enable sessionspaces controller on production

charts/apps/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: apps
 description: An argocd app to deploy apps inside the virtual cluster
 type: application
-version: 0.5.23
+version: 0.5.24

charts/apps/values.yaml

@@ -116,13 +116,13 @@ kyverno:
         verbosity: 0
 
 sessionspaces:
-  enabled: true
+  enabled: false
   targetRevision: production
   extraValuesFiles: []
   valuesObject: {}
 
 sessionspacesController:
-  enabled: false
+  enabled: true
   targetRevision: production
   extraValueFiles: []
   valuesObject: {}

charts/graph-proxy/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: graph-proxy
 description: A GraphQL proxy for the Argo Workflows Server
 type: application
-version: 0.2.52
+version: 0.2.53
 appVersion: 0.3.0
 dependencies:
   - name: common

charts/graph-proxy/staging-values.yaml

@@ -1,6 +1,3 @@
-image:
-  tag: "0.3.0"
-
 argoServerUrl: https://argo-workflows.staging.workflows.diamond.ac.uk
 oidcIssuerUrl: https://identity-test.diamond.ac.uk/realms/dls
 oidcAudiences: "workflows-cluster-staging,graph"

charts/graph-proxy/values.yaml

@@ -1,7 +1,7 @@
 image:
   registry: ghcr.io
   repository: diamondlightsource/workflows-graph-proxy
-  tag: "0.2.3"
+  tag: ""
   digest: ""
   pullPolicy: IfNotPresent
   pullSecrets: []

charts/workflows/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: workflows
 description: Data Analysis workflow orchestration
 type: application
-version: 0.14.3
+version: 0.14.4
 dependencies:
   - name: argo-workflows
     repository: https://argoproj.github.io/argo-helm

charts/workflows/templates/sessionspace-clusterpolicy.yaml

@@ -1,121 +1,3 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: {{ .Release.Name }}-sessionspace
-spec:
-  validationFailureAction: Enforce
-  background: false
-  generateExisting: true
-  mutateExistingOnPolicyUpdate: true
-  rules:
-    - name: add-workflow-label-to-configmap
-      match:
-        resources:
-          kinds:
-            - ConfigMap
-          names:
-            - sessionspaces
-          selector:
-            matchLabels:
-              app.kubernetes.io/managed-by: sessionspaces
-          namespaceSelector:
-            matchLabels:
-              app.kubernetes.io/managed-by: sessionspaces
-      preconditions:
-        all:
-        - key: "{{ `{{ request.object.metadata.labels.\"workflows.argoproj.io/configmap-type\" || '' }}` }}"
-          operator: NotEquals
-          value: Parameter
-      mutate:
-        targets:
-          - apiVersion: v1
-            kind: ConfigMap
-            name: sessionspaces
-            namespace: "{{ `{{request.object.metadata.namespace}}` }}"
-        patchStrategicMerge:
-          metadata:
-            labels:
-              workflows.argoproj.io/configmap-type: Parameter
-    - name: generate-visit-member-role-binding
-      match:
-        resources:
-          kinds:
-            - ConfigMap
-          names:
-            - sessionspaces
-          selector:
-            matchLabels:
-              app.kubernetes.io/managed-by: sessionspaces
-          namespaceSelector:
-            matchLabels:
-              app.kubernetes.io/managed-by: sessionspaces
-      context:
-        - name: sessionspace
-          configMap:
-            name: sessionspaces
-            namespace: "{{ `{{request.object.metadata.namespace}}` }}"
-      generate:
-        synchronize: true
-        apiVersion: rbac.authorization.k8s.io/v1
-        kind: RoleBinding
-        name: visit-member
-        namespace: "{{ `{{request.namespace}}` }}"
-        data:
-          subjects: |-
-            {{
-            `{{
-              sessionspace.data.members | parse_json(@)[].{"apiGroup": 'rbac.authorization.k8s.io', "kind": 'User', "name": join('', ['oidc:', @])}
-            }}`
-            }}
-          roleRef:
-            kind: ClusterRole
-            name: visit-member
-            apiGroup: rbac.authorization.k8s.io
-    - name: generate-argo-workflow-service-account
-      match:
-        resources:
-          kinds:
-            - Namespace
-          selector:
-            matchLabels:
-              app.kubernetes.io/managed-by: sessionspaces
-      generate:
-        apiVersion: v1
-        kind: ServiceAccount
-        name: argo-workflow
-        namespace: "{{ `{{request.object.metadata.name}}` }}"
-    - name: generate-argo-workflow-role-binding
-      skipBackgroundRequests: false
-      match:
-        resources:
-          kinds:
-            - ServiceAccount
-          names:
-            - argo-workflow
-          namespaceSelector:
-            matchLabels:
-              app.kubernetes.io/managed-by: sessionspaces
-      generate:
-        apiVersion: rbac.authorization.k8s.io/v1
-        kind: RoleBinding
-        name: argo-workflow
-        namespace: "{{ `{{request.namespace}}` }}"
-        data:
-          metadata:
-            ownerReferences:
-              - apiVersion: v1
-                kind: ServiceAccount
-                name: "{{ `{{request.object.metadata.name}}` }}"
-                uid: "{{ `{{request.object.metadata.uid}}` }}"
-          subjects:
-            - kind: ServiceAccount
-              name: argo-workflow
-              namespace: "{{ `{{request.namespace}}` }}"
-          roleRef:
-            kind: ClusterRole
-            name: argo-workflow
-            apiGroup: rbac.authorization.k8s.io
----
 apiVersion: policies.kyverno.io/v1alpha1
 kind: GeneratingPolicy
 metadata: