[```firestartr-bootstrap```] Errors detected in the bootstrap of a new customer

[frmadem]

Motivation

There are harcoded envs in the render of the files pushed to the repo:

1. https://github.com/prefapp/daggerverse/blob/main/firestartr-bootstrap/deployment.go#L185
2. https://github.com/prefapp/daggerverse/blob/main/firestartr-bootstrap/deployment.go#L159

Related issues

• https://github.com/prefapp/gitops-k8s/issues/1422

[jalvarezit]

Bootstrap process uses the following values in firestartr helm chart:

controller:
  enabled: true
  secretStoreKeysRefs:
    githubAppId: /firestartr/<CUSTOMER>/fs-<CUSTOMER>-admin/app-id # NOTE ADMIN APP
    githubAppPem: /firestartr/<CUSTOMER>/fs-<CUSTOMER>-admin/pem
  metrics:
    enabled: true
  datadog:
    enabled: true
    service: "firestartr-controller-<CUSTOMER>"
    extraTags:
      tenant: <TENANT>
      datacenter: aws-eu-west-1
    apm:
      enabled: true
      correlateLogs: true
      traceSampleRate:
        enabled: true

We should not use admin app for the controller, we should use it's own GitHub App with scoped privileges.

[jalvarezit]

Additionally there is some stuff in the configuration that is a bit confusing or misleading.

In the CredentialsFile.yaml we have the following info:

argoCD:
  githubAppId: "..."
  githubAppInstallationId: "..."
githubApp:
  owner: ...
  botName: "fs-...[bot]"
  prefappBotPat: "..." # Prefapp Bot's PAT
  operatorPat: "..."

Firstly argoCD block should not be configured, we should take the value from the parameter store. It seems that is from an older version

Then we have a githubApp block that does not configure a GitHub App 🤔 , it should me github instead most likely.

Inside that key we set the owner which corresponds to the GitHub organization name but we are also configuring that in the BootstrapFile.yaml and not sure if that one is even used.

Finally about botName I am not sure if we should set that as we are not signing the commits and I believe that is not being used at the moment either.

[jalvarezit]

Also we need to update the bootstrap to use the latest version of the chart to avoid facing this problem again.

[frmadem]

Bootstrap process uses the following values in firestartr helm chart:

controller:
  enabled: true
  secretStoreKeysRefs:
    githubAppId: /firestartr/<CUSTOMER>/fs-<CUSTOMER>-admin/app-id # NOTE ADMIN APP
    githubAppPem: /firestartr/<CUSTOMER>/fs-<CUSTOMER>-admin/pem
  metrics:
    enabled: true
  datadog:
    enabled: true
    service: "firestartr-controller-<CUSTOMER>"
    extraTags:
      tenant: <TENANT>
      datacenter: aws-eu-west-1
    apm:
      enabled: true
      correlateLogs: true
      traceSampleRate:
        enabled: true

We should not use admin app for the controller, we should use it's own GitHub App with scoped privileges.

@jalvarezit therefore the /firestartr/<CUSTOMER>/fs-<CUSTOMER>/app-id parameter right?

[jalvarezit]

Bootstrap process uses the following values in firestartr helm chart:

controller:
  enabled: true
  secretStoreKeysRefs:
    githubAppId: /firestartr/<CUSTOMER>/fs-<CUSTOMER>-admin/app-id # NOTE ADMIN APP
    githubAppPem: /firestartr/<CUSTOMER>/fs-<CUSTOMER>-admin/pem
  metrics:
    enabled: true
  datadog:
    enabled: true
    service: "firestartr-controller-<CUSTOMER>"
    extraTags:
      tenant: <TENANT>
      datacenter: aws-eu-west-1
    apm:
      enabled: true
      correlateLogs: true
      traceSampleRate:
        enabled: true

We should not use admin app for the controller, we should use it's own GitHub App with scoped privileges.

@jalvarezit therefore the /firestartr/<CUSTOMER>/fs-<CUSTOMER>/app-id parameter right?

that's right

[jalvarezit]

Another problem we saw is that PR created by the bootstrap process in state-argocd uploads:
state-github => apps/firestartr/<customer_name>
state-infra => apps/firestartr/<customer_name>

Example: https://github.com/firestartr-pro/state-argocd/pull/12/changes/c26cfc888b5d263dcb2b90ee9440bb7c64a6ccb1

Fix:
https://github.com/firestartr-pro/state-argocd/pull/13