Merge branch 'main' into osrm-rm-mode

jkossak · web-flow · commit 7267dc7a72c1 · 2025-10-28T14:11:04.000Z
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -7,7 +7,7 @@
 # someone opens a pull request.
 
 # Everything requires Platform team review by default
-* @johnoloughlin @garyloug @palade @rranjan3 @krishnajs @hyunsun @scottmbaker @damiankopyto @cjnolan @SushilLakra @soniabha-intc @guptagunjan @sys-orch-approve
+* @johnoloughlin @garyloug @palade @rranjan3 @krishnajs @hyunsun @scottmbaker @damiankopyto @cjnolan @SushilLakra @soniabha-intc @guptagunjan @sys-orch-approve @ram-srini @shankarsrinivas1
 
 # Dependabot is used to manage dependencies in this repository. It is configured to automatically open pull requests to
 # update dependencies when new versions are available. The following files are managed by Dependabot and do not require
diff --git a/.github/actions/cypress/action.yaml b/.github/actions/cypress/action.yaml
@@ -40,7 +40,7 @@ runs:
       with:
         repository: open-edge-platform/orch-ui
         path: orch-ui
-        ref: d17f65821d4879b80300d942966ca919f2a51924
+        ref: 1d2a8182411f24dad5bd317f42fe9f631fdcf01a
         persist-credentials: false
     - run: git log -1
       shell: bash
diff --git a/argocd/applications/configs/infra-managers.yaml b/argocd/applications/configs/infra-managers.yaml
@@ -69,7 +69,7 @@ telemetry-manager:
 
 os-resource-manager:
   managerArgs:
-    osProfileRevision: 0.8.5
+    osProfileRevision: ~0.8.5
     osSecurityFeatureEnable: false
     inventoryAddress: "inventory.orch-infra.svc.cluster.local:50051"
     traceURL: "orchestrator-observability-opentelemetry-collector.orch-platform.svc:4318"
diff --git a/argocd/applications/custom/tenancy-init.tpl b/argocd/applications/custom/tenancy-init.tpl
@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2025 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+image:
+  registry: {{.Values.argo.containerRegistryURL }}
+  repository: common/tenancy-init
+imagePullSecrets:
+  {{- with .Values.argo.imagePullSecrets }}
+    {{- toYaml . | nindent 2 }}
+  {{- end }}
diff --git a/argocd/applications/templates/tenancy-init.yaml b/argocd/applications/templates/tenancy-init.yaml
@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2025 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+{{- $appName        := "tenancy-init" }}
+{{- $namespace      := "orch-iam" }}
+{{- $syncWave       := "1200" }}
+---
+{{- if and (index .Values.argo.enabled "multitenant_gateway") (index .Values.argo.enabled "defaultTenancy") }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "{{ $syncWave }}"
+  name: {{$appName}}
+  namespace: {{ required "A valid namespace entry required!" .Values.argo.namespace }}
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: {{ required "A valid projectName entry required!" .Values.argo.project }}
+  sources:
+    - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
+      chart: common/charts/{{$appName}}
+      targetRevision: 25.2.7
+      helm:
+        releaseName: {{$appName}}
+        valuesObject:
+          {{- $customFile := printf "custom/%s.tpl" $appName }}
+          {{- $customConfig := tpl (.Files.Get $customFile) . | fromYaml }}
+          {{- $baseFile := printf "configs/%s.yaml" $appName }}
+          {{- $baseConfig := .Files.Get $baseFile|fromYaml}}
+          {{- $overwrite := (get .Values.postCustomTemplateOverwrite $appName ) | default dict }}
+          {{- mergeOverwrite $baseConfig $customConfig $overwrite | toYaml | nindent 10 }}
+  destination:
+    namespace: {{$namespace}}
+    server: {{ required "A valid targetServer entry required!" .Values.argo.targetServer }}
+  syncPolicy:
+    {{- if .Values.argo.autosync }}
+    automated:
+      prune: false
+      selfHeal: false
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        maxDuration: 3m0s
+        factor: 2
+    {{- end }}
+    syncOptions:
+      - CreateNamespace=true
+{{- end }}
diff --git a/argocd/applications/templates/web-ui-admin.yaml b/argocd/applications/templates/web-ui-admin.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: orch-ui/charts/orch-ui-admin
-      targetRevision: 3.2.0
+      targetRevision: 3.2.1
       helm:
         releaseName: web-ui
         valuesObject:
diff --git a/argocd/applications/templates/web-ui-app-orch.yaml b/argocd/applications/templates/web-ui-app-orch.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: orch-ui/charts/orch-ui-app-orch
-      targetRevision: 3.2.2
+      targetRevision: 3.2.3
       helm:
         releaseName: web-ui
         valuesObject:
diff --git a/argocd/applications/templates/web-ui-cluster-orch.yaml b/argocd/applications/templates/web-ui-cluster-orch.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: orch-ui/charts/orch-ui-cluster-orch
-      targetRevision: 3.2.2
+      targetRevision: 3.2.3
       helm:
         releaseName: web-ui
         valuesObject:
diff --git a/argocd/applications/templates/web-ui-infra.yaml b/argocd/applications/templates/web-ui-infra.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: orch-ui/charts/orch-ui-infra
-      targetRevision: 3.2.4
+      targetRevision: 3.2.6
       helm:
         releaseName: web-ui
         valuesObject:
diff --git a/argocd/applications/templates/web-ui-root.yaml b/argocd/applications/templates/web-ui-root.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: orch-ui/charts/orch-ui-root
-      targetRevision: 3.2.1
+      targetRevision: 3.2.3
       helm:
         releaseName: web-ui
         valuesObject:
diff --git a/design-proposals/eim-modular-decomposition.md b/design-proposals/eim-modular-decomposition.md
@@ -311,6 +311,11 @@ The updated OXM profile architecture supporting Secure Device Onboarding and OS
 > To avoid this we can leverage and automate the device credentials injection and bootstrapping mechanism used by EIM
 > scale testing framework where EIM agents are running in docker containers simulating edge nodes.
 
+Here is another example of **Track #1 (Status Quo + Use Case Enablement)** with Out-of-Band Device Management workflow
+for device vPRO/AMT activation management.
+
+![Modular Workflow for vPRO/AMT Activation Management](images/modular-vpro-amt-activation.png)
+
 - **Track #2 (Bring-Your-Own Infrastructure)**
   - Introduce configuration surfaces that allow customers to plug in third-party identity and secrets backends such
     as Keycloak, Vault, load balancers, Kubernetes clusters, or database services mirroring the flexibility
@@ -387,23 +392,37 @@ components to integrate vPRO device management capabilities into their edge solu
 
 Here are some of the **value additions EIM provides on top of the core Intel DMT**.
 
-- Unified provisioning that chains PXE/HTTPS boot, OS imaging, and DMT agent activation
+- Unified provisioning that chains PXE/HTTPS boot, OS provisioning, and DMT agent activation
   into a single zero-touch workflow, shrinking factory floor and field deployment effort.
 - Vendor-neutral policy engine that detects device-specific vPRO/ISM capabilities at runtime
   and drives conditional actions (power, KVM, remediation) without custom scripting.
-- Managed upgrade pipelines that coordinate firmware, OS, and DMT service rollouts with
+- Managed upgrade pipelines that coordinate firmware, OS, and DMT service rollout with
   staged approvals, compliance gating, and automated CVE closure reporting.
+- Policy based support for vPRO Device management in both Admin (Admin control mode) and
+  Client control mode (CCM) across fleet of devices.
+- Policy-Driven Lifecycle & Compliance:  
+  - Activation intents (conditional profile selection based on hardware inventory).
+  - Ongoing compliance (password rotation cadence, Wi-Fi credential expiry, secure boot posture).
+  - Conditional remediation triggers (auto power cycle on heartbeat failure).
+  - Integrate DMT profile constructs as resources referenced in EMF policies.  
 - Multi-tenant governance model with regional/site hierarchies, granular RBAC, and per-tenant
   secrets isolation that scales DMT beyond single-customer environments.
 - Automated recovery playbooks that restore OS, agents, credentials, and application payloads
   end-to-end, giving operations a deterministic “return-to-known-good” button.
-- Cross-layer Inventory and telemetry lake that fuses hardware counters, OS health,
-  Kubernetes state, and application metrics to expose Intel silicon insights alongside fleet KPIs.
+- Intelligent Telemetry & Analytics Layer:
+  - Cross-layer Inventory and telemetry lake that fuses hardware counters, OS health,
+    Kubernetes state, and application metrics to expose Intel silicon insights alongside fleet KPIs.
+  - Stream device state (connected/disconnected, KVM sessions, SOL usage, boot events) into EMF’s data lake.
+  - ML-driven anomaly detection: flag devices with abnormal remote session frequency or provisioning failures.
+  - Predictive maintenance: combine hardware inventory (via AMT) with performance metrics to forecast failures.  
 - Secure device retirement workflows that orchestrate de-authorization, cryptographic wipe,
   audit evidence capture, and re-inventory of reclaimed assets.
 - Integrated secure remote operations combining audited KVM, just-in-time SSH, and policy-bound
   break-glass controls to keep remediation compliant.
 - Edge-aware reliability features that prevent repeated vPRO activations on lossy or intermittent networks.
+- Enhanced Security & Attestation:
+  - Combine AMT hardware data with EMF’s attestation pipeline: TPM quotes, firmware hash checks, secure boot status.
+  - Cross-correlate with SBOM/HW inventory to produce compliance scorecards.
 
 ### Fine grained E2E vPRO workflows
 
diff --git a/design-proposals/images/modular-vpro-amt-activation.png b/design-proposals/images/modular-vpro-amt-activation.png
diff --git a/installer/cluster.tpl b/installer/cluster.tpl
@@ -22,6 +22,7 @@ root:
     - orch-configs/profiles/resource-default.yaml
     ${AWS_PROD_PROFILE}
     ${O11Y_PROFILE}
+    ${SINGLE_TENANCY_PROFILE}
     ${EMAIL_PROFILE}
     ${AUTOCERT_PROFILE}
     - orch-configs/profiles/artifact-rs-production-noauth.yaml
diff --git a/installer/configure-cluster.sh b/installer/configure-cluster.sh
@@ -119,6 +119,11 @@ else
     export SRE_PROFILE="#- orch-configs/profiles/enable-sre.yaml"
 fi
 
+if [ -z $SINGLE_TENANCY ]; then
+    export SINGLE_TENANCY_PROFILE="#- orch-configs/profiles/enable-singleTenancy.yaml"
+else
+    export SINGLE_TENANCY_PROFILE="- orch-configs/profiles/enable-singleTenancy.yaml"
+
 if [ "${DISABLE_O11Y:-false}" = "true" ]; then
     export O11Y_ENABLE_PROFILE="#- orch-configs/profiles/enable-o11y.yaml"
 else
diff --git a/installer/utils.sh b/installer/utils.sh
@@ -93,6 +93,9 @@ load_provision_values() {
             smtp_url)
                 export SMTP_URL="$value"
                 ;;
+            single_tenancy)
+                export SINGLE_TENANCY="$value"
+                ;;
         esac
     done < ${PROVISION_CONFIG_VALUES}
 }
diff --git a/on-prem-installers/onprem/onprem_installer.sh b/on-prem-installers/onprem/onprem_installer.sh
@@ -411,6 +411,9 @@ write_configs_using_overrides() {
     yq -i '.argo.o11y.alertingMonitor.smtp.insecureSkipVerify|=true' "$tmp_dir"/$si_config_repo/orch-configs/clusters/"$ORCH_INSTALLER_PROFILE".yaml
   fi
 
+  if [[ ${SINGLE_TENANCY} == "true" ]]; then
+    yq -i '.root.clusterValues += ["orch-configs/profiles/enable-singleTenancy.yaml"]' "$tmp_dir"/$si_config_repo/orch-configs/clusters/"$ORCH_INSTALLER_PROFILE".yaml
+  fi
   # Override MetalLB address pools
   yq -i '.postCustomTemplateOverwrite.metallb-config.ArgoIP|=strenv(ARGO_IP)' "$tmp_dir"/$si_config_repo/orch-configs/clusters/"$ORCH_INSTALLER_PROFILE".yaml
   yq -i '.postCustomTemplateOverwrite.metallb-config.TraefikIP|=strenv(TRAEFIK_IP)' "$tmp_dir"/$si_config_repo/orch-configs/clusters/"$ORCH_INSTALLER_PROFILE".yaml
@@ -476,6 +479,7 @@ validate_config() {
 ASSUME_YES=false
 SKIP_DOWNLOAD=false
 ENABLE_TRACE=false
+SINGLE_TENANCY=false
 
 if [ -n "${1-}" ]; then
   while :; do
@@ -513,6 +517,9 @@ if [ -n "${1-}" ]; then
         set -x
         ENABLE_TRACE=true
       ;;
+      -st|--single_tenancy)
+        SINGLE_TENANCY="true"
+      ;;
       -w|--write-config)
         WRITE_CONFIG="true"
       ;;
diff --git a/orch-configs/profiles/enable-singleTenancy.yaml b/orch-configs/profiles/enable-singleTenancy.yaml
@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2025 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Enables Single Tenancy by creating a default tenant
+
+argo:
+  enabled:
+    defaultTenancy: true
diff --git a/orch-configs/templates/cluster.tpl b/orch-configs/templates/cluster.tpl
@@ -7,6 +7,9 @@ root:
   useLocalValues: false
   clusterValues:
     - orch-configs/profiles/enable-platform.yaml
+{{- if .Values.enableDefaultTenancy }}
+    - orch-configs/profiles/enable-singleTenancy.yaml
+{{- end }}
 {{- if .Values.enableObservability }}
     - orch-configs/profiles/enable-o11y.yaml
 {{- end }}
diff --git a/pod-configs/module/load-balancer/main.tf b/pod-configs/module/load-balancer/main.tf
@@ -40,6 +40,9 @@ resource "aws_security_group" "common" {
 # Create EIP(if not internal), NLB, Listener, TargetGroup
 resource "aws_eip" "main" {
   for_each = local.subnets_with_eip
+  tags = {
+    Name = "${var.cluster_name}-nlb"
+  }
 }
 resource "aws_lb" "main" {
   name               = substr(sha256("${var.cluster_name}-${var.name}"), 0, 32)
@@ -93,4 +96,4 @@ resource "aws_lb_listener" "main" {
     type             = "forward"
     target_group_arn = aws_lb_target_group.main[each.key].arn
   }
-}
+}
diff --git a/pod-configs/module/vpc-nat-gateway/main.tf b/pod-configs/module/vpc-nat-gateway/main.tf
@@ -4,6 +4,9 @@
 
 resource "aws_eip" "ngw" {
   for_each = var.subnets_with_eip
+  tags = {
+    Name = "${var.vpc_name}-nat-gateway"
+  }
 }
 
 data "aws_subnet" "subnets_with_eip" {
diff --git a/pod-configs/orchestrator/cluster/variable.tf b/pod-configs/orchestrator/cluster/variable.tf
@@ -160,7 +160,7 @@ variable "aurora_postgres_ver_major" {
 }
 variable "aurora_postgres_ver_minor" {
   type    = string
-  default = "9"
+  default = "17"
 }
 variable "aurora_min_acus" {
   # 1 ACU ~= 2GB memory
