Add Vaclab NTP Server and Update Panels

ansible/inventory.yaml

@@ -1,4 +1,12 @@
 ---
+# Hosts that run a vaclab-ntp server pod (hostNetwork) locally. Their system
+# clock is already disciplined directly by that pod's chronyd, so they must
+# NOT also run a native host-level chrony client - two chronyd instances
+# steering the same kernel clock fight each other and cause large offsets.
+ntp_server_hosts:
+  hosts:
+    metal-01.he-eu-hel1.misc.vacdst.status.im:
+
 k3s_cluster:
   children:
     server:

ansible/playbooks/chrony_report.yaml

@@ -0,0 +1,90 @@
+---
+- name: Gather chrony tracking status from client hosts
+  hosts: k3s_cluster:!ntp_server_hosts
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Get chrony tracking summary (host-level)
+      ansible.builtin.shell: |
+        set -o pipefail
+        chronyc tracking | awk -F': ' '
+          /^Stratum/ {stratum=$2}
+          /^System time/ {
+            split($2, a, " "); v = a[1] + 0
+            if ($2 ~ /fast/) v = -v
+            sys_ms = v * 1000
+          }
+          /^Last offset/ {
+            split($2, a, " "); lastoff_ms = (a[1] + 0) * 1000
+          }
+          /^RMS offset/ {
+            split($2, a, " "); rms_ms = (a[1] + 0) * 1000
+          }
+          /^Root dispersion/ {
+            split($2, a, " "); rootdisp_ms = (a[1] + 0) * 1000
+          }
+          /^Leap status/ {leap=$2}
+          END {printf "%s,%.3f,%.3f,%.3f,%.3f,%s", stratum, sys_ms, lastoff_ms, rms_ms, rootdisp_ms, leap}
+        '
+      args:
+        executable: /bin/bash
+      register: chrony_summary
+      changed_when: false
+
+# ntp_server_hosts (currently just metal-01) have no host-level chronyc
+# anymore - only the co-located ntp-server pod (replicas: 1, ordinal 0)
+# disciplines that host's clock. Query the pod itself instead.
+- name: Gather chrony tracking status from the vaclab-ntp server pod
+  hosts: server[0]
+  become: false
+  gather_facts: false
+  environment:
+    KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+  tasks:
+    - name: Get chrony tracking summary from ntp-server-0
+      ansible.builtin.shell: |
+        set -o pipefail
+        kubectl exec -n vaclab-ntp ntp-server-0 -- chronyc tracking | awk -F': ' '
+          /^Stratum/ {stratum=$2}
+          /^System time/ {
+            split($2, a, " "); v = a[1] + 0
+            if ($2 ~ /fast/) v = -v
+            sys_ms = v * 1000
+          }
+          /^Last offset/ {
+            split($2, a, " "); lastoff_ms = (a[1] + 0) * 1000
+          }
+          /^RMS offset/ {
+            split($2, a, " "); rms_ms = (a[1] + 0) * 1000
+          }
+          /^Root dispersion/ {
+            split($2, a, " "); rootdisp_ms = (a[1] + 0) * 1000
+          }
+          /^Leap status/ {leap=$2}
+          END {printf "%s,%.3f,%.3f,%.3f,%.3f,%s", stratum, sys_ms, lastoff_ms, rms_ms, rootdisp_ms, leap}
+        '
+      args:
+        executable: /bin/bash
+      register: chrony_summary_ntp_server_pod
+      changed_when: false
+
+- name: Display cluster-wide chrony sync table
+  hosts: server[0]
+  become: false
+  gather_facts: false
+  tasks:
+    - name: Print combined table
+      vars:
+        header: "{{ '%-32s %-8s %12s %14s %10s %14s %-8s' | format('HOST', 'STRATUM', 'OFFSET(ms)', 'LASTOFF(ms)', 'RMS(ms)', 'ROOTDISP(ms)', 'LEAP') }}"
+      ansible.builtin.debug:
+        msg: |
+          {{ header }}
+          {% for item in groups['k3s_cluster'] %}
+          {% if item in groups['ntp_server_hosts'] %}
+          {% set f = chrony_summary_ntp_server_pod.stdout.split(',') %}
+          {{ '%-32s %-8s %12s %14s %10s %14s %-8s' | format(item | regex_replace('\.status\.im$', '') ~ ' (via pod)', f[0], f[1], f[2], f[3], f[4], f[5]) }}
+          {% else %}
+          {% set f = hostvars[item].chrony_summary.stdout.split(',') %}
+          {{ '%-32s %-8s %12s %14s %10s %14s %-8s' | format(item | regex_replace('\.status\.im$', ''), f[0], f[1], f[2], f[3], f[4], f[5]) }}
+          {% endif %}
+          {% endfor %}

ansible/playbooks/tasks/chrony_client.yaml

@@ -0,0 +1,33 @@
+---
+- name: Install chrony
+  ansible.builtin.apt:
+    name: chrony
+    state: present
+    update_cache: true
+
+- name: Configure chrony to sync against the internal vaclab-ntp server, with Cloudflare as backup
+  ansible.builtin.copy:
+    dest: /etc/chrony/chrony.conf
+    mode: '0644'
+    content: |
+      # Managed by Ansible: update_chrony_client.yaml
+      # Primary: the sole vaclab-ntp server, hostNetwork on metal-01, so
+      # reached directly on the standard NTP port (123) - no NodePort
+      # involved. Using the full SSH-facing hostname (confirmed resolvable -
+      # it's what every ansible connection in this playbook uses), not the
+      # bare k8s node name, which is a different string and not confirmed
+      # resolvable at the OS/DNS level.
+      server metal-01.he-eu-hel1.misc.vacdst.status.im iburst prefer
+      # Backup: only used if the vaclab-ntp server is unreachable.
+      server time.cloudflare.com iburst
+      driftfile /var/lib/chrony/chrony.drift
+      rtcsync
+      makestep 1.0 3
+      logdir /var/log/chrony
+  notify: Restart chrony
+
+- name: Ensure chrony service is enabled and running
+  ansible.builtin.systemd:
+    name: chrony
+    state: started
+    enabled: true

ansible/playbooks/update_chrony_client.yaml

@@ -0,0 +1,48 @@
+---
+- name: Remove conflicting host-level chrony on vaclab-ntp server hosts
+  hosts: ntp_server_hosts
+  become: true
+  tasks:
+    # These hosts run a vaclab-ntp server pod with hostNetwork: true, whose
+    # chronyd already corrects this host's kernel clock directly. A
+    # second, independent chronyd here would fight it for control over the
+    # same clock and cause instability. 
+    # Disabling the host-level chrony client avoids this conflict.
+    - name: Stop and disable native chrony service
+      ansible.builtin.systemd:
+        name: chrony
+        state: stopped
+        enabled: false
+      ignore_errors: true
+
+    - name: Remove chrony package
+      ansible.builtin.apt:
+        name: chrony
+        state: absent
+
+- name: Configure chrony NTP client on cluster hosts without a local ntp-server pod
+  hosts: k3s_cluster:!ntp_server_hosts
+  become: true
+  handlers:
+    - name: Restart chrony
+      ansible.builtin.systemd:
+        name: chrony
+        state: restarted
+
+  tasks:
+    - name: Apply chrony client configuration
+      ansible.builtin.import_tasks: tasks/chrony_client.yaml
+
+- name: Verify chrony sync status
+  hosts: k3s_cluster
+  become: true
+  tasks:
+    - name: Check chrony sources (or note that this host has no host-level chrony)
+      ansible.builtin.command: chronyc sources
+      register: chrony_sources
+      changed_when: false
+      failed_when: false
+
+    - name: Display chrony sources
+      ansible.builtin.debug:
+        var: chrony_sources.stdout_lines

extras/otlp-trace-test-job.yaml

@@ -23,7 +23,7 @@ spec:
                   key: token
           args:
             - "traces"
-            - "--otlp-endpoint=otlp.lab.vac.dev:30317"
+            - "--otlp-endpoint=otlp.lab.vac.dev:31317"
             - "--otlp-insecure"
             - "--otlp-header"
             - "Authorization=\"Bearer $(OTEL_CLIENT_TOKEN)\""

fleet/dst-dashboard/backend/backend.yaml

@@ -30,7 +30,7 @@ spec:
           effect: "PreferNoSchedule"
       containers:
       - name: dst-dashboard-backend
-        image: mamoutoudiarra/dst-dashboard-backend:v1.3
+        image: mamoutoudiarra/dst-dashboard-backend:v1.4
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000

fleet/dst-dashboard/frontend/frontend.yaml

@@ -30,7 +30,7 @@ spec:
           effect: "PreferNoSchedule"
       containers:
       - name: frontend
-        image: mamoutoudiarra/dst-dashboard-frontend:v0.5
+        image: mamoutoudiarra/dst-dashboard-frontend:v0.6
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 80