run_70453f635e1272fb

input

{
  "request": "Triage Jira ticket SREIN-1687: Can't redeploy amo-proxy workloads using ArgoCD",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/SREIN-1687"
  ],
  "sourceContext": {
    "issue": "SREIN-1687"
  }
}

summary

SREIN-1687 reports that a user cannot locate or redeploy amo-proxy workloads via ArgoCD, even though the corresponding Kubernetes Deployments and ConfigMaps are visible in the GCP Console for the moz-fx-webservices-high-nonprod project. The ticket is urgent because it blocks rolling out a security fix. The ticket is currently in Backlog status with no comments or assignee activity yet, and no runbook/design doc is linked. Root cause is unclear — could be a missing ArgoCD Application/permissions issue, or amo-proxy may have been deployed outside of ArgoCD's normal GitOps flow (possibly via a legacy process set up by a former AMO SRE, "Wei"), meaning it may not be tracked in ArgoCD at all.

findings

• Reporter can see amo-proxy Deployments/ConfigMaps in GCP Console for moz-fx-webservices-high-nonprod, but cannot find the corresponding Application in ArgoCD UI.
• Reporter suspects this could be a permissions issue, but also notes the original setup was done years ago by a former SRE (Wei) who supported AMO, suggesting the deployment mechanism/ownership may be undocumented or non-standard (possibly not GitOps-managed via ArgoCD at all, e.g. deployed via manual kubectl/Terraform/other CI pipeline).
• Ticket is marked urgent (blocks a security fix rollout) but is sitting in Backlog with zero comments, indicating it has not yet been triaged/acknowledged by SRE-IN.
• No confluence runbook or design doc reference is present in the ticket description to consult for amo-proxy's deployment architecture.

proposed actions

Thanks for flagging this — since it's blocking a security fix, we'll prioritize triage. A few things to check/clarify:

1. Can you confirm which ArgoCD instance/URL you're searching in, and what RBAC role/group your account has there? It's possible amo-proxy's ArgoCD Application lives in a project/AppProject you don't have visibility into (ArgoCD RBAC can filter search results by project).
2. Can you share the exact namespace and Deployment name for amo-proxy in moz-fx-webservices-high-nonprod? We'll check the ArgoCD API/`argocd app list` directly (bypassing UI search) to see if an Application exists for it, and inspect its `argocd.argoproj.io/instance` label to confirm ArgoCD ownership.
3. If no matching Application is found, amo-proxy may have been deployed outside of the current GitOps flow (e.g., a legacy manual kubectl apply, an older Argo/CI pipeline, or Terraform), as suggested by the fact it was originally set up by a former AMO SRE. In that case we'll need to identify the actual deployment path (check for CI/CD pipeline configs, Helm charts, or Terraform modules referencing amo-proxy) and either onboard it to ArgoCD properly or point you to the correct redeploy mechanism.
4. In the interim, if this is time-sensitive for the security fix, we can do a manual `kubectl set image`/rollout restart on the affected Deployment(s) as a stopgap while we resolve the ArgoCD visibility/ownership question — let us know if you'd like help with that.

We'll update this ticket once we've confirmed whether an ArgoCD Application exists for amo-proxy.

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "SREIN-1687"
    },
    "result": {
      "key": "SREIN-1687",
      "summary": "Can't redeploy amo-proxy workloads using ArgoCD",
      "status": "Backlog",
      "description_text": "This is relatively urgent as it\u2019s needed to deploy a security fix. I\u2019m trying to apply the changes to     (specifically    ) I see the workloads for dev when searching for  amo-proxy  in google cloud console for nonprod: https://console.cloud.google.com/kubernetes/workload/overview?project=moz-fx-webservices-high-nonpro I also see the configMaps: https://console.cloud.google.com/kubernetes/config?project=moz-fx-webservices-high-nonpro But I don\u2019t see a way for me to redeploy these. In ArgoCD, searching for  amo-proxy  yields no results for me. Am I just missing permissions ? How is  amo-proxy  supposed to be deployed ? This was set up years ago by Wei when he was handling SRE duties for AMO.",
      "comment_count": 0,
      "comments": []
    }
  }
]

log