WIP: Feat/openvox operator pilot - #148
Open
Aman1994 wants to merge 8 commits into
Open
Conversation
added 8 commits
July 31, 2026 13:09
Evaluation chart for replacing argocd-helm-charts/openvox with the OpenVox Operator. Bundles the operator (CRDs + controller), the openvox-stack CRs and a CNPG PostgreSQL, plus the KubeAid-local templates ported from the openvox chart: code PVC, gfetch, puppet-agent-exporter, Prometheus RBAC, Traefik IngressRouteTCP and the blackbox Probe. Does not replace the openvox chart. README documents the full values mapping, 13 gaps and the results of a cluster test on kcm.obmondo.com, including two blockers that need upstream fixes: no immutable image tags to pin to, and pods created with runAsUser 1001 but no fsGroup, which fails on every CSI storage class tested.
Always recursively chowns the full code tree on every pod start, which takes minutes on a populated 20Gi volume and stalls the rollout.
Full stack verified up on kcm.obmondo.com: CA Ready, Server running and answering /status/v1/simple, OpenVoxDB running after creating pg_trgm. Checked upstream develop (080b666): the missing fsGroup and the unquoted environmentTimeout are still unfixed there, and the recent code-volume fix (#469) does not give hiera-data a mount path.
CNPG runs these statements once against the application database right after initdb. Needed for applications requiring an extension before their first start; OpenVoxDB will not boot without pg_trgm. Skipped on recovery bootstrap, where the source cluster already has it.
Full teardown and reinstall converged unattended: CA ready in 2.5min, pg_trgm auto-created, gfetch cold clone lands the correct layout, server up with zero restarts. Only puppet-agent-exporter is still red, which is the known missing dropzone (gap 5). Adds gap 15: uninstall deadlocks because Certificate finalizers can only be cleared by the operator, which Helm and ArgoCD delete first.
Our autosign is not a pattern match: puppet_autosign.rb calls the Obmondo API and registers the node as a side effect of signing. The operator hardcodes its own autosign binary and drives it from SigningPolicy CRs, which support no executable. The extraConfig override might win on the puppet.conf key, but Server exposes no extraEnv or extraSecrets, so the client certificate the script needs cannot reach the pod. Also records the deferred functional test plan.
… work Tested on the pilot with the override pointed at /bin/true: puppetserver honours the first autosign key, the operator's binary, and rejected the CSR. Also records that puppet.conf is mounted with subPath, so config changes need a Server restart.
Written for sharing outside the immediate work: three blockers (node registration, storage ownership, version pinning), the gaps below them, what did work, and the recommendation to wait.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.