Bunker

Recent Commits

• semantic-release-bot (27 Jul 26)

  chore(release): 1.65.3 [skip ci] ## [1.65.3](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.65.2...v1.65.3) (2026-07-27) ### Bug Fixes * **plateforme:** colocalise les apps DB avec la zone du primary CNPG ([cd7f52c](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/cd7f52c8b8cf9e769b0c0aab7aa6722b3f90a3b2))

• François-Guillaume Ribreau (26 Jul 26)

  fix(plateforme): colocalise les apps DB avec la zone du primary CNPG keycloak, spicedb, controlplane, operation-worker et synchronizer se connectent au cluster CNPG unique (-db) mais n'avaient aucune affinité → placés hors de la zone du primary (apps en dc02, primary en dc01), chaque requête d'auth/permission (session keycloak, check spicedb) payant un hop FTTH inter-DC. Helper plateforme.dbColocation (podAffinity soft weight 100 vers le pod role=primary du cluster <fullname>-db, topologyKey zone) câblé sur les 5 Deployments qui parlent à Postgres. Soft (preferred, jamais Pending), suit le primary. Console (sans DB) non touché.

• semantic-release-bot (22 Jul 26)

  chore(release): 1.65.2 [skip ci] ## [1.65.2](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.65.1...v1.65.2) (2026-07-22) ### Bug Fixes * **cnpg-backup:** corrige les creds S3 + bucket de plateforme-prod-db ([65782c3](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/65782c3f73cf615084ecee65a83c455644304834))

• FranceNuage (22 Jul 26)

  fix(cnpg-backup): corrige les creds S3 + bucket de plateforme-prod-db Le SealedSecret cnpg-backup-s3-credentials chiffrait une service-account du user MinIO `frn-cnpg-backup-managed-france-nuage-controlplane-prod` (un AUTRE cluster), alors que plateforme-prod-db écrit dans le bucket `frn-cnpg-backup-plateforme-prod-db`. La policy de ces creds n'autorisant pas ce bucket → `PutObject AccessDenied` sur l'archivage WAL → réplica db-1 en crashloop (ne peut plus archiver) → cluster dégradé 1/2 + aucun PITR possible (incident 2026-07-22, détecté par backup-monitor : last backup > 32h). - SealedSecret : re-scellé avec une service-account du bon user `frn-cnpg-backup-plateforme-prod-db` (propriétaire du bucket, testée en écriture). - values-prod : backup `enabled: true` (était false) + destinationPath aligné sur `s3://frn-cnpg-backup-plateforme-prod-db/` (bucket existant qui contient déjà les base backups + WAL du cluster, était `frn-cnpg-backup-plateforme-prod` non créé). Appliqué en live (SealedSecret + secret patché) : archivage WAL a repris ("Continuous archiving is working"), réplica db-1 sort du crashloop et re-sync. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

• semantic-release-bot (21 Jul 26)

  chore(release): 1.65.1 [skip ci] ## [1.65.1](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.65.0...v1.65.1) (2026-07-21) ### Bug Fixes * **controlplane:** ajoute betterstack.io/monitor-type=expected_status_code ([791d67b](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/791d67b2094f65824573c2de0e5fb48d95f4188f))

• kevin_gillet (21 Jul 26)

  fix(controlplane): ajoute betterstack.io/monitor-type=expected_status_code Le monitor BetterStack de l'ingress controlplane restait de type "status" (attend un 2xx) et voyait donc le 400 attendu de l'endpoint Connect/gRPC comme DOWN (incident permanent k8s:plateforme-prod/plateforme-prod-controlplane). betterstack-sync n'injecte expected-status-code dans le monitor QUE si monitor-type == expected_status_code (sinon défaut "status" → code ignoré). L'annotation expected-status-code=400 posée précédemment était donc inerte. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• semantic-release-bot (19 Jul 26)

  chore(release): 1.65.0 [skip ci] # [1.65.0](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.64.0...v1.65.0) (2026-07-19) ### Features * **helm:** sonde BetterStack controlplane attend un HTTP 400 ([18a8201](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/18a82018404a3e5291bd0a83836e58b08f1e3367))

• FranceNuage (19 Jul 26)

  feat(helm): sonde BetterStack controlplane attend un HTTP 400 Endpoint Connect/gRPC : un GET nu renvoie 400 (requete non-gRPC), verifie en reel sur controlplane.france-nuage.fr. Sans ca la sonde BetterStack considererait le 400 comme un incident. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• semantic-release-bot (17 Jul 26)

  chore(release): 1.64.0 [skip ci] # [1.64.0](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.63.0...v1.64.0) (2026-07-17) ### Features * **helm:** expose console et controlplane via Ingress ([bfd47f3](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/bfd47f3bbdf7952a949ff2be2dc37884ae2efb77))

• Kévin GILLET (17 Jul 26)

  feat(helm): expose console et controlplane via Ingress Le chart plateforme bundlait console + controlplane dans le namespace plateforme-prod sans aucun Ingress : controlplane.france-nuage.fr retournait 404 (aucun backend cote kingress) et la console publique dependait encore de l'ancien chart standalone. Ajoute deux templates Ingress parametrables (kingress, classe nginx requise par Capsule, TLS via cert-manager letsencrypt-prod, annotations BetterStack), desactives par defaut et actives dans values-prod.yaml : - console.france-nuage.fr -> svc <fullname>-console:80 - controlplane.france-nuage.fr -> svc <fullname>-controlplane:80 Le controlplane parle Connect/gRPC-web sur HTTP/1.1, un Ingress standard suffit cote kingress. Meme pattern que charts/console et charts/controlplane de l'ancienne archi. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• semantic-release-bot (16 Jul 26)

  chore(release): 1.63.0 [skip ci] # [1.63.0](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.62.1...v1.63.0) (2026-07-16) ### Features * **db:** migre les 3 bases vers un cluster CloudNativePG unique ([b28ff67](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/b28ff6765c63db3dd9dcd048bc41f31b74448adf))

• Kévin GILLET (16 Jul 26)

  feat(db): migre les 3 bases vers un cluster CloudNativePG unique Remplace les StatefulSets postgres/keycloak-db/spicedb-db (mono-instance, sans backup) par un Cluster CNPG unique hébergeant les 3 bases : - controlplane -> base `postgres` via le superuser - keycloak / spicedb -> bases + rôles dédiés (managed.roles + postInitSQL) Services alias ExternalName -> conserve les hostnames attendus par les apps (aucun changement de template d'app ni de helper). HA 2 réplicas + storage local + anti-affinité zone + backup S3 barman en prod. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• semantic-release-bot (16 Jul 26)

  chore(release): 1.62.1 [skip ci] ## [1.62.1](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.62.0...v1.62.1) (2026-07-16) ### Bug Fixes * on arrête d'utiliser la ada car trop d'erreur de manque de place dispo du scheduler ([f78b0f5](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/f78b0f5785352c88f855fc9f377a005e75d6e99b)) * use prod kubeconfig ([12cd992](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/12cd99288d98ba999cf4287b2acd2207ab5ed5fd))

• Kévin GILLET (16 Jul 26)

  fix: on arrête d'utiliser la ada car trop d'erreur de manque de place dispo du scheduler

• Kévin GILLET (16 Jul 26)

  fix: use prod kubeconfig

• semantic-release-bot (14 Jul 26)

  chore(release): 1.62.0 [skip ci] # [1.62.0](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.61.1...v1.62.0) (2026-07-14) ### Features * replace longrunning operations with workflow engine and add managed services ([af3ab57](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/af3ab57ad5ee86e66946c388c2fe94ec1392de30))

• Thomas Tartrau (14 Jul 26)

  feat: replace longrunning operations with workflow engine and add managed services Replace the old operation-based async system with a new workflow engine that supports scheduled execution, locking, and status tracking. Add full managed services support across the stack: backend (service, repo, routes, migrations, worker), console frontend (pages, components, services), node-sdk (proto, generated clients, fixtures), and authz schema.

• François-Guillaume Ribreau (17 May 26)

  ci(runners): re-route heavy Rust jobs to ada6000 (group_runners_enabled OK) Reapplies commit b060db3b after activation of group_runners_enabled=true côté GitLab Settings → CI/CD → Runners du projet plateforme. La tentative précédente (b060db3b → 01845662 revert) avait été bloquée car les group runners n'étaient pas exposés au projet. Baseline SaaS (pipeline 2531865730, runner kube cluster fr) : - unit tests / controlplane : 308s - code style / controlplane : 132s Gain attendu sur ada6000 (24 threads physiques + 8 CPU runner cap + cache S3 MinIO local) : ~30-50% sur ces 2 jobs CPU-bound Rust standalone.

• semantic-release-bot (17 May 26)

  chore(release): 1.61.1 [skip ci] ## [1.61.1](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.61.0...v1.61.1) (2026-05-17) ### Reverts * Revert "ci(runners): offload heavy Rust jobs to on-prem ada6000 runner" ([0184566](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/01845662d3d703ba3e192308ef2c34863d9f8ee1))

• François-Guillaume Ribreau (17 May 26)

  Revert "ci(runners): offload heavy Rust jobs to on-prem ada6000 runner" This reverts commit b060db3b. The on-prem-ada6000 group runner is online and idle but the plateforme project has `group_runners_enabled: false` in its CI settings, so the group-scoped runner is not visible to this project. Tagged jobs stay in `pending` forever and block the pipeline. Prerequisite before re-introducing the tag: enable group runners on the project (Settings > CI/CD > Runners > "Enable group runners") OR re-register the ada6000 runner as a project-level runner on plateforme. The candidate jobs remain `code style / controlplane` (~120s cargo fmt + clippy workspace) and `unit tests / controlplane` (~300s cargo test workspace + postgres) — both pure-CPU Rust workloads with no cluster-fr dependency that would benefit from the 24-thread on-prem runner.

• François-Guillaume Ribreau (17 May 26)

  ci(runners): offload heavy Rust jobs to on-prem ada6000 runner Tag `code style / controlplane` (cargo fmt + clippy workspace, ~120s baseline) and `unit tests / controlplane` (cargo test workspace + postgres, ~300s baseline) on the dedicated on-prem-ada6000 runner. These two jobs are pure-CPU/RAM Rust workloads with no dependency on the france-nuage k8s cluster (no kubectl, no helm, no cluster-fr kubeconfig). The ada6000 runner (24 threads / 60 GiB) provides significantly more parallelism than the in-cluster runners, which should cut workspace build + test wall-clock time noticeably. KUBERNETES_*_LIMIT bumped to 8 CPU / 16-20 GiB on these jobs so the runner-side pod scheduler exposes enough resources to cargo. Buildkit-driven `build /*` jobs are intentionally NOT moved: they provision a buildx instance against KUBE_CI_NAMESPACE_NAME inside the france-nuage cluster, so they must keep running on the in-cluster runner. Likewise for deploy/cleanup/system-tests stages.

• semantic-release-bot (06 Apr 26)

  chore(release): 1.61.0 [skip ci] # [1.61.0](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.60.0...v1.61.0) (2026-04-06) ### Features * add beta page ([b4a036d](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/b4a036d216fd361ce475694c86a4f35f61199ab9))

• Robin (06 Apr 26)

  feat: add beta page

• semantic-release-bot (06 Apr 26)

  chore(release): 1.60.0 [skip ci] # [1.60.0](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/compare/v1.59.0...v1.60.0) (2026-04-06) ### Bug Fixes * invalid console production iam parameters ([d610003](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/d610003f2b83ee33bbd6643a4596290395e63ffd)) * on commente la partie deploy et cleanup inutilisée pour le moment ([94b9586](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/94b95863944ff58a8aeba28593cb2b84ec2c16d3)) * on ne deploy pas sur le kube pour le moment ([bd46e60](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/bd46e60e1cb380af301efe8fed60637dc41f40f1)) * on ne garde que le deploy sur kube pour les branche autre que master ([54f58df](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/54f58dffb37e963bcf09ee19e86faf8b8a57d510)) * on rajoute le step de deploy manquant ([685da95](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/685da953155508bb399b063959bca2ceb89bd7f2)) ### Features * add vm resize ([42cad2e](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/42cad2e52207c4ecb2606eccea5e2c36030296ef)) * using sealed secret for production ([1035205](https://gitlab.com/getbunker-france-nuage/france-nuage/plateforme/commit/1035205fa39a45fed1fe621d4cd4b0a09e37f58e))

• Kévin GILLET (06 Apr 26)

  fix: on rajoute le step de deploy manquant

• Kévin GILLET (06 Apr 26)

  fix: on ne garde que le deploy sur kube pour les branche autre que master

• Kévin GILLET (06 Apr 26)

  fix: on commente la partie deploy et cleanup inutilisée pour le moment

• Kévin GILLET (06 Apr 26)

  fix: on ne deploy pas sur le kube pour le moment

• Robin (03 Apr 26)

  fix: invalid console production iam parameters

• Leo Dautriche (23 Feb 26)

  test