cluster-configuration/templates/ingress-nginx/nginx-ingress-application.yaml

 {{ if .Values.ingressNginx.enabled }}
 {{- $applicationName := .Values.ingressNginx.applicationNameOverride | default (print .Values.clusterName "-ingress-nginx-application") }}
-
+{{- $config := dict -}}
+{{- if .Values.ingressNginx.config }}
+{{- $config = mustMergeOverwrite $config .Values.ingressNginx.config }}
+{{- end }}
+{{- if .Values.ingressNginx.allowSnippetAnnotations }}
+{{- $config = mustMergeOverwrite $config (dict "annotations-risk-level" "critical") }}
+{{- end }}
+---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -60,9 +67,9 @@ spec:
               namespaceSelector:
                 any: true
           {{- end }}
-          {{- if .Values.ingressNginx.config }}
+          {{- if $config }}
           config:
-            {{ .Values.ingressNginx.config | toYaml | nindent 12 }}
+            {{ $config | toYaml | nindent 12 }}
           {{- end }}
           resources:
             requests:

cluster-configuration/values/admin-rke2.yaml

@@ -9,6 +9,7 @@ ingressNginx:
   enabled: true
   defaultClass: true
   watchIngressWithoutClass: true
+  allowSnippetAnnotations: true
   serviceAnnotations:
     # To be able to share the same ip for several services
     # https://metallb.org/usage/#ip-address-sharing

swh/values/local-cluster.yaml

@@ -1020,6 +1020,7 @@ loaders:
         - save_code_now:swh.loader.svn.tasks.MountAndLoadSvnRepository
         - save_code_now:swh.loader.svn.tasks.DumpMountAndLoadSvnRepository
         - save_code_now:swh.loader.package.archive.tasks.LoadTarball
+        - save_code_now:swh.loader.core.tasks.LoadTarballDirectory
       ackLate: true
       replicas: 2
 

swh/values/production/swh-cassandra.yaml

@@ -2330,6 +2330,7 @@ loaders:
         - save_code_now:swh.loader.svn.tasks.MountAndLoadSvnRepository
         - save_code_now:swh.loader.svn.tasks.DumpMountAndLoadSvnRepository
         - save_code_now:swh.loader.package.archive.tasks.LoadTarball
+        - save_code_now:swh.loader.core.tasks.LoadTarballDirectory
       ackLate: true
     save-code-now-git:
       enabled: true

swh/values/staging/default.yaml

@@ -593,6 +593,9 @@ externalServices:
     rpc-python3k:
       internalName: graph-rpc-ingress
       target: archive-staging-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    grpc-provenance:
+      internalName: provenance-grpc-popular-ingress
+      target: archive-staging-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
 vault:
   hosts:

swh/values/staging/next-version.yaml

@@ -320,6 +320,7 @@ loaders:
         - save_code_now:swh.loader.svn.tasks.MountAndLoadSvnRepository
         - save_code_now:swh.loader.svn.tasks.DumpMountAndLoadSvnRepository
         - save_code_now:swh.loader.package.archive.tasks.LoadTarball
+        - save_code_now:swh.loader.core.tasks.LoadTarballDirectory
       ackLate: true
       autoScaling:
         stopWhenNoActivity: true

swh/values/staging/swh-cassandra.yaml

@@ -420,6 +420,7 @@ loaders:
         - save_code_now:swh.loader.svn.tasks.MountAndLoadSvnRepository
         - save_code_now:swh.loader.svn.tasks.DumpMountAndLoadSvnRepository
         - save_code_now:swh.loader.package.archive.tasks.LoadTarball
+        - save_code_now:swh.loader.core.tasks.LoadTarballDirectory
       ackLate: true
       replicas: 2
       # low profile as there is no autoscaling
@@ -2419,7 +2420,50 @@ alter:
 provenance:
   enabled: true
   deployments:
+    popular-grpc:
+      enabled: true
+      type: grpc
+      replicas: 2
+      dataset:
+        name: 2024-08-23-popular-500-python
+        provenance:
+          fetch: true
+          index: true
+          path: /srv/dataset/provenance
+        graph:
+          path: /srv/dataset/graph
+      startService: true
+      extraVolumes:
+        dataset-persistent:
+          mountPath: /srv/dataset
+          volumeDefinition:
+            persistentVolumeClaim:
+              claimName: provenance-popular-persistent-pvc
+      hosts:
+        - provenance-grpc-popular-ingress
+      ingress:
+        enabled: true
+        extraAnnotations:
+          nginx.ingress.kubernetes.io/proxy-body-size: 4G
+          nginx.ingress.kubernetes.io/proxy-buffering: "on"
+          nginx.ingress.kubernetes.io/client-body-buffer-size: 128K
+        endpoints:
+          default:
+            paths:
+              - path: /
+      extraIngresses:
+        - hosts:
+          - provenance.internal.staging.swh.network
+          whitelistSourceRangeRef: stagingNetworkRanges
+          endpoints:
+            default:
+              paths:
+                - path: /
+              extraWhitelistSourceRange:
+                - 192.168.50.0/24 # for blackbox monitoring
+                - 192.168.101.0/24 # vpn network
     graph-granet:
+      type: rpc
       graphConfigurationRef: provenanceGraphGrpcConfiguration
       replicas: 2
       gunicorn:
@@ -2440,7 +2484,7 @@ provenance:
               - path: /
       extraIngresses:
         - hosts:
-          - provenance.internal.staging.swh.network
+          - provenance-rpc.internal.staging.swh.network
           whitelistSourceRangeRef: stagingNetworkRanges
           endpoints:
             default:
@@ -2469,6 +2513,18 @@ plainGrpcGraphConfiguration:
 volumes:
   enabled: true
   persistentVolumeClaims:
+    # grpc provenance volume
+    provenance-popular-persistent-pvc:
+      enabled: true
+      appName: provenance-popular-grpc
+      spec:
+        storageClassName: local-persistent
+        volumeMode: Filesystem
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi
     alter-recovery-bundles-pvc:
       enabled: true
       appName: alter

values-swh-application-versions.yaml

@@ -41,7 +41,7 @@ swh_objstorage_image_version: '20250319.1'
 swh_objstorage_replayer_image: container-registry.softwareheritage.org/swh/infra/swh-apps/objstorage_replayer
 swh_objstorage_replayer_image_version: '20250319.1'
 swh_provenance_image: container-registry.softwareheritage.org/swh/infra/swh-apps/provenance
-swh_provenance_image_version: '20250321.1'
+swh_provenance_image_version: '20250326.3'
 swh_scheduler_image: container-registry.softwareheritage.org/swh/infra/swh-apps/scheduler
 swh_scheduler_image_version: '20250319.1'
 swh_scrubber_image: container-registry.softwareheritage.org/swh/infra/swh-apps/scrubber