gitadmin/devops-infra-helm-charts-gcp

Fork 0

Files

T

Your Name b8575bb8b9 added repo

2026-08-26 03:39:42 +05:30

10 KiB

Raw Blame History

Per AI Blitz Plan §skills.infra. Layer: 1. Repo: devops-infra-helm-charts.

Skill — `add-infra-tool`

Layer: Layer 1 — agent generates diff(s) and opens PR(s) in this repo and (separately) in the sister repo. Reviewer + Argo CD UI Sync click are the human gates. Scope: the values-side slice in devops-infra-helm-charts plus the matching Argo Application slice in github.com/Meesho/devops-infra-argo-config.

This skill is the agent-callable form for adding a new infrastructure tool to a target cluster. It parameterises the onboard-app-to-cluster.md procedure and pairs the values-side PR with a sister-repo PR for the Argo CD Application.

For graduating an incubator tool fleet-wide, see ../../docs/platform/schemas/incubator-values-schema.md.

When to Use

Triggers like:

"Add <tool> to <cluster>."
"Bring up <tool> on k8s-shared-int-ase1 for trial."
"Onboard a new infra tool — chart already exists in helm-templates/."
"Land an incubator deploy of <tool> on the integration cluster."

Do not use this skill for:

Onboarding a service workload — services live in their own repos, not here.
Adding a route to an existing tool — see add-contour-route.md.
Bumping an existing tool's chart version — use bump-chart-version.md.
Adding a brand-new cluster — use the onboard-new-cluster.md procedure.
Editing observability / alert rules — diagnose-deployment.md routes to the right procedure.

Input

Required:

tool:                <name>                  # e.g. cert-manager, keda, kyverno
target_cluster:      <cluster-folder>        # e.g. k8s-shared-int-ase1
chart_source:        existing | new-vendored # is helm-templates/<tool>/ already present?
release_name:        <name>                  # often == tool
workload_namespace:  <ns>
image_tag:           <pinned-tag>            # NEVER 'latest'
resources:
  cpu_request:       <e.g. 250m>
  memory_request:    <e.g. 512Mi>
  cpu_limit:         <e.g. 1>
  memory_limit:      <e.g. 2Gi>
node_pool_key:       dedicated | cloud.google.com/compute-class
node_pool_value:     <pool-or-cc-name>

Optional:

incubator:               <bool>              # adds top-of-file comment, disables autoscaling defaults
needs_external_dns:      <bool>
needs_external_secret:   <bool>
needs_compute_class:     <bool>              # GKE Autopilot only
priority_class:          <name-in-manifests/priorityclass/<cluster>/>
persistence:
  enabled:               <bool>
  storage_class:         <name>
  size:                  <e.g. 100Gi>
sister_repo_app_name:    <name>              # default: <release_name>-<target_cluster>

Steps

1. Verify pre-conditions

# Chart exists (chart_source: existing)
ls helm-templates/<tool>/Chart.yaml

# Cluster exists
ls helm-overrides/<target_cluster>/

# Tool not already onboarded here
[ ! -d helm-overrides/<target_cluster>/<tool>/ ]

# StorageClass exists if persistence.enabled
ls manifests/storageclass/<storage_class>.yaml

# PriorityClass exists if priority_class set
ls manifests/priorityclass/<target_cluster>/<priority_class>.yaml

If chart_source: new-vendored, the chart must already be in helm-templates/<tool>/. If not, that is a separate (chart-vendoring) PR — fail fast and ask the user to land that first. Do not vendor the chart inside this skill.

2. Read the cluster's scheduling profile

Sample 3 sibling apps on the same cluster:

for f in $(ls helm-overrides/<target_cluster>/*/custom-values.yaml | grep -v contour | head -3); do
  echo "--- $f ---"
  yq e '.nodeSelector, .tolerations' "$f"
done

Confirm node_pool_key matches the cluster's actual style (dedicated: for standard GKE; cloud.google.com/compute-class: for Autopilot — k8s-central-prd-ase1, k8s-dsgpu-prd-ase1, k8s-shared-int-ase1). Mismatch → fail fast.

3. Generate `helm-overrides/<target_cluster>/<tool>/custom-values.yaml`

Skeleton:

# Incubator: cluster=<target_cluster>, owner=<owner>, graduation-target=<date>   # only if incubator=true

image:
  registry: asia-southeast1-docker.pkg.dev
  repository: meesho-devops-admin-0622/admin/sre/<tool>
  tag: <image_tag>
  pullPolicy: IfNotPresent

replicaCount: 1                              # incubator default; raise after load profile

resources:
  requests:
    cpu: <cpu_request>
    memory: <memory_request>
  limits:
    cpu: <cpu_limit>
    memory: <memory_limit>

nodeSelector:
  <node_pool_key>: <node_pool_value>
tolerations:
  - key: <node_pool_key>
    value: <node_pool_value>
    effect: NoSchedule

# if persistence.enabled:
persistence:
  enabled: true
  storageClass: <storage_class>
  size: <size>
  accessModes: [ReadWriteOnce]

# if priority_class set:
priorityClassName: <priority_class>

serviceAccount:
  create: true
  name: <release_name>
  annotations: {}                            # add iam.gke.io/gcp-service-account if WI binding needed

4. Sidecar manifests (conditional)

needs_compute_class: true → write helm-overrides/<target_cluster>/<tool>/computeclass/<node_pool_value>.yaml. metadata.name MUST equal <node_pool_value>. See raw-manifest-sidecar-schema.md §ComputeClass.
needs_external_dns: true → write helm-overrides/<target_cluster>/<tool>/external-dns-services/<svc>.yaml. Skip in incubator deploys. See raw-manifest-sidecar-schema.md §Service for external-dns binding.
needs_external_secret: true → write helm-overrides/<target_cluster>/external-secrets/<release_name>.yaml. Reference an existing SecretStore / ClusterSecretStore.

5. Validate

yamllint helm-overrides/<target_cluster>/<tool>/custom-values.yaml

helm template <release_name> helm-templates/<tool> \
  -f helm-overrides/<target_cluster>/<tool>/custom-values.yaml > /tmp/render.yaml

# Optional: dry-run sidecar manifests
kubectl --context=<ctx> --dry-run=server -f helm-overrides/<target_cluster>/<tool>/computeclass/ apply 2>/dev/null || true

helm template must succeed.

6. Open the values-side PR (this repo)

git checkout -b add-tool/<tool>-on-<target_cluster>
git add helm-overrides/<target_cluster>/<tool>/
git commit -m "Add <tool> to <target_cluster>"
git push origin add-tool/<tool>-on-<target_cluster>
gh pr create --base main --title "Add <tool> to <target_cluster>"

7. Open the sister-repo PR (Argo Application)

In github.com/Meesho/devops-infra-argo-config, draft an Application:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: <sister_repo_app_name>
  namespace: argocd
spec:
  destination:
    name: <target_cluster>
    namespace: <workload_namespace>
  source:
    repoURL: https://github.com/Meesho/devops-infra-helm-charts.git
    targetRevision: main
    path: helm-overrides/<target_cluster>/<tool>
    helm:
      valueFiles: [custom-values.yaml]
  syncPolicy:
    syncOptions: [CreateNamespace=true]
    # NO automated.{prune,selfHeal} — manual sync per ADR-A5

PR-link the values-side PR in the description; PR-link the sister-repo PR back in the values-side PR description.

8. Hand off — do NOT Sync from this skill

Argo CD UI Sync is a human gate. The skill stops at "two PRs open with green CI." The user clicks Sync after both merge.

Pattern Reference

Recent onboardings to compare against: git log --oneline --grep='Onboard\|Add' -i -- helm-overrides/ | head -10 and inspect the diffs.
For Contour onboardings (multi-instance, scheduling-heavy): always cross-reference contour-nodeselector-tolerations-summary.md.
For incubator-style first deploys: see ../../docs/platform/schemas/incubator-values-schema.md.

Gotchas (Layer constraints, common mistakes)

Per-cluster scheduling is non-portable. Never copy nodeSelector / tolerations / computeClass from another cluster — author from scratch using same-cluster siblings (SANCTITY_RULES R5).
Vanilla-chart edits are forks. If helm-templates/<tool>/ is vanilla upstream, do not edit templates/ or values.yaml to add knobs (NEVER-DO). Wrap with a Meesho chart or upstream-PR.
Never bypass TruffleHog. No --no-verify, no git commit -n, no removing the hook. Real secrets via ExternalSecret.
fullnameOverride is load-bearing. Set deliberately or omit; never change later.
image.tag: latest is forbidden. Always pin.
Sister-repo PR is mandatory. Without an Application, the values do nothing on the cluster. Do not "ship just the values."
Manual sync is the default for infra apps — do not set automated.{prune,selfHeal}: true to "make it easier" (ADR-A5).
k8s-central-prd-ase1, k8s-dsgpu-prd-ase1, k8s-shared-int-ase1 are GKE Autopilot — they use cloud.google.com/compute-class: not dedicated:.
db-* clusters have minimal sibling apps to compare scheduling against. Confirm with cluster owner before guessing.
No production hostnames as readiness probes / values URLs (SANCTITY_RULES R3).

Layer constraint

Layer 1. Open both PRs; do not merge them; do not Sync. Reviewer + Argo CD UI Sync click are the human gates.

Procedure: ../../docs/platform/procedures/onboard-app-to-cluster.md.
Procedure: ../../docs/platform/procedures/onboard-new-cluster.md — for brand-new clusters.
Schema: ../../docs/platform/schemas/custom-values-schema.md.
Schema: ../../docs/platform/schemas/incubator-values-schema.md.
Schema: ../../docs/platform/schemas/raw-manifest-sidecar-schema.md.
Skill: onboard-app.md — the existing peer skill (older variant; this skill supersedes for incubator-aware inputs).
Boundaries: ../../docs/global/AGENT_BOUNDARIES.md.

10 KiB Raw Blame History

Skill — add-infra-tool