicy
  nunca se aplica.

Fix:
- Annotations 'helm.sh/hook: pre-install,pre-upgrade' + 'hook-weight: -8'
  + 'hook-delete-policy: before-hook-creation'.
- Weight ordering: -10 AddonClaim → -8 NetworkPolicy → -7 Role/RoleBinding
  → -5 SA → 0 Job Alembic.
- delete-policy: before-hook-creation (no hook-succeeded): el Deployment de
  la fase principal necesita la NP viva en runtime.
- Comentario en la regla egress :443 aclarando que cubre kube-apiserver
  (10.43.0.1) + Harbor (sin necesidad de regla adicional).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-25 10:13:03 -05:00
ilopezandClaude Opus 4.7 1bf3283b6a fix(chart): InitContainer wait-for-secret sin set -e (set -u solo)
__APP_NAME__ — build & deploy / Calidad + build + push (push) Failing after 3m54s
Details
__APP_NAME__ — build & deploy / Helm upgrade --install (push) Has been skipped
Details 
set -e mataba el script con curl exit 6 (DNS transitorio en el primer
intento) antes de que el retry pudiera correr. Cambio:
- set -u: undefined vars siguen matando (correcto).
- set -e quitado: curl fail no mata el script.
- HTTP=$(curl ... || echo "000"): si curl exits non-zero, capturamos
  un codigo HTTP "000" para que el retry siga corriendo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-25 09:51:21 -05:00
ilopezandClaude Opus 4.7 eae346684f fix(chart): InitContainer curl+REST API en lugar de bitnami/kubectl:1.30
__APP_NAME__ — build & deploy / Calidad + build + push (push) Failing after 13s
Details
__APP_NAME__ — build & deploy / Helm upgrade --install (push) Has been skipped
Details 
bitnami retiro los tags semanticos minor (1.30/1.29/etc.) de Docker Hub
2026-05; solo quedan latest + digests. El InitContainer fallaba con
ImagePullBackOff en el smoke E2E DO (run 1511/1512 del tenant
91c93c9c060a48febb7874c87c1ce993).

Cambio:
- image: bitnami/kubectl:1.30 -> curlimages/curl:8.20.0 (Docker Official,
  tag estable).
- comando: kubectl get secret -> curl REST API kubernetes.default.svc con
  SA token + CA cert montados en /var/run/secrets/kubernetes.io/serviceaccount.
- Misma logica: 48 iteraciones x 5s = 240s busy-wait.
- El Role/RoleBinding (role-db-secret-reader.yaml) ya da el permiso get
  secrets al SA — sin cambios RBAC necesarios.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-25 09:46:35 -05:00
ilopezandClaude Opus 4.7 5a215ed293 feat: AddonClaim + InitContainer wait-for-secret en chart helm
__APP_NAME__ — build & deploy / Calidad + build + push (push) Failing after 1m19s
Details
__APP_NAME__ — build & deploy / Helm upgrade --install (push) Has been skipped
Details 
Cierra GOLDEN-PATH-ADDONCLAIM-MISSING (P0 hands-off pipeline).

Cambios:
- helm/APP_NAME/templates/addonclaim.yaml (NEW): hook pre-install/pre-upgrade
  weight -10, SIN delete-policy (sobrevive upgrades, evita disparar finalizer
  cleanup-logical). Gated por .Values.database.enabled (default true).
- helm/APP_NAME/templates/role-db-secret-reader.yaml (NEW): Role + RoleBinding
  weight -7 que permite al SA leer el Secret <release>-db-creds. Lo consume
  el InitContainer wait-for-secret del Job Alembic.
- helm/APP_NAME/templates/job-alembic-upgrade.yaml: gated por
  database.enabled, anade InitContainer wait-for-secret (48x5s=240s) que
  espera a que addon-provisioner publique el Secret tras reconciliar el
  AddonClaim. Absorbe la latencia del @kopf.timer (RECONCILE_INTERVAL 300s
  + initial_delay 60s) sin tocar el operator.
- helm/APP_NAME/values.yaml: bloque database completo (enabled, addonType,
  databaseName, user.permissions, deletionPolicy Retain). Opt-out con
  database.enabled=false + alembic.enabled=false.
- .gitea/workflows/APP_NAME-build.yaml: helm timeout 5m -> 7m (margen para
  reconcile addon-provisioner + StatefulSet ready + DDL Job + Alembic).
- claim-mariadb.yaml (DELETED): obsoleto - estaba en la raiz del template
  y nunca se renderizaba por helm. Reemplazado por addonclaim.yaml dentro
  del chart helm.
- README.md: documenta nueva tabla de hook weights, opt-out database, y
  trade-off del orphan AddonClaim post-uninstall (cleanup explicito).

Decision arquitectural: Opcion D modificada (Opus 4.6 consult).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-25 07:56:42 -05:00