From 23388d3459a571083680cc6029286a88451843da Mon Sep 17 00:00:00 2001 From: David Hadley Date: Fri, 16 Oct 2026 13:54:02 +0100 Subject: [PATCH 1/5] feat(charts): enable sessionspaces-controller in production --- charts/apps/values.yaml | 4 ++-- charts/graph-proxy/staging-values.yaml | 3 --- charts/graph-proxy/values.yaml | 2 +- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/charts/apps/values.yaml b/charts/apps/values.yaml index 1c5e3c0bc..52830a3ef 100644 --- a/charts/apps/values.yaml +++ b/charts/apps/values.yaml @@ -116,13 +116,13 @@ kyverno: verbosity: 0 sessionspaces: - enabled: true + enabled: false targetRevision: production extraValuesFiles: [] valuesObject: {} sessionspacesController: - enabled: false + enabled: true targetRevision: production extraValueFiles: [] valuesObject: {} diff --git a/charts/graph-proxy/staging-values.yaml b/charts/graph-proxy/staging-values.yaml index d0cc3f58e..54e0652a7 100644 --- a/charts/graph-proxy/staging-values.yaml +++ b/charts/graph-proxy/staging-values.yaml @@ -1,6 +1,3 @@ -image: - tag: "0.3.0" - argoServerUrl: https://argo-workflows.staging.workflows.diamond.ac.uk oidcIssuerUrl: https://identity-test.diamond.ac.uk/realms/dls oidcAudiences: "workflows-cluster-staging,graph" diff --git a/charts/graph-proxy/values.yaml b/charts/graph-proxy/values.yaml index 835d67331..ce7c95895 100644 --- a/charts/graph-proxy/values.yaml +++ b/charts/graph-proxy/values.yaml @@ -1,7 +1,7 @@ image: registry: ghcr.io repository: diamondlightsource/workflows-graph-proxy - tag: "0.2.3" + tag: "" digest: "" pullPolicy: IfNotPresent pullSecrets: [] From 12c4de63d196b295aa4f0e0db0b460ef3961cede Mon Sep 17 00:00:00 2001 From: David Hadley Date: Fri, 16 Oct 2026 13:55:28 +0100 Subject: [PATCH 2/5] chore(charts): increment apps chart version --- charts/apps/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/apps/Chart.yaml b/charts/apps/Chart.yaml index 41303fcc1..857c0d3d1 100644 --- a/charts/apps/Chart.yaml +++ b/charts/apps/Chart.yaml @@ -2,4 +2,4 @@ apiVersion: v2 name: apps description: An argocd app to deploy apps inside the virtual cluster type: application -version: 0.5.23 +version: 0.5.24 From 8519da3b0d000a684458bd603603b3e6acc697ee Mon Sep 17 00:00:00 2001 From: David Hadley Date: Fri, 16 Oct 2026 13:55:54 +0100 Subject: [PATCH 3/5] chore(charts): increment graph-proxy chart version --- charts/graph-proxy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/graph-proxy/Chart.yaml b/charts/graph-proxy/Chart.yaml index 5679c8b03..baf205c10 100644 --- a/charts/graph-proxy/Chart.yaml +++ b/charts/graph-proxy/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: graph-proxy description: A GraphQL proxy for the Argo Workflows Server type: application -version: 0.2.52 +version: 0.2.53 appVersion: 0.3.0 dependencies: - name: common From db8f2148600109ab4f1a31634e713498bb5e84c3 Mon Sep 17 00:00:00 2001 From: iamvigneshwars Date: Thu, 1 Oct 2026 09:00:01 +0100 Subject: [PATCH 4/5] fix(workflows)): remove redundant policies --- .../default-localqueue-clusterpolicy.yaml | 28 ----- .../templates/sessionspace-clusterpolicy.yaml | 118 ------------------ .../argo-workflow/chainsaw-test.yaml | 35 ------ .../test-policy/localqueue/chainsaw-test.yaml | 28 ----- .../sessionspaces/chainsaw-test.yaml | 31 ----- .../visit-member/chainsaw-test.yaml | 78 ------------ 6 files changed, 318 deletions(-) delete mode 100644 charts/workflows/templates/default-localqueue-clusterpolicy.yaml delete mode 100644 charts/workflows/test-policy/argo-workflow/chainsaw-test.yaml delete mode 100644 charts/workflows/test-policy/localqueue/chainsaw-test.yaml delete mode 100644 charts/workflows/test-policy/sessionspaces/chainsaw-test.yaml delete mode 100644 charts/workflows/test-policy/visit-member/chainsaw-test.yaml diff --git a/charts/workflows/templates/default-localqueue-clusterpolicy.yaml b/charts/workflows/templates/default-localqueue-clusterpolicy.yaml deleted file mode 100644 index 949433970..000000000 --- a/charts/workflows/templates/default-localqueue-clusterpolicy.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# Design: Policy creates LocalQueues for new matching namespaces; post-install Job handles existing ones. -# This avoids Kyverno's generateExisting limitations with large namespace counts. -# Note: May fail if matched namespaces grow excessively from zero (clean install); upstream Kyverno bug. -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: generate-default-localqueue -spec: - validationFailureAction: Enforce - rules: - - name: create-localqueue-for-session - match: - any: - - resources: - kinds: - - Namespace - selector: - matchLabels: - app.kubernetes.io/managed-by: sessionspaces - generate: - synchronize: true - apiVersion: kueue.x-k8s.io/v1beta2 - kind: LocalQueue - name: default-queue - namespace: "{{ `{{request.object.metadata.name}}` }}" - data: - spec: - clusterQueue: default-queue diff --git a/charts/workflows/templates/sessionspace-clusterpolicy.yaml b/charts/workflows/templates/sessionspace-clusterpolicy.yaml index 826e95cb8..ce2ab51e4 100644 --- a/charts/workflows/templates/sessionspace-clusterpolicy.yaml +++ b/charts/workflows/templates/sessionspace-clusterpolicy.yaml @@ -1,121 +1,3 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: {{ .Release.Name }}-sessionspace -spec: - validationFailureAction: Enforce - background: false - generateExisting: true - mutateExistingOnPolicyUpdate: true - rules: - - name: add-workflow-label-to-configmap - match: - resources: - kinds: - - ConfigMap - names: - - sessionspaces - selector: - matchLabels: - app.kubernetes.io/managed-by: sessionspaces - namespaceSelector: - matchLabels: - app.kubernetes.io/managed-by: sessionspaces - preconditions: - all: - - key: "{{ `{{ request.object.metadata.labels.\"workflows.argoproj.io/configmap-type\" || '' }}` }}" - operator: NotEquals - value: Parameter - mutate: - targets: - - apiVersion: v1 - kind: ConfigMap - name: sessionspaces - namespace: "{{ `{{request.object.metadata.namespace}}` }}" - patchStrategicMerge: - metadata: - labels: - workflows.argoproj.io/configmap-type: Parameter - - name: generate-visit-member-role-binding - match: - resources: - kinds: - - ConfigMap - names: - - sessionspaces - selector: - matchLabels: - app.kubernetes.io/managed-by: sessionspaces - namespaceSelector: - matchLabels: - app.kubernetes.io/managed-by: sessionspaces - context: - - name: sessionspace - configMap: - name: sessionspaces - namespace: "{{ `{{request.object.metadata.namespace}}` }}" - generate: - synchronize: true - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - name: visit-member - namespace: "{{ `{{request.namespace}}` }}" - data: - subjects: |- - {{ - `{{ - sessionspace.data.members | parse_json(@)[].{"apiGroup": 'rbac.authorization.k8s.io', "kind": 'User', "name": join('', ['oidc:', @])} - }}` - }} - roleRef: - kind: ClusterRole - name: visit-member - apiGroup: rbac.authorization.k8s.io - - name: generate-argo-workflow-service-account - match: - resources: - kinds: - - Namespace - selector: - matchLabels: - app.kubernetes.io/managed-by: sessionspaces - generate: - apiVersion: v1 - kind: ServiceAccount - name: argo-workflow - namespace: "{{ `{{request.object.metadata.name}}` }}" - - name: generate-argo-workflow-role-binding - skipBackgroundRequests: false - match: - resources: - kinds: - - ServiceAccount - names: - - argo-workflow - namespaceSelector: - matchLabels: - app.kubernetes.io/managed-by: sessionspaces - generate: - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - name: argo-workflow - namespace: "{{ `{{request.namespace}}` }}" - data: - metadata: - ownerReferences: - - apiVersion: v1 - kind: ServiceAccount - name: "{{ `{{request.object.metadata.name}}` }}" - uid: "{{ `{{request.object.metadata.uid}}` }}" - subjects: - - kind: ServiceAccount - name: argo-workflow - namespace: "{{ `{{request.namespace}}` }}" - roleRef: - kind: ClusterRole - name: argo-workflow - apiGroup: rbac.authorization.k8s.io ---- apiVersion: policies.kyverno.io/v1alpha1 kind: GeneratingPolicy metadata: diff --git a/charts/workflows/test-policy/argo-workflow/chainsaw-test.yaml b/charts/workflows/test-policy/argo-workflow/chainsaw-test.yaml deleted file mode 100644 index c5ab4982e..000000000 --- a/charts/workflows/test-policy/argo-workflow/chainsaw-test.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: chainsaw.kyverno.io/v1alpha1 -kind: Test -metadata: - name: argo-workflow -spec: - namespaceTemplate: - metadata: - labels: - app.kubernetes.io/managed-by: sessionspaces - steps: - - try: - - apply: - resource: - apiVersion: v1 - kind: ConfigMap - metadata: - name: sessionspaces - labels: - app.kubernetes.io/managed-by: sessionspaces - data: - members: '["member1", "member2"]' - - sleep: - duration: 20s - - assert: - resource: - apiVersion: v1 - kind: ServiceAccount - metadata: - name: argo-workflow - - assert: - resource: - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - name: argo-workflow diff --git a/charts/workflows/test-policy/localqueue/chainsaw-test.yaml b/charts/workflows/test-policy/localqueue/chainsaw-test.yaml deleted file mode 100644 index cde666f76..000000000 --- a/charts/workflows/test-policy/localqueue/chainsaw-test.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: chainsaw.kyverno.io/v1alpha1 -kind: Test -metadata: - name: localqueue -spec: - namespaceTemplate: - metadata: - labels: - app.kubernetes.io/managed-by: sessionspaces - steps: - - try: - - apply: - resource: - apiVersion: v1 - kind: Namespace - metadata: - name: test-session-ns - labels: - app.kubernetes.io/managed-by: sessionspaces - - assert: - resource: - apiVersion: kueue.x-k8s.io/v1beta2 - kind: LocalQueue - metadata: - name: default-queue - namespace: test-session-ns - spec: - clusterQueue: default-queue diff --git a/charts/workflows/test-policy/sessionspaces/chainsaw-test.yaml b/charts/workflows/test-policy/sessionspaces/chainsaw-test.yaml deleted file mode 100644 index fd78fd9a2..000000000 --- a/charts/workflows/test-policy/sessionspaces/chainsaw-test.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: chainsaw.kyverno.io/v1alpha1 -kind: Test -metadata: - name: sessionspaces -spec: - namespaceTemplate: - metadata: - labels: - app.kubernetes.io/managed-by: sessionspaces - steps: - - try: - - apply: - resource: - apiVersion: v1 - kind: ConfigMap - metadata: - name: sessionspaces - labels: - app.kubernetes.io/managed-by: sessionspaces - data: - members: '["member1", "member2"]' - - sleep: - duration: 5s - - assert: - resource: - apiVersion: v1 - kind: ConfigMap - metadata: - name: sessionspaces - labels: - workflows.argoproj.io/configmap-type: Parameter diff --git a/charts/workflows/test-policy/visit-member/chainsaw-test.yaml b/charts/workflows/test-policy/visit-member/chainsaw-test.yaml deleted file mode 100644 index 97b8b7149..000000000 --- a/charts/workflows/test-policy/visit-member/chainsaw-test.yaml +++ /dev/null @@ -1,78 +0,0 @@ -apiVersion: chainsaw.kyverno.io/v1alpha1 -kind: Test -metadata: - name: visit-members -spec: - namespaceTemplate: - metadata: - labels: - app.kubernetes.io/managed-by: sessionspaces - steps: - - try: - - apply: - resource: - apiVersion: v1 - kind: ConfigMap - metadata: - name: sessionspaces - labels: - app.kubernetes.io/managed-by: sessionspaces - data: - members: "[\"enu43627\", \"iat69393\", \"mgr27357\"]" - - sleep: - duration: 5s - - assert: - resource: - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - name: visit-member - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: visit-member - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: User - name: "oidc:enu43627" - - apiGroup: rbac.authorization.k8s.io - kind: User - name: "oidc:iat69393" - - apiGroup: rbac.authorization.k8s.io - kind: User - name: "oidc:mgr27357" - - apply: - resource: - apiVersion: v1 - kind: ConfigMap - metadata: - name: sessionspaces - labels: - app.kubernetes.io/managed-by: sessionspaces - data: - members: "[\"enu43627\", \"iat69393\", \"mgr27357\", \"kiw94553\"]" - - sleep: - duration: 5s - - assert: - resource: - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - name: visit-member - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: visit-member - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: User - name: "oidc:enu43627" - - apiGroup: rbac.authorization.k8s.io - kind: User - name: "oidc:iat69393" - - apiGroup: rbac.authorization.k8s.io - kind: User - name: "oidc:mgr27357" - - apiGroup: rbac.authorization.k8s.io - kind: User - name: "oidc:kiw94553" From 403341daded45a990c0af3b5d66cb6786013733f Mon Sep 17 00:00:00 2001 From: iamvigneshwars Date: Thu, 1 Oct 2026 09:00:37 +0100 Subject: [PATCH 5/5] chore(workflows): bump workflows version from 0.13.70 to 0.13.71 --- charts/workflows/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/workflows/Chart.yaml b/charts/workflows/Chart.yaml index 9d5991e12..50204dafa 100644 --- a/charts/workflows/Chart.yaml +++ b/charts/workflows/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: workflows description: Data Analysis workflow orchestration type: application -version: 0.14.3 +version: 0.14.4 dependencies: - name: argo-workflows repository: https://argoproj.github.io/argo-helm