ymal: compose repeated node lane templates

2026-07-08 06:34:23 +02:00
parent 0cea74367a
commit d083e88bb9
13 changed files with 1232 additions and 1585 deletions
@@ -7,22 +7,20 @@ metadata:
  composition:
    mode: yaml-anchors-and-merge
    intent: node overlays inherit common web-probe sentinel baselines and render node/lane identity from variables.
-
 baselines:
-  sentinel: &sentinel-base
+  sentinel:
    enabled: true
    mode: web-probe-observe-wrapper
-
  runtime:
-    common: &runtime-common
-      namespace: hwlab-${lane}
+    common:
+      namespace: "hwlab-${lane}"
      listenHost: 0.0.0.0
      servicePort: 8080
      pvcStorage: 10Gi
      replicas: 1
      healthPath: /api/health
      metricsPath: /metrics
-      scheduler: &scheduler-10m
+      scheduler:
        intervalMs: 600000
        heartbeatStaleSeconds: 900
        maxConcurrentRuns: 1
@@ -30,11 +28,12 @@ baselines:
      observability:
        otel:
          enabled: true
-          serviceName: hwlab-web-probe-sentinel-${nodeLower}
+          serviceName: "hwlab-web-probe-sentinel-${nodeLower}"
          tracesEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
          sampler: parentbased_traceidratio
          samplerArg: "1"
      kubernetesApi:
+        &kubernetesApi
        endpoint:
          host: 172.16.0.5
          port: 6443
@@ -45,20 +44,19 @@ baselines:
              port: 443
            - cidr: 172.16.0.5/32
              port: 6443
-    scheduler15m: &scheduler-15m
+    scheduler15m:
      intervalMs: 900000
      heartbeatStaleSeconds: 900
      maxConcurrentRuns: 1
-    sqlite: &sqlite-common
+    sqlite:
      busyTimeoutMs: 2000
-
  cicd:
-    source: &cicd-source
+    source:
      repository: pikasTech/unidesk
      branch: master
      gitSshUrl: ssh://git@ssh.github.com:443/pikasTech/unidesk.git
      gitMirrorReadUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
-      buildContext: .
+      buildContext: "."
      entrypoint: scripts/web-probe-sentinel-service.ts
      checkoutPaths:
        - scripts
@@ -68,23 +66,23 @@ baselines:
        - package.json
        - bun.lock
        - bun.lockb
-    sourceAuthority: &cicd-source-authority
+    sourceAuthority:
      mode: gitMirrorSnapshot
      resolver: k8s-git-mirror
      allowHostGit: false
      allowGithubDirectInPipeline: false
-    sourceSnapshot: &cicd-source-snapshot
-      stageRefPrefix: refs/unidesk/snapshots/web-probe-sentinel/{branch}
+    sourceSnapshot:
+      stageRefPrefix: "refs/unidesk/snapshots/web-probe-sentinel/{branch}"
      missingObjectPolicy: fail-fast
      refreshPolicy: sync-before-snapshot
      cacheRef: source.gitMirrorReadUrl
-    builder: &cicd-builder
+    builder:
      namespace: devops-infra
      sourceMode: sparse-git-checkout
      gitSshSecretName: git-mirror-github-ssh
      activeDeadlineSeconds: 900
      ttlSecondsAfterFinished: 3600
-    monitorWeb: &monitor-web
+    monitorWeb:
      frontendStack: vue3-vendored-browser-build
      runtimeMode: runner-served-bridge
      assetRoot: scripts/assets/web-probe-sentinel-monitor-web
@@ -99,7 +97,7 @@ baselines:
        verifyPhase: pre-image-build
        buildkitState:
          mode: hostPath
-          path: /var/lib/unidesk/web-probe-sentinel/buildkit-${nodeLower}
+          path: "/var/lib/unidesk/web-probe-sentinel/buildkit-${nodeLower}"
          type: DirectoryOrCreate
      gitMirror:
        source: source.gitMirrorReadUrl
@@ -107,12 +105,12 @@ baselines:
        postFlush: required
      ciBudget:
        maxSeconds: 120
-    maintenance: &maintenance
+    maintenance:
      startCommand: sentinel maintenance start
      stopCommand: sentinel maintenance stop
-    confirmWait: &confirm-wait
+    confirmWait:
      maxSeconds: 120
-    publishCurrent: &publish-current
+    publishCurrent:
      endToEndBudget:
        maxSeconds: 120
      stageBudgets:
@@ -131,14 +129,13 @@ baselines:
        waitTimeoutMs: 60000
        commandTimeoutSeconds: 90
        fullPage: false
-
  publicExposure:
-    common: &public-exposure-common
+    common:
      enabled: true
      mode: pk01-caddy-frp-path
      hostname: monitor.pikapython.com
      expectedA: 82.156.23.220
-    frpc: &frpc-common
+    frpc:
      image: 127.0.0.1:5000/hwlab/frpc:v0.68.1
      serverAddr: 82.156.23.220
      serverPort: 22000
@@ -146,144 +143,57 @@ baselines:
      tokenSourceKey: FRP_TOKEN
      secretKey: frpc.toml
      tokenKey: token
-    caddy: &caddy-common
+    caddy:
      route: PK01
      configPath: /etc/caddy/Caddyfile
      serviceName: caddy
      email: ops@pikapython.com
      tls: auto
      responseHeaderTimeoutSeconds: 600
-
  secrets:
-    jd01BootstrapSource: &jd01-bootstrap-source
+    jd01BootstrapSource:
      purpose: bootstrap-admin
      sourceRef: .env/HWLAB_admin.txt
      sourceKey: HWLAB_ADMIN_PASSWORD
      sourceLine: 2
-    dsflashPromptSource: &dsflash-prompt-source
+    dsflashPromptSource:
      purpose: prompt-set
      sourceRef: hwlab/web-probe-sentinel-dsflash-go.env
      sourceKey: DSFLASH_GO_TOOL_CALL_10X_PROMPTS_JSON
-    frpTokenSource: &frp-token-source
+    frpTokenSource:
      purpose: frp-token
      sourceRef: platform-infra/pk01-frp.env
      sourceKey: FRP_TOKEN
-
 nodes:
  JD01:
-    target: &jd01-target
-      node: ${NODE}
-      lane: ${LANE}
-      publicOriginRef: config/hwlab-node-lanes.yaml#lanes.${LANE}.targets.${NODE}.public.webUrl
-
-    cicdCommon: &jd01-cicd-common
-      controlPlaneConfigRef: config/hwlab-node-control-plane.yaml#targets[1]
-      source:
-        <<: *cicd-source
-        gitMirrorReadUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
-      sourceAuthority:
-        <<: *cicd-source-authority
-        mode: giteaSnapshot
-        resolver: gitea-mirror
-      sourceSnapshot:
-        <<: *cicd-source-snapshot
-        stageRefPrefix: refs/unidesk/snapshots/gitea-actions/unidesk-master
-        refreshPolicy: gitea-controlled-snapshot
-      argo: &jd01-argo
-        namespace: argocd
-        projectName: hwlab-jd01
-        repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        targetRevision: v0.3-gitops
-      maintenance:
-        <<: *maintenance
-      monitorWeb:
-        <<: *monitor-web
-        gitMirror:
-          source: source.gitMirrorReadUrl
-          preSync: not-required
-          postFlush: not-required
-      confirmWait:
-        <<: *confirm-wait
-      publishCurrent:
-        <<: *publish-current
-
+    target:
+      extends: templates.webProbeSentinelTarget
+    cicdCommon:
+      extends: templates.webProbeSentinelCicdCommon
    sentinels:
      jd01-web-probe-sentinel:
        sentinel:
-          <<: *sentinel-base
-          id: jd01-web-probe-sentinel
-          configRefs:
-            runtime: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.runtime
-            scenarios: config/hwlab-web-probe-sentinel/scenarios.multi-sentinel.yaml#sentinel.scenarios
-            promptSet: config/hwlab-web-probe-sentinel/prompt-set.dsflash-go.yaml#sentinel.promptSet
-            reportViews: config/hwlab-web-probe-sentinel/report-views.multi-sentinel.yaml#sentinel.reportViews
-            publicExposure: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.publicExposure
-            cicd: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.cicd
-            secrets: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.secrets
+          extends: templates.webProbeSentinelSentinel
        runtime:
-          <<: *runtime-common
-          target:
-            <<: *jd01-target
-            observeWrapperRef: config/hwlab-node-lanes.yaml#lanes.${LANE}.targets.${NODE}.observability.webProbe.sentinels[0]
-          serviceAccountName: hwlab-web-probe-sentinel-${nodeLower}
-          deploymentName: hwlab-web-probe-sentinel-${nodeLower}
-          serviceName: hwlab-web-probe-sentinel-${nodeLower}
-          pvcName: hwlab-web-probe-sentinel-${nodeLower}-state
-          stateRoot: /var/lib/web-probe-sentinel-${nodeLower}
-          imageRef: 127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}:source-commit
-          scheduler:
-            <<: *scheduler-10m
-          sqlite:
-            <<: *sqlite-common
-            path: /var/lib/web-probe-sentinel-${nodeLower}/index.sqlite
+          extends: templates.webProbeSentinelRuntime
+          kubernetesApi:
+            *kubernetesApi
        publicExposure:
-          <<: *public-exposure-common
-          publicBaseUrl: https://monitor.pikapython.com/sentinels/${nodeLower}-web-probe-sentinel
-          routePrefix: /sentinels/${nodeLower}-web-probe-sentinel
+          extends: templates.webProbeSentinelPublicExposure
          frpc:
-            <<: *frpc-common
-            deploymentName: hwlab-web-probe-sentinel-${nodeLower}-frpc
-            secretName: hwlab-web-probe-sentinel-${nodeLower}-frpc
            httpProxy:
-              name: hwlab-${nodeLower}-${lane}-web-probe-sentinel
              remotePort: 22098
-              localIP: hwlab-web-probe-sentinel-${nodeLower}.hwlab-${lane}.svc.cluster.local
-              localPort: 8080
-          caddy:
-            <<: *caddy-common
-            managedBlockOwner: hwlab-web-probe-sentinel-${nodeLower}-${lane}
        cicd:
-          <<: *jd01-cicd-common
-          builder:
-            <<: *cicd-builder
-            jobPrefix: web-probe-sentinel-${nodeLower}-publish
-          gitopsPath: deploy/gitops/node/${nodeLower}/web-probe-sentinel
-          argo:
-            <<: *jd01-argo
-            applicationName: hwlab-web-probe-sentinel-${nodeLower}
-          image:
-            repository: 127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}
-            tagSource: source-commit
-            baseImageRef: config/hwlab-node-control-plane.yaml#targets[1].tekton.toolsImage.output
-            envRecipeRef: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.runtime
-          targetValidation:
-            scenarioId: workbench-dsflash-go-hwpod-two-turn-freeze-repro
-            maxSeconds: 600
-            serviceUnavailablePolicy: structured-failure
-            cadenceScheduler:
-              enabled: true
-              reason: k8s-native-periodic-quick-verify
-              concurrencyPolicy: Forbid
-              startingDeadlineSeconds: 600
-              successfulJobsHistoryLimit: 3
-              failedJobsHistoryLimit: 5
-              activeDeadlineSlackSeconds: 60
-              ttlSecondsAfterFinished: 86400
-              backoffLimit: 0
+          extends: templates.webProbeSentinelCicd
        secrets:
          sources:
-            - <<: *jd01-bootstrap-source
-            - <<: *dsflash-prompt-source
+            - sourceLine: 2
+              sourceKey: HWLAB_ADMIN_PASSWORD
+              sourceRef: .env/HWLAB_admin.txt
+              purpose: bootstrap-admin
+            - sourceKey: DSFLASH_GO_TOOL_CALL_10X_PROMPTS_JSON
+              sourceRef: hwlab/web-probe-sentinel-dsflash-go.env
+              purpose: prompt-set
            - purpose: account-a
              sourceRef: .env/HWLAB_admin.txt
              sourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
@@ -292,102 +202,52 @@ nodes:
              usernameSourceRef: .env/HWLAB_admin.txt
              usernameSourceLine: 1
            - purpose: account-b
-              sourceRef: hwlab/${nodeLower}-${lane}-preset-users.env
-              sourceKey: ${NODE}_SECOND_USER_PASSWORD
+              sourceRef: "hwlab/${nodeLower}-${lane}-preset-users.env"
+              sourceKey: "${NODE}_SECOND_USER_PASSWORD"
              format: web-account-json
-              username: ${nodeLower}-sentinel@hwlab.local
-            - <<: *frp-token-source
+              username: "${nodeLower}-sentinel@hwlab.local"
+            - sourceKey: FRP_TOKEN
+              sourceRef: platform-infra/pk01-frp.env
+              purpose: frp-token
          runtimeSecrets:
-            - name: hwlab-web-probe-sentinel-${nodeLower}-bootstrap
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-bootstrap"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: bootstrap-admin
                  targetKey: bootstrap-admin-password
-            - name: hwlab-web-probe-sentinel-${nodeLower}-prompt-set
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-prompt-set"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: prompt-set
                  targetKey: prompts.json
-            - name: hwlab-web-probe-sentinel-${nodeLower}-accounts
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-accounts"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: account-a
                  targetKey: account-a.json
                - sourcePurpose: account-b
                  targetKey: account-b.json
-            - name: hwlab-web-probe-sentinel-${nodeLower}-frpc
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-frpc"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: frp-token
                  targetKey: token
-
+    variables:
+      LANE: v03
+      controlPlaneIndex: "1"
+      argoProjectName: hwlab-jd01
+      NODE: JD01
  NC01:
-    target: &nc01-target
-      node: ${NODE}
-      lane: ${LANE}
-      publicOriginRef: config/hwlab-node-lanes.yaml#lanes.${LANE}.targets.${NODE}.public.webUrl
-
-    cicdCommon: &nc01-cicd-common
-      controlPlaneConfigRef: config/hwlab-node-control-plane.yaml#targets[2]
-      source:
-        <<: *cicd-source
-        gitSshUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
-        gitMirrorReadUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
-      sourceAuthority:
-        <<: *cicd-source-authority
-        mode: giteaSnapshot
-        resolver: gitea-mirror
-      sourceSnapshot:
-        <<: *cicd-source-snapshot
-        stageRefPrefix: refs/unidesk/snapshots/gitea-actions/unidesk-master
-        refreshPolicy: gitea-controlled-snapshot
-      argo: &nc01-argo
-        namespace: argocd
-        projectName: hwlab-v03
-        repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
-        targetRevision: v0.3-gitops
-      maintenance:
-        <<: *maintenance
-      monitorWeb:
-        <<: *monitor-web
-        gitMirror:
-          source: source.gitMirrorReadUrl
-          preSync: not-required
-          postFlush: not-required
-      confirmWait:
-        <<: *confirm-wait
-      publishCurrent:
-        <<: *publish-current
-
+    target:
+      extends: templates.webProbeSentinelTarget
+    cicdCommon:
+      extends: templates.webProbeSentinelCicdCommon
    sentinels:
      nc01-web-probe-sentinel:
        sentinel:
-          <<: *sentinel-base
-          id: nc01-web-probe-sentinel
-          configRefs:
-            runtime: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.runtime
-            scenarios: config/hwlab-web-probe-sentinel/scenarios.multi-sentinel.yaml#sentinel.scenarios
-            promptSet: config/hwlab-web-probe-sentinel/prompt-set.dsflash-go.yaml#sentinel.promptSet
-            reportViews: config/hwlab-web-probe-sentinel/report-views.multi-sentinel.yaml#sentinel.reportViews
-            publicExposure: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.publicExposure
-            cicd: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.cicd
-            secrets: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.secrets
+          extends: templates.webProbeSentinelSentinel
        runtime:
-          <<: *runtime-common
-          target:
-            <<: *nc01-target
-            observeWrapperRef: config/hwlab-node-lanes.yaml#lanes.${LANE}.targets.${NODE}.observability.webProbe.sentinels[0]
-          serviceAccountName: hwlab-web-probe-sentinel-${nodeLower}
-          deploymentName: hwlab-web-probe-sentinel-${nodeLower}
-          serviceName: hwlab-web-probe-sentinel-${nodeLower}
-          pvcName: hwlab-web-probe-sentinel-${nodeLower}-state
-          stateRoot: /var/lib/web-probe-sentinel-${nodeLower}
-          imageRef: 127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}:source-commit
-          scheduler:
-            <<: *scheduler-10m
-          sqlite:
-            <<: *sqlite-common
-            path: /var/lib/web-probe-sentinel-${nodeLower}/index.sqlite
+          extends: templates.webProbeSentinelRuntime
          kubernetesApi:
            endpoint:
              host: 10.43.0.1
@@ -398,86 +258,258 @@ nodes:
                - cidr: 10.43.0.1/32
                  port: 443
        publicExposure:
-          <<: *public-exposure-common
-          publicBaseUrl: https://monitor.pikapython.com/sentinels/${nodeLower}-web-probe-sentinel
-          routePrefix: /sentinels/${nodeLower}-web-probe-sentinel
+          extends: templates.webProbeSentinelPublicExposure
          frpc:
-            <<: *frpc-common
-            deploymentName: hwlab-web-probe-sentinel-${nodeLower}-frpc
-            secretName: hwlab-web-probe-sentinel-${nodeLower}-frpc
            httpProxy:
-              name: hwlab-${nodeLower}-${lane}-web-probe-sentinel
              remotePort: 22084
-              localIP: hwlab-web-probe-sentinel-${nodeLower}.hwlab-${lane}.svc.cluster.local
-              localPort: 8080
-          caddy:
-            <<: *caddy-common
-            managedBlockOwner: hwlab-web-probe-sentinel-${nodeLower}-${lane}
        cicd:
-          <<: *nc01-cicd-common
-          builder:
-            <<: *cicd-builder
-            jobPrefix: web-probe-sentinel-${nodeLower}-publish
-          gitopsPath: deploy/gitops/node/${nodeLower}/web-probe-sentinel
-          argo:
-            <<: *nc01-argo
-            applicationName: hwlab-web-probe-sentinel-${nodeLower}
-          image:
-            repository: 127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}
-            tagSource: source-commit
-            baseImageRef: config/hwlab-node-control-plane.yaml#targets[2].tekton.toolsImage.output
-            envRecipeRef: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.runtime
-          targetValidation:
-            scenarioId: workbench-dsflash-go-hwpod-two-turn-freeze-repro
-            maxSeconds: 600
-            serviceUnavailablePolicy: structured-failure
-            cadenceScheduler:
-              enabled: true
-              reason: k8s-native-periodic-quick-verify
-              concurrencyPolicy: Forbid
-              startingDeadlineSeconds: 600
-              successfulJobsHistoryLimit: 3
-              failedJobsHistoryLimit: 5
-              activeDeadlineSlackSeconds: 60
-              ttlSecondsAfterFinished: 86400
-              backoffLimit: 0
+          extends: templates.webProbeSentinelCicd
        secrets:
          sources:
            - purpose: bootstrap-admin
-              sourceRef: hwlab/${nodeLower}-${lane}-bootstrap-admin.env
+              sourceRef: "hwlab/${nodeLower}-${lane}-bootstrap-admin.env"
              sourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
-            - <<: *dsflash-prompt-source
+            - sourceKey: DSFLASH_GO_TOOL_CALL_10X_PROMPTS_JSON
+              sourceRef: hwlab/web-probe-sentinel-dsflash-go.env
+              purpose: prompt-set
            - purpose: account-a
-              sourceRef: hwlab/${nodeLower}-${lane}-bootstrap-admin.env
+              sourceRef: "hwlab/${nodeLower}-${lane}-bootstrap-admin.env"
              sourceKey: HWLAB_BOOTSTRAP_ADMIN_PASSWORD
              format: web-account-json
              username: admin
            - purpose: account-b
-              sourceRef: hwlab/${nodeLower}-${lane}-preset-users.env
-              sourceKey: ${NODE}_SECOND_USER_PASSWORD
+              sourceRef: "hwlab/${nodeLower}-${lane}-preset-users.env"
+              sourceKey: "${NODE}_SECOND_USER_PASSWORD"
              format: web-account-json
-              username: ${nodeLower}-sentinel@hwlab.local
-            - <<: *frp-token-source
+              username: "${nodeLower}-sentinel@hwlab.local"
+            - sourceKey: FRP_TOKEN
+              sourceRef: platform-infra/pk01-frp.env
+              purpose: frp-token
          runtimeSecrets:
-            - name: hwlab-web-probe-sentinel-${nodeLower}-bootstrap
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-bootstrap"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: bootstrap-admin
                  targetKey: bootstrap-admin-password
-            - name: hwlab-web-probe-sentinel-${nodeLower}-prompt-set
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-prompt-set"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: prompt-set
                  targetKey: prompts.json
-            - name: hwlab-web-probe-sentinel-${nodeLower}-accounts
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-accounts"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: account-a
                  targetKey: account-a.json
                - sourcePurpose: account-b
                  targetKey: account-b.json
-            - name: hwlab-web-probe-sentinel-${nodeLower}-frpc
-              namespace: hwlab-${lane}
+            - name: "hwlab-web-probe-sentinel-${nodeLower}-frpc"
+              namespace: "hwlab-${lane}"
              data:
                - sourcePurpose: frp-token
                  targetKey: token
+    variables:
+      LANE: v03
+      controlPlaneIndex: "2"
+      argoProjectName: hwlab-v03
+      NODE: NC01
+templates:
+  webProbeSentinelTarget:
+    node: "${NODE}"
+    lane: "${LANE}"
+    publicOriginRef: "config/hwlab-node-lanes.yaml#lanes.${LANE}.targets.${NODE}.public.webUrl"
+  webProbeSentinelCicdCommon:
+    controlPlaneConfigRef: "config/hwlab-node-control-plane.yaml#targets[${controlPlaneIndex}]"
+    source:
+      checkoutPaths:
+        - scripts
+        - config
+        - config.json
+        - src
+        - package.json
+        - bun.lock
+        - bun.lockb
+      entrypoint: scripts/web-probe-sentinel-service.ts
+      buildContext: "."
+      gitMirrorReadUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
+      gitSshUrl: ssh://git@ssh.github.com:443/pikasTech/unidesk.git
+      branch: master
+      repository: pikasTech/unidesk
+    sourceAuthority:
+      allowGithubDirectInPipeline: false
+      allowHostGit: false
+      resolver: gitea-mirror
+      mode: giteaSnapshot
+    sourceSnapshot:
+      cacheRef: source.gitMirrorReadUrl
+      refreshPolicy: gitea-controlled-snapshot
+      missingObjectPolicy: fail-fast
+      stageRefPrefix: refs/unidesk/snapshots/gitea-actions/unidesk-master
+    argo:
+      namespace: argocd
+      projectName: "${argoProjectName}"
+      repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
+      targetRevision: v0.3-gitops
+    maintenance:
+      stopCommand: sentinel maintenance stop
+      startCommand: sentinel maintenance start
+    monitorWeb:
+      ciBudget:
+        maxSeconds: 120
+      gitMirror:
+        source: source.gitMirrorReadUrl
+        preSync: not-required
+        postFlush: not-required
+      imageBuild:
+        packageMode: copy-only-containerfile
+        networkMode: host
+        proxySource: node.networkProfile.imageBuildProxy
+        contextIgnore: generated
+        verifyPhase: pre-image-build
+        buildkitState:
+          mode: hostPath
+          path: "/var/lib/unidesk/web-probe-sentinel/buildkit-${nodeLower}"
+          type: DirectoryOrCreate
+      envReuse:
+        mode: k8s-buildkit-and-ci-node-deps
+        nodeDepsPath: /opt/hwlab-ci-node-deps/node_modules
+      assetRoot: scripts/assets/web-probe-sentinel-monitor-web
+      runtimeMode: runner-served-bridge
+      frontendStack: vue3-vendored-browser-build
+    confirmWait:
+      maxSeconds: 120
+    publishCurrent:
+      dashboard:
+        enabled: true
+        required: true
+        viewport: 1440x900
+        timeoutMs: 30000
+        waitTimeoutMs: 60000
+        commandTimeoutSeconds: 90
+        fullPage: false
+      stageBudgets:
+        sourceSyncSeconds: 20
+        sourceFetchSeconds: 20
+        monitorWebVerifySeconds: 15
+        imageBuildSeconds: 45
+        gitopsSeconds: 15
+        argoRuntimeSeconds: 30
+        dashboardVerifySeconds: 30
+      endToEndBudget:
+        maxSeconds: 120
+  webProbeSentinelSentinel:
+    mode: web-probe-observe-wrapper
+    enabled: true
+    id: "${nodeLower}-web-probe-sentinel"
+    configRefs:
+      runtime: "config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.runtime"
+      scenarios: "config/hwlab-web-probe-sentinel/scenarios.multi-sentinel.yaml#sentinel.scenarios"
+      promptSet: "config/hwlab-web-probe-sentinel/prompt-set.dsflash-go.yaml#sentinel.promptSet"
+      reportViews: "config/hwlab-web-probe-sentinel/report-views.multi-sentinel.yaml#sentinel.reportViews"
+      publicExposure: "config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.publicExposure"
+      cicd: "config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.cicd"
+      secrets: "config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.secrets"
+  webProbeSentinelRuntime:
+    kubernetesApi:
+      endpoint:
+        host: 172.16.0.5
+        port: 6443
+      egress:
+        enabled: true
+        rules:
+          - cidr: 10.43.0.1/32
+            port: 443
+          - cidr: 172.16.0.5/32
+            port: 6443
+    observability:
+      otel:
+        enabled: true
+        serviceName: "hwlab-web-probe-sentinel-${nodeLower}"
+        tracesEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
+        sampler: parentbased_traceidratio
+        samplerArg: "1"
+    scheduler:
+      freshnessWarningMultiple: 2
+      maxConcurrentRuns: 1
+      heartbeatStaleSeconds: 900
+      intervalMs: 600000
+    metricsPath: /metrics
+    healthPath: /api/health
+    replicas: 1
+    pvcStorage: 10Gi
+    servicePort: 8080
+    listenHost: 0.0.0.0
+    namespace: "hwlab-${lane}"
+    target:
+      extends: templates.webProbeSentinelTarget
+      observeWrapperRef: "config/hwlab-node-lanes.yaml#lanes.${LANE}.targets.${NODE}.observability.webProbe.sentinels[0]"
+    serviceAccountName: "hwlab-web-probe-sentinel-${nodeLower}"
+    deploymentName: "hwlab-web-probe-sentinel-${nodeLower}"
+    serviceName: "hwlab-web-probe-sentinel-${nodeLower}"
+    pvcName: "hwlab-web-probe-sentinel-${nodeLower}-state"
+    stateRoot: "/var/lib/web-probe-sentinel-${nodeLower}"
+    imageRef: "127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}:source-commit"
+    sqlite:
+      busyTimeoutMs: 2000
+      path: "/var/lib/web-probe-sentinel-${nodeLower}/index.sqlite"
+  webProbeSentinelPublicExposure:
+    expectedA: 82.156.23.220
+    hostname: monitor.pikapython.com
+    mode: pk01-caddy-frp-path
+    enabled: true
+    publicBaseUrl: "https://monitor.pikapython.com/sentinels/${nodeLower}-web-probe-sentinel"
+    routePrefix: "/sentinels/${nodeLower}-web-probe-sentinel"
+    frpc:
+      tokenKey: token
+      secretKey: frpc.toml
+      tokenSourceKey: FRP_TOKEN
+      tokenSourceRef: platform-infra/pk01-frp.env
+      serverPort: 22000
+      serverAddr: 82.156.23.220
+      image: 127.0.0.1:5000/hwlab/frpc:v0.68.1
+      deploymentName: "hwlab-web-probe-sentinel-${nodeLower}-frpc"
+      secretName: "hwlab-web-probe-sentinel-${nodeLower}-frpc"
+      httpProxy:
+        name: "hwlab-${nodeLower}-${lane}-web-probe-sentinel"
+        remotePort: 0
+        localIP: "hwlab-web-probe-sentinel-${nodeLower}.hwlab-${lane}.svc.cluster.local"
+        localPort: 8080
+    caddy:
+      responseHeaderTimeoutSeconds: 600
+      tls: auto
+      email: ops@pikapython.com
+      serviceName: caddy
+      configPath: /etc/caddy/Caddyfile
+      route: PK01
+      managedBlockOwner: "hwlab-web-probe-sentinel-${nodeLower}-${lane}"
+  webProbeSentinelCicd:
+    extends: templates.webProbeSentinelCicdCommon
+    builder:
+      ttlSecondsAfterFinished: 3600
+      activeDeadlineSeconds: 900
+      gitSshSecretName: git-mirror-github-ssh
+      sourceMode: sparse-git-checkout
+      namespace: devops-infra
+      jobPrefix: "web-probe-sentinel-${nodeLower}-publish"
+    gitopsPath: "deploy/gitops/node/${nodeLower}/web-probe-sentinel"
+    argo:
+      applicationName: "hwlab-web-probe-sentinel-${nodeLower}"
+    image:
+      repository: "127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}"
+      tagSource: source-commit
+      baseImageRef: "config/hwlab-node-control-plane.yaml#targets[${controlPlaneIndex}].tekton.toolsImage.output"
+      envRecipeRef: "config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.runtime"
+    targetValidation:
+      scenarioId: workbench-dsflash-go-hwpod-two-turn-freeze-repro
+      maxSeconds: 600
+      serviceUnavailablePolicy: structured-failure
+      cadenceScheduler:
+        enabled: true
+        reason: k8s-native-periodic-quick-verify
+        concurrencyPolicy: Forbid
+        startingDeadlineSeconds: 600
+        successfulJobsHistoryLimit: 3
+        failedJobsHistoryLimit: 5
+        activeDeadlineSlackSeconds: 60
+        ttlSecondsAfterFinished: 86400
+        backoffLimit: 0