fix umami prod argocd

changes:
  - creating qa and prod overlays
  - better manifest labeling
  - docs updates with deployment timing information

Signed-off-by: greg pereira <[email protected]>

.gitignore

@@ -29,4 +29,5 @@ pathservice.pid
 playwright/.auth
 # dont track secrets in git
 deploy/k8s/overlays/kind/umami/umami-secret.yaml
-deploy/k8s/overlays/openshift/umami/umami-secret.yaml
+deploy/k8s/overlays/openshift/umami/qa/umami-secret.yaml
+deploy/k8s/overlays/openshift/umami/prod/umami-secret.yaml

Makefile

@@ -193,7 +193,6 @@ deploy-umami-kind: wait-for-readiness load-images
 	$(CMD_PREFIX) kubectl --context=$(ILAB_KUBE_CONTEXT) create namespace $(UMAMI_KUBE_NAMESPACE) --dry-run=client -o yaml | kubectl apply -f -
 	$(CMD_PREFIX) bash -c "source .env && \
 		deploy/k8s/base/umami/deploy-umami-openshift-env-secret-conversion.sh KIND $(UMAMI_KUBE_NAMESPACE)"
-	$(CMD_PREFIX) kubectl create -f ./deploy/k8s/overlays/kind/umami/umami-secret.yaml
 	$(CMD_PREFIX) kubectl --context=$(ILAB_KUBE_CONTEXT) apply -k ./deploy/k8s/overlays/kind/umami
 	$(CMD_PREFIX) echo "Waiting for Umami Deployment (pods: postgresql and umami) ..."
 	$(CMD_PREFIX) kubectl --context=$(ILAB_KUBE_CONTEXT) wait --for=condition=Ready pods -n $(UMAMI_KUBE_NAMESPACE) --all -l app.kubernetes.io/part-of=umami --timeout=15m
@@ -203,7 +202,6 @@ deploy-umami-kind: wait-for-readiness load-images
 .PHONY: undeploy-umami-kind
 undeploy-umami-kind:
 	-$(CMD_PREFIX) kubectl --context=$(ILAB_KUBE_CONTEXT) scale --replicas=0 deployment/umami -n $(UMAMI_KUBE_NAMESPACE)
-	-$(CMD_PREFIX) kubectl --context=$(ILAB_KUBE_CONTEXT) delete -f ./deploy/k8s/overlays/kind/umami/umami-secret.yaml
 	-$(CMD_PREFIX) kubectl --context=$(ILAB_KUBE_CONTEXT) delete -k ./deploy/k8s/overlays/kind/umami
 
 .PHONY: start-dev-kind ## Run the development environment on Kind cluster
@@ -240,9 +238,8 @@ deploy-umami-qa-openshift:
 	fi
 	$(CMD_PREFIX) $(OC) create namespace $(UMAMI_KUBE_NAMESPACE) --dry-run=client -o yaml | $(OC) apply -f -
 	$(CMD_PREFIX) source .env && \
-		deploy/k8s/base/umami/deploy-umami-openshift-env-secret-conversion.sh OPENSHIFT $(UMAMI_KUBE_NAMESPACE)
-	$(CMD_PREFIX) $(OC) apply -f ./deploy/k8s/overlays/openshift/umami/umami-secret.yaml
-	$(CMD_PREFIX) $(OC) apply -k ./deploy/k8s/overlays/openshift/umami
+		deploy/k8s/base/umami/deploy-umami-openshift-env-secret-conversion.sh QA_OPENSHIFT $(UMAMI_KUBE_NAMESPACE)
+	$(CMD_PREFIX) $(OC) apply -k ./deploy/k8s/overlays/openshift/umami/qa
 	$(CMD_PREFIX) echo "Waiting for Umami Deployment (pods: postgresql and umami) ..."
 	$(CMD_PREFIX) $(OC) wait --for=condition=Ready pods -n $(UMAMI_KUBE_NAMESPACE) --all -l app.kubernetes.io/part-of=umami --timeout=15m
 	$(CMD_PREFIX) umami_route=$$($(OC) get route umami -n $(UMAMI_KUBE_NAMESPACE) | tail -n 1 | awk '{print $$2}') ; \
@@ -251,8 +248,7 @@ deploy-umami-qa-openshift:
 .PHONY: undeploy-umami-qa-openshift
 undeploy-umami-qa-openshift:
 	-$(CMD_PREFIX) $(OC) scale --replicas=0 deployment/umami -n $(UMAMI_KUBE_NAMESPACE)
-	-$(CMD_PREFIX) $(OC) delete -f ./deploy/k8s/overlays/openshift/umami/umami-secret.yaml
-	-$(CMD_PREFIX) $(OC) delete -k ./deploy/k8s/overlays/openshift/umami
+	-$(CMD_PREFIX) $(OC) delete -k ./deploy/k8s/overlays/openshift/umami/qa
 
 .PHONY: deploy-prod-openshift
 deploy-prod-openshift: ## Deploy production stack of the InstructLab UI on OpenShift
@@ -284,13 +280,12 @@ deploy-umami-prod-openshift: check-kubeseal check-sealed-secrets-controller
 	fi
 	$(CMD_PREFIX) $(OC) create namespace $(UMAMI_KUBE_NAMESPACE) --dry-run=client -o yaml | $(OC) apply -f -
 	$(CMD_PREFIX) source .env && \
-		deploy/k8s/base/umami/deploy-umami-openshift-env-secret-conversion.sh "OPENSHIFT" $(UMAMI_KUBE_NAMESPACE)
-	$(CMD_PREFIX) cat deploy/k8s/overlays/openshift/umami/umami-secret.yaml | kubeseal \
+		deploy/k8s/base/umami/deploy-umami-openshift-env-secret-conversion.sh PROD_OPENSHIFT $(UMAMI_KUBE_NAMESPACE)
+	$(CMD_PREFIX) cat ./deploy/k8s/overlays/openshift/umami/prod/umami-secret.yaml | kubeseal \
 		--controller-name=${SEALED_SECRETS_CONTROLLER_NAME} \
 		--controller-namespace=${SEALED_SECRETS_CONTROLLER_NAMESPACE} \
-		--format yaml > ./deploy/k8s/overlays/openshift/umami/umami-secret.sealedsecret.yaml
-	$(CMD_PREFIX) $(OC) apply -f deploy/k8s/overlays/openshift/umami/umami-secret.sealedsecret.yaml
-	$(CMD_PREFIX) $(OC) apply -k deploy/k8s/overlays/openshift/umami
+		--format yaml > ./deploy/k8s/overlays/openshift/umami/prod/umami-secret.sealedsecret.yaml
+	$(CMD_PREFIX) $(OC) apply -k ./deploy/k8s/overlays/openshift/umami/prod
 	$(CMD_PREFIX) echo "Waiting for Umami Deployment (pods: postgresql and umami) ..."
 	$(CMD_PREFIX) $(OC) wait --for=condition=Ready pods -n $(UMAMI_KUBE_NAMESPACE) --all -l app.kubernetes.io/part-of=umami --timeout=15m
 	$(CMD_PREFIX) umami_route=$$($(OC) get route umami -n $(UMAMI_KUBE_NAMESPACE) | tail -n 1 | awk '{print $$2}') ; \
@@ -299,8 +294,7 @@ deploy-umami-prod-openshift: check-kubeseal check-sealed-secrets-controller
 .PHONY: undeploy-umami-prod-openshift
 undeploy-umami-prod-openshift:
 	-$(CMD_PREFIX) $(OC) scale --replicas=0 deployment/umami -n $(UMAMI_KUBE_NAMESPACE)
-	-$(CMD_PREFIX) $(OC) delete -f ./deploy/k8s/overlays/openshift/umami/umami-secret.sealedsecret.yaml
-	-$(CMD_PREFIX) $(OC) delete -k ./deploy/k8s/overlays/openshift/umami
+	-$(CMD_PREFIX) $(OC) delete -k ./deploy/k8s/overlays/openshift/umami/prod
 
 .PHONY: check-dev-container-installed
 check-dev-container-installed:

deploy/k8s/base/umami/deploy-umami-openshift-env-secret-conversion.sh

@@ -11,27 +11,32 @@ fi
 
 if [ "$#" -ne 2 ]; then
     echo "USAGE: $0 TARGET NAMESPACE
-      TARGET:     The deployment target. Options: [\"OPENSHIFT\", \"KIND\"]
+      TARGET:     The deployment target. Options: [\"KIND\", \"QA_OPENSHIFT\", \"PROD_OPENSHIFT\"]
       NAMESPACE:  The namespace where you want to deploy the umami-secret." 1>&2
     exit 1
 fi
 
 TARGET="$1"
 NAMESPACE="$2"
 
-if [ "${TARGET}" == "OPENSHIFT" ]; then
-  UMAMI_SECRET_FILE_PATH="deploy/k8s/overlays/openshift/umami/umami-secret.yaml"
-  UMAMI_DATABASE_NAME_KEY_NAME=POSTGRESQL_DATABASE
-  UMAMI_DATABASE_USER_KEY_NAME=POSTGRESQL_USER
-  UMAMI_DATABASE_PASSWORD_KEY_NAME=POSTGRESQL_PASSWORD
-elif [ "${TARGET}" == "KIND" ]; then
+if [ "${TARGET}" == "KIND" ]; then
   UMAMI_SECRET_FILE_PATH="deploy/k8s/overlays/kind/umami/umami-secret.yaml"
   UMAMI_DATABASE_NAME_KEY_NAME=POSTGRES_DB
   UMAMI_DATABASE_USER_KEY_NAME=POSTGRES_USER
   UMAMI_DATABASE_PASSWORD_KEY_NAME=POSTGRES_PASSWORD
+elif [ "${TARGET}" == "QA_OPENSHIFT" ]; then
+  UMAMI_SECRET_FILE_PATH="deploy/k8s/overlays/openshift/umami/qa/umami-secret.yaml"
+  UMAMI_DATABASE_NAME_KEY_NAME=POSTGRESQL_DATABASE
+  UMAMI_DATABASE_USER_KEY_NAME=POSTGRESQL_USER
+  UMAMI_DATABASE_PASSWORD_KEY_NAME=POSTGRESQL_PASSWORD
+elif [ "${TARGET}" == "PROD_OPENSHIFT" ]; then
+  UMAMI_SECRET_FILE_PATH="deploy/k8s/overlays/openshift/umami/prod/umami-secret.yaml"
+  UMAMI_DATABASE_NAME_KEY_NAME=POSTGRESQL_DATABASE
+  UMAMI_DATABASE_USER_KEY_NAME=POSTGRESQL_USER
+  UMAMI_DATABASE_PASSWORD_KEY_NAME=POSTGRESQL_PASSWORD
 else
   echo "Error, \$TARGET ${TARGET} not recongnized.
-    TARGET options: [\"OPENSHIFT\", \"KIND\"]"
+    TARGET options: [\"KIND\", \"QA_OPENSHIFT\", \"PROD_OPENSHIFT\"]"
   exit 1
 fi
 
@@ -73,6 +78,9 @@ kubectl create secret generic umami-secret \
   --dry-run=client \
   -o yaml > ${UMAMI_SECRET_FILE_PATH}
 
-yq eval ".metadata.labels.cluster_domain = \"${cluster_domain}\"" -i ${UMAMI_SECRET_FILE_PATH}
+yq eval ".metadata.labels.sealed-secrets-controller-cluster-domain = \"${cluster_domain}\"" -i ${UMAMI_SECRET_FILE_PATH}
+yq eval ".metadata.labels.\"app.kubernetes.io/app\" = \"umami\"" -i ${UMAMI_SECRET_FILE_PATH}
+yq eval ".metadata.labels.\"app.kubernetes.io/instance\" = \"umami\"" -i ${UMAMI_SECRET_FILE_PATH}
+yq eval ".metadata.labels.\"app.kubernetes.io/part-of\" = \"umami\"" -i ${UMAMI_SECRET_FILE_PATH}
 
 echo "Secret manifest has been created: ${UMAMI_SECRET_FILE_PATH}."

deploy/k8s/base/umami/kustomization.yaml

@@ -10,8 +10,6 @@ resources:
 labels:
   - includeSelectors: true
     pairs:
-      app: umami
-      app.kubernetes.io/component: umami
       app.kubernetes.io/instance: umami
       app.kubernetes.io/name: umami
       app.kubernetes.io/part-of: umami

deploy/k8s/base/umami/postgresql-pvc.yaml

@@ -2,6 +2,8 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: umami-postgresql-db-data
+  labels:
+    app.kubernetes.io/component: umami-postgresql
 spec:
   accessModes:
     - ReadWriteOnce

deploy/k8s/base/umami/postgresql-service.yaml

@@ -3,10 +3,10 @@ kind: Service
 metadata:
   name: umami-db
   labels:
-    component: db
+    app.kubernetes.io/component: umami-postgresql
 spec:
   ports:
     - port: 5432
       name: postgres
   selector:
-    app: umami
+    app.kubernetes.io/name: umami

deploy/k8s/base/umami/umami-service.yaml

@@ -4,11 +4,11 @@ kind: Service
 metadata:
   name: umami
   labels:
-    component: web
+    app.kubernetes.io/component: umami-web
 spec:
   ports:
     - name: web
       port: 3001
   selector:
-    app: umami
+    app.kubernetes.io/name: umami
   type: ClusterIP

deploy/k8s/overlays/kind/umami/kustomization.yaml

@@ -4,3 +4,4 @@ namespace: umami
 resources:
   - ../../../base/umami
   - umami-ingress.yaml
+  - umami-secret.yaml

deploy/k8s/overlays/kind/umami/umami-ingress.yaml

@@ -5,6 +5,11 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: nginx
     nginx.ingress.kubernetes.io/rewrite-target: /
+  labels:
+    app.kubernetes.io/component: umami-web
+    app.kubernetes.io/instance: umami
+    app.kubernetes.io/name: umami
+    app.kubernetes.io/part-of: umami
 spec:
   ingressClassName: nginx
   rules:

deploy/k8s/overlays/openshift/umami/kustomization.yaml → deploy/k8s/overlays/openshift/umami/common/kustomization.yaml

@@ -1,9 +1,8 @@
-# Umami will be deployed on the QA cluster but host metrics for both prod and QA
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: umami
 resources:
-  - ../../../base/umami
+  - ../../../../base/umami
   - umami-route.yaml
 patches:
   - target:

deploy/k8s/overlays/openshift/umami/umami-route.yaml → deploy/k8s/overlays/openshift/umami/common/umami-route.yaml

@@ -3,7 +3,10 @@ kind: Route
 metadata:
   name: umami
   labels:
-    name: umami
+    app.kubernetes.io/component: umami-web
+    app.kubernetes.io/instance: umami
+    app.kubernetes.io/name: umami
+    app.kubernetes.io/part-of: umami
 spec:
   port:
     targetPort: 3001

deploy/k8s/overlays/openshift/umami/prod/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../common
+  - umami-secret.sealedsecret.yaml

deploy/k8s/overlays/openshift/umami/prod/umami-secret.sealedsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: umami-secret
+  namespace: umami
+spec:
+  encryptedData:
+    APP_SECRET: AgAQagK0rvYk5ENQKXiUWA8LNWnvEWDTDHOFCZTcfxvqLKCkigfQsjnUiBVhQQd5RR0S6KeeB21JI+4AchRywwtc20NRAsOXvuipc5HTHznBekLNaaoYSgPNvmPPV/wALqcyseM/Nr73NraSJ6WYHrB9O5f9ihetD/saeYACsZNNepXkuRqioIbTZbHHGSeMRV84483WdPfhHGtB2f1rzamS/3GuXEbw4OaHIHBFq4hplwI2cj1qgBAWWr7XGctVhbVRj2QwisNVKsBHyskEOWdFjMHYqwZIVS32EDlz/VMKdh/e8hkPKz9jxWUgsP3rofUhLlE5nvjcBLZmhaPv+0nywwxn6h/d9HZhg8OPHN0L+M/4KJ4veINNCCtWiWorwCMkeO0HJfZmiGRxm2usNZo39Zr3KCpJBL8qBkKbNgBGaRGsilL3mx1J7bJwYinD81SmeqZouwUAbWPGjwM6TS5Vi5CCpYWlX/1idZrq+QCyhFOVYovHjNF9686mbmFvK4tx6Hmhi5fcs8ftJF/kGvTx/REoJhU25VftFwoiuEoVIwJFmU6EXzKKAqnB835bpDssRmNlshkDryWh5dWDo/CD7nNyaASpj0Mtk/aB593HaBqKZOycSzkbCymCx1DKfV0x0F+qxjHFZLIY1l/YlOYerjQpVDFWhjDhUZOjJgciYQQOwLP8fkheTyyCghzYCVxFkgKmduJTqBpL
+    DATABASE_TYPE: AgBtfzP+q2l/1M2RB98XdEBHD1GyuuUTqdEEtx8e8FHC6fOywQlfPZPT1MhesmpQCoKzHxDlf8df78hPPmVjrFJ8OIIR+7H74tgqJog5hZCNQE/eESN/truoGj5BpXbo9ea9Ryr4+7o7jkwc/HgQXWut/viv1EXj2Ztixuj+D6B9kxVfuHs4IfduIbZ0yLY+vvdR64ZU1tRtIamqh4JQCj1I2Y8RdSeUZcU2m30BI5WPB26OeiPbxoFScAvdC41OJJLfIL+axj7cMb9pYgwksGB2cs8cDo32i4pTTJy76UENdrkQzS9OWtCzgWXVPMdfNvbZxqytZ92g9P1Crk06rZt72ZxXr85rNvAYDeDNrrPqjCHCh37NCDL3tjDkhrOzePCKCzwwdRcteQx4aPpFJh4KVq4rGkkKXTbx2tNde60/KrIv+ojaVVf5HvmyeUIUW9jcWOrlrRAXtYqFloV6lggZFjf6paPpy0lvpOAxMAn5a9YTWnixlBGqSbEB5ldbKadjHMvFMrJNOEM9oEkDolmy7QUvjwZ8Q9oZQY54Vmyxsp3LD/S0dYTB2bAV/CTa+Lc7HnAKh3TosHabNAqSEas6TnvtkmDDsHBrDzcpqJBDN0LL5vtk838+BqyNK//ZHB5O4vgX37Pm6KywO7vw857pD8IynFoNRcv3ymephceFS8aaWtxS5po8DXOj4cgJ7l4ZdhXUVc3S0fhb
+    DATABASE_URL: AgAWBQfSSeBS5wNbtktrFOZ7wn+gV6cCjcSQx7SGw0YK3FnF6b1PwyN2HBamSnBCUdjg5bmJ9/sjR27HMHwt3O/wAT8hbiiFAyKg3EkJ6E2a9twUlTvoFLhX097rSygPE1xkQkPo5RobanUT00ZIlurMUXKKGTwesGA60T//Rn4luxu7NXEVlFn4uP9mdQfrE9BGz6IXoC0+Pq0ozMvxdzrEqDnQ0JdD+TqlcGZh3P34jgZxcbgozSw6HP1zeFjwd3GzU8fyBZCAXRd78uo1V2lVVA9QmQeWsIWgQ8Annypa0DL3SffibaTCHO6u+GW/kaj4a1bnaPfFw6alT4g+RNiXBCQ6+9OENAPCzjE1rZkz+v1dGnYSoz1Cu+0deaRyWHXhuDahUufdE9pKJV69iMf7ssd4WXGujm9CGrlK2wEO6FReJjmahZt+i96rLeB/nLxE2o5475x2UWn6mLCA/pdTD2FU847djLwsc96Kn3kVR/CmLOB2CyLKysf+G+p+Nb4id70ELrFtzCywboF35hg+G0gDkFdftS6OEv8D1GzjWOIy7LL1d8DH1cLHTyTTKchh1O2jFOH22dDonUnogXhm7VRxADAxmS32A/05P+VJJYHSiXogmRoX6dCf8oOqbp37N9YncVvCsvSwJMWN6smwSF6Toepq7hAdW6PzrEEEyQm8cp2aDeiobMEBEtFTFQrUK6bkREapGfIJJcVQj/7+fo0AB0w173sHWHTMsXaRSbbzV80JbmpdBxTWnQ==
+    POSTGRESQL_DATABASE: AgCc0Jt1relM83/DECu+S/UwN2lAOpQaQJEnnTmH+2KRF2dOcG+t+rUK4Hg8PotCUFRb65EqVuShByjymTTny8EAbCbmMNPHGHwvu95LjsewDPGeGMFVTq0E+Vjrb+if+6ZDv4VEDIFmNmkY6hoWZ5zufENzrPgVWcTOH+9p9i7wSaQl4gc1TKbU8Z4OOzj0eoLiIDp8k/N7VmwS6hOVKt3P0qRK8tWKOgimZuBm5uxg+EARrj0Y9aX8pDw/8AANFSijLVANUyITZ0qkLsrJ9uSamoy/DHKHBbkIg1QlXC5T/G0CQxO4lAEVsO22wBmy8TishmaYgvU++EhBPr3A67Gv8IaBG2lu0riCq3XtNK/4ze3jHIuHjXzbMA30ih73U4zaaJijrXQQl7MgesSTBrqtj1dwnwEtT2wKdNsaAhSfOneHdnitqefke4KmDLCx3dkaBymdolm6vwXZayKWVqZ53KujQQAgnBeFcvBu3fmKCpLoszWsSgH/3NUL6icrjSq/1CuVSja5IRmgl7sY3ej3EkMyrhim8DOhUETiSPKrBRJYAV6TXL+oHtOkBbWR2wOxkfblrtG150NyqWdL4j1MW/QukLz9Rs9bjHs1yBctatOKk3HFzIMS9phpYMb2p7snIDUUbRdWsx/uL8EiIN0hJw8CifnKib50x5sjVmyIXr+AWFQaeG5lshirN1kbX8LTQyVlIg==
+    POSTGRESQL_PASSWORD: AgB1wXof0RI/cMNmd+aVE6kIChjvxS0woCsm0tVoD0QdB/he0ShV4CP3U8GtLQ8HkizJdaSh+ozyb09YdlRgebFx/DMyzWsuHsMxGD34vx76i++W5WB7g/edw8/DiXBjzfISFYMrrw/tLPw9Wxqw83inASB5V1tfoLKip1QF/KrgOeWp0SUN7vj1tY8aV9W+KhK5ETy2UXb5TNGqn0TsOEAKwccERHYrwEpECVxLqO6CKaosUuQpdzLL6yEse0qBll/w6OQnU6bWEL7faaQz7ahukBXOtAZve5l2DlgXfq4sUobaDfd5wdl8tF+ezy0Wxv8cFMez39ea82LuSiNnjKX4DVZunJlkGDbqepXgM8nYclRRf/VNbw/IE2w3BSf7brvdQTMpEgEOnIUfmhD8p/wu2u3GvZWP9f8wvLK50SBWfid3Jm4aDu9SIyplR8CYVHGptCOdb/jUU7qgYxT9EwGxCkt0l2ZRGZz496tF74oRlpZ7vx2ruKGm0gwjqIdjGvspOpzBAr3t+vBAgGdwjdDZjjJVZepLf4MvI7PwqinBlZqND+RU/xnrwLxWkullX0CeG1uKGRDdt89RTheqY2K7FskOnIyu42ky1ZDBxWSG159mSHtrJY3B38J1ZJYuFeADiTmkvFaPksV4oc+GrnhO1j/GcUdN3Zdte4fOAIorxd3s3v9VAZxJCVI7XwdwwwKKXdIKGg==
+    POSTGRESQL_USER: AgAUVJ1miLrT36XDP3K3hkkexFNbEECuAnT3WLavYrYrhsPzr4kabgdoLA+nozCvrfcGhG0ysf4mAo1Dk80xMlmchRW7yfHzNe/ZM6uKVjV0BKomp7TBnAn0JoWBHA80mbEF/0klLBpiXmgs7csgBd42myPBNLJ/81TUK/xy+SYQa8zZUC8ecoOraLJfVRVgmNq2L4Ajqz5TWV9hPn7GPZSN87wlp2i3o7IC+oHqb5MzsVQUAILlPCPiXpgXSzBf4YI1JSBh5Nj9EhGQ4LYtOYiHH8q93TO42lHZPahw4ZOnjdarTFOfWd5igqw5jW1pVnrgQEIpJ1skdC19WRl1PIKzWF4ijR2IQc5n482wSzG0GMNXxGdY/T/QuGnVwFpqbhyZQt6U34TLMaao7z0RgAyD+qC5Wu/RjhhX+8NOLI9O/oi8hZYIKnbregWK3t6uf8jp0xbrrQ8E2QDxbxf/g9X4KSxdYMR2790ADwIFdA3esXpB3seer5ftbBN55Xg3wLeVAaQT7EM7pKviy0MGMs/bwUs5FSe1+b8t4tOzohMFwwJcZoYC3EE26s1T1ZodE78T1Kt/C9aHVtNGZ68+M/t/szMwdgMOdmp7xV7rQEda4XIaNp6q9ZB4RW+NsKWOt56sRU+zmBoJZ3RZDprwR106Iz2T/1mz0Uc5ktEBpcZw4ElodkEpoHb0aJQWSgGkQHKmHLR9xQ==
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/app: umami
+        app.kubernetes.io/instance: umami
+        app.kubernetes.io/part-of: umami
+        sealed-secrets-controller-cluster-domain: c130-e.us-south.containers.cloud.ibm.com
+      name: umami-secret
+      namespace: umami
+

deploy/k8s/overlays/openshift/umami/qa/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../common
+  - umami-secret.yaml