From 88f43bdb48fafa122eeb28c1b0d691b8a1b7b367 Mon Sep 17 00:00:00 2001 From: Itai Segall Date: Fri, 21 Aug 2026 18:59:24 +0000 Subject: [PATCH 1/4] wip Signed-off-by: Itai Segall --- cluster/pulumi/infra/sweet.ts | 52 +++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 cluster/pulumi/infra/sweet.ts diff --git a/cluster/pulumi/infra/sweet.ts b/cluster/pulumi/infra/sweet.ts new file mode 100644 index 0000000000..df321d848a --- /dev/null +++ b/cluster/pulumi/infra/sweet.ts @@ -0,0 +1,52 @@ +// Copyright (c) 2024 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +import * as gcp from '@pulumi/gcp'; +import * as k8s from '@pulumi/kubernetes'; +import { + HELM_MAX_HISTORY_SIZE, + exactNamespace, + infraAffinityAndTolerations, +} from '@canton-network/splice-pulumi-common'; + +//helm install --namespace sweet --create-namespace sweet-operator +// oci://registry.sweet.security/helm/operatorchart --set sweet.apiKey=[...] --set sweet.secret=[...] + +export function configureSweet(): k8s.helm.v3.Release { + const operatorNs = exactNamespace('sweet-operator', false, true); + const sweetNs = exactNamespace('sweet', false, true); + + const apiKey = gcp.secretmanager.getSecretVersionOutput({ + secret: 'sweet-api-key', + }).secretData; + const secret = gcp.secretmanager.getSecretVersionOutput({ + secret: 'sweet-secret', + }).secretData; + + + return new k8s.helm.v3.Release( + 'sweet', + { + name: 'sweet', + chart: 'operatorchart', + version: '1.0.265090', + namespace: sweetNs.ns.metadata.name, + repositoryOpts: { + repo: 'oci://registry.sweet.security/helm', + }, + values: { + apiKey, + secret, + operator: { + ...infraAffinityAndTolerations, + } + }, + maxHistory: HELM_MAX_HISTORY_SIZE, + }, + { + dependsOn: [operatorNs.ns, sweetNs.ns], + } + + ); + +} From 1d9878d75c9d233eb04c9e0e0e6034c4dad5f66c Mon Sep 17 00:00:00 2001 From: Itai Segall Date: Mon, 24 Aug 2026 17:56:19 +0000 Subject: [PATCH 2/4] . Signed-off-by: Itai Segall --- cluster/pulumi/infra/src/index.ts | 3 +++ cluster/pulumi/infra/sweet.ts | 33 +++++++++++++++++++------------ 2 files changed, 23 insertions(+), 13 deletions(-) diff --git a/cluster/pulumi/infra/src/index.ts b/cluster/pulumi/infra/src/index.ts index 10b83d3b17..24c316fb9c 100644 --- a/cluster/pulumi/infra/src/index.ts +++ b/cluster/pulumi/infra/src/index.ts @@ -21,6 +21,7 @@ import { deployGCPodReaper } from './maintenance'; import { configureNetwork } from './network'; import { configureReloader } from './reloader'; import { configureStorage } from './storage'; +import { configureSweet } from '../sweet'; const network = configureNetwork(clusterBasename, clusterBaseDomain); @@ -64,6 +65,8 @@ configureStorage(); configureReloader(); +configureSweet(); + installExtraCustomResources(); if (enableGCReaperJob) { diff --git a/cluster/pulumi/infra/sweet.ts b/cluster/pulumi/infra/sweet.ts index df321d848a..717c02c2f3 100644 --- a/cluster/pulumi/infra/sweet.ts +++ b/cluster/pulumi/infra/sweet.ts @@ -9,9 +9,6 @@ import { infraAffinityAndTolerations, } from '@canton-network/splice-pulumi-common'; -//helm install --namespace sweet --create-namespace sweet-operator -// oci://registry.sweet.security/helm/operatorchart --set sweet.apiKey=[...] --set sweet.secret=[...] - export function configureSweet(): k8s.helm.v3.Release { const operatorNs = exactNamespace('sweet-operator', false, true); const sweetNs = exactNamespace('sweet', false, true); @@ -23,22 +20,32 @@ export function configureSweet(): k8s.helm.v3.Release { secret: 'sweet-secret', }).secretData; - return new k8s.helm.v3.Release( - 'sweet', + 'sweet-operator', { - name: 'sweet', - chart: 'operatorchart', - version: '1.0.265090', + name: 'sweet-operator', + chart: 'oci://registry.sweet.security/helm/operatorchart', + version: '1.0.265090+06a1b12d61fc35ceb20b350388f7e812d382e4b2', namespace: sweetNs.ns.metadata.name, - repositoryOpts: { - repo: 'oci://registry.sweet.security/helm', - }, values: { - apiKey, - secret, + sweet: { + apiKey, + secret, + }, operator: { ...infraAffinityAndTolerations, + }, + frontier: { + extraValues: { + informer: { + ...infraAffinityAndTolerations, + }, + } + }, + admiral: { + extraValues: { + ...infraAffinityAndTolerations, + }, } }, maxHistory: HELM_MAX_HISTORY_SIZE, From 92b9a52b56c865382df5c946015f29701ef6151a Mon Sep 17 00:00:00 2001 From: Itai Segall Date: Wed, 26 Aug 2026 19:16:10 +0000 Subject: [PATCH 3/4] [static] . Signed-off-by: Itai Segall --- cluster/pulumi/infra/src/index.ts | 2 +- cluster/pulumi/infra/sweet.ts | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/cluster/pulumi/infra/src/index.ts b/cluster/pulumi/infra/src/index.ts index 24c316fb9c..13081ef28a 100644 --- a/cluster/pulumi/infra/src/index.ts +++ b/cluster/pulumi/infra/src/index.ts @@ -5,6 +5,7 @@ import * as k8s from '@pulumi/kubernetes'; import { config } from '@canton-network/splice-pulumi-common'; import { svsConfig } from '@canton-network/splice-pulumi-common-sv/src/config'; +import { configureSweet } from '../sweet'; import { configureAuth0 } from './auth0'; import { configureCloudArmorPolicy } from './cloudArmor'; import { @@ -21,7 +22,6 @@ import { deployGCPodReaper } from './maintenance'; import { configureNetwork } from './network'; import { configureReloader } from './reloader'; import { configureStorage } from './storage'; -import { configureSweet } from '../sweet'; const network = configureNetwork(clusterBasename, clusterBaseDomain); diff --git a/cluster/pulumi/infra/sweet.ts b/cluster/pulumi/infra/sweet.ts index 717c02c2f3..b0d78430c9 100644 --- a/cluster/pulumi/infra/sweet.ts +++ b/cluster/pulumi/infra/sweet.ts @@ -44,7 +44,9 @@ export function configureSweet(): k8s.helm.v3.Release { }, admiral: { extraValues: { - ...infraAffinityAndTolerations, + admirald: { + ...infraAffinityAndTolerations, + }, }, } }, From 24807743c109cbafd56ccb817731df73924886a5 Mon Sep 17 00:00:00 2001 From: Itai Segall Date: Thu, 27 Aug 2026 11:46:42 +0000 Subject: [PATCH 4/4] [static] . Signed-off-by: Itai Segall --- cluster/pulumi/infra/src/config.ts | 1 + cluster/pulumi/infra/src/index.ts | 4 +++- cluster/pulumi/infra/sweet.ts | 12 ++++++------ 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/cluster/pulumi/infra/src/config.ts b/cluster/pulumi/infra/src/config.ts index 3d42081c5d..a82d449669 100644 --- a/cluster/pulumi/infra/src/config.ts +++ b/cluster/pulumi/infra/src/config.ts @@ -60,6 +60,7 @@ export const InfraConfigSchema = z.object({ initialConnectionWindowSize: z.int(), }), }), + enableSweetSecurity: z.boolean().default(false), extraCustomResources: z.object({}).catchall(z.any()).default({}), }), cloudArmor: CloudArmorConfigSchema, diff --git a/cluster/pulumi/infra/src/index.ts b/cluster/pulumi/infra/src/index.ts index 13081ef28a..cac6cdc412 100644 --- a/cluster/pulumi/infra/src/index.ts +++ b/cluster/pulumi/infra/src/index.ts @@ -65,7 +65,9 @@ configureStorage(); configureReloader(); -configureSweet(); +if (infraConfig.enableSweetSecurity) { + configureSweet(); +} installExtraCustomResources(); diff --git a/cluster/pulumi/infra/sweet.ts b/cluster/pulumi/infra/sweet.ts index b0d78430c9..67cf473f88 100644 --- a/cluster/pulumi/infra/sweet.ts +++ b/cluster/pulumi/infra/sweet.ts @@ -6,12 +6,12 @@ import * as k8s from '@pulumi/kubernetes'; import { HELM_MAX_HISTORY_SIZE, exactNamespace, - infraAffinityAndTolerations, + infraKubernetesScheduling, } from '@canton-network/splice-pulumi-common'; export function configureSweet(): k8s.helm.v3.Release { - const operatorNs = exactNamespace('sweet-operator', false, true); - const sweetNs = exactNamespace('sweet', false, true); + const operatorNs = exactNamespace('sweet-operator', false, false); + const sweetNs = exactNamespace('sweet', false, false); const apiKey = gcp.secretmanager.getSecretVersionOutput({ secret: 'sweet-api-key', @@ -33,19 +33,19 @@ export function configureSweet(): k8s.helm.v3.Release { secret, }, operator: { - ...infraAffinityAndTolerations, + ...infraKubernetesScheduling, }, frontier: { extraValues: { informer: { - ...infraAffinityAndTolerations, + ...infraKubernetesScheduling, }, } }, admiral: { extraValues: { admirald: { - ...infraAffinityAndTolerations, + ...infraKubernetesScheduling, }, }, }