idp-templates/template-web-backend-python
Template
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity
16 Commits 1 Branch 0 Tags
81b024edd6956919f397143a2b934e2b145f3666
Commit Graph

3 Commits

Author SHA1 Message Date
ilopez
81b024edd6 fix(chart): NetworkPolicy como Helm hook weight -8 (no resource normal)
Some checks failed
__APP_NAME__ — build & deploy / Calidad + build + push (push) Failing after 14s
Details
__APP_NAME__ — build & deploy / Helm upgrade --install (push) Has been skipped
Details 
Chicken-and-egg encontrado en smoke E2E DO (cluster 91c93c9c):
- ns 'apps' tiene default-deny NetworkPolicy entregada por stack-deployer.
- Job Alembic (pre-install hook) ejecuta InitContainer wait-for-secret que
  hace REST API call al kube-apiserver para chequear Secret.
- La NetworkPolicy del chart (que permite DNS + apiserver egress) estaba como
  RESOURCE NORMAL, asi que solo se aplicaba en la FASE PRINCIPAL del helm
  install, DESPUES de los hooks.
- Resultado: el InitContainer del hook quedaba bloqueado DNS por
  default-deny → curl timeout 240s → helm install fail → NetworkPolicy
  nunca se aplica.

Fix:
- Annotations 'helm.sh/hook: pre-install,pre-upgrade' + 'hook-weight: -8'
  + 'hook-delete-policy: before-hook-creation'.
- Weight ordering: -10 AddonClaim → -8 NetworkPolicy → -7 Role/RoleBinding
  → -5 SA → 0 Job Alembic.
- delete-policy: before-hook-creation (no hook-succeeded): el Deployment de
  la fase principal necesita la NP viva en runtime.
- Comentario en la regla egress :443 aclarando que cubre kube-apiserver
  (10.43.0.1) + Harbor (sin necesidad de regla adicional).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-25 10:13:03 -05:00
Coralware IDP CI
5d51971270 chore: migrar Ingress Traefik→NGINX + cascada wildcard cert (sync APERTURA COVE S3)
Some checks failed
__APP_NAME__ — build & deploy / build (push) Failing after 0s
Details
__APP_NAME__ — build & deploy / helm-deploy (push) Has been skipped
Details
2026-05-21 10:04:51 -05:00
Irving López
fcec92ea1d feat: sincronizar scaffold completo del shape web-backend/python
Some checks failed
__APP_NAME__ — build & deploy / build (push) Failing after 0s
Details
__APP_NAME__ — build & deploy / helm-deploy (push) Has been skipped
Details 
Sincroniza el scaffold canónico desde templates/web-backend-python/ del
repo IDP. Reemplaza el placeholder mínimo previo (.gitea/workflows/ci.yaml,
README.md, .gitignore, catalog-info.yaml) por el scaffold completo
documentado en ADR-053 §3:

- code/ — FastAPI app con /health (db check), /metrics, /demo estático,
  middleware correlation_id, settings Pydantic, db.py con SQLAlchemy
- code/alembic/ — migración inicial vacía + env.py usando MIGRATION_DATABASE_URL
- code/tests/ — pytest + httpx TestClient (test_health, test_demo)
- helm/APP_NAME/ — chart con Deployment, Service, IngressRoute Traefik,
  NetworkPolicy, ServiceMonitor, Job alembic-upgrade como hook
  pre-upgrade,pre-install (backoffLimit: 0)
- coralware-shape.yaml — manifiesto v1alpha1 del contrato del shape
- claim-mariadb.yaml — AddonClaim declarativo (uso futuro ADR-052)
- catalog-info.yaml — entidad Backstage actualizada
- .gitea/workflows/APP_NAME-build.yaml — invoca reusable workflow ADR-038
  + job helm-deploy con KUBECONFIG_TENANT_B64

Placeholders __APP_NAME__, __TIER__, __TENANT_ID__, __TENANT_ID_NODASHES__
serán sustituidos server-side por repo-provisioner cuando materialice el
template para un tenant (pendiente — ADR-053 §11.5).

El openspec/ del golden path NO se sincroniza al repo Gitea (gobernanza
interna de Coralware).

Refs: ADR-052, ADR-053, poc-nexobms.md (PoC NexoBMS Demetrio).
 2026-05-06 17:48:13 -05:00