radiantlogic-devops · jmcorne · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jul 24, 2026
diff --git a/.github/workflows/lint-test-common-services.yaml b/.github/workflows/lint-test-common-services.yaml
@@ -55,6 +55,7 @@ jobs:
         run: |
           helm repo add prometheus https://prometheus-community.github.io/helm-charts
           helm repo add grafana https://grafana.github.io/helm-charts
+          helm repo add grafana-community https://grafana-community.github.io/helm-charts
           helm repo add elastic https://helm.elastic.co
           helm repo add kibana https://helm.elastic.co
           helm repo add argo-cd https://argoproj.github.io/argo-helm
@@ -66,6 +67,7 @@ jobs:
           helm repo add velero https://vmware-tanzu.github.io/helm-charts
           helm repo add cnpg https://cloudnative-pg.github.io/charts
           helm repo add velero-ui https://helm.otwld.com
+          helm repo add flink-kubernetes-operator https://downloads.apache.org/flink/flink-kubernetes-operator-1.15.0
 
       - name: Run chart-testing (lint)
         run: ct lint --target-branch ${{ env.DEFAULT_BRANCH }}

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,161 @@
+# Changelog
+
+All notable changes to this Helm repository are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [common-services 2.0.3] — 2026-07-24
+
+### Périmètre
+
+Montée de version et durcissement Ops de **common-services 2.0.3** pour clusters **Kubernetes 1.34 / 1.35** :
+
+| Domaine | Composants |
+|---|---|
+| Backup / DR | Velero |
+| Databases | CloudNativePG |
+| Data processing | Flink Kubernetes Operator |
+| Observability / logs | Alloy, Loki |
+| Retrait | Nebula Operator (complet) |
+
+Livraison via **Argo CD** : **un seul état Git final** `common-services` **2.0.3**, **une sync** vers cet état. Pas de paliers Helm intermédiaires, pas de RC, pas de runner de migration multi-sync.
+
+### Tableau versions (actuel → cible)
+
+| Composant | Chart actuel | App actuel | Chart cible | App cible |
+|---|---|---|---|---|
+| Velero | `10.1.2` | `1.16.2` | `12.1.0` | `1.18.1` |
+| CloudNativePG | `0.28.3` | `1.29.1` | `0.29.0` | `1.30.0` |
+| Flink Kubernetes Operator | `1.14.0` | `1.14.0` | `1.15.0` | `1.15.0` |
+| Alloy | `1.2.1` | `v1.10.1` | `1.11.0` | `v1.18.0` |
+| Loki | `grafana/loki` `6.40.0` | `3.5.3` | `grafana-community/loki` `18.5.3` | `3.7.4` |
+| Nebula Operator | `1.8.6` | — | **retiré** | — |
+
+Repository Flink mis à jour vers `https://downloads.apache.org/flink/flink-kubernetes-operator-1.15.0`.
+
+### Décisions de livraison
+
+- **Un seul état Git final 2.0.3**, sync Argo CD unique.
+- **Pas de paliers Helm / RC / runner multi-sync** pour Velero ni Loki.
+- Justification Velero : la documentation officielle est structurée version-par-version ; avec les **CRDs finales** appliquées par `crds-installer` et l’image Velero / plugin AWS de la cible, un cut direct 1.16 → 1.18 est acceptable Ops (pas besoin de déployer 1.17 en paliers dans ce dépôt).
+- Justification Loki : le guide Grafana Community décrit un **`helm upgrade`** après adaptation des values, pas une chaîne de douze déploiements intermédiaires. Les values locales sont corrigées pour être cohérentes S3 + SimpleScalable avant le cut.
+
+### Pourquoi le repository Helm Loki change
+
+- L’OSS Loki Helm chart a été déplacé vers **Grafana Community**.
+- Sur l’ancien dépôt `https://grafana.github.io/helm-charts`, les charts Loki **7.x+** ciblent **GEL (Grafana Enterprise Logs)** uniquement.
+- Ne **pas** utiliser `grafana/loki` `7.1.0` (ou toute série 7.x du dépôt Grafana historique) pour cette stack OSS.
+- Lien officiel de migration : https://grafana.com/docs/loki/latest/setup/upgrade/upgrade-to-community/
+- Cible : repository `https://grafana-community.github.io/helm-charts`, chart **`18.5.3`**, application Loki **`3.7.4`**.
+
+### Breaking / values Loki
+
+Corrections obligatoires dans `charts/common-services/values.yaml` :
+
+| Sujet | Avant (problématique) | Après (2.0.3) |
+|---|---|---|
+| Repository | `grafana/loki` | `grafana-community/loki` |
+| `deploymentMode` | `SimpleScalable` | `SimpleScalable` **explicite** (défaut community = `Monolithic`) |
+| `loki.storage.type` | `filesystem` (incohérent avec schema S3) | `s3` |
+| Schema | `object_store: s3`, TSDB **v13**, période `2024-04-01` | **inchangé** (pas de rewrite schema) |
+| Compactor | `delete_request_store: filesystem` | `delete_request_store: s3` |
+| Monitoring chart 18 | `monitoring.rules.alerting` | `monitoring.alerts` (+ `monitoring.rules` sans clé obsolète) |
+| ServiceAccount | généré / non piné | `serviceAccount.name: loki` (stabilité IRSA / pod identity) |
+| PVC backend | défaut community (`whenDeleted: Delete` + auto-delete) | `enableStatefulSetAutoDeletePVC: true` + `whenDeleted/whenScaled: Retain` |
+
+Les `bucketNames` / région S3 restent des **placeholders documentés** ; secrets et IRSA restent hors Git (overlays environnement).
+
+Overlays mis à jour pour le nouveau dépôt / retrait Nebula : `charts/common-services/override-values.yaml`, `values-qaibtest.yaml`.
+
+### Backup Manager
+
+- Image alignée : `radiantone/eoc-backup-manager:1.18.1`.
+- Retrait de la configuration documentation UI legacy et des variables d'environnement associées (documentation Huma sur `/docs`, `/openapi.json`, `/openapi.yaml`).
+- Ajout de `backupManager.env` (passthrough) pour les overrides runtime (ex. `HTTP_READ_HEADER_TIMEOUT`).
+- Ports, probes et `LISTEN_PORT` alignés sur `backupManager.service.containerPort`.
+
+### Velero
+
+- Chart `12.1.0` / app `1.18.1`.
+- Plugin AWS aligné : `velero/velero-plugin-for-aws:v1.14.2` (compatible Velero 1.18 ; doc upgrade 1.18 utilise `v1.14.0`).
+- `upgradeCRDs: false` conservé — les CRDs sont appliquées par **`crds-installer`** sur la version finale pinée.
+- Smoke test runtime attendu après sync : backup + restore.
+
+### CloudNativePG / Flink
+
+- CNPG chart `0.29.0` / operator `1.30.0` ; CRDs via `crds-installer` ; values locales inchangées sauf incompatibilité (aucune requise dans ce cut).
+- Flink Operator `1.15.0` + URL Apache versionnée ; CRDs via `crds-installer` ; webhook reste `create: false`.
+
+### Alloy
+
+- Bump chart `1.11.0` / app `v1.18.0` **uniquement**.
+- Topologie **DaemonSet** conservée (`controller.type: daemonset`).
+- Pas de clustering HA / StatefulSet dans ce cut.
+
+### Nebula — retrait complet
+
+Hypothèse Ops : **plus aucune application n’utilise Nebula**. S’il reste des CR en cluster, elles sont **supprimées quand même** (pas de fail-closed).
+
+Retiré du chart :
+
+- dépendance `nebula-operator` dans `Chart.yaml` ;
+- bloc values `nebula-operator` ;
+- overlays (`override-values.yaml`, `values-qaibtest.yaml`) ;
+- template workaround `templates/nebula/controller-manager-patch-rbac.yml` ;
+- dashboards Nebula (`dashboards/ido/graph-database.json`, `dashboards-logs/ido/nebula-*.json`) ;
+- RBAC backup-manager spécifique Nebula ;
+- entrée d’**install** Nebula dans `crds-installer` (plus de chart à installer).
+
+Extension de **`crds-installer`** (pas de Job/hook séparé) :
+
+1. entrée config `action: delete` / `cleanup: true` pour le pattern `\.nebula-graph\.io` ;
+2. liste les CRDs matchantes ;
+3. pour chaque CRD, purge **toutes** les instances CR (cluster-wide / namespaced) ;
+4. retire les finalizers bloquants si nécessaire ;
+5. supprime les CRDs ;
+6. no-op si déjà absentes ;
+7. n’échoue pas parce que des CR existaient — on les purge (`|| true` sur le cleanup).
+
+RBAC du Job élargi avec verbes sur `apps.nebula-graph.io` et `autoscaling.nebula-graph.io`.
+
+### Validation
+
+**Rendu Git (obligatoire avant merge) :**
+
+```bash
+helm dependency update charts/common-services
+helm lint charts/common-services
+helm template test charts/common-services --kube-version 1.34.0 >/dev/null
+helm template test charts/common-services --kube-version 1.35.0 >/dev/null
+```
+
+**Checklist runtime non-prod puis prod :**
+
+- [ ] Diff manifests limité aux cinq composants upgradés + retrait Nebula
+- [ ] Velero : backup/restore smoke test après sync
+- [ ] Loki : push + query logs historiques S3 + nouveaux writes ; pas de mixed-version prolongé
+- [ ] CNPG / Flink : operator Ready, CR existants inchangés fonctionnellement
+- [ ] Alloy : pods Ready, logs vers gateway Loki, scrapes Prometheus
+- [ ] Nebula : opérateur absent, CR absents, CRDs absentes, sync Healthy
+
+### Liens officiels
+
+- Velero upgrade 1.17 : https://velero.io/docs/v1.17/upgrade-to-1.17/
+- Velero upgrade 1.18 : https://velero.io/docs/v1.18/upgrade-to-1.18/
+- Velero plugin AWS (compat) : https://github.com/vmware-tanzu/velero-plugin-for-aws
+- Loki → Grafana Community : https://grafana.com/docs/loki/latest/setup/upgrade/upgrade-to-community/
+- Loki community charts : https://grafana-community.github.io/helm-charts
+- CloudNativePG charts : https://cloudnative-pg.github.io/charts
+- Flink Kubernetes Operator 1.15.0 : https://downloads.apache.org/flink/flink-kubernetes-operator-1.15.0
+- Alloy chart : https://github.com/grafana/alloy/tree/main/operations/helm/charts/alloy
+
+### Hors scope (volontaire)
+
+- Paliers Velero 1.17 / Loki 6.55 et scripts/RC associés
+- Refonte topologie Alloy (clustering HA)
+- Migration Loki hors de `SimpleScalable` (à planifier avant Loki 4.0, pas dans ce cut)
+- Bump `velero-ui` sauf blocage par le nouveau Velero (non constaté comme bloquant ici)
+
+---
+
+Ce fichier est la **source de vérité Ops** pour la montée common-services 2.0.3.
diff --git a/charts/common-services/Chart.yaml b/charts/common-services/Chart.yaml
@@ -10,7 +10,7 @@ type: application
 # Chart Version
 # -------------
 # This version should be incremented following Semantic Versioning (https://semver.org/) whenever the chart's structure or templates change.
-version: 2.0.2
+version: 2.0.3
 
 # Application Version (Informational)
 # -----------------------------------
@@ -93,32 +93,28 @@ dependencies:
   repository: https://fluent.github.io/helm-charts
   condition: fluent-bit.enabled
 - name: velero
-  version: 10.1.2
+  version: 12.1.0
   repository: https://vmware-tanzu.github.io/helm-charts
   condition: velero.enabled
 - name: cloudnative-pg
   repository: https://cloudnative-pg.github.io/charts
-  version: 0.28.0
+  version: 0.29.0
   condition: cloudnative-pg.enabled
 - name: velero-ui
   version: 0.x.x
   repository: https://helm.otwld.com
   condition: velero-ui.enabled
-- name: nebula-operator
-  version: 1.8.6
-  repository: https://vesoft-inc.github.io/nebula-operator/charts
-  condition: nebula-operator.enabled
 - name: flink-kubernetes-operator
-  version: 1.14.0
-  repository: https://downloads.apache.org/flink/flink-kubernetes-operator-1.14.0
+  version: 1.15.0
+  repository: https://downloads.apache.org/flink/flink-kubernetes-operator-1.15.0
   condition: flink-kubernetes-operator.enabled
 - name: loki
-  repository: https://grafana.github.io/helm-charts
-  version: 6.40.0
+  repository: https://grafana-community.github.io/helm-charts
+  version: 18.5.3
   condition: loki.enabled
 - name: alloy
   repository: https://grafana.github.io/helm-charts
-  version: 1.2.1
+  version: 1.11.0
   condition: alloy.enabled
 - name: prometheus-elasticsearch-exporter
   version: 6.6.0

diff --git a/charts/common-services/README.md b/charts/common-services/README.md
@@ -1,10 +1,19 @@
 # common-services
 
-![Version: 2.0.1](https://img.shields.io/badge/Version-2.0.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.0](https://img.shields.io/badge/AppVersion-2.0-informational?style=flat-square)
+![Version: 2.0.3](https://img.shields.io/badge/Version-2.0.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.0](https://img.shields.io/badge/AppVersion-2.0-informational?style=flat-square)
 
 A Helm chart for deploying RadiantOne Common Services on Kubernetes
 
-## What's New in 2.0.1
+See the repository root [`CHANGELOG.md`](../../CHANGELOG.md) for the full common-services **2.0.3** migration notes (Velero, CNPG, Flink, Alloy, Loki community, Nebula removal).
+
+## What's New in 2.0.3
+
+- Velero chart `12.1.0` / app `1.18.1` (AWS plugin `v1.14.2`)
+- CloudNativePG chart `0.29.0` / operator `1.30.0`
+- Flink Kubernetes Operator `1.15.0`
+- Alloy chart `1.11.0` / app `v1.18.0` (DaemonSet topology unchanged)
+- Loki migrated to `grafana-community/loki` chart `18.5.3` / app `3.7.4`
+- Nebula Operator removed; remaining Nebula CRs/CRDs purged via `crds-installer`
 
 ### Automatic Metrics & Dashboards
 
@@ -57,27 +66,30 @@ Kubernetes: `>=1.24.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://argoproj.github.io/argo-helm | argo-cd | 5.6.0 |
+| https://argoproj.github.io/argo-helm | argo-cd | 7.8.0 |
 | https://charts.bitnami.com/bitnami | postgresql | 12.1.3 |
 | https://charts.bitnami.com/bitnami | zookeeper | 11.0.0 |
-| https://cloudnative-pg.github.io/charts | cloudnative-pg | 0.21.4 |
-| https://fluent.github.io/helm-charts | fluent-bit | 0.39.0 |
-| https://grafana.github.io/helm-charts | grafana | 6.40.0 |
-| https://haproxytech.github.io/helm-charts | haproxy | 1.17.3 |
+| https://cloudnative-pg.github.io/charts | cloudnative-pg | 0.29.0 |
+| https://downloads.apache.org/flink/flink-kubernetes-operator-1.15.0 | flink-kubernetes-operator | 1.15.0 |
+| https://fluent.github.io/helm-charts | fluent-bit | 0.48.0 |
+| https://grafana.github.io/helm-charts | alloy | 1.11.0 |
+| https://grafana.github.io/helm-charts | grafana | 8.10.0 |
+| https://grafana-community.github.io/helm-charts | loki | 18.5.3 |
+| https://haproxytech.github.io/helm-charts | haproxy | 1.24.0 |
 | https://helm.elastic.co | elasticsearch | 7.17.3 |
 | https://helm.elastic.co | kibana | 7.17.3 |
 | https://helm.runix.net | pgadmin4 | 1.13.8 |
 | https://opensearch-project.github.io/helm-charts | opensearch | 2.16.1 |
 | https://opensearch-project.github.io/helm-charts | opensearch-dashboards | 2.14.0 |
-| https://prometheus-community.github.io/helm-charts | prometheus | 15.13.0 |
-| https://vmware-tanzu.github.io/helm-charts | velero | 7.2.1 |
+| https://prometheus-community.github.io/helm-charts | prometheus | 20.2.1 |
+| https://vmware-tanzu.github.io/helm-charts | velero | 12.1.0 |
 
 ## Values
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | argo-cd | object | `{"applicationSet":{"enabled":false},"configs":{"params":{"server.insecure":true,"server.rootpath":"/argocd"}},"controller":{"nodeSelector":{}},"crds":{"keep":false},"dex":{"enabled":false},"enabled":true,"fullnameOverride":"argocd","notifications":{"enabled":false},"redis":{"nodeSelector":{}},"repoServer":{"nodeSelector":{}},"server":{"nodeSelector":{},"service":{"type":"NodePort"}}}` | -------------------  This section enables and configures Argo CD, a GitOps continuous delivery tool for Kubernetes.  Key Features: - Automated application deployment and synchronization from Git repositories - Declarative configuration using Kubernetes manifests - Visual UI for managing applications and observing their state - Optional integration with Dex for authentication and authorization - Customizable server settings (root path, security) - Node selector configuration for different Argo CD components  Note: Review and adjust settings for production environments. |
-| backupManager | object | `{"affinity":{},"enabled":false,"image":{"pullPolicy":"Always","repository":"radiantone/backup-manager","tag":"dev"},"imagePullSecrets":[],"log":{"format":"text","level":"info"},"nodeSelector":{},"podAnnotations":{},"podSecurityContext":{},"replicas":1,"resources":{"limits":{"cpu":"250m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}},"securityContext":{},"service":{"containerPort":8080,"port":80},"swagger":{"enabled":false,"host":"localhost","port":8080},"tolerations":[],"webhook":{"backup":{"timeout":"1h","url":""},"enabled":false,"restore":{"timeout":"1h","url":""},"syncPeriod":"1m"}}` | --------------------------------------------------------------- |
+| backupManager | object | `{"affinity":{},"enabled":false,"env":{},"image":{"pullPolicy":"Always","repository":"radiantone/eoc-backup-manager","tag":"1.18.1"},"imagePullSecrets":[],"log":{"format":"json","level":"info"},"nodeSelector":{},"podAnnotations":{},"podSecurityContext":{},"podsWaitTimeout":"5m","replicas":1,"resources":{"limits":{"cpu":"250m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}},"securityContext":{},"service":{"containerPort":8080,"port":80,"type":"ClusterIP"},"tolerations":[],"webhook":{"backup":{"timeout":"1h","url":""},"enabled":false,"restore":{"timeout":"1h","url":""},"syncPeriod":"1m"}}` | --------------------------------------------------------------- |
 | cloudnative-pg | object | `{"affinity":{},"config":{"create":true,"data":{"INHERITED_ANNOTATIONS":"meta.helm.sh/*, helm.sh/*","INHERITED_LABELS":"app.kubernetes.io/*, radiantlogic.io/*"},"name":"cnpg-controller-manager-config"},"enabled":false,"fullnameOverride":"cnpg","nodeSelector":{},"tolerations":[]}` | --------------------------------------------------------------- |
 | curator | object | `{"client":{"certificate":"","client_cert":"","client_key":"","hosts":["elasticsearch-master"],"master_only":false,"password":"","port":9200,"ssl_no_validate":true,"timeout":300,"use_ssl":false,"username":""},"cronjob":{"annotations":{},"concurrencyPolicy":"","failedJobsHistoryLimit":"","jobRestartPolicy":"Never","labels":{},"schedule":"0 0 * * *","startingDeadlineSeconds":"","successfulJobsHistoryLimit":""},"dryrun":false,"enabled":true,"hooks":{"install":false,"upgrade":false},"logging":{"blacklist":["elasticsearch","urllib3"],"logfile":"","logformat":"default","loglevel":"INFO"},"logs":[{"name":"vds_server.log"},{"name":"vds_server_access.log"},{"name":"adap_access.log"},{"name":"adap.log"},{"name":"web.log"},{"name":"web_access.log"},{"name":"event.log"},{"name":"periodiccache.log"},{"name":"admin_rest_api_access.log"},{"name":"sync_engine.log"},{"name":"alerts.log"},{"name":"approvals_audit.log"},{"name":"scim.log"},{"name":"audit.log"},{"name":"internal-container.log"}],"nodeSelector":{},"pod":{"annotations":{}},"priorityClassName":"","psp":{"create":false},"rbac":{"enabled":false},"resources":{},"securityContext":{"runAsUser":16},"serviceAccount":{"annotations":{},"create":false}}` | ------------------ This section controls the behavior of Elasticsearch Curator, a tool for managing Elasticsearch indices. Curator can perform actions like deleting, closing, or creating indices based on configured filters. |
 | curator.client | object | `{"certificate":"","client_cert":"","client_key":"","hosts":["elasticsearch-master"],"master_only":false,"password":"","port":9200,"ssl_no_validate":true,"timeout":300,"use_ssl":false,"username":""}` | --------------------------- Specify the connection details for your Elasticsearch cluster. |