0da9e4c82d
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/, repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/) - Retire oneoffs/ directories across services - Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding - Reorganize scripts/ into ops/, render/, sync/, manual-tests/ - Add Makefile with render/validate/test/flux targets and repo-structure tests - Update flux-system application CRs to the new paths - Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror) - Refresh knowledge catalogs, dashboards, vmalert rules, quality contract Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
106 lines
4.2 KiB
Makefile
106 lines
4.2 KiB
Makefile
# Makefile
|
|
SHELL := /usr/bin/env bash
|
|
|
|
KUSTOMIZE ?= kustomize
|
|
PYTHON ?= $(if $(wildcard .venv/bin/python),.venv/bin/python,python3)
|
|
TERRAFORM ?= terraform
|
|
TRIVY ?= trivy
|
|
BUILD_DIR ?= build
|
|
ATLAS_FLUX_ROOT := clusters/atlas/flux-system
|
|
AETHER_FLUX_ROOT := clusters/aether/flux-system
|
|
AETHER_TF_DIR := terraform/aether
|
|
FLUX_KUSTOMIZATION ?= flux-system
|
|
FLUX_NAMESPACE ?= flux-system
|
|
FLUX_PATH ?= $(ATLAS_FLUX_ROOT)
|
|
TRIVY_CACHE_DIR ?= $(BUILD_DIR)/trivy-cache
|
|
TRIVY_DB_FLAGS ?= --skip-db-update
|
|
|
|
.PHONY: help render render-atlas render-aether render-services render-infrastructure validate dashboards knowledge test flux-diff flux-inventory trivy-scan security-report security aether-fmt aether-init aether-validate aether-plan
|
|
|
|
help:
|
|
@printf '%s\n' \
|
|
'Targets:' \
|
|
' render Render Atlas, Aether, services, and infrastructure.' \
|
|
' render-atlas Render the Atlas Flux root.' \
|
|
' render-aether Render the Aether Flux root.' \
|
|
' render-services Render every service kustomization.' \
|
|
' render-infrastructure Render infrastructure kustomizations.' \
|
|
' validate Run render checks plus the local quality gate.' \
|
|
' dashboards Regenerate Grafana dashboard artifacts.' \
|
|
' knowledge Regenerate Atlas knowledge artifacts and comms mirror.' \
|
|
' test Run the local quality gate.' \
|
|
' flux-diff Diff a Flux Kustomization; override FLUX_KUSTOMIZATION/FLUX_PATH.' \
|
|
' flux-inventory Print Flux Kustomization inventory.' \
|
|
' trivy-scan Run the local Trivy filesystem scan.' \
|
|
' security-report Build IronBank report from build/trivy-fs.json.' \
|
|
' security Run Trivy scan and build the IronBank report.' \
|
|
' aether-fmt Check Terraform formatting for Aether.' \
|
|
' aether-init Initialize Aether Terraform providers.' \
|
|
' aether-validate Validate Aether Terraform after init.' \
|
|
' aether-plan Plan Aether Terraform from local variables/env.'
|
|
|
|
render: render-atlas render-aether render-services render-infrastructure
|
|
|
|
render-atlas:
|
|
$(KUSTOMIZE) build $(ATLAS_FLUX_ROOT) >/tmp/titan-iac-atlas-flux-system.yaml
|
|
|
|
render-aether:
|
|
$(KUSTOMIZE) build $(AETHER_FLUX_ROOT) >/tmp/titan-iac-aether-flux-system.yaml
|
|
|
|
render-services:
|
|
@set -euo pipefail; \
|
|
while IFS= read -r k; do \
|
|
d="$${k%/kustomization.yaml}"; \
|
|
printf 'render %s\n' "$$d"; \
|
|
$(KUSTOMIZE) build "$$d" >/tmp/titan-iac-render.yaml; \
|
|
done < <(find services -name kustomization.yaml | sort)
|
|
|
|
render-infrastructure:
|
|
@set -euo pipefail; \
|
|
while IFS= read -r k; do \
|
|
d="$${k%/kustomization.yaml}"; \
|
|
printf 'render %s\n' "$$d"; \
|
|
$(KUSTOMIZE) build "$$d" >/tmp/titan-iac-render.yaml; \
|
|
done < <(find infrastructure -name kustomization.yaml | sort)
|
|
|
|
validate: render test
|
|
|
|
dashboards:
|
|
$(PYTHON) scripts/render/dashboards_render_atlas.py --build
|
|
$(PYTHON) scripts/render/dashboards_render_logs.py --build
|
|
$(PYTHON) scripts/render/logging_render_observability.py --build
|
|
|
|
knowledge:
|
|
$(PYTHON) scripts/render/knowledge_render_atlas.py --write --sync-comms
|
|
|
|
test:
|
|
$(PYTHON) -m testing.quality_gate --profile local --build-dir $(BUILD_DIR)
|
|
|
|
flux-diff:
|
|
flux diff kustomization $(FLUX_KUSTOMIZATION) --namespace $(FLUX_NAMESPACE) --path $(FLUX_PATH)
|
|
|
|
flux-inventory:
|
|
$(PYTHON) scripts/render/flux_inventory.py $(ATLAS_FLUX_ROOT)
|
|
|
|
trivy-scan:
|
|
mkdir -p $(BUILD_DIR)
|
|
$(TRIVY) fs --cache-dir "$(TRIVY_CACHE_DIR)" $(TRIVY_DB_FLAGS) --skip-files clusters/atlas/flux-system/gotk-components.yaml --timeout 5m --no-progress --format json --output $(BUILD_DIR)/trivy-fs.json --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .
|
|
|
|
security-report:
|
|
@test -s $(BUILD_DIR)/trivy-fs.json || { printf '%s\n' 'missing build/trivy-fs.json; run make trivy-scan first'; exit 1; }
|
|
$(PYTHON) ci/scripts/supply_chain_report.py --trivy-json $(BUILD_DIR)/trivy-fs.json --waivers ci/titan-iac-trivy-waivers.json --output $(BUILD_DIR)/ironbank-compliance.json
|
|
|
|
security: trivy-scan security-report
|
|
|
|
aether-fmt:
|
|
$(TERRAFORM) -chdir=$(AETHER_TF_DIR) fmt -check
|
|
|
|
aether-init:
|
|
$(TERRAFORM) -chdir=$(AETHER_TF_DIR) init
|
|
|
|
aether-validate:
|
|
$(TERRAFORM) -chdir=$(AETHER_TF_DIR) validate
|
|
|
|
aether-plan:
|
|
$(TERRAFORM) -chdir=$(AETHER_TF_DIR) plan
|