SDCICD-1958: add deploy/gitops-base for GitOps fleet deployment layer by maknop · Pull Request #251 · openshift-online/hypershell

maknop · 2026-09-04T18:47:37Z

Move the GitOps deployment layer (servicemonitor, external-secrets, NetworkPolicies, name-references, sync-wave patches, jwt-enforce component, HA main profile) from the private hypershell-gitops repo into this repo so the app owns its deployment definition and central GitOps only carries per-instance overlays that reference it.

Layout (additive; no existing paths modified):
deploy/gitops-base/wrapper -> ../../hub + gitops resources
deploy/gitops-base/components/jwt-enforce
deploy/gitops-base/profiles/main -> ../../wrapper + jwt-enforce (3x HA, CNPG)

Move the GitOps deployment layer (servicemonitor, external-secrets, NetworkPolicies, name-references, sync-wave patches, jwt-enforce component, HA main profile) from the private hypershell-gitops repo into this repo so the app owns its deployment definition and central GitOps only carries per-instance overlays that reference it. Layout (additive; no existing paths modified): deploy/gitops-base/wrapper -> ../../hub + gitops resources deploy/gitops-base/components/jwt-enforce deploy/gitops-base/profiles/main -> ../../wrapper + jwt-enforce (3x HA, CNPG)

coderabbitai · 2026-09-04T18:47:48Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Team

Run ID: f1512d41-0a54-403d-817b-0a754df860ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

jsell-rh · 2026-09-04T18:51:35Z

Amber review

Status: Complete

View the submitted review.

jsell-rh

Verdict

This PR additively imports a self-contained GitOps deployment layer (deploy/gitops-base) for the HyperShell control-plane apps, which is a reasonable ownership move. However, several manifests will not do what the profile intends once rendered against the current deploy/base (label selectors that match nothing) and the base carries a cluster of patch fragments that are never referenced and are stale relative to the current DB wiring, so I'm requesting changes for correctness and clarity.

Major

1. HA podAntiAffinity selectors match no pods (HA spreading is a silent no-op).
deploy/gitops-base/profiles/main/kustomization.yaml sets podAntiAffinity label selectors on app.kubernetes.io/name: hypershell-api-server and app.kubernetes.io/name: hypershell-web-console. The pods rendered from deploy/base are labeled app: hypershell-api-server / app: hypershell-web-console (there is no app.kubernetes.io/name pod label, and deploy/base/kustomization.yaml has no labels/commonLabels transformer). The selector therefore matches zero pods, and the preferred zone anti-affinity never spreads the 3 HA replicas. Use app: hypershell-api-server / app: hypershell-web-console to match the base pod labels (Confidence: High).

2. ServiceMonitor selector matches no Service (metrics not scraped).
deploy/gitops-base/wrapper/servicemonitor.yaml selects Services by app.kubernetes.io/name: hypershell, but the base Services (deploy/base/api-server.yaml, etc.) carry no such metadata label. As rendered by this base, the ServiceMonitor selects nothing and no endpoints are scraped. Either add the label to the base Services (via a labels transformer) or change the selector to match the existing labels (Confidence: Medium - a downstream overlay could inject the label, but nothing in-tree does).

3. Orphaned/stale patch fragments not wired into any kustomization.
db-env-patch.yaml, db-secret-patch.yaml, db-volume-patch.yaml, kustomization-patch.yaml, route-host-patch.yaml, rbac-patch.yaml, and rbac-prefix-patch.yaml are not referenced by wrapper/kustomization.yaml or profiles/main/kustomization.yaml. Beyond being dead weight, db-secret-patch.yaml/db-env-patch.yaml describe an env-var-based DB config (POSTGRES_DB/POSTGRES_USER/POSTGRES_PASSWORD via secretKeyRef) that no longer exists in deploy/base - the base now uses file-mounted secrets (--db-*-file=/secrets/...) and already mounts hypershell-db-app, so db-volume-patch.yaml is redundant and the env patches would fail (replace on nonexistent paths) if ever wired in. Please either wire these in intentionally or remove them; as-is they mislead future maintainers about how DB wiring works (Confidence: High).

Minor

4. Divergent duplicate CNPG Cluster definition.
deploy/gitops-base/profiles/main/cnpg.yaml redeclares a hypershell-db CNPG Cluster (3 instances, 50Gi, pinned postgresql:16.4, tuned parameters, no resource requests/limits) that diverges from deploy/base/hypershell-db-cluster.yaml (1 instance, 1Gi, resource requests/limits, no pinned image). These are two sources of truth for the same cluster name; consider consolidating or documenting the relationship, and add resource requests/limits to the HA profile's cluster for schedulability guarantees (Confidence: Medium).

5. Environment-specific config baked into the base.
deploy/gitops-base/wrapper/external-secrets.yaml hardcodes ClusterSecretStore name vault-cluster-store. If store naming can vary per environment, prefer exposing it for overlay override to keep configuration separate from the shared base (Confidence: Low).

Cross-PR coordination

No material cross-PR coordination issue requires maintainer action.

Findings Summary (ordered by severity, highest first):

[Major] HA podAntiAffinity selectors use app.kubernetes.io/name but base pods use app, so anti-affinity matches nothing - Deployment Correctness (profiles/main/kustomization.yaml L38-41, L62-65)
[Major] ServiceMonitor selector app.kubernetes.io/name: hypershell matches no base Service; metrics not scraped - Observability (wrapper/servicemonitor.yaml L10)
[Major] Orphaned/stale patch fragments not referenced by any kustomization; env DB patches are incompatible with the current file-mounted DB wiring - Maintainability / Correctness (wrapper/db-secret-patch.yaml, db-env-patch.yaml, db-volume-patch.yaml, kustomization-patch.yaml, route-host-patch.yaml, rbac-patch.yaml, rbac-prefix-patch.yaml)
[Minor] Divergent duplicate CNPG hypershell-db Cluster vs deploy/base; profile cluster lacks resource requests/limits - Consistency (profiles/main/cnpg.yaml)
[Minor] Hardcoded ClusterSecretStore name in shared base - Config Separation (wrapper/external-secrets.yaml L8)

Convention Checklist (omit conventions not applicable to the diff):

Convention	Result
SecurityContext on pod specs (CNPG managed by operator)	Pass
Image references consistent across manifests	Fail
Reconcile/config-separate-from-code	Fail
No em dashes	Pass
Conventional/descriptive commit message	Pass

jsell-rh · 2026-09-04T18:56:19Z

+                      - key: app.kubernetes.io/name
+                        operator: In
+                        values:
+                        - hypershell-api-server


The podAntiAffinity label selector keys on app.kubernetes.io/name: hypershell-api-server, but pods rendered from deploy/base are labeled app: hypershell-api-server (no app.kubernetes.io/name pod label, and no labels transformer in deploy/base/kustomization.yaml). This selector matches zero pods, so the HA anti-affinity spreading is a silent no-op. Change the selector to app: hypershell-api-server.

jsell-rh · 2026-09-04T18:56:19Z

+                      - key: app.kubernetes.io/name
+                        operator: In
+                        values:
+                        - hypershell-web-console


Same label mismatch as the api-server block: pods are labeled app: hypershell-web-console, not app.kubernetes.io/name. Zone anti-affinity will not spread the web-console replicas. Use app: hypershell-web-console.

jsell-rh · 2026-09-04T18:56:19Z

+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hypershell


This selects Services by app.kubernetes.io/name: hypershell, but the base Services (e.g. deploy/base/api-server.yaml) carry no such metadata label. As rendered by this base the ServiceMonitor matches no Service and scrapes nothing. Add the label to the base Services via a labels transformer, or change the selector to match the existing labels.

jsell-rh · 2026-09-04T18:56:19Z

@@ -0,0 +1,69 @@
+apiVersion: apps/v1


This patch (and db-env-patch.yaml) inject POSTGRES_DB/POSTGRES_USER/POSTGRES_PASSWORD env vars via secretKeyRef, but the current deploy/base deployments use file-mounted DB config (--db-*-file=/secrets/...) and already mount hypershell-db-app. Additionally, this file is not referenced by any kustomization. It is stale and dead - remove it or intentionally wire it in against the current base structure.

jsell-rh · 2026-09-04T18:56:19Z

@@ -0,0 +1,9 @@
+patches:


This fragment references db-volume-patch.yaml, but nothing references kustomization-patch.yaml itself (it is not included by wrapper/kustomization.yaml). The base already mounts hypershell-db-app for the db-secrets volume, so db-volume-patch.yaml is also redundant. Please remove these orphaned fragments or wire them in explicitly.

jsell-rh · 2026-09-04T18:56:19Z

+kind: Cluster
+metadata:
+  name: hypershell-db
+spec:


This redeclares the hypershell-db CNPG Cluster with 3 instances/50Gi/pinned postgresql:16.4, diverging from deploy/base/hypershell-db-cluster.yaml (1 instance/1Gi, with resource requests/limits). Two definitions of the same cluster name will drift. Consider consolidating, and add resource requests/limits here so the HA cluster has schedulability guarantees.

jsell-rh reviewed Sep 4, 2026

View reviewed changes

Navigation Menu

Uh oh!

SDCICD-1958: add deploy/gitops-base for GitOps fleet deployment layer - #251

SDCICD-1958: add deploy/gitops-base for GitOps fleet deployment layer#251
maknop wants to merge 1 commit into
openshift-online:mainfrom
ritmun:SDCICD-1958-gitops-base

maknop commented Sep 4, 2026

Uh oh!

coderabbitai Bot commented Sep 4, 2026

Review skipped

Uh oh!

jsell-rh commented Sep 4, 2026 •

edited

Loading

Uh oh!

jsell-rh left a comment

Uh oh!

jsell-rh Sep 4, 2026

Uh oh!

jsell-rh Sep 4, 2026

Uh oh!

jsell-rh Sep 4, 2026

Uh oh!

jsell-rh Sep 4, 2026

Uh oh!

jsell-rh Sep 4, 2026

Uh oh!

jsell-rh Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

maknop commented Sep 4, 2026

Uh oh!

coderabbitai Bot commented Sep 4, 2026

Review skipped

Uh oh!

jsell-rh commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Amber review

Uh oh!

jsell-rh left a comment

Choose a reason for hiding this comment

Verdict

Major

Minor

Cross-PR coordination

Uh oh!

jsell-rh Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

jsell-rh Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

jsell-rh Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

jsell-rh Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

jsell-rh Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

jsell-rh Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jsell-rh commented Sep 4, 2026 •

edited

Loading