From 05301e40b9dcee579c030cf01864f767bbd89fb1 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 10 Feb 2026 12:36:54 -0800 Subject: [PATCH 01/49] chore: use app of apps deployer --- app-of-apps/Chart.yaml | 5 + app-of-apps/templates/_helpers.tpl | 33 +++++ app-of-apps/templates/external-secrets.yaml | 29 ++++ app-of-apps/templates/gitlab.yaml | 35 +++++ app-of-apps/templates/keycloak.yaml | 42 ++++++ app-of-apps/templates/noobaa.yaml | 27 ++++ .../templates/openshift-pipelines.yaml | 23 +++ app-of-apps/templates/quay.yaml | 27 ++++ .../templates/redhat-developer-hub.yaml | 61 ++++++++ app-of-apps/templates/rhdh-gitops.yaml | 17 +++ app-of-apps/templates/rhtas.yaml | 21 +++ app-of-apps/templates/vault.yaml | 41 ++++++ app-of-apps/values.yaml | 134 ++++++++++++++++++ gitlab/templates/cm-gitlab-init.yaml | 120 ++++++++++++---- gitlab/templates/cm-gitlab-templates.yaml | 1 - quay/quay-registry/templates/cm-config.yaml | 6 +- .../values.yaml | 2 +- .../templates/rhdh-config-template.yaml | 3 - .../values.yaml | 3 - ...cluster-role-binding-default-sa-admin.yaml | 4 +- .../templates/cm-sa-token-writer.yaml | 71 ++++++++++ .../templates/es-argocd-password.yaml | 21 +++ .../templates/es-gitlab-token.yaml | 21 +++ .../templates/es-kubernetes-sa-token.yaml | 21 +++ .../templates/es-oauth-client.yaml | 25 ++++ .../templates/es-postgresql.yaml | 25 ++++ .../templates/job-sa-token.yaml | 29 ++++ .../secret-backstage-argocd-password.yaml | 11 -- .../secret-backstage-gitlab-token.yaml | 11 -- .../secret-backstage-kubernetes-sa-token.yaml | 11 -- .../templates/secret-backstage-npmrc.yaml | 2 +- .../secret-backstage-oauth-client.yaml | 12 -- .../secret-backstage-orchestrator-token.yaml | 10 -- .../secret-backstage-postgresql.yaml | 12 -- .../redhat-developer-hub-prereqs/values.yaml | 15 +- vault/templates/cm-vault-setup.yaml | 13 ++ vault/templates/cronjob-auto-unseal.yaml | 107 ++++++++++++++ vault/templates/job-unseal-vault.yaml | 32 ----- vault/values.yaml | 13 +- 39 files changed, 942 insertions(+), 154 deletions(-) create mode 100644 app-of-apps/Chart.yaml create mode 100644 app-of-apps/templates/_helpers.tpl create mode 100644 app-of-apps/templates/external-secrets.yaml create mode 100644 app-of-apps/templates/gitlab.yaml create mode 100644 app-of-apps/templates/keycloak.yaml create mode 100644 app-of-apps/templates/noobaa.yaml create mode 100644 app-of-apps/templates/openshift-pipelines.yaml create mode 100644 app-of-apps/templates/quay.yaml create mode 100644 app-of-apps/templates/redhat-developer-hub.yaml create mode 100644 app-of-apps/templates/rhdh-gitops.yaml create mode 100644 app-of-apps/templates/rhtas.yaml create mode 100644 app-of-apps/templates/vault.yaml create mode 100644 app-of-apps/values.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/job-sa-token.yaml delete mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-argocd-password.yaml delete mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-gitlab-token.yaml delete mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-kubernetes-sa-token.yaml delete mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-oauth-client.yaml delete mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-orchestrator-token.yaml delete mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-postgresql.yaml create mode 100644 vault/templates/cronjob-auto-unseal.yaml delete mode 100644 vault/templates/job-unseal-vault.yaml diff --git a/app-of-apps/Chart.yaml b/app-of-apps/Chart.yaml new file mode 100644 index 0000000..8742b8f --- /dev/null +++ b/app-of-apps/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: app-of-apps +description: Root app-of-apps chart that deploys all platform components as Argo CD Applications +type: application +version: 0.1.0 diff --git a/app-of-apps/templates/_helpers.tpl b/app-of-apps/templates/_helpers.tpl new file mode 100644 index 0000000..18aa93d --- /dev/null +++ b/app-of-apps/templates/_helpers.tpl @@ -0,0 +1,33 @@ +{{/* +Common sync policy for child Applications. +Provides automated sync with prune, selfHeal, retry with backoff, and standard syncOptions. +*/}} +{{- define "app-of-apps.syncPolicy" -}} +syncPolicy: + automated: + prune: true + selfHeal: true + retry: + backoff: + duration: 5s + factor: 2 + maxDuration: 3m0s + limit: 10 + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true +{{- end }} + +{{/* +Common Application metadata with foreground finalizer. +Usage: {{ include "app-of-apps.metadata" (dict "name" "my-app" "namespace" .Values.argocd.namespace "syncWave" "0") }} +*/}} +{{- define "app-of-apps.metadata" -}} +metadata: + name: {{ .name }} + namespace: {{ .namespace }} + annotations: + argocd.argoproj.io/sync-wave: "{{ .syncWave }}" + finalizers: + - resources-finalizer.argocd.argoproj.io/foreground +{{- end }} diff --git a/app-of-apps/templates/external-secrets.yaml b/app-of-apps/templates/external-secrets.yaml new file mode 100644 index 0000000..74b3f86 --- /dev/null +++ b/app-of-apps/templates/external-secrets.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.externalSecrets.name "namespace" .Values.argocd.namespace "syncWave" "0") }} +spec: + destination: + namespace: {{ .Values.externalSecrets.namespace }} + server: https://kubernetes.default.svc + project: default + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - '.webhooks[]?.clientConfig.caBundle' + source: + path: external-secrets + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + vault-integration: + vault: + namespace: {{ .Values.vault.namespace }} + name: {{ .Values.vault.name }} + auth: + namespace: {{ .Values.vault.authNamespace }} + syncPolicy: + automated: {} + syncOptions: + - CreateNamespace=true diff --git a/app-of-apps/templates/gitlab.yaml b/app-of-apps/templates/gitlab.yaml new file mode 100644 index 0000000..5c0163a --- /dev/null +++ b/app-of-apps/templates/gitlab.yaml @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.gitlab.name "namespace" .Values.argocd.namespace "syncWave" "1") }} +spec: + destination: + namespace: {{ .Values.gitlab.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: gitlab + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + parameters: + - name: gitlab.smtp.host + value: {{ .Values.gitlab.smtp.host | quote }} + - name: gitlab.ssh.host + value: {{ .Values.gitlab.ssh.host | quote }} + - name: gitlab.rootPassword + value: {{ .Values.gitlab.rootPassword | quote }} + - name: gitlab.users.password + value: {{ .Values.gitlab.usersPassword | quote }} + - name: gitlab.host + value: {{ .Values.gitlab.host }} + - name: cluster.subdomain + value: {{ .Values.gitlab.cluster.subdomain }} + - name: gitops.namespace + value: {{ .Values.gitlab.gitops.namespace }} + - name: quay.host + value: {{ .Values.gitlab.quay.host }} + - name: vault.name + value: {{ .Values.vault.name }} + - name: vault.namespace + value: {{ .Values.vault.namespace }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/keycloak.yaml b/app-of-apps/templates/keycloak.yaml new file mode 100644 index 0000000..93e126a --- /dev/null +++ b/app-of-apps/templates/keycloak.yaml @@ -0,0 +1,42 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.keycloak.name "namespace" .Values.argocd.namespace "syncWave" "1") }} +spec: + destination: + namespace: {{ .Values.keycloak.namespace }} + server: https://kubernetes.default.svc + project: default + ignoreDifferences: + - group: k8s.keycloak.org + kind: KeycloakRealmImport + jqPathExpressions: + - .. | (.id, .containerId, .secret)? | strings + source: + path: keycloak + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + keycloak: + nameOverride: {{ .Values.keycloak.crName }} + route: + host: {{ .Values.keycloak.route.host }} + ingress: + enabled: {{ .Values.keycloak.externalAccess }} + keycloak-realm-import: + keycloak: + name: {{ .Values.keycloak.crName }} + realm: + name: {{ .Values.keycloak.realm.name }} + client: + backstage: + name: {{ .Values.keycloak.client.backstage.name }} + redirectUri: {{ .Values.keycloak.client.backstage.redirectUri }} + webOrigin: {{ .Values.keycloak.client.backstage.webOrigin }} + secret: {{ .Values.keycloak.client.backstage.secret | quote }} + backstagePlugin: + name: {{ .Values.keycloak.client.backstagePlugin.name }} + secret: {{ .Values.keycloak.client.backstagePlugin.secret | quote }} + users: + password: {{ .Values.keycloak.users.password | quote }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/noobaa.yaml b/app-of-apps/templates/noobaa.yaml new file mode 100644 index 0000000..5b6708a --- /dev/null +++ b/app-of-apps/templates/noobaa.yaml @@ -0,0 +1,27 @@ +{{- if .Values.noobaa.enabled }} +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.noobaa.name "namespace" .Values.argocd.namespace "syncWave" "0") }} +spec: + destination: + namespace: {{ .Values.noobaa.namespace }} + server: https://kubernetes.default.svc + project: default + ignoreDifferences: + - group: noobaa.io + kind: NooBaa + jsonPointers: + - /metadata/labels + - /spec/coreResources + - /spec/dbResources + - /spec/endpoints + source: + path: noobaa + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + noobaa: + nameOverride: {{ .Values.noobaa.name }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} +{{- end }} diff --git a/app-of-apps/templates/openshift-pipelines.yaml b/app-of-apps/templates/openshift-pipelines.yaml new file mode 100644 index 0000000..296fec0 --- /dev/null +++ b/app-of-apps/templates/openshift-pipelines.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.openshiftPipelines.name "namespace" .Values.argocd.namespace "syncWave" "0") }} +spec: + destination: + namespace: {{ .Values.openshiftPipelines.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: openshift-pipelines + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + syncPolicy: + automated: {} + retry: + backoff: + duration: 5s + factor: 2 + maxDuration: 3m0s + limit: 2 + syncOptions: + - CreateNamespace=false + - RespectIgnoreDifferences=true diff --git a/app-of-apps/templates/quay.yaml b/app-of-apps/templates/quay.yaml new file mode 100644 index 0000000..7a29c9d --- /dev/null +++ b/app-of-apps/templates/quay.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.quay.name "namespace" .Values.argocd.namespace "syncWave" "1") }} +spec: + destination: + namespace: {{ .Values.quay.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: quay + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + quay-registry: + quay: + host: {{ .Values.quay.host }} + adminUser: {{ .Values.quay.adminUser }} + adminUserPassword: {{ .Values.quay.adminUserPassword | quote }} + organizations: {{ .Values.quay.organizations | toJson }} + vault: + name: {{ .Values.vault.name }} + namespace: {{ .Values.vault.namespace }} + noobaa: + name: {{ .Values.noobaa.name }} + namespace: {{ .Values.noobaa.namespace }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/redhat-developer-hub.yaml b/app-of-apps/templates/redhat-developer-hub.yaml new file mode 100644 index 0000000..8c48285 --- /dev/null +++ b/app-of-apps/templates/redhat-developer-hub.yaml @@ -0,0 +1,61 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.rhdh.name "namespace" .Values.argocd.namespace "syncWave" "2") }} +spec: + destination: + namespace: {{ .Values.rhdh.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: redhat-developer-hub + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + redhat-developer-hub-prereqs: + vault: + namespace: {{ .Values.vault.namespace }} + name: {{ .Values.vault.name }} + backstage: + postgresql: + password: {{ .Values.vault.secrets.rhdh.postgresqlPassword | quote }} + redhat-developer-hub-config-template: + gitlab: + rootPassword: {{ .Values.rhdh.configTemplate.gitlab.rootPassword | quote }} + host: {{ .Values.rhdh.configTemplate.gitlab.host }} + backstage: + host: {{ .Values.rhdh.configTemplate.backstage.host }} + keycloak: + host: {{ .Values.rhdh.configTemplate.keycloak.host }} + realm: {{ .Values.rhdh.configTemplate.keycloak.realm }} + loginRealm: {{ .Values.rhdh.configTemplate.keycloak.loginRealm }} + clientId: {{ .Values.rhdh.configTemplate.keycloak.clientId }} + clientSecret: {{ .Values.rhdh.configTemplate.keycloak.clientSecret | quote }} + gitops: + host: {{ .Values.rhdh.configTemplate.gitops.host }} + kubernetes: + api: {{ .Values.rhdh.configTemplate.kubernetes.api }} + cluster: + subdomain: {{ .Values.rhdh.configTemplate.cluster.subdomain }} + redhat-developer-hub-application: + gitops: + namespace: {{ .Values.rhdh.application.gitops.namespace }} + helm: + version: {{ .Values.rhdh.application.helm.version }} + values: + git: + host: {{ .Values.rhdh.application.helm.values.git.host }} + syncPolicy: + automated: + prune: true + selfHeal: true + retry: + backoff: + duration: 10s + factor: 2 + maxDuration: 10m + limit: 15 + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + - ApplyOutOfSyncOnly=true diff --git a/app-of-apps/templates/rhdh-gitops.yaml b/app-of-apps/templates/rhdh-gitops.yaml new file mode 100644 index 0000000..5cb9bfe --- /dev/null +++ b/app-of-apps/templates/rhdh-gitops.yaml @@ -0,0 +1,17 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.rhdhGitops.name "namespace" .Values.argocd.namespace "syncWave" "1") }} +spec: + destination: + namespace: {{ .Values.rhdhGitops.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: gitops + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + nameOverride: {{ .Values.rhdhGitops.name }} + password: {{ .Values.rhdhGitops.password | quote }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/rhtas.yaml b/app-of-apps/templates/rhtas.yaml new file mode 100644 index 0000000..ac0cada --- /dev/null +++ b/app-of-apps/templates/rhtas.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.rhtas.name "namespace" .Values.argocd.namespace "syncWave" "2") }} +spec: + destination: + namespace: {{ .Values.rhtas.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: rhtas + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + trusted-artifact-signer: + oidc: {{ .Values.rhtas.oidcIssuer }} + email: {{ .Values.rhtas.rootCert.email }} + org: {{ .Values.rhtas.rootCert.org }} + instance: {{ .Values.rhtas.instance }} + namespace: {{ .Values.rhtas.namespace }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/vault.yaml b/app-of-apps/templates/vault.yaml new file mode 100644 index 0000000..01b9706 --- /dev/null +++ b/app-of-apps/templates/vault.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.vault.name "namespace" .Values.argocd.namespace "syncWave" "0") }} +spec: + destination: + namespace: {{ .Values.vault.namespace }} + server: https://kubernetes.default.svc + project: default + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - '.webhooks[]?.clientConfig.caBundle' + source: + path: vault + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + nameOverride: {{ .Values.vault.name }} + kubernetes: + apiserver: {{ .Values.cluster.apiServer }} + vault: + auth: + namespace: {{ .Values.vault.authNamespace }} + secrets: + gitlab: + rootPassword: {{ .Values.vault.secrets.gitlab.rootPassword | quote }} + keycloak: + clientId: {{ .Values.vault.secrets.keycloak.clientId }} + clientSecret: {{ .Values.vault.secrets.keycloak.clientSecret | quote }} + pluginClientSecret: {{ .Values.vault.secrets.keycloak.pluginClientSecret | quote }} + rhdh: + argocdPassword: {{ .Values.vault.secrets.rhdh.argocdPassword | quote }} + postgresqlPassword: {{ .Values.vault.secrets.rhdh.postgresqlPassword | quote }} + common: + password: {{ .Values.vault.secrets.common.password | quote }} + syncPolicy: + automated: {} + syncOptions: + - CreateNamespace=true diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml new file mode 100644 index 0000000..0e8b8da --- /dev/null +++ b/app-of-apps/values.yaml @@ -0,0 +1,134 @@ +gitops: + repoURL: https://github.com/evanshortiss/etx-app-platform-helm.git + targetRevision: main + +argocd: + namespace: openshift-gitops + +cluster: + subdomain: "" + apiServer: "" + +common: + password: "" + +vault: + name: vault + namespace: vault + authNamespace: default + secrets: + gitlab: + rootPassword: "" + keycloak: + clientId: backstage + clientSecret: "" + pluginClientSecret: "" + rhdh: + argocdPassword: "" + postgresqlPassword: password + common: + password: "" + +externalSecrets: + name: external-secrets + namespace: external-secrets + +openshiftPipelines: + name: openshift-pipelines + namespace: openshift-operators + +noobaa: + enabled: true + name: noobaa + namespace: openshift-storage + +gitlab: + name: gitlab + namespace: gitlab + host: "" + smtp: + host: "" + ssh: + host: "" + rootPassword: "" + usersPassword: "" + cluster: + subdomain: "" + gitops: + namespace: "" + quay: + host: "" + +keycloak: + name: keycloak + namespace: keycloak + crName: keycloak + externalAccess: false + route: + host: "" + realm: + name: backstage + client: + backstage: + name: backstage + redirectUri: "" + webOrigin: "" + secret: "" + backstagePlugin: + name: backstage-plugin + secret: "" + users: + password: "" + +quay: + name: quay + namespace: quay-registry + host: "" + adminUser: quayadmin + adminUserPassword: "" + organizations: + - parasol + +rhdhGitops: + name: rhdh-gitops + namespace: rhdh-gitops + password: "" + +rhdh: + name: backstage-bootstrap + namespace: backstage + configTemplate: + gitlab: + rootPassword: "" + host: "" + backstage: + host: "" + keycloak: + host: "" + realm: backstage + loginRealm: backstage + clientId: backstage-plugin + clientSecret: "" + gitops: + host: "" + kubernetes: + api: "" + cluster: + subdomain: "" + application: + gitops: + namespace: openshift-gitops + helm: + version: 1.8.2 + values: + git: + host: "" + +rhtas: + name: trusted-artifact-signer + namespace: trusted-artifact-signer + instance: securesign + oidcIssuer: "" + rootCert: + email: admin@rhdemo.com + org: Parasol diff --git a/gitlab/templates/cm-gitlab-init.yaml b/gitlab/templates/cm-gitlab-init.yaml index da9e282..ec69892 100644 --- a/gitlab/templates/cm-gitlab-init.yaml +++ b/gitlab/templates/cm-gitlab-init.yaml @@ -14,11 +14,25 @@ data: root_password: {{ $.Values.gitlab.rootPassword }} user_create: true tasks: - - name: Pause for 5 minutes waiting for GitLab - ansible.builtin.pause: - minutes: 5 + - name: Wait for GitLab pod to be ready + kubernetes.core.k8s_info: + kind: Pod + namespace: '{{ "{{" }} gitlab_namespace {{ "}}" }}' + label_selectors: + - app=gitlab + register: r_gitlab_pod + retries: 120 + delay: 10 + until: + - r_gitlab_pod.resources is defined + - r_gitlab_pod.resources | length > 0 + - r_gitlab_pod.resources[0].status is defined + - r_gitlab_pod.resources[0].status.phase is defined + - r_gitlab_pod.resources[0].status.phase == 'Running' + - r_gitlab_pod.resources[0].status.containerStatuses is defined + - r_gitlab_pod.resources[0].status.containerStatuses | selectattr('ready', 'equalto', true) | list | length == r_gitlab_pod.resources[0].status.containerStatuses | length - - name: Check GitLab Liveness + - name: Wait for GitLab API to be available ansible.builtin.uri: url: https://{{ $.Values.gitlab.host }}/api/v4/projects method: GET @@ -65,11 +79,15 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false + retries: 10 + delay: 5 + register: r_application_settings + until: r_application_settings.status == 200 status_code: 200 {{- range $item := .Values.gitlab.users.users }} - - name: Create users + - name: Create user {{ $item.id }} ansible.builtin.uri: url: https://{{ $.Values.gitlab.host }}/api/v4/users method: POST @@ -85,11 +103,13 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false - status_code: 201 + status_code: + - 201 + - 409 register: r_user - retries: 100 + retries: 10 delay: 5 - until: r_user.status == 201 + until: r_user.status in [201, 409] {{- end }} - name: List users @@ -104,7 +124,7 @@ data: {{- range $item := .Values.gitlab.groups }} - - name: Create group + - name: Create group {{ $item.name }} ansible.builtin.uri: url: https://{{ $.Values.gitlab.host }}/api/v4/groups method: POST @@ -116,11 +136,27 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false - status_code: 201 - register: r_group - retries: 100 + status_code: + - 201 + - 400 + - 409 + register: r_group_create + retries: 10 delay: 5 - until: r_group.status == 201 + until: r_group_create.status in [201, 400, 409] + failed_when: + - r_group_create.status == 400 + - "'has already been taken' not in (r_group_create.json | default({}) | string)" + + - name: Look up group {{ $item.name }} + ansible.builtin.uri: + url: https://{{ $.Values.gitlab.host }}/api/v4/groups/{{ $item.name }} + method: GET + headers: + PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' + validate_certs: false + status_code: 200 + register: r_group {{- if $item.repo }} @@ -140,11 +176,17 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false - status_code: 201 - retries: 100 + status_code: + - 201 + - 400 + - 409 + retries: 10 delay: 5 register: r_import - until: r_import.status == 201 + until: r_import.status in [201, 400, 409] + failed_when: + - r_import.status == 400 + - "'has already been taken' not in (r_import.json | default({}) | string)" loop: {{- range $item1 := $item.repo }} - name: {{ $item1.name }} @@ -156,7 +198,7 @@ data: {{- if $item.project }} {{- range $item1 := $item.project }} - - name: Create project for group + - name: Create project {{ $item1.name }} for group ansible.builtin.uri: url: https://{{ $.Values.gitlab.host }}/api/v4/projects method: POST @@ -170,11 +212,27 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false - status_code: 201 - retries: 100 + status_code: + - 201 + - 400 + - 409 + retries: 10 delay: 5 + register: r_create_project_result + until: r_create_project_result.status in [201, 400, 409] + failed_when: + - r_create_project_result.status == 400 + - "'has already been taken' not in (r_create_project_result.json | default({}) | string)" + + - name: Look up project {{ $item1.name }} + ansible.builtin.uri: + url: https://{{ $.Values.gitlab.host }}/api/v4/projects/{{ $item.name }}%2F{{ $item1.name }} + method: GET + headers: + PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' + validate_certs: false + status_code: 200 register: r_create_project - until: r_create_project.status == 201 {{- if $item1.labels }} @@ -189,11 +247,13 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false - status_code: 201 - retries: 100 + status_code: + - 201 + - 409 + retries: 10 delay: 5 register: r_create_label - until: r_create_label.status == 201 + until: r_create_label.status in [201, 409] loop: {{- range $item2 := $item1.labels }} - name: {{ $item2.name }} @@ -206,7 +266,7 @@ data: {{- if $item.users }} {{- range $item1 := $item.users }} - - name: Add user to group + - name: Add user {{ $item1.id }} to group when: item.username == '{{ $item1.id }}' ansible.builtin.uri: url: https://{{ $.Values.gitlab.host }}/api/v4/groups/{{ "{{" }} r_group.json.id {{ "}}" }}/members @@ -218,11 +278,13 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false - status_code: 201 + status_code: + - 201 + - 409 register: r_group_user - retries: 100 + retries: 10 delay: 5 - until: r_group_user.status == 201 + until: r_group_user.status in [201, 409] or r_group_user is skipped loop: '{{ "{{" }} r_users.json {{ "}}" }}' {{- end }} {{- end }} @@ -253,5 +315,5 @@ data: pod: {{ .Values.vault.namespace }}-0 command: '{{ "{{" }} item {{ "}}" }}' loop: - - 'vault kv put kv/secrets/rhdh/gitlab token={{ "{{" }} root_token {{ "}}" }}' - - 'vault kv put kv/secrets/rhdh/gitlab_webhook secret={{ "{{" }} webhook_secret {{ "}}" }}' + - 'vault kv put kv/secrets/gitlab/token value={{ "{{" }} root_token {{ "}}" }}' + - 'vault kv put kv/secrets/gitlab/webhook-secret value={{ "{{" }} webhook_secret {{ "}}" }}' diff --git a/gitlab/templates/cm-gitlab-templates.yaml b/gitlab/templates/cm-gitlab-templates.yaml index 0d7ce83..7b4ada8 100644 --- a/gitlab/templates/cm-gitlab-templates.yaml +++ b/gitlab/templates/cm-gitlab-templates.yaml @@ -89,7 +89,6 @@ data: rhdh_gitops_namespace: "{{ $.Values.gitops.namespace }}" rhdh_gitops_project: "{{ $.Values.gitops.project }}" quay_host: "{{ $.Values.quay.host }}" - orchestrator_namespace: "{{ $.Values.orchestrator.namespace }}" {{- end }} - name: Add new files to the repository diff --git a/quay/quay-registry/templates/cm-config.yaml b/quay/quay-registry/templates/cm-config.yaml index edd13a3..a4a16f9 100644 --- a/quay/quay-registry/templates/cm-config.yaml +++ b/quay/quay-registry/templates/cm-config.yaml @@ -147,9 +147,9 @@ data: pod: {{ .Values.vault.namespace }}-0 command: '{{ "{{" }} item {{ "}}" }}' loop: - - 'vault kv put kv/secrets/rhdh/registry/auth value={{ "{{" }} quay_auth | b64encode {{ "}}" }}' - - "vault kv put kv/secrets/rhdh/registry/username value={{ .Values.quay.adminUser }}" - - "vault kv put kv/secrets/rhdh/registry/password value={{ .Values.quay.adminUserPassword }}" + - 'vault kv put kv/secrets/quay/auth value={{ "{{" }} quay_auth | b64encode {{ "}}" }}' + - "vault kv put kv/secrets/quay/username value={{ .Values.quay.adminUser }}" + - "vault kv put kv/secrets/quay/password value={{ .Values.quay.adminUserPassword }}" {{- range $item := .Values.quay.organizations }} - name: Create organization {{ $item }} diff --git a/redhat-developer-hub/redhat-developer-hub-application/values.yaml b/redhat-developer-hub/redhat-developer-hub-application/values.yaml index 797fefc..438b2bc 100644 --- a/redhat-developer-hub/redhat-developer-hub-application/values.yaml +++ b/redhat-developer-hub/redhat-developer-hub-application/values.yaml @@ -6,7 +6,7 @@ gitops: helm: repo: https://charts.openshift.io chart: redhat-developer-hub - version: 1.8.0 + version: 1.8.2 values: git: host: diff --git a/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml b/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml index 9995aad..8ccd7ce 100644 --- a/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml +++ b/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml @@ -89,9 +89,6 @@ data: argocd_host: "{{ $.Values.gitops.host }}" kubernetes_api_url: "{{ $.Values.kubernetes.api }}" backstage_backend_secret: {{ randAlphaNum 24 | b64enc }} - oauth2_proxy_cookie_secret: {{ randAlpha 32 | lower | b64enc }} - oauth2_proxy_oidc_issuer: "{{ $.Values.oauth2.issuer }}" - orchestrator_sonataflow_data_index_service: "{{ $.Values.orchestrator.sonataFlowDataIndexService }}" {{- end }} - name: Add new files to the repository diff --git a/redhat-developer-hub/redhat-developer-hub-config-template/values.yaml b/redhat-developer-hub/redhat-developer-hub-config-template/values.yaml index c69f213..7877d6a 100644 --- a/redhat-developer-hub/redhat-developer-hub-config-template/values.yaml +++ b/redhat-developer-hub/redhat-developer-hub-config-template/values.yaml @@ -32,9 +32,6 @@ gitops: kubernetes: api: -oauth2: - issuer: - cluster: subdomain: diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cluster-role-binding-default-sa-admin.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cluster-role-binding-default-sa-admin.yaml index daec266..ff14a74 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cluster-role-binding-default-sa-admin.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cluster-role-binding-default-sa-admin.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: cluster-admin-default-{{ .Values.namespace }} + name: cluster-admin-default-{{ .Release.Namespace }} annotations: {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} subjects: - kind: ServiceAccount - namespace: {{ .Values.namespace }} + namespace: {{ .Release.Namespace }} name: default roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml new file mode 100644 index 0000000..22992de --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: sa-token-writer + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "1" +data: + playbook.yaml: | + --- + - name: Write SA token to Vault + hosts: localhost + vars: + namespace: {{ .Release.Namespace }} + vault_namespace: {{ .Values.vault.namespace }} + vault_name: {{ .Values.vault.name }} + tasks: + - name: Create service account token secret + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: Secret + type: kubernetes.io/service-account-token + metadata: + name: default-token + namespace: '{{ "{{" }} namespace {{ "}}" }}' + annotations: + kubernetes.io/service-account.name: default + + - name: Wait for token to be populated + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: default-token + namespace: '{{ "{{" }} namespace {{ "}}" }}' + register: r_token_secret + retries: 60 + delay: 5 + until: + - r_token_secret.resources is defined + - r_token_secret.resources | length > 0 + - r_token_secret.resources[0].data is defined + - r_token_secret.resources[0].data.token is defined + - r_token_secret.resources[0].data.token | length > 0 + + - name: Decode token + ansible.builtin.set_fact: + sa_token: '{{ "{{" }} r_token_secret.resources[0].data.token | b64decode {{ "}}" }}' + + - name: Retrieve Vault Pod + kubernetes.core.k8s_info: + kind: Pod + name: '{{ "{{" }} vault_name {{ "}}" }}-0' + namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' + register: r_vault + retries: 120 + delay: 5 + until: + - r_vault.resources is defined + - r_vault.resources | length > 0 + - r_vault.resources[0].status is defined + - r_vault.resources[0].status.phase is defined + - r_vault.resources[0].status.phase == 'Running' + + - name: Write SA token to Vault + kubernetes.core.k8s_exec: + namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' + pod: '{{ "{{" }} vault_name {{ "}}" }}-0' + command: 'vault kv put kv/secrets/rhdh/kubernetes-sa-token value={{ "{{" }} sa_token {{ "}}" }}' diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml new file mode 100644 index 0000000..f559c69 --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-password + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: argocd-password + creationPolicy: Owner + data: + - secretKey: ARGOCD_PASSWORD + remoteRef: + key: secrets/rhdh/argocd-password + property: value diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml new file mode 100644 index 0000000..ab66b2c --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-token + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: gitlab-token + creationPolicy: Owner + data: + - secretKey: GITLAB_TOKEN + remoteRef: + key: secrets/gitlab/token + property: value diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml new file mode 100644 index 0000000..245cd5e --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: kubernetes-sa-token + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + refreshInterval: 1m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: kubernetes-sa-token + creationPolicy: Owner + data: + - secretKey: KUBERNETES_SA_TOKEN + remoteRef: + key: secrets/rhdh/kubernetes-sa-token + property: value diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml new file mode 100644 index 0000000..a0711a1 --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml @@ -0,0 +1,25 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: oauth-client + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: oauth-client + creationPolicy: Owner + data: + - secretKey: OAUTH_CLIENT_ID + remoteRef: + key: secrets/keycloak/client-secret + property: clientId + - secretKey: OAUTH_CLIENT_SECRET + remoteRef: + key: secrets/keycloak/client-secret + property: clientSecret diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml new file mode 100644 index 0000000..b1a46ad --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml @@ -0,0 +1,25 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: {{ include "redhat-developer-hub-prereqs.name" . }}-postgresql + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: {{ include "redhat-developer-hub-prereqs.name" . }}-postgresql + creationPolicy: Owner + data: + - secretKey: postgres-password + remoteRef: + key: secrets/rhdh/postgresql-password + property: value + - secretKey: adminPasswordKey + remoteRef: + key: secrets/rhdh/postgresql-password + property: value diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/job-sa-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/job-sa-token.yaml new file mode 100644 index 0000000..e89d15a --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/job-sa-token.yaml @@ -0,0 +1,29 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: sa-token-writer + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "1" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation +spec: + backoffLimit: 10 + template: + spec: + serviceAccountName: default + restartPolicy: OnFailure + containers: + - name: sa-token-writer + image: quay.io/agnosticd/ee-multicloud:latest + command: + - ansible-playbook + - /playbook/playbook.yaml + volumeMounts: + - name: playbook + mountPath: /playbook + volumes: + - name: playbook + configMap: + name: sa-token-writer diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-argocd-password.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-argocd-password.yaml deleted file mode 100644 index 467fc89..0000000 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-argocd-password.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: Secret -apiVersion: v1 -metadata: - name: argocd-password - labels: - {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} - annotations: - {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} -stringData: - ARGOCD_PASSWORD: {{ .Values.backstage.argocd.password }} -type: Opaque diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-gitlab-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-gitlab-token.yaml deleted file mode 100644 index c559db3..0000000 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-gitlab-token.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: Secret -apiVersion: v1 -metadata: - name: gitlab-token - labels: - {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} - annotations: - {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} -stringData: - GITLAB_TOKEN: {{ .Values.backstage.gitlab.token }} -type: Opaque diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-kubernetes-sa-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-kubernetes-sa-token.yaml deleted file mode 100644 index eacea7a..0000000 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-kubernetes-sa-token.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: Secret -apiVersion: v1 -metadata: - name: kubernetes-sa-token - labels: - {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} - annotations: - {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} -stringData: - KUBERNETES_SA_TOKEN: {{ .Values.backstage.kubernetes.sa_token }} -type: Opaque diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-npmrc.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-npmrc.yaml index cb8bf24..7046aac 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-npmrc.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-npmrc.yaml @@ -7,5 +7,5 @@ metadata: annotations: {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} stringData: - .npmrc: registry=https://npm.registry.redhat.com + .npmrc: '@redhat:registry=https://npm.registry.redhat.com' type: Opaque diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-oauth-client.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-oauth-client.yaml deleted file mode 100644 index 7dbd752..0000000 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-oauth-client.yaml +++ /dev/null @@ -1,12 +0,0 @@ -kind: Secret -apiVersion: v1 -metadata: - name: oauth-client - labels: - {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} - annotations: - {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} -stringData: - OAUTH_CLIENT_ID: {{ .Values.backstage.oauth.clientId }} - OAUTH_CLIENT_SECRET: {{ .Values.backstage.oauth.clientSecret }} -type: Opaque diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-orchestrator-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-orchestrator-token.yaml deleted file mode 100644 index 10416ed..0000000 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-orchestrator-token.yaml +++ /dev/null @@ -1,10 +0,0 @@ -kind: Secret -apiVersion: v1 -metadata: - name: backstage-orchestrator-token - labels: - {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} - annotations: - {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} -stringData: - ORCHESTRATOR_TOKEN: {{ .Values.backstage.orchestrator.token }} \ No newline at end of file diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-postgresql.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-postgresql.yaml deleted file mode 100644 index 3a67dc7..0000000 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/secret-backstage-postgresql.yaml +++ /dev/null @@ -1,12 +0,0 @@ -kind: Secret -apiVersion: v1 -metadata: - name: {{ include "redhat-developer-hub-prereqs.name" . }}-postgresql - labels: - {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} - annotations: - {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} -stringData: - postgres-password: {{ .Values.backstage.postgresql.password }} - adminPasswordKey: {{ .Values.backstage.postgresql.password }} -type: Opaque diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/values.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/values.yaml index c6745fc..ca25be8 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/values.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/values.yaml @@ -2,20 +2,13 @@ nameOverride: "backstage" namespace: default +vault: + namespace: vault + name: vault + backstage: - argocd: - password: - gitlab: - token: - kubernetes: - sa_token: - oauth: - clientId: - clientSecret: postgresql: password: password - orchestrator: - token: rbacPolicy: - "p, role:default/location_read, catalog.entity.read, read, allow" diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index f7a97b6..f20b22d 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -106,3 +106,16 @@ data: - name: Enable kv version 2 ansible.builtin.shell: | oc exec vault-0 -n {{ "{{" }} vault_namespace {{ "}}" }} -- vault secrets enable -version=2 kv + + - name: Pre-populate known secrets + kubernetes.core.k8s_exec: + namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' + pod: vault-0 + command: '{{ "{{" }} item {{ "}}" }}' + loop: + - 'vault kv put kv/secrets/gitlab/root-password value={{ $.Values.secrets.gitlab.rootPassword }}' + - 'vault kv put kv/secrets/keycloak/client-secret clientId={{ $.Values.secrets.keycloak.clientId }} clientSecret={{ $.Values.secrets.keycloak.clientSecret }}' + - 'vault kv put kv/secrets/keycloak/plugin-client-secret value={{ $.Values.secrets.keycloak.pluginClientSecret }}' + - 'vault kv put kv/secrets/rhdh/argocd-password value={{ $.Values.secrets.rhdh.argocdPassword }}' + - 'vault kv put kv/secrets/rhdh/postgresql-password value={{ $.Values.secrets.rhdh.postgresqlPassword }}' + - 'vault kv put kv/secrets/common/password value={{ $.Values.secrets.common.password }}' diff --git a/vault/templates/cronjob-auto-unseal.yaml b/vault/templates/cronjob-auto-unseal.yaml new file mode 100644 index 0000000..8fb42e5 --- /dev/null +++ b/vault/templates/cronjob-auto-unseal.yaml @@ -0,0 +1,107 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: vault-auto-unseal +spec: + schedule: "*/1 * * * *" + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 1 + jobTemplate: + spec: + template: + spec: + serviceAccountName: vault + restartPolicy: Never + containers: + - name: unsealer + image: registry.redhat.io/openshift4/ose-cli:v4.7 + volumeMounts: + - mountPath: /vault-unseal-config + name: vault-unseal-config-volume + command: + - /bin/bash + - -c + - | + echo "=== Vault Auto-Unseal Check at $(date) ===" + + # Check if vault-0 pod exists + if ! oc get pod {{ include "vault.name" . }}-0 -n {{ .Release.Namespace }} &>/dev/null; then + echo "Vault pod {{ include "vault.name" . }}-0 not found, skipping..." + exit 0 + fi + + # Check vault status + echo "Checking Vault status..." + set +e + oc exec {{ include "vault.name" . }}-0 -n {{ .Release.Namespace }} -- vault status -tls-skip-verify + STATUS=$? + set -e + + echo "Status code: $STATUS" + + if [ $STATUS -eq 0 ]; then + echo "Vault is already unsealed and healthy" + exit 0 + elif [ $STATUS -eq 2 ]; then + echo "Vault is sealed, checking initialization status..." + + # Check if already initialized (keys file exists) + set +e + oc exec {{ include "vault.name" . }}-0 -n {{ .Release.Namespace }} -- test -f /vault/data/vault-auto-unseal-keys.txt + KEYS_EXISTS=$? + set -e + + if [ $KEYS_EXISTS -eq 0 ]; then + echo "Vault already initialized, unsealing with existing keys..." + oc exec {{ include "vault.name" . }}-0 -n {{ .Release.Namespace }} -- /bin/sh /vault/data/unseal.sh + + # Verify unseal succeeded + set +e + oc exec {{ include "vault.name" . }}-0 -n {{ .Release.Namespace }} -- vault status -tls-skip-verify + FINAL_STATUS=$? + set -e + + if [ $FINAL_STATUS -eq 0 ]; then + echo "Successfully unsealed Vault" + exit 0 + else + echo "Vault unseal failed (exit code: $FINAL_STATUS)" + exit 1 + fi + else + # Vault is not initialized - initialize it + echo "Initializing Vault for the first time..." + oc exec {{ include "vault.name" . }}-0 --namespace={{ .Release.Namespace }} --stdin --tty -- vault operator init -format=yaml > /tmp/vault-auto-unseal-keys.txt + + echo "Copying unseal keys to Vault pod..." + cat /tmp/vault-auto-unseal-keys.txt | oc exec -i -n {{ .Release.Namespace }} {{ include "vault.name" . }}-0 -c {{ include "vault.name" . }} "--" sh -c "cat > /vault/data/vault-auto-unseal-keys.txt" + + echo "Copying unseal script to Vault pod..." + cat /vault-unseal-config/unseal.sh | oc exec -i -n {{ .Release.Namespace }} {{ include "vault.name" . }}-0 -c {{ include "vault.name" . }} "--" sh -c "cat > /vault/data/unseal.sh" + + echo "Unsealing Vault..." + oc exec {{ include "vault.name" . }}-0 --namespace={{ .Release.Namespace }} --stdin --tty -- /bin/sh /vault/data/unseal.sh + + # Verify unsealing succeeded + set +e + oc exec {{ include "vault.name" . }}-0 --namespace={{ .Release.Namespace }} -- vault status -tls-skip-verify + FINAL_STATUS=$? + set -e + + if [ $FINAL_STATUS -eq 0 ]; then + echo "Vault successfully initialized and unsealed" + exit 0 + else + echo "Vault unseal verification failed" + exit 1 + fi + fi + else + echo "Vault status check failed with unexpected code: $STATUS" + exit 1 + fi + volumes: + - name: vault-unseal-config-volume + configMap: + name: vault-unseal-config diff --git a/vault/templates/job-unseal-vault.yaml b/vault/templates/job-unseal-vault.yaml deleted file mode 100644 index 8f10dcd..0000000 --- a/vault/templates/job-unseal-vault.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: unseal-volt -spec: - template: - spec: - containers: - - name: unseal-volt - command: - - /bin/bash - - -c - - | - echo "Wait for Vault Pod Readiness" - until oc get pod vault-0 -n vault -o jsonpath='{.status.conditions[?(@.type=="PodReadyToStartContainers")].status}' | grep -q True; do - echo "Waiting for Ready..." - sleep 2 - done - oc exec vault-0 --namespace=vault --stdin --tty -- vault operator init -format=yaml > /tmp/vault-auto-unseal-keys.txt - cat /tmp/vault-auto-unseal-keys.txt | oc exec -i -n vault vault-0 -c vault "--" sh -c "cat > /vault/data/vault-auto-unseal-keys.txt" - cat /vault-unseal-config/unseal.sh | oc exec -i -n vault vault-0 -c vault "--" sh -c "cat > /vault/data/unseal.sh" - oc exec vault-0 --namespace=vault --stdin --tty -- /bin/sh /vault/data/unseal.sh - image: registry.redhat.io/openshift4/ose-cli:v4.7 - volumeMounts: - - mountPath: /vault-unseal-config - name: vault-unseal-config-volume - restartPolicy: Never - serviceAccount: vault - volumes: - - name: vault-unseal-config-volume - configMap: - name: vault-unseal-config \ No newline at end of file diff --git a/vault/values.yaml b/vault/values.yaml index 865a31a..bba40ea 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -7,4 +7,15 @@ vault: auth: namespace: default - \ No newline at end of file +secrets: + gitlab: + rootPassword: "" + keycloak: + clientId: backstage + clientSecret: "" + pluginClientSecret: "" + rhdh: + argocdPassword: "" + postgresqlPassword: "" + common: + password: "" From 6265f1a3475aa7bfc45c4cd587e9bb73b5ad2223 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 10 Feb 2026 14:11:30 -0800 Subject: [PATCH 02/49] feat: update orchestrator to use vault --- app-of-apps/templates/orchestrator.yaml | 24 +++++++++++++++++ app-of-apps/templates/vault.yaml | 2 ++ app-of-apps/values.yaml | 13 ++++++++++ .../orchestrator-backstage-backend-token.yaml | 26 ++++++++++++++----- .../orchestrator-ocp-gitlab-secret.yaml | 26 ++++++++++++++----- .../orchestrator-ocp-token-secret.yaml | 26 ++++++++++++++----- orchestrator/orchestrator/values.yaml | 4 --- .../templates/es-orchestrator-token.yaml | 21 +++++++++++++++ vault/templates/cm-vault-setup.yaml | 1 + vault/values.yaml | 2 ++ 10 files changed, 123 insertions(+), 22 deletions(-) create mode 100644 app-of-apps/templates/orchestrator.yaml create mode 100644 redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml diff --git a/app-of-apps/templates/orchestrator.yaml b/app-of-apps/templates/orchestrator.yaml new file mode 100644 index 0000000..fa0c83c --- /dev/null +++ b/app-of-apps/templates/orchestrator.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.orchestrator.name "namespace" .Values.argocd.namespace "syncWave" "3") }} +spec: + destination: + namespace: {{ .Values.orchestrator.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: orchestrator + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + orchestrator: + backstage: + namespace: {{ .Values.orchestrator.namespace }} + backend: + url: {{ .Values.orchestrator.backstage.backend.url }} + openshift: + url: {{ .Values.orchestrator.openshift.url }} + gitlab: + url: {{ .Values.orchestrator.gitlab.url }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/vault.yaml b/app-of-apps/templates/vault.yaml index 01b9706..935a533 100644 --- a/app-of-apps/templates/vault.yaml +++ b/app-of-apps/templates/vault.yaml @@ -33,6 +33,8 @@ spec: rhdh: argocdPassword: {{ .Values.vault.secrets.rhdh.argocdPassword | quote }} postgresqlPassword: {{ .Values.vault.secrets.rhdh.postgresqlPassword | quote }} + orchestrator: + token: {{ .Values.vault.secrets.orchestrator.token | quote }} common: password: {{ .Values.vault.secrets.common.password | quote }} syncPolicy: diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 0e8b8da..a2f8177 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -26,6 +26,8 @@ vault: rhdh: argocdPassword: "" postgresqlPassword: password + orchestrator: + token: "" common: password: "" @@ -132,3 +134,14 @@ rhtas: rootCert: email: admin@rhdemo.com org: Parasol + +orchestrator: + name: orchestrator + namespace: backstage + backstage: + backend: + url: "" + openshift: + url: "" + gitlab: + url: "" diff --git a/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml b/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml index cb6ba60..8ce85e3 100644 --- a/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml +++ b/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml @@ -1,11 +1,25 @@ -apiVersion: v1 -kind: Secret +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret metadata: name: {{ include "orchestrator.name" . }}-backstage-backend-token namespace: {{ include "orchestrator.namespace" . }} annotations: {{- include "orchestrator.argocd-syncwave" . | nindent 4 }} -type: opaque -stringData: - BACKSTAGE_BACKEND_BEARER_TOKEN: {{ .Values.backstage.backend.token }} - BACKSTAGE_BACKEND_URL: {{ .Values.backstage.backend.url }} +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: {{ include "orchestrator.name" . }}-backstage-backend-token + creationPolicy: Owner + template: + engineVersion: v2 + data: + BACKSTAGE_BACKEND_BEARER_TOKEN: {{ printf "{{ .token }}" | quote }} + BACKSTAGE_BACKEND_URL: {{ .Values.backstage.backend.url | quote }} + data: + - secretKey: token + remoteRef: + key: secrets/rhdh/orchestrator-token + property: value diff --git a/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml b/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml index 2013ca7..6e6c9df 100644 --- a/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml +++ b/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml @@ -1,11 +1,25 @@ -apiVersion: v1 -kind: Secret +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret metadata: name: {{ include "orchestrator.name" . }}-gitlab-token namespace: {{ include "orchestrator.namespace" . }} annotations: {{- include "orchestrator.argocd-syncwave" . | nindent 4 }} -type: opaque -stringData: - GITLAB_TOKEN: {{ .Values.gitlab.token }} - GITLAB_URL: {{ .Values.gitlab.url }} +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: {{ include "orchestrator.name" . }}-gitlab-token + creationPolicy: Owner + template: + engineVersion: v2 + data: + GITLAB_TOKEN: {{ printf "{{ .token }}" | quote }} + GITLAB_URL: {{ .Values.gitlab.url | quote }} + data: + - secretKey: token + remoteRef: + key: secrets/gitlab/token + property: value diff --git a/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml b/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml index 4ae18d9..8939ac5 100644 --- a/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml +++ b/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml @@ -1,11 +1,25 @@ -apiVersion: v1 -kind: Secret +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret metadata: name: {{ include "orchestrator.name" . }}-ocp-token namespace: {{ include "orchestrator.namespace" . }} annotations: {{- include "orchestrator.argocd-syncwave" . | nindent 4 }} -type: opaque -stringData: - OCP_API_SERVER_TOKEN: {{ .Values.openshift.token }} - OCP_API_SERVER_URL: {{ .Values.openshift.url }} +spec: + refreshInterval: 1m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: {{ include "orchestrator.name" . }}-ocp-token + creationPolicy: Owner + template: + engineVersion: v2 + data: + OCP_API_SERVER_TOKEN: {{ printf "{{ .token }}" | quote }} + OCP_API_SERVER_URL: {{ .Values.openshift.url | quote }} + data: + - secretKey: token + remoteRef: + key: secrets/rhdh/kubernetes-sa-token + property: value diff --git a/orchestrator/orchestrator/values.yaml b/orchestrator/orchestrator/values.yaml index f19ad21..88617f4 100644 --- a/orchestrator/orchestrator/values.yaml +++ b/orchestrator/orchestrator/values.yaml @@ -3,19 +3,15 @@ backstage: operator: enabled: false backend: - token: url: openshift: - token: url: gitlab: - token: url: argocd: enabled: true orchestrator: syncwave: "0" - diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml new file mode 100644 index 0000000..bf76215 --- /dev/null +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: backstage-orchestrator-token + labels: + {{- include "redhat-developer-hub-prereqs.labels" . | nindent 4 }} + annotations: + {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: backstage-orchestrator-token + creationPolicy: Owner + data: + - secretKey: ORCHESTRATOR_TOKEN + remoteRef: + key: secrets/rhdh/orchestrator-token + property: value diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index f20b22d..8bcfe17 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -118,4 +118,5 @@ data: - 'vault kv put kv/secrets/keycloak/plugin-client-secret value={{ $.Values.secrets.keycloak.pluginClientSecret }}' - 'vault kv put kv/secrets/rhdh/argocd-password value={{ $.Values.secrets.rhdh.argocdPassword }}' - 'vault kv put kv/secrets/rhdh/postgresql-password value={{ $.Values.secrets.rhdh.postgresqlPassword }}' + - 'vault kv put kv/secrets/rhdh/orchestrator-token value={{ $.Values.secrets.orchestrator.token }}' - 'vault kv put kv/secrets/common/password value={{ $.Values.secrets.common.password }}' diff --git a/vault/values.yaml b/vault/values.yaml index bba40ea..ea5a36a 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -17,5 +17,7 @@ secrets: rhdh: argocdPassword: "" postgresqlPassword: "" + orchestrator: + token: "" common: password: "" From e82c1fc850e14ed9da95016d9a26285f8bc9822e Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 10 Feb 2026 16:08:13 -0800 Subject: [PATCH 03/49] fix: gitlab init uri params error --- gitlab/templates/cm-gitlab-init.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/gitlab/templates/cm-gitlab-init.yaml b/gitlab/templates/cm-gitlab-init.yaml index ec69892..0031057 100644 --- a/gitlab/templates/cm-gitlab-init.yaml +++ b/gitlab/templates/cm-gitlab-init.yaml @@ -79,11 +79,11 @@ data: headers: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false - retries: 10 - delay: 5 - register: r_application_settings - until: r_application_settings.status == 200 status_code: 200 + retries: 10 + delay: 5 + register: r_application_settings + until: r_application_settings.status == 200 {{- range $item := .Values.gitlab.users.users }} From 1e517f5bc969c82ffd3907417bdd107d1bf2f317 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 10 Feb 2026 16:12:21 -0800 Subject: [PATCH 04/49] fix: gitlab yaml indentation --- gitlab/templates/cm-gitlab-init.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/gitlab/templates/cm-gitlab-init.yaml b/gitlab/templates/cm-gitlab-init.yaml index 0031057..f1d1fa3 100644 --- a/gitlab/templates/cm-gitlab-init.yaml +++ b/gitlab/templates/cm-gitlab-init.yaml @@ -80,10 +80,10 @@ data: PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' validate_certs: false status_code: 200 - retries: 10 - delay: 5 - register: r_application_settings - until: r_application_settings.status == 200 + retries: 10 + delay: 5 + register: r_application_settings + until: r_application_settings.status == 200 {{- range $item := .Values.gitlab.users.users }} From 7551ce5339f018ab4e36d0aa82296d537034f91d Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 10 Feb 2026 16:39:16 -0800 Subject: [PATCH 05/49] fix: orchestrator var passing --- app-of-apps/templates/gitlab.yaml | 2 ++ gitlab/templates/cm-gitlab-templates.yaml | 1 + 2 files changed, 3 insertions(+) diff --git a/app-of-apps/templates/gitlab.yaml b/app-of-apps/templates/gitlab.yaml index 5c0163a..8c6267a 100644 --- a/app-of-apps/templates/gitlab.yaml +++ b/app-of-apps/templates/gitlab.yaml @@ -32,4 +32,6 @@ spec: value: {{ .Values.vault.name }} - name: vault.namespace value: {{ .Values.vault.namespace }} + - name: orchestrator.namespace + value: {{ .Values.orchestrator.namespace }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/gitlab/templates/cm-gitlab-templates.yaml b/gitlab/templates/cm-gitlab-templates.yaml index 7b4ada8..0d7ce83 100644 --- a/gitlab/templates/cm-gitlab-templates.yaml +++ b/gitlab/templates/cm-gitlab-templates.yaml @@ -89,6 +89,7 @@ data: rhdh_gitops_namespace: "{{ $.Values.gitops.namespace }}" rhdh_gitops_project: "{{ $.Values.gitops.project }}" quay_host: "{{ $.Values.quay.host }}" + orchestrator_namespace: "{{ $.Values.orchestrator.namespace }}" {{- end }} - name: Add new files to the repository From 106b00bc20370cc2bf4c0eb0cc0e8b42449bed59 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 10 Feb 2026 16:59:02 -0800 Subject: [PATCH 06/49] fix: template rendering idempotency --- gitlab/templates/cm-gitlab-templates.yaml | 38 +++++++++++------------ 1 file changed, 18 insertions(+), 20 deletions(-) diff --git a/gitlab/templates/cm-gitlab-templates.yaml b/gitlab/templates/cm-gitlab-templates.yaml index 0d7ce83..70cda53 100644 --- a/gitlab/templates/cm-gitlab-templates.yaml +++ b/gitlab/templates/cm-gitlab-templates.yaml @@ -70,26 +70,24 @@ data: {{- range $item1 := $item.templates }} - - name: Fetch /tmp/{{ $item.project }}/{{ $item1 }} template from remote host - run_once: true - ansible.builtin.fetch: - src: /tmp/{{ $item.project }}/{{ $item1 }} - dest: /tmp/{{ $item1 }} - flat: true - fail_on_missing: true - - - name: Apply template /tmp/{{ $item.project }}/{{ $item1 }} - ansible.builtin.template: - src: /tmp/{{ $item1 }} - dest: /tmp/{{ $item.project }}/{{ $item1 }} - mode: "0660" - vars: - gitlab_host: "{{ $.Values.gitlab.host }}" - cluster_subdomain: "{{ $.Values.cluster.subdomain }}" - rhdh_gitops_namespace: "{{ $.Values.gitops.namespace }}" - rhdh_gitops_project: "{{ $.Values.gitops.project }}" - quay_host: "{{ $.Values.quay.host }}" - orchestrator_namespace: "{{ $.Values.orchestrator.namespace }}" + - name: Replace template variables in /tmp/{{ $item.project }}/{{ $item1 }} + ansible.builtin.replace: + path: /tmp/{{ $item.project }}/{{ $item1 }} + regexp: '\{\{\s*{{ "{{" }} item.key {{ "}}" }}\s*\}\}' + replace: '{{ "{{" }} item.value {{ "}}" }}' + loop: + - key: gitlab_host + value: "{{ $.Values.gitlab.host }}" + - key: cluster_subdomain + value: "{{ $.Values.cluster.subdomain }}" + - key: rhdh_gitops_namespace + value: "{{ $.Values.gitops.namespace }}" + - key: rhdh_gitops_project + value: "{{ $.Values.gitops.project }}" + - key: quay_host + value: "{{ $.Values.quay.host }}" + - key: orchestrator_namespace + value: "{{ $.Values.orchestrator.namespace }}" {{- end }} - name: Add new files to the repository From 91331cf25334708f03c679718783f1356bc6bd4e Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 13:43:25 -0800 Subject: [PATCH 07/49] feat: add devspaces to deployment --- README.md | 121 +++++++++++++++--- app-of-apps/templates/devspaces.yaml | 15 +++ app-of-apps/values.yaml | 5 + devspaces/Chart.yaml | 13 ++ devspaces/devspaces-instance/Chart.yaml | 5 + .../devspaces-instance/templates/_helpers.tpl | 32 +++++ .../templates/checluster.yaml | 44 +++++++ devspaces/devspaces-instance/values.yaml | 15 +++ devspaces/devspaces-operator/Chart.yaml | 5 + .../devspaces-operator/templates/_helpers.tpl | 92 +++++++++++++ .../templates/devspaces-operatorgroup.yaml | 11 ++ .../templates/devspaces-subscription.yaml | 14 ++ devspaces/devspaces-operator/values.yaml | 19 +++ devspaces/values.yaml | 0 14 files changed, 371 insertions(+), 20 deletions(-) create mode 100644 app-of-apps/templates/devspaces.yaml create mode 100644 devspaces/Chart.yaml create mode 100644 devspaces/devspaces-instance/Chart.yaml create mode 100644 devspaces/devspaces-instance/templates/_helpers.tpl create mode 100644 devspaces/devspaces-instance/templates/checluster.yaml create mode 100644 devspaces/devspaces-instance/values.yaml create mode 100644 devspaces/devspaces-operator/Chart.yaml create mode 100644 devspaces/devspaces-operator/templates/_helpers.tpl create mode 100644 devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml create mode 100644 devspaces/devspaces-operator/templates/devspaces-subscription.yaml create mode 100644 devspaces/devspaces-operator/values.yaml create mode 100644 devspaces/values.yaml diff --git a/README.md b/README.md index 9c0559f..2294173 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,98 @@ -Helm charts for Platform Engineering Workshop. +# Platform Engineering Workshop — Helm Charts +Helm charts that deploy a complete Platform Engineering workshop environment on OpenShift 4.x. Designed for use with the [platform-engineering-workshop](https://github.com/rhpds/platform-engineering-workshop) Ansible-based deployer, which bootstraps the cluster and deploys a single Argo CD `Application` CR pointing to the `app-of-apps/` chart. From there, Argo CD manages everything. -To verify the RHTAS installation & configuration: +> [!NOTE] +> This is a **workshop/demo environment**. Some design choices (storing passwords in Vault at deploy time, broad RBAC grants, shared credentials) reflect that priority. Don't use this as a production reference architecture. -1) Login to the OpenShift Cluster +## What gets deployed -2) Download `cosign` from the OCP console / "Command Line Tools" and install it in your PATH +The workshop stands up the following on a single OpenShift cluster: -3) `oc project trusted-artifact-signer` +| Component | Chart | Purpose | +|---|---|---| +| **HashiCorp Vault** | `vault/` | Secrets backend — stores tokens, passwords, and credentials | +| **External Secrets Operator** | `external-secrets/` | Syncs Vault secrets into Kubernetes `Secret` resources via `ExternalSecret` CRs | +| **OpenShift Pipelines** | `openshift-pipelines/` | Tekton-based CI/CD | +| **NooBaa** | `noobaa/` | S3-compatible object storage (backing store for Quay) | +| **GitLab** | `gitlab/` | Source code management — users, groups, and repos are created via init Jobs | +| **Keycloak** | `keycloak/` | SSO/OIDC provider for Developer Hub and Trusted Artifact Signer | +| **Quay** | `quay/` | Container image registry | +| **RHDH GitOps** | `gitops/` | Dedicated Argo CD instance for Developer Hub-managed applications | +| **Red Hat Developer Hub** | `redhat-developer-hub/` | Internal developer portal (Backstage) | +| **Trusted Artifact Signer** | `rhtas/` | Sigstore-based container image signing (Fulcio, Rekor, etc.) | -4) Setup your environment +## App-of-apps pattern + +The `app-of-apps/` chart is the root. It renders one Argo CD `Application` CR per component, each pointing back into this same repository at the appropriate chart path. Argo CD then syncs each child Application independently. + +Sync waves control ordering: + +- **Wave 0** — Foundational: Vault, External Secrets, OpenShift Pipelines, NooBaa +- **Wave 1** — Services: GitLab, Keycloak, Quay, RHDH GitOps +- **Wave 2** — Consumers: Red Hat Developer Hub, Trusted Artifact Signer + +Every child Application uses a foreground deletion finalizer, so deleting the root app-of-apps Application cascade-deletes everything. + +## Secret management + +Vault is the single source of truth for secrets. The flow works like this: + +1. **Ansible** provides known secrets (common password, Keycloak client secrets, ArgoCD password, etc.) as Helm values when creating the app-of-apps Application +2. **Vault's setup Job** (`vault/templates/cm-vault-setup.yaml`) initialises the KV v2 engine, configures Kubernetes auth, and **pre-populates** these known secrets at `kv/secrets//...` paths +3. **Service init Jobs** (GitLab, Quay) generate additional secrets at runtime (GitLab root PAT, webhook secret, Quay registry credentials) and write them to Vault +4. **ExternalSecret CRs** in the RHDH prereqs chart pull secrets from Vault into Kubernetes Secrets that Developer Hub consumes + +> [!IMPORTANT] +> The Vault setup Job pre-populates secrets using values passed through Helm. In a production setup you'd use a proper secret injection workflow. Here, the tradeoff is acceptable because the passwords are generated once by Ansible and the cluster is ephemeral. + +### Vault paths + +| Path | Written by | Consumed by | +|---|---|---| +| `kv/secrets/gitlab/root-password` | Vault setup Job | — | +| `kv/secrets/gitlab/token` | GitLab init Job | RHDH (ExternalSecret) | +| `kv/secrets/gitlab/webhook-secret` | GitLab init Job | — | +| `kv/secrets/keycloak/client-secret` | Vault setup Job | RHDH (ExternalSecret) | +| `kv/secrets/keycloak/plugin-client-secret` | Vault setup Job | — | +| `kv/secrets/quay/auth` | Quay config Job | — | +| `kv/secrets/quay/username` | Quay config Job | — | +| `kv/secrets/quay/password` | Quay config Job | — | +| `kv/secrets/rhdh/argocd-password` | Vault setup Job | RHDH (ExternalSecret) | +| `kv/secrets/rhdh/postgresql-password` | Vault setup Job | RHDH (ExternalSecret) | +| `kv/secrets/rhdh/kubernetes-sa-token` | RHDH SA token Job | RHDH (ExternalSecret) | +| `kv/secrets/common/password` | Vault setup Job | — | + +## Embedded Ansible playbooks + +Several charts use a pattern where a `ConfigMap` contains an Ansible playbook, and a `Job` runs it using an Ansible execution environment image. This handles multi-step imperative setup that can't be expressed declaratively: + +- **`vault/templates/cm-vault-setup.yaml`** — Initialises Vault: retrieves the root token, creates policies, enables Kubernetes auth, enables the KV engine, and pre-populates secrets +- **`gitlab/templates/cm-gitlab-init.yaml`** — Waits for GitLab to be ready, creates a root PAT, configures application settings, creates users/groups/repos, imports repositories, and writes the PAT + webhook secret to Vault +- **`quay/quay-registry/templates/cm-config.yaml`** — Waits for the Quay registry to be ready, creates the admin user, extends the API token expiration, and writes registry credentials to Vault +- **`redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml`** — Creates a `kubernetes.io/service-account-token` Secret, waits for the token to be populated, and writes it to Vault so RHDH can use it for cluster access +- **`redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml`** — Clones the Developer Hub config repo from GitLab, templates it with cluster-specific values, and pushes the result back + +These Jobs use the `quay.io/agnosticd/ee-multicloud` execution environment image (or `ose-cli` for simpler scripts) and follow Helm/Argo CD sync-wave ordering to ensure dependencies are ready. + +## Vault auto-unseal + +Vault uses Shamir key shares stored on the pod's PVC. A `CronJob` (`vault/templates/cronjob-auto-unseal.yaml`) runs every minute to check Vault's seal status and automatically unseal it if needed. This handles: + +- **Initial deployment** — initialises Vault, stores unseal keys, and unseals +- **Pod/cluster restarts** — detects the sealed state and unseals using the persisted keys + +## Verifying RHTAS + +To verify the Trusted Artifact Signer installation: + +1. Login to the OpenShift cluster + +2. Download `cosign` from the OCP console "Command Line Tools" and install it in your PATH + +3. `oc project trusted-artifact-signer` + +4. Setup your environment: ``` export TUF_URL=$(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) @@ -28,29 +111,27 @@ export SIGSTORE_REKOR_URL=$COSIGN_REKOR_URL export REKOR_REKOR_SERVER=$COSIGN_REKOR_URL ``` -5) `cosign initialize` +5. `cosign initialize` -6) Sign an arbitrary container image, for example +6. Sign an arbitrary container image: ``` echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h - podman push ttl.sh/rhtas/test-image:1h +cosign sign -y ttl.sh/rhtas/test-image:1h ``` -`cosign sign -y ttl.sh/rhtas/test-image:1h` +When asked to authenticate, use one of the registered workshop users, e.g. `dev1@rhdemo.com`. -When asked to authenticate, use one of the registered workshop users/password, e.g. `dev1@rhdemo.com` +7. Verify the signature: +``` +cosign verify --certificate-identity=dev1@rhdemo.com ttl.sh/rhtas/test-image:1h | jq +``` -7) Verify the signature - -`cosign verify --certificate-identity=dev1@rhdemo.com ttl.sh/rhtas/test-image:1h` - -(add `| jq` to make it readable) - -8) Show signature/security info related to the OCI artifact - -`cosign tree ttl.sh/rhtas/test-image:1h` +8. Show signature/security info related to the OCI artifact: +``` +cosign tree ttl.sh/rhtas/test-image:1h +``` \ No newline at end of file diff --git a/app-of-apps/templates/devspaces.yaml b/app-of-apps/templates/devspaces.yaml new file mode 100644 index 0000000..2fe3ef5 --- /dev/null +++ b/app-of-apps/templates/devspaces.yaml @@ -0,0 +1,15 @@ +{{- if .Values.devspaces.enabled }} +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.devspaces.name "namespace" .Values.argocd.namespace "syncWave" "0") }} +spec: + destination: + namespace: {{ .Values.devspaces.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: devspaces + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} +{{- end }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index a2f8177..4fb468a 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -135,6 +135,11 @@ rhtas: email: admin@rhdemo.com org: Parasol +devspaces: + enabled: true + name: devspaces + namespace: openshift-devspaces + orchestrator: name: orchestrator namespace: backstage diff --git a/devspaces/Chart.yaml b/devspaces/Chart.yaml new file mode 100644 index 0000000..27e053b --- /dev/null +++ b/devspaces/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: devspaces +description: A Helm chart for OpenShift Dev Spaces +type: application +version: 0.1.0 + +dependencies: + - name: devspaces-operator + version: 0.1.0 + repository: file://devspaces-operator + - name: devspaces-instance + version: 0.1.0 + repository: file://devspaces-instance diff --git a/devspaces/devspaces-instance/Chart.yaml b/devspaces/devspaces-instance/Chart.yaml new file mode 100644 index 0000000..36aa6cc --- /dev/null +++ b/devspaces/devspaces-instance/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: devspaces-instance +description: A Helm chart for the OpenShift Dev Spaces CheCluster instance +type: application +version: 0.1.0 diff --git a/devspaces/devspaces-instance/templates/_helpers.tpl b/devspaces/devspaces-instance/templates/_helpers.tpl new file mode 100644 index 0000000..35076af --- /dev/null +++ b/devspaces/devspaces-instance/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "devspaces-instance.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Determine target namespace +*/}} +{{- define "devspaces-instance.namespace" -}} +{{- if .Values.namespace }} +{{- printf "%s" .Values.namespace }} +{{- else }} +{{- printf "%s" .Release.Namespace }} +{{- end }} +{{- end }} + +{{/* +ArgoCD Syncwave for CheCluster instance +*/}} +{{- define "devspaces-instance.argocd-syncwave" -}} +{{- if .Values.argocd }} +{{- if and (.Values.argocd.instance.syncwave) (.Values.argocd.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.instance.syncwave }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml new file mode 100644 index 0000000..9ffedf2 --- /dev/null +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -0,0 +1,44 @@ +--- +apiVersion: org.eclipse.che/v2 +kind: CheCluster +metadata: + name: {{ include "devspaces-instance.name" . }} + namespace: {{ include "devspaces-instance.namespace" . }} + annotations: + {{- include "devspaces-instance.argocd-syncwave" . | nindent 4 }} +spec: + components: + cheServer: + debug: false + logLevel: INFO + dashboard: {} + devWorkspace: {} + devfileRegistry: {} + imagePuller: + enable: false + metrics: + enable: true + pluginRegistry: + openVSXURL: 'https://open-vsx.org' + containerRegistry: {} + devEnvironments: + startTimeoutSeconds: {{ .Values.devEnvironments.startTimeoutSeconds }} + secondsOfRunBeforeIdling: {{ .Values.devEnvironments.secondsOfRunBeforeIdling }} + maxNumberOfWorkspacesPerUser: {{ .Values.devEnvironments.maxNumberOfWorkspacesPerUser }} + containerBuildConfiguration: + openShiftSecurityContextConstraint: container-build + disableContainerBuildCapabilities: false + defaultEditor: {{ .Values.devEnvironments.defaultEditor }} + defaultNamespace: + autoProvisioning: true + template: -devspaces + secondsOfInactivityBeforeIdling: 1800 + storage: + pvcStrategy: per-user + gitServices: {} + networking: + auth: + gateway: + configLabels: + app: che + component: che-gateway-config diff --git a/devspaces/devspaces-instance/values.yaml b/devspaces/devspaces-instance/values.yaml new file mode 100644 index 0000000..482b73b --- /dev/null +++ b/devspaces/devspaces-instance/values.yaml @@ -0,0 +1,15 @@ +nameOverride: "devspaces" +fullnameOverride: "" + +namespace: "" + +devEnvironments: + startTimeoutSeconds: 300 + secondsOfRunBeforeIdling: 600 + maxNumberOfWorkspacesPerUser: 2 + defaultEditor: che-incubator/che-code/latest + +argocd: + enabled: true + instance: + syncwave: "0" diff --git a/devspaces/devspaces-operator/Chart.yaml b/devspaces/devspaces-operator/Chart.yaml new file mode 100644 index 0000000..e343c7e --- /dev/null +++ b/devspaces/devspaces-operator/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: devspaces-operator +description: A Helm chart for the OpenShift Dev Spaces operator +type: application +version: 0.1.0 diff --git a/devspaces/devspaces-operator/templates/_helpers.tpl b/devspaces/devspaces-operator/templates/_helpers.tpl new file mode 100644 index 0000000..e8c91c3 --- /dev/null +++ b/devspaces/devspaces-operator/templates/_helpers.tpl @@ -0,0 +1,92 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "devspaces-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "devspaces-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "devspaces-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "devspaces-operator.labels" -}} +helm.sh/chart: {{ include "devspaces-operator.chart" . }} +{{ include "devspaces-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "devspaces-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "devspaces-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Determine target namespace +*/}} +{{- define "devspaces-operator.namespace" -}} +{{- if .Values.namespace }} +{{- printf "%s" .Values.namespace }} +{{- else }} +{{- printf "%s" .Release.Namespace }} +{{- end }} +{{- end }} + +{{/* +ArgoCD Syncwave for operator subscription +*/}} +{{- define "devspaces-operator.argocd-syncwave" -}} +{{- if .Values.argocd }} +{{- if and (.Values.argocd.operator.syncwave) (.Values.argocd.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.operator.syncwave }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} + +{{/* +ArgoCD Syncwave for operatorgroup +*/}} +{{- define "devspaces-operatorgroup.argocd-syncwave" -}} +{{- if .Values.argocd }} +{{- if and (.Values.argocd.operatorgroup.syncwave) (.Values.argocd.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.operatorgroup.syncwave }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} diff --git a/devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml b/devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml new file mode 100644 index 0000000..5b738ee --- /dev/null +++ b/devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: "{{ include "devspaces-operator.name" . }}-operatorgroup" + namespace: {{ include "devspaces-operator.namespace" . }} + annotations: + {{- include "devspaces-operatorgroup.argocd-syncwave" . | nindent 4 }} +spec: + targetNamespaces: + - {{ include "devspaces-operator.namespace" . }} diff --git a/devspaces/devspaces-operator/templates/devspaces-subscription.yaml b/devspaces/devspaces-operator/templates/devspaces-subscription.yaml new file mode 100644 index 0000000..027aad8 --- /dev/null +++ b/devspaces/devspaces-operator/templates/devspaces-subscription.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: {{ include "devspaces-operator.name" . }}-operator + namespace: {{ include "devspaces-operator.namespace" . }} + annotations: + {{- include "devspaces-operator.argocd-syncwave" . | nindent 4 }} +spec: + channel: {{ .Values.devspaces.subscription.channel }} + installPlanApproval: {{ .Values.devspaces.subscription.installPlanApproval }} + name: {{ .Values.devspaces.subscription.name }} + source: {{ .Values.devspaces.subscription.source }} + sourceNamespace: {{ .Values.devspaces.subscription.sourceNamespace }} diff --git a/devspaces/devspaces-operator/values.yaml b/devspaces/devspaces-operator/values.yaml new file mode 100644 index 0000000..873aa69 --- /dev/null +++ b/devspaces/devspaces-operator/values.yaml @@ -0,0 +1,19 @@ +nameOverride: "devspaces" +fullnameOverride: "" + +namespace: "" + +devspaces: + subscription: + channel: stable + installPlanApproval: Automatic + name: devspacesoperator + source: devspaces-catalogsource + sourceNamespace: openshift-marketplace + +argocd: + enabled: true + operatorgroup: + syncwave: "-3" + operator: + syncwave: "-2" diff --git a/devspaces/values.yaml b/devspaces/values.yaml new file mode 100644 index 0000000..e69de29 From 8fba1404004c2b98416e4bff356b376b83e4c4a7 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 14:57:27 -0800 Subject: [PATCH 08/49] fix: use standard refresh intervals for secrets --- .../templates/orchestrator-backstage-backend-token.yaml | 2 +- .../orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml | 2 +- .../orchestrator/templates/orchestrator-ocp-token-secret.yaml | 2 +- .../templates/es-argocd-password.yaml | 2 +- .../redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml | 2 +- .../templates/es-kubernetes-sa-token.yaml | 2 +- .../redhat-developer-hub-prereqs/templates/es-oauth-client.yaml | 2 +- .../templates/es-orchestrator-token.yaml | 2 +- .../redhat-developer-hub-prereqs/templates/es-postgresql.yaml | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml b/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml index 8ce85e3..98d0245 100644 --- a/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml +++ b/orchestrator/orchestrator/templates/orchestrator-backstage-backend-token.yaml @@ -6,7 +6,7 @@ metadata: annotations: {{- include "orchestrator.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1h + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml b/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml index 6e6c9df..200b370 100644 --- a/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml +++ b/orchestrator/orchestrator/templates/orchestrator-ocp-gitlab-secret.yaml @@ -6,7 +6,7 @@ metadata: annotations: {{- include "orchestrator.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1h + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml b/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml index 8939ac5..a5bc4b0 100644 --- a/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml +++ b/orchestrator/orchestrator/templates/orchestrator-ocp-token-secret.yaml @@ -6,7 +6,7 @@ metadata: annotations: {{- include "orchestrator.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1m + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml index f559c69..d17811b 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-argocd-password.yaml @@ -7,7 +7,7 @@ metadata: annotations: {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1h + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml index ab66b2c..b29381c 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-gitlab-token.yaml @@ -7,7 +7,7 @@ metadata: annotations: {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1h + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml index 245cd5e..78c6c2e 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-kubernetes-sa-token.yaml @@ -7,7 +7,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "2" spec: - refreshInterval: 1m + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml index a0711a1..c84dbff 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-oauth-client.yaml @@ -7,7 +7,7 @@ metadata: annotations: {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1h + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml index bf76215..062dd56 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-orchestrator-token.yaml @@ -7,7 +7,7 @@ metadata: annotations: {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1h + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml index b1a46ad..0d44846 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/es-postgresql.yaml @@ -7,7 +7,7 @@ metadata: annotations: {{- include "redhat-developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} spec: - refreshInterval: 1h + refreshInterval: 5m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore From 6859ee3b919364c7a217a41bb9743482869e5e41 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 15:05:10 -0800 Subject: [PATCH 09/49] fix: devspaces catalog source --- .../devspaces-operator/templates/devspaces-subscription.yaml | 1 + devspaces/devspaces-operator/values.yaml | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/devspaces/devspaces-operator/templates/devspaces-subscription.yaml b/devspaces/devspaces-operator/templates/devspaces-subscription.yaml index 027aad8..6f979e9 100644 --- a/devspaces/devspaces-operator/templates/devspaces-subscription.yaml +++ b/devspaces/devspaces-operator/templates/devspaces-subscription.yaml @@ -12,3 +12,4 @@ spec: name: {{ .Values.devspaces.subscription.name }} source: {{ .Values.devspaces.subscription.source }} sourceNamespace: {{ .Values.devspaces.subscription.sourceNamespace }} + startingCSV: {{ .Values.devspaces.subscription.startingCSV }} diff --git a/devspaces/devspaces-operator/values.yaml b/devspaces/devspaces-operator/values.yaml index 873aa69..a39957b 100644 --- a/devspaces/devspaces-operator/values.yaml +++ b/devspaces/devspaces-operator/values.yaml @@ -8,7 +8,8 @@ devspaces: channel: stable installPlanApproval: Automatic name: devspacesoperator - source: devspaces-catalogsource + source: redhat-operators + startingCSV: devspacesoperator.v3.26.0 sourceNamespace: openshift-marketplace argocd: From 52dc0b1431a1d878bd2ae1426c4f570617f46aea Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 15:14:50 -0800 Subject: [PATCH 10/49] fix: missing resources errors (for operator installs) --- app-of-apps/templates/_helpers.tpl | 1 + 1 file changed, 1 insertion(+) diff --git a/app-of-apps/templates/_helpers.tpl b/app-of-apps/templates/_helpers.tpl index 18aa93d..357bf5b 100644 --- a/app-of-apps/templates/_helpers.tpl +++ b/app-of-apps/templates/_helpers.tpl @@ -16,6 +16,7 @@ syncPolicy: syncOptions: - CreateNamespace=true - RespectIgnoreDifferences=true + - SkipDryRunOnMissingResource=true {{- end }} {{/* From 9004de36bbde15339858feabda9a501c743786a0 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 15:20:08 -0800 Subject: [PATCH 11/49] fix(devspaces): correct operator package name The subscription referenced package "devspacesoperator" which does not exist in the redhat-operators catalog. The correct package name is "devspaces". Co-Authored-By: Claude Opus 4.6 --- devspaces/devspaces-operator/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devspaces/devspaces-operator/values.yaml b/devspaces/devspaces-operator/values.yaml index a39957b..ee64f79 100644 --- a/devspaces/devspaces-operator/values.yaml +++ b/devspaces/devspaces-operator/values.yaml @@ -7,7 +7,7 @@ devspaces: subscription: channel: stable installPlanApproval: Automatic - name: devspacesoperator + name: devspaces source: redhat-operators startingCSV: devspacesoperator.v3.26.0 sourceNamespace: openshift-marketplace From c2aa77ed2d212625876c596a2a52b00e7de70653 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 15:22:53 -0800 Subject: [PATCH 12/49] fix: add vault auth to the sa token writer --- .../templates/cm-sa-token-writer.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml index 22992de..0d4740d 100644 --- a/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml +++ b/redhat-developer-hub/redhat-developer-hub-prereqs/templates/cm-sa-token-writer.yaml @@ -64,8 +64,20 @@ data: - r_vault.resources[0].status.phase is defined - r_vault.resources[0].status.phase == 'Running' + - name: Read Vault token + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: vault-token + namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' + register: r_vault_token + + - name: Set Vault token + ansible.builtin.set_fact: + vault_token: '{{ "{{" }} r_vault_token.resources[0].data.token | b64decode {{ "}}" }}' + - name: Write SA token to Vault kubernetes.core.k8s_exec: namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' pod: '{{ "{{" }} vault_name {{ "}}" }}-0' - command: 'vault kv put kv/secrets/rhdh/kubernetes-sa-token value={{ "{{" }} sa_token {{ "}}" }}' + command: 'sh -c "VAULT_TOKEN={{ "{{" }} vault_token {{ "}}" }} vault kv put kv/secrets/rhdh/kubernetes-sa-token value={{ "{{" }} sa_token {{ "}}" }}"' From 8cf127f23b87700962c28a14a50c231b3dff50aa Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 16:52:04 -0800 Subject: [PATCH 13/49] fix: use correct che auto provision prop --- devspaces/devspaces-instance/templates/checluster.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index 9ffedf2..34ae030 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -30,7 +30,7 @@ spec: disableContainerBuildCapabilities: false defaultEditor: {{ .Values.devEnvironments.defaultEditor }} defaultNamespace: - autoProvisioning: true + autoProvision: true template: -devspaces secondsOfInactivityBeforeIdling: 1800 storage: From 946b252631288de6f491b2c0f27959f5f52555cc Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 17:26:43 -0800 Subject: [PATCH 14/49] fix: remove target ns from devspace install --- .../devspaces-operator/templates/devspaces-operatorgroup.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml b/devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml index 5b738ee..8bc0e1b 100644 --- a/devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml +++ b/devspaces/devspaces-operator/templates/devspaces-operatorgroup.yaml @@ -6,6 +6,4 @@ metadata: namespace: {{ include "devspaces-operator.namespace" . }} annotations: {{- include "devspaces-operatorgroup.argocd-syncwave" . | nindent 4 }} -spec: - targetNamespaces: - - {{ include "devspaces-operator.namespace" . }} +spec: {} From b809d7beec27c1433bb064414f8f2fc02ebca345 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 12 Feb 2026 17:37:33 -0800 Subject: [PATCH 15/49] fix: use user rhdh password in vault for rhdh --- vault/templates/cm-vault-setup.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index 8bcfe17..fa3d75e 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -116,7 +116,7 @@ data: - 'vault kv put kv/secrets/gitlab/root-password value={{ $.Values.secrets.gitlab.rootPassword }}' - 'vault kv put kv/secrets/keycloak/client-secret clientId={{ $.Values.secrets.keycloak.clientId }} clientSecret={{ $.Values.secrets.keycloak.clientSecret }}' - 'vault kv put kv/secrets/keycloak/plugin-client-secret value={{ $.Values.secrets.keycloak.pluginClientSecret }}' - - 'vault kv put kv/secrets/rhdh/argocd-password value={{ $.Values.secrets.rhdh.argocdPassword }}' + - 'vault kv put kv/secrets/rhdh/argocd-password value={{ $.Values.secrets.common.password }}' - 'vault kv put kv/secrets/rhdh/postgresql-password value={{ $.Values.secrets.rhdh.postgresqlPassword }}' - 'vault kv put kv/secrets/rhdh/orchestrator-token value={{ $.Values.secrets.orchestrator.token }}' - 'vault kv put kv/secrets/common/password value={{ $.Values.secrets.common.password }}' From ebd0aad1c177f9ca6e621ecd9381521bd90ae3fd Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Fri, 13 Feb 2026 15:47:25 -0800 Subject: [PATCH 16/49] feat: enable oidc login to devspaces and gitlab integration --- app-of-apps/templates/devspaces.yaml | 9 ++++ app-of-apps/templates/keycloak.yaml | 5 +++ app-of-apps/templates/vault.yaml | 1 + app-of-apps/values.yaml | 6 +++ .../templates/checluster.yaml | 8 +++- .../templates/es-gitlab-oauth.yaml | 35 ++++++++++++++++ devspaces/devspaces-instance/values.yaml | 8 ++++ gitlab/templates/cm-gitlab-init.yaml | 29 +++++++++++++ .../templates/_helpers.tpl | 11 +++++ .../templates/keycloak-realmimport.yaml | 41 +++++++++++++++++++ keycloak/keycloak-realm-import/values.yaml | 5 +++ vault/templates/cm-vault-setup.yaml | 1 + vault/values.yaml | 1 + 13 files changed, 159 insertions(+), 1 deletion(-) create mode 100644 devspaces/devspaces-instance/templates/es-gitlab-oauth.yaml diff --git a/app-of-apps/templates/devspaces.yaml b/app-of-apps/templates/devspaces.yaml index 2fe3ef5..479ad5f 100644 --- a/app-of-apps/templates/devspaces.yaml +++ b/app-of-apps/templates/devspaces.yaml @@ -11,5 +11,14 @@ spec: path: devspaces repoURL: {{ .Values.gitops.repoURL }} targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + devspaces-instance: + gitlab: + host: {{ .Values.gitlab.host }} + oidc: + identityProviderURL: https://{{ .Values.keycloak.route.host }}/realms/{{ .Values.keycloak.realm.name }} + oAuthClientName: {{ .Values.keycloak.client.devspaces.name }} + oAuthSecret: {{ .Values.keycloak.client.devspaces.secret | quote }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} {{- end }} diff --git a/app-of-apps/templates/keycloak.yaml b/app-of-apps/templates/keycloak.yaml index 93e126a..54b2c95 100644 --- a/app-of-apps/templates/keycloak.yaml +++ b/app-of-apps/templates/keycloak.yaml @@ -37,6 +37,11 @@ spec: backstagePlugin: name: {{ .Values.keycloak.client.backstagePlugin.name }} secret: {{ .Values.keycloak.client.backstagePlugin.secret | quote }} + devspaces: + name: {{ .Values.keycloak.client.devspaces.name }} + redirectUri: {{ .Values.keycloak.client.devspaces.redirectUri }} + webOrigin: {{ .Values.keycloak.client.devspaces.webOrigin }} + secret: {{ .Values.keycloak.client.devspaces.secret | quote }} users: password: {{ .Values.keycloak.users.password | quote }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/vault.yaml b/app-of-apps/templates/vault.yaml index 935a533..d9ad6a7 100644 --- a/app-of-apps/templates/vault.yaml +++ b/app-of-apps/templates/vault.yaml @@ -30,6 +30,7 @@ spec: clientId: {{ .Values.vault.secrets.keycloak.clientId }} clientSecret: {{ .Values.vault.secrets.keycloak.clientSecret | quote }} pluginClientSecret: {{ .Values.vault.secrets.keycloak.pluginClientSecret | quote }} + devspacesClientSecret: {{ .Values.vault.secrets.keycloak.devspacesClientSecret | quote }} rhdh: argocdPassword: {{ .Values.vault.secrets.rhdh.argocdPassword | quote }} postgresqlPassword: {{ .Values.vault.secrets.rhdh.postgresqlPassword | quote }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 4fb468a..855201b 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -23,6 +23,7 @@ vault: clientId: backstage clientSecret: "" pluginClientSecret: "" + devspacesClientSecret: "" rhdh: argocdPassword: "" postgresqlPassword: password @@ -79,6 +80,11 @@ keycloak: backstagePlugin: name: backstage-plugin secret: "" + devspaces: + name: devspaces + redirectUri: "" + webOrigin: "" + secret: "" users: password: "" diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index 34ae030..c1d59a5 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -35,9 +35,15 @@ spec: secondsOfInactivityBeforeIdling: 1800 storage: pvcStrategy: per-user - gitServices: {} + gitServices: + gitlab: + - secretName: gitlab-oauth-config + endpoint: https://{{ .Values.gitlab.host }} networking: auth: + identityProviderURL: {{ .Values.oidc.identityProviderURL }} + oAuthClientName: {{ .Values.oidc.oAuthClientName }} + oAuthSecret: {{ .Values.oidc.oAuthSecret }} gateway: configLabels: app: che diff --git a/devspaces/devspaces-instance/templates/es-gitlab-oauth.yaml b/devspaces/devspaces-instance/templates/es-gitlab-oauth.yaml new file mode 100644 index 0000000..14201e9 --- /dev/null +++ b/devspaces/devspaces-instance/templates/es-gitlab-oauth.yaml @@ -0,0 +1,35 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-oauth-config + namespace: {{ include "devspaces-instance.namespace" . }} + annotations: + {{- include "devspaces-instance.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: gitlab-oauth-config + creationPolicy: Owner + template: + metadata: + labels: + app.kubernetes.io/part-of: che.eclipse.org + app.kubernetes.io/component: oauth-scm-configuration + annotations: + che.eclipse.org/oauth-scm-server: gitlab + che.eclipse.org/scm-server-endpoint: https://{{ .Values.gitlab.host }} + data: + id: {{ printf "{{ .id }}" | quote }} + secret: {{ printf "{{ .secret }}" | quote }} + data: + - secretKey: id + remoteRef: + key: secrets/gitlab/devspaces-oauth + property: id + - secretKey: secret + remoteRef: + key: secrets/gitlab/devspaces-oauth + property: secret diff --git a/devspaces/devspaces-instance/values.yaml b/devspaces/devspaces-instance/values.yaml index 482b73b..9a37b54 100644 --- a/devspaces/devspaces-instance/values.yaml +++ b/devspaces/devspaces-instance/values.yaml @@ -9,6 +9,14 @@ devEnvironments: maxNumberOfWorkspacesPerUser: 2 defaultEditor: che-incubator/che-code/latest +gitlab: + host: "" + +oidc: + identityProviderURL: "" + oAuthClientName: "" + oAuthSecret: "" + argocd: enabled: true instance: diff --git a/gitlab/templates/cm-gitlab-init.yaml b/gitlab/templates/cm-gitlab-init.yaml index f1d1fa3..d41f814 100644 --- a/gitlab/templates/cm-gitlab-init.yaml +++ b/gitlab/templates/cm-gitlab-init.yaml @@ -317,3 +317,32 @@ data: loop: - 'vault kv put kv/secrets/gitlab/token value={{ "{{" }} root_token {{ "}}" }}' - 'vault kv put kv/secrets/gitlab/webhook-secret value={{ "{{" }} webhook_secret {{ "}}" }}' + + - name: Create GitLab OAuth application for DevSpaces + ansible.builtin.uri: + url: https://{{ $.Values.gitlab.host }}/api/v4/applications + method: POST + body_format: form-urlencoded + body: + name: devspaces + redirect_uri: "https://devspaces.{{ $.Values.cluster.subdomain }}/api/oauth/callback" + scopes: "api read_user read_repository write_repository openid profile email" + confidential: "true" + headers: + PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' + validate_certs: false + status_code: + - 200 + - 201 + register: r_devspaces_oauth_app + retries: 10 + delay: 5 + until: r_devspaces_oauth_app.status in [200, 201] + + - name: Store DevSpaces GitLab OAuth credentials in Vault + kubernetes.core.k8s_exec: + namespace: {{ .Values.vault.namespace }} + pod: {{ .Values.vault.namespace }}-0 + command: '{{ "{{" }} item {{ "}}" }}' + loop: + - 'vault kv put kv/secrets/gitlab/devspaces-oauth id={{ "{{" }} r_devspaces_oauth_app.json.application_id {{ "}}" }} secret={{ "{{" }} r_devspaces_oauth_app.json.secret {{ "}}" }}' diff --git a/keycloak/keycloak-realm-import/templates/_helpers.tpl b/keycloak/keycloak-realm-import/templates/_helpers.tpl index 66c7303..cbcd64c 100644 --- a/keycloak/keycloak-realm-import/templates/_helpers.tpl +++ b/keycloak/keycloak-realm-import/templates/_helpers.tpl @@ -98,6 +98,17 @@ Backstage client secret {{- end }} {{- end }} +{{/* +DevSpaces client secret +*/}} +{{- define "keycloak-realmimport.client-devspaces-secret" -}} +{{- if .Values.client.devspaces.secret }} +{{- .Values.client.devspaces.secret }} +{{- else }} +{{- randAlphaNum 32 }} +{{- end }} +{{- end }} + {{/* User password */}} diff --git a/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml b/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml index b4ce4ca..58a099d 100644 --- a/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml +++ b/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml @@ -687,6 +687,47 @@ spec: - phone - offline_access - microprofile-jwt + - id: {{ uuidv4 }} + clientId: {{ .Values.client.devspaces.name }} + surrogateAuthRequired: false + enabled: true + alwaysDisplayInConsole: false + clientAuthenticatorType: client-secret + secret: {{ include "keycloak-realmimport.client-devspaces-secret" . }} + redirectUris: + - {{ .Values.client.devspaces.redirectUri }} + webOrigins: + - '{{ .Values.client.devspaces.webOrigin }}' + notBefore: 0 + bearerOnly: false + consentRequired: false + standardFlowEnabled: true + implicitFlowEnabled: false + directAccessGrantsEnabled: true + serviceAccountsEnabled: false + publicClient: false + frontchannelLogout: true + protocol: openid-connect + attributes: + oidc.ciba.grant.enabled: 'false' + backchannel.logout.session.required: 'true' + display.on.consent.screen: 'false' + oauth2.device.authorization.grant.enabled: 'false' + backchannel.logout.revoke.offline.tokens: 'false' + authenticationFlowBindingOverrides: {} + fullScopeAllowed: true + nodeReRegistrationTimeout: -1 + defaultClientScopes: + - profile + - roles + - email + - web-origins + optionalClientScopes: + - acr + - address + - phone + - offline_access + - microprofile-jwt - id: {{ uuidv4 }} clientId: {{ .Values.client.backstagePlugin.name }} surrogateAuthRequired: false diff --git a/keycloak/keycloak-realm-import/values.yaml b/keycloak/keycloak-realm-import/values.yaml index aa054ed..6ba3682 100644 --- a/keycloak/keycloak-realm-import/values.yaml +++ b/keycloak/keycloak-realm-import/values.yaml @@ -64,6 +64,11 @@ client: redirectUri: webOrigin: secret: + devspaces: + name: devspaces + redirectUri: "" + webOrigin: "" + secret: trustedartifactsigner: name: trusted-artifact-signer redirectUri: diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index fa3d75e..44bf5ac 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -116,6 +116,7 @@ data: - 'vault kv put kv/secrets/gitlab/root-password value={{ $.Values.secrets.gitlab.rootPassword }}' - 'vault kv put kv/secrets/keycloak/client-secret clientId={{ $.Values.secrets.keycloak.clientId }} clientSecret={{ $.Values.secrets.keycloak.clientSecret }}' - 'vault kv put kv/secrets/keycloak/plugin-client-secret value={{ $.Values.secrets.keycloak.pluginClientSecret }}' + - 'vault kv put kv/secrets/keycloak/devspaces-client-secret value={{ $.Values.secrets.keycloak.devspacesClientSecret }}' - 'vault kv put kv/secrets/rhdh/argocd-password value={{ $.Values.secrets.common.password }}' - 'vault kv put kv/secrets/rhdh/postgresql-password value={{ $.Values.secrets.rhdh.postgresqlPassword }}' - 'vault kv put kv/secrets/rhdh/orchestrator-token value={{ $.Values.secrets.orchestrator.token }}' diff --git a/vault/values.yaml b/vault/values.yaml index ea5a36a..693129d 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -14,6 +14,7 @@ secrets: clientId: backstage clientSecret: "" pluginClientSecret: "" + devspacesClientSecret: "" rhdh: argocdPassword: "" postgresqlPassword: "" From c1664d84e854c4fdab83f626da00de5f1117474d Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Fri, 13 Feb 2026 16:14:21 -0800 Subject: [PATCH 17/49] fix: add additional oidc config to devspaces --- devspaces/devspaces-instance/templates/checluster.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index c1d59a5..e612332 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -9,6 +9,8 @@ metadata: spec: components: cheServer: + extraProperties: + CHE_OIDC_USERNAME__CLAIM: email debug: false logLevel: INFO dashboard: {} @@ -48,3 +50,11 @@ spec: configLabels: app: che component: che-gateway-config + oAuthProxy: + cookieExpireSeconds: 300 + deployment: + containers: + - env: + - name: OAUTH2_PROXY_BACKEND_LOGOUT_URL + value: "https://{{ .Values.oidc.identityProviderURL }}/protocol/openid-connect/logout?id_token_hint={id_token}" + name: oauth-proxy From 915b9b7e7ade110a269b36c7fd0dda33f1d9279a Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Fri, 13 Feb 2026 16:19:23 -0800 Subject: [PATCH 18/49] fix: remove additional https --- devspaces/devspaces-instance/templates/checluster.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index e612332..167e966 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -56,5 +56,5 @@ spec: containers: - env: - name: OAUTH2_PROXY_BACKEND_LOGOUT_URL - value: "https://{{ .Values.oidc.identityProviderURL }}/protocol/openid-connect/logout?id_token_hint={id_token}" + value: "{{ .Values.oidc.identityProviderURL }}/protocol/openid-connect/logout?id_token_hint={id_token}" name: oauth-proxy From 59b0deef8773f4a26cc2f1b9b372bc908b4c5c39 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Fri, 13 Feb 2026 16:31:36 -0800 Subject: [PATCH 19/49] chore: test oidc overrides for devspaces --- .../templates/checluster.yaml | 20 +++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index 167e966..7016050 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -54,7 +54,23 @@ spec: cookieExpireSeconds: 300 deployment: containers: - - env: + - name: oauth-proxy + env: + - name: OAUTH2_PROXY_PROVIDER + value: oidc + - name: OAUTH2_PROXY_OIDC_ISSUER_URL + value: {{ .Values.oidc.identityProviderURL }} + - name: OAUTH2_PROXY_CLIENT_ID + value: {{ .Values.oidc.oAuthClientName }} + - name: OAUTH2_PROXY_CLIENT_SECRET + value: {{ .Values.oidc.oAuthSecret }} + - name: OAUTH2_PROXY_SCOPE + value: openid email profile + - name: OAUTH2_PROXY_EMAIL_DOMAINS + value: "*" + - name: OAUTH2_PROXY_SKIP_PROVIDER_BUTTON + value: "true" + - name: OAUTH2_PROXY_PASS_ACCESS_TOKEN + value: "true" - name: OAUTH2_PROXY_BACKEND_LOGOUT_URL value: "{{ .Values.oidc.identityProviderURL }}/protocol/openid-connect/logout?id_token_hint={id_token}" - name: oauth-proxy From 2bda260f5fbcea744b91dd3cf2764e9f4f96c0b2 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Fri, 13 Feb 2026 17:08:21 -0800 Subject: [PATCH 20/49] feat: add new oauth to openshift for dev login --- app-of-apps/templates/devspaces.yaml | 4 --- app-of-apps/templates/keycloak.yaml | 9 +++--- app-of-apps/templates/openshift-oauth.yaml | 20 +++++++++++++ app-of-apps/templates/vault.yaml | 2 +- app-of-apps/values.yaml | 11 ++++--- .../templates/checluster.yaml | 27 ----------------- devspaces/devspaces-instance/values.yaml | 5 ---- .../templates/_helpers.tpl | 8 ++--- .../templates/keycloak-realmimport.yaml | 8 ++--- keycloak/keycloak-realm-import/values.yaml | 5 ++-- openshift-oauth/Chart.yaml | 5 ++++ .../templates/es-oidc-client-secret.yaml | 22 ++++++++++++++ openshift-oauth/templates/oauth.yaml | 30 +++++++++++++++++++ openshift-oauth/values.yaml | 10 +++++++ vault/templates/cm-vault-setup.yaml | 2 +- vault/values.yaml | 2 +- 16 files changed, 111 insertions(+), 59 deletions(-) create mode 100644 app-of-apps/templates/openshift-oauth.yaml create mode 100644 openshift-oauth/Chart.yaml create mode 100644 openshift-oauth/templates/es-oidc-client-secret.yaml create mode 100644 openshift-oauth/templates/oauth.yaml create mode 100644 openshift-oauth/values.yaml diff --git a/app-of-apps/templates/devspaces.yaml b/app-of-apps/templates/devspaces.yaml index 479ad5f..9838fef 100644 --- a/app-of-apps/templates/devspaces.yaml +++ b/app-of-apps/templates/devspaces.yaml @@ -16,9 +16,5 @@ spec: devspaces-instance: gitlab: host: {{ .Values.gitlab.host }} - oidc: - identityProviderURL: https://{{ .Values.keycloak.route.host }}/realms/{{ .Values.keycloak.realm.name }} - oAuthClientName: {{ .Values.keycloak.client.devspaces.name }} - oAuthSecret: {{ .Values.keycloak.client.devspaces.secret | quote }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} {{- end }} diff --git a/app-of-apps/templates/keycloak.yaml b/app-of-apps/templates/keycloak.yaml index 54b2c95..687eec5 100644 --- a/app-of-apps/templates/keycloak.yaml +++ b/app-of-apps/templates/keycloak.yaml @@ -37,11 +37,10 @@ spec: backstagePlugin: name: {{ .Values.keycloak.client.backstagePlugin.name }} secret: {{ .Values.keycloak.client.backstagePlugin.secret | quote }} - devspaces: - name: {{ .Values.keycloak.client.devspaces.name }} - redirectUri: {{ .Values.keycloak.client.devspaces.redirectUri }} - webOrigin: {{ .Values.keycloak.client.devspaces.webOrigin }} - secret: {{ .Values.keycloak.client.devspaces.secret | quote }} + openshift: + name: {{ .Values.keycloak.client.openshift.name }} + redirectUri: {{ .Values.keycloak.client.openshift.redirectUri }} + secret: {{ .Values.keycloak.client.openshift.secret | quote }} users: password: {{ .Values.keycloak.users.password | quote }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/openshift-oauth.yaml b/app-of-apps/templates/openshift-oauth.yaml new file mode 100644 index 0000000..b529656 --- /dev/null +++ b/app-of-apps/templates/openshift-oauth.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.openshiftOAuth.name "namespace" .Values.argocd.namespace "syncWave" "3") }} +spec: + destination: + namespace: {{ .Values.openshiftOAuth.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: openshift-oauth + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + keycloak: + host: {{ .Values.keycloak.route.host }} + realm: {{ .Values.keycloak.realm.name }} + oidc: + clientId: {{ .Values.keycloak.client.openshift.name }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/templates/vault.yaml b/app-of-apps/templates/vault.yaml index d9ad6a7..4ea4eda 100644 --- a/app-of-apps/templates/vault.yaml +++ b/app-of-apps/templates/vault.yaml @@ -30,7 +30,7 @@ spec: clientId: {{ .Values.vault.secrets.keycloak.clientId }} clientSecret: {{ .Values.vault.secrets.keycloak.clientSecret | quote }} pluginClientSecret: {{ .Values.vault.secrets.keycloak.pluginClientSecret | quote }} - devspacesClientSecret: {{ .Values.vault.secrets.keycloak.devspacesClientSecret | quote }} + openshiftClientSecret: {{ .Values.vault.secrets.keycloak.openshiftClientSecret | quote }} rhdh: argocdPassword: {{ .Values.vault.secrets.rhdh.argocdPassword | quote }} postgresqlPassword: {{ .Values.vault.secrets.rhdh.postgresqlPassword | quote }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 855201b..ea3fc11 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -23,7 +23,7 @@ vault: clientId: backstage clientSecret: "" pluginClientSecret: "" - devspacesClientSecret: "" + openshiftClientSecret: "" rhdh: argocdPassword: "" postgresqlPassword: password @@ -80,10 +80,9 @@ keycloak: backstagePlugin: name: backstage-plugin secret: "" - devspaces: - name: devspaces + openshift: + name: openshift redirectUri: "" - webOrigin: "" secret: "" users: password: "" @@ -141,6 +140,10 @@ rhtas: email: admin@rhdemo.com org: Parasol +openshiftOAuth: + name: openshift-oauth + namespace: openshift-config + devspaces: enabled: true name: devspaces diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index 7016050..c9fba83 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -43,34 +43,7 @@ spec: endpoint: https://{{ .Values.gitlab.host }} networking: auth: - identityProviderURL: {{ .Values.oidc.identityProviderURL }} - oAuthClientName: {{ .Values.oidc.oAuthClientName }} - oAuthSecret: {{ .Values.oidc.oAuthSecret }} gateway: configLabels: app: che component: che-gateway-config - oAuthProxy: - cookieExpireSeconds: 300 - deployment: - containers: - - name: oauth-proxy - env: - - name: OAUTH2_PROXY_PROVIDER - value: oidc - - name: OAUTH2_PROXY_OIDC_ISSUER_URL - value: {{ .Values.oidc.identityProviderURL }} - - name: OAUTH2_PROXY_CLIENT_ID - value: {{ .Values.oidc.oAuthClientName }} - - name: OAUTH2_PROXY_CLIENT_SECRET - value: {{ .Values.oidc.oAuthSecret }} - - name: OAUTH2_PROXY_SCOPE - value: openid email profile - - name: OAUTH2_PROXY_EMAIL_DOMAINS - value: "*" - - name: OAUTH2_PROXY_SKIP_PROVIDER_BUTTON - value: "true" - - name: OAUTH2_PROXY_PASS_ACCESS_TOKEN - value: "true" - - name: OAUTH2_PROXY_BACKEND_LOGOUT_URL - value: "{{ .Values.oidc.identityProviderURL }}/protocol/openid-connect/logout?id_token_hint={id_token}" diff --git a/devspaces/devspaces-instance/values.yaml b/devspaces/devspaces-instance/values.yaml index 9a37b54..ad26aab 100644 --- a/devspaces/devspaces-instance/values.yaml +++ b/devspaces/devspaces-instance/values.yaml @@ -12,11 +12,6 @@ devEnvironments: gitlab: host: "" -oidc: - identityProviderURL: "" - oAuthClientName: "" - oAuthSecret: "" - argocd: enabled: true instance: diff --git a/keycloak/keycloak-realm-import/templates/_helpers.tpl b/keycloak/keycloak-realm-import/templates/_helpers.tpl index cbcd64c..8af9400 100644 --- a/keycloak/keycloak-realm-import/templates/_helpers.tpl +++ b/keycloak/keycloak-realm-import/templates/_helpers.tpl @@ -99,11 +99,11 @@ Backstage client secret {{- end }} {{/* -DevSpaces client secret +OpenShift client secret */}} -{{- define "keycloak-realmimport.client-devspaces-secret" -}} -{{- if .Values.client.devspaces.secret }} -{{- .Values.client.devspaces.secret }} +{{- define "keycloak-realmimport.client-openshift-secret" -}} +{{- if .Values.client.openshift.secret }} +{{- .Values.client.openshift.secret }} {{- else }} {{- randAlphaNum 32 }} {{- end }} diff --git a/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml b/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml index 58a099d..d60c374 100644 --- a/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml +++ b/keycloak/keycloak-realm-import/templates/keycloak-realmimport.yaml @@ -688,16 +688,16 @@ spec: - offline_access - microprofile-jwt - id: {{ uuidv4 }} - clientId: {{ .Values.client.devspaces.name }} + clientId: {{ .Values.client.openshift.name }} surrogateAuthRequired: false enabled: true alwaysDisplayInConsole: false clientAuthenticatorType: client-secret - secret: {{ include "keycloak-realmimport.client-devspaces-secret" . }} + secret: {{ include "keycloak-realmimport.client-openshift-secret" . }} redirectUris: - - {{ .Values.client.devspaces.redirectUri }} + - {{ .Values.client.openshift.redirectUri }} webOrigins: - - '{{ .Values.client.devspaces.webOrigin }}' + - '*' notBefore: 0 bearerOnly: false consentRequired: false diff --git a/keycloak/keycloak-realm-import/values.yaml b/keycloak/keycloak-realm-import/values.yaml index 6ba3682..92d2930 100644 --- a/keycloak/keycloak-realm-import/values.yaml +++ b/keycloak/keycloak-realm-import/values.yaml @@ -64,10 +64,9 @@ client: redirectUri: webOrigin: secret: - devspaces: - name: devspaces + openshift: + name: openshift redirectUri: "" - webOrigin: "" secret: trustedartifactsigner: name: trusted-artifact-signer diff --git a/openshift-oauth/Chart.yaml b/openshift-oauth/Chart.yaml new file mode 100644 index 0000000..91b2ca3 --- /dev/null +++ b/openshift-oauth/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: openshift-oauth +description: Configures OpenShift OAuth with Keycloak as an OpenID Connect identity provider +type: application +version: 0.1.0 diff --git a/openshift-oauth/templates/es-oidc-client-secret.yaml b/openshift-oauth/templates/es-oidc-client-secret.yaml new file mode 100644 index 0000000..a0300bf --- /dev/null +++ b/openshift-oauth/templates/es-oidc-client-secret.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: openshift-oidc-client-secret + namespace: openshift-config + {{- if and .Values.argocd .Values.argocd.enabled }} + annotations: + argocd.argoproj.io/sync-wave: {{ .Values.argocd.syncwave | quote }} + {{- end }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: openshift-oidc-client-secret + creationPolicy: Owner + data: + - secretKey: clientSecret + remoteRef: + key: secrets/keycloak/openshift-client-secret + property: value diff --git a/openshift-oauth/templates/oauth.yaml b/openshift-oauth/templates/oauth.yaml new file mode 100644 index 0000000..84b89dd --- /dev/null +++ b/openshift-oauth/templates/oauth.yaml @@ -0,0 +1,30 @@ +apiVersion: config.openshift.io/v1 +kind: OAuth +metadata: + name: cluster +spec: + identityProviders: + - name: htpasswd + mappingMethod: claim + type: HTPasswd + htpasswd: + fileData: + name: htpasswd + - name: developers + mappingMethod: claim + type: OpenID + openID: + clientID: {{ .Values.oidc.clientId }} + clientSecret: + name: openshift-oidc-client-secret + issuer: https://{{ .Values.keycloak.host }}/realms/{{ .Values.keycloak.realm }} + claims: + preferredUsername: + - preferred_username + email: + - email + name: + - name + extraScopes: + - email + - profile diff --git a/openshift-oauth/values.yaml b/openshift-oauth/values.yaml new file mode 100644 index 0000000..9d8ae5c --- /dev/null +++ b/openshift-oauth/values.yaml @@ -0,0 +1,10 @@ +keycloak: + host: "" + realm: backstage + +oidc: + clientId: openshift + +argocd: + enabled: true + syncwave: "3" diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index 44bf5ac..81f96cf 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -116,7 +116,7 @@ data: - 'vault kv put kv/secrets/gitlab/root-password value={{ $.Values.secrets.gitlab.rootPassword }}' - 'vault kv put kv/secrets/keycloak/client-secret clientId={{ $.Values.secrets.keycloak.clientId }} clientSecret={{ $.Values.secrets.keycloak.clientSecret }}' - 'vault kv put kv/secrets/keycloak/plugin-client-secret value={{ $.Values.secrets.keycloak.pluginClientSecret }}' - - 'vault kv put kv/secrets/keycloak/devspaces-client-secret value={{ $.Values.secrets.keycloak.devspacesClientSecret }}' + - 'vault kv put kv/secrets/keycloak/openshift-client-secret value={{ $.Values.secrets.keycloak.openshiftClientSecret }}' - 'vault kv put kv/secrets/rhdh/argocd-password value={{ $.Values.secrets.common.password }}' - 'vault kv put kv/secrets/rhdh/postgresql-password value={{ $.Values.secrets.rhdh.postgresqlPassword }}' - 'vault kv put kv/secrets/rhdh/orchestrator-token value={{ $.Values.secrets.orchestrator.token }}' diff --git a/vault/values.yaml b/vault/values.yaml index 693129d..6c161fd 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -14,7 +14,7 @@ secrets: clientId: backstage clientSecret: "" pluginClientSecret: "" - devspacesClientSecret: "" + openshiftClientSecret: "" rhdh: argocdPassword: "" postgresqlPassword: "" From e27e2d08981dd2b6d406d6ace4e59f950755eb80 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Fri, 13 Feb 2026 17:12:56 -0800 Subject: [PATCH 21/49] fix: make vault init idempotent --- vault/templates/cm-vault-setup.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index 81f96cf..679e7a5 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -106,6 +106,7 @@ data: - name: Enable kv version 2 ansible.builtin.shell: | oc exec vault-0 -n {{ "{{" }} vault_namespace {{ "}}" }} -- vault secrets enable -version=2 kv + ignore_errors: true - name: Pre-populate known secrets kubernetes.core.k8s_exec: From d5dc4f408a587269f9715d770176f9b4b92f0b7d Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Fri, 13 Feb 2026 17:39:39 -0800 Subject: [PATCH 22/49] doc: add note about oauth for devs/devspaces --- README.md | 11 ++++++++++- .../devspaces-instance/templates/checluster.yaml | 4 ++++ openshift-oauth/templates/oauth.yaml | 4 ++++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 2294173..9955997 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,8 @@ The workshop stands up the following on a single OpenShift cluster: | **OpenShift Pipelines** | `openshift-pipelines/` | Tekton-based CI/CD | | **NooBaa** | `noobaa/` | S3-compatible object storage (backing store for Quay) | | **GitLab** | `gitlab/` | Source code management — users, groups, and repos are created via init Jobs | -| **Keycloak** | `keycloak/` | SSO/OIDC provider for Developer Hub and Trusted Artifact Signer | +| **Keycloak** | `keycloak/` | SSO/OIDC provider for Developer Hub, Trusted Artifact Signer, and OpenShift login | +| **OpenShift OAuth** | `openshift-oauth/` | Adds Keycloak as an OpenID identity provider on the cluster OAuth CR | | **Quay** | `quay/` | Container image registry | | **RHDH GitOps** | `gitops/` | Dedicated Argo CD instance for Developer Hub-managed applications | | **Red Hat Developer Hub** | `redhat-developer-hub/` | Internal developer portal (Backstage) | @@ -54,6 +55,7 @@ Vault is the single source of truth for secrets. The flow works like this: | `kv/secrets/gitlab/token` | GitLab init Job | RHDH (ExternalSecret) | | `kv/secrets/gitlab/webhook-secret` | GitLab init Job | — | | `kv/secrets/keycloak/client-secret` | Vault setup Job | RHDH (ExternalSecret) | +| `kv/secrets/keycloak/openshift-client-secret` | Vault setup Job | OpenShift OAuth (ExternalSecret) | | `kv/secrets/keycloak/plugin-client-secret` | Vault setup Job | — | | `kv/secrets/quay/auth` | Quay config Job | — | | `kv/secrets/quay/username` | Quay config Job | — | @@ -61,8 +63,15 @@ Vault is the single source of truth for secrets. The flow works like this: | `kv/secrets/rhdh/argocd-password` | Vault setup Job | RHDH (ExternalSecret) | | `kv/secrets/rhdh/postgresql-password` | Vault setup Job | RHDH (ExternalSecret) | | `kv/secrets/rhdh/kubernetes-sa-token` | RHDH SA token Job | RHDH (ExternalSecret) | +| `kv/secrets/gitlab/devspaces-oauth` | GitLab init Job | DevSpaces (ExternalSecret) | | `kv/secrets/common/password` | Vault setup Job | — | +## Developer authentication + +Workshop users (dev1, dev2, pe1, pe2) authenticate via Keycloak. The `openshift-oauth/` chart adds a **"developers"** OpenID Connect identity provider to the cluster OAuth CR alongside the default htpasswd provider. Users see both options on the OpenShift login page. + +DevSpaces reuses this flow — the DevSpaces operator hardcodes `provider="openshift"` in its gateway proxy config, so it always authenticates through OpenShift OAuth, which in turn redirects to Keycloak. + ## Embedded Ansible playbooks Several charts use a pattern where a `ConfigMap` contains an Ansible playbook, and a `Job` runs it using an Ansible execution environment image. This handles multi-step imperative setup that can't be expressed declaratively: diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index c9fba83..1ccf32c 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -41,6 +41,10 @@ spec: gitlab: - secretName: gitlab-oauth-config endpoint: https://{{ .Values.gitlab.host }} + # DevSpaces authenticates via OpenShift OAuth — the operator's gateway proxy + # hardcodes provider="openshift" and ignores external OIDC overrides. Workshop + # users log in through the "developers" OpenID provider added to the cluster + # OAuth CR (see openshift-oauth/ chart), which redirects to Keycloak. networking: auth: gateway: diff --git a/openshift-oauth/templates/oauth.yaml b/openshift-oauth/templates/oauth.yaml index 84b89dd..1478b7a 100644 --- a/openshift-oauth/templates/oauth.yaml +++ b/openshift-oauth/templates/oauth.yaml @@ -1,3 +1,7 @@ +# Adds Keycloak as an OpenID Connect identity provider ("developers") to the +# cluster OAuth CR. DevSpaces on OpenShift always authenticates via OpenShift +# OAuth (the operator hardcodes provider="openshift" in the gateway proxy +# config), so this is also how workshop users log into DevSpaces. apiVersion: config.openshift.io/v1 kind: OAuth metadata: From 23e2bce7d4db8c78ebb5783081071eb4a4493f15 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 16 Feb 2026 14:45:13 -0800 Subject: [PATCH 23/49] fix: restrict devworkspace resources --- .../devspaces-instance/templates/checluster.yaml | 11 +++++++++++ devspaces/devspaces-instance/values.yaml | 7 +++++++ 2 files changed, 18 insertions(+) diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index 1ccf32c..7d36eaa 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -27,6 +27,17 @@ spec: startTimeoutSeconds: {{ .Values.devEnvironments.startTimeoutSeconds }} secondsOfRunBeforeIdling: {{ .Values.devEnvironments.secondsOfRunBeforeIdling }} maxNumberOfWorkspacesPerUser: {{ .Values.devEnvironments.maxNumberOfWorkspacesPerUser }} + defaultContainerResources: + limits: + cpu: {{ .Values.devEnvironments.resources.limits.cpu }} + memory: {{ .Values.devEnvironments.resources.limits.memory }} + requests: + cpu: {{ .Values.devEnvironments.resources.requests.cpu }} + memory: {{ .Values.devEnvironments.resources.requests.memory }} + containerResourceCaps: + limits: + cpu: {{ .Values.devEnvironments.resources.limits.cpu }} + memory: {{ .Values.devEnvironments.resources.limits.memory }} containerBuildConfiguration: openShiftSecurityContextConstraint: container-build disableContainerBuildCapabilities: false diff --git a/devspaces/devspaces-instance/values.yaml b/devspaces/devspaces-instance/values.yaml index ad26aab..cd76c56 100644 --- a/devspaces/devspaces-instance/values.yaml +++ b/devspaces/devspaces-instance/values.yaml @@ -8,6 +8,13 @@ devEnvironments: secondsOfRunBeforeIdling: 600 maxNumberOfWorkspacesPerUser: 2 defaultEditor: che-incubator/che-code/latest + resources: + limits: + memory: 2Gi + cpu: "2" + requests: + memory: 512Mi + cpu: 250m gitlab: host: "" From a84f60698f0d509a6f44e5af2edb8901d862974c Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 16 Feb 2026 14:45:38 -0800 Subject: [PATCH 24/49] feat: auto create users in quay --- app-of-apps/templates/quay.yaml | 1 + app-of-apps/values.yaml | 1 + quay/quay-registry/templates/cm-config.yaml | 30 +++++++++++++++++++++ quay/quay-registry/values.yaml | 1 + 4 files changed, 33 insertions(+) diff --git a/app-of-apps/templates/quay.yaml b/app-of-apps/templates/quay.yaml index 7a29c9d..fe446d1 100644 --- a/app-of-apps/templates/quay.yaml +++ b/app-of-apps/templates/quay.yaml @@ -18,6 +18,7 @@ spec: adminUser: {{ .Values.quay.adminUser }} adminUserPassword: {{ .Values.quay.adminUserPassword | quote }} organizations: {{ .Values.quay.organizations | toJson }} + users: {{ .Values.quay.users | toJson }} vault: name: {{ .Values.vault.name }} namespace: {{ .Values.vault.namespace }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index ea3fc11..258546c 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -95,6 +95,7 @@ quay: adminUserPassword: "" organizations: - parasol + users: [] rhdhGitops: name: rhdh-gitops diff --git a/quay/quay-registry/templates/cm-config.yaml b/quay/quay-registry/templates/cm-config.yaml index a4a16f9..f94ae91 100644 --- a/quay/quay-registry/templates/cm-config.yaml +++ b/quay/quay-registry/templates/cm-config.yaml @@ -163,4 +163,34 @@ data: body_format: json validate_certs: false status_code: 201 +{{- end }} + +{{- range $user := .Values.quay.users }} + - name: Create user {{ $user.username }} + ansible.builtin.uri: + url: '{{ "{{" }} r_quay_registry.resources[0].status.registryEndpoint {{ "}}" }}/api/v1/superuser/users/' + method: POST + headers: + Authorization: 'Bearer {{ "{{" }} r_quayadmin.json.access_token {{ "}}" }}' + body: + username: {{ $user.username }} + email: {{ $user.email }} + body_format: json + validate_certs: false + status_code: + - 200 + register: r_create_user_{{ $user.username }} + + - name: Set password for {{ $user.username }} + ansible.builtin.uri: + url: '{{ "{{" }} r_quay_registry.resources[0].status.registryEndpoint {{ "}}" }}/api/v1/superuser/users/{{ $user.username }}' + method: PUT + headers: + Authorization: 'Bearer {{ "{{" }} r_quayadmin.json.access_token {{ "}}" }}' + body: + password: {{ $user.password }} + body_format: json + validate_certs: false + status_code: + - 200 {{- end }} \ No newline at end of file diff --git a/quay/quay-registry/values.yaml b/quay/quay-registry/values.yaml index b66ad67..6b95974 100644 --- a/quay/quay-registry/values.yaml +++ b/quay/quay-registry/values.yaml @@ -52,6 +52,7 @@ quay: cpu: 125m memory: 1Gi organizations: [] + users: [] noobaa: From a3fff51d0ac9cf03f8ddab259150e24f4192abee Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 16 Feb 2026 14:51:44 -0800 Subject: [PATCH 25/49] fix: quote cpu values in devspaces config --- .../devspaces-instance/templates/checluster.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/devspaces/devspaces-instance/templates/checluster.yaml b/devspaces/devspaces-instance/templates/checluster.yaml index 7d36eaa..ce4b327 100644 --- a/devspaces/devspaces-instance/templates/checluster.yaml +++ b/devspaces/devspaces-instance/templates/checluster.yaml @@ -29,15 +29,15 @@ spec: maxNumberOfWorkspacesPerUser: {{ .Values.devEnvironments.maxNumberOfWorkspacesPerUser }} defaultContainerResources: limits: - cpu: {{ .Values.devEnvironments.resources.limits.cpu }} - memory: {{ .Values.devEnvironments.resources.limits.memory }} + cpu: {{ .Values.devEnvironments.resources.limits.cpu | quote }} + memory: {{ .Values.devEnvironments.resources.limits.memory | quote }} requests: - cpu: {{ .Values.devEnvironments.resources.requests.cpu }} - memory: {{ .Values.devEnvironments.resources.requests.memory }} + cpu: {{ .Values.devEnvironments.resources.requests.cpu | quote }} + memory: {{ .Values.devEnvironments.resources.requests.memory | quote }} containerResourceCaps: limits: - cpu: {{ .Values.devEnvironments.resources.limits.cpu }} - memory: {{ .Values.devEnvironments.resources.limits.memory }} + cpu: {{ .Values.devEnvironments.resources.limits.cpu | quote }} + memory: {{ .Values.devEnvironments.resources.limits.memory | quote }} containerBuildConfiguration: openShiftSecurityContextConstraint: container-build disableContainerBuildCapabilities: false From 658bb329d37ce7bc8dd888f0584d18576cd594ee Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 16 Feb 2026 22:07:16 -0800 Subject: [PATCH 26/49] feat: add litellm credentials to vault --- app-of-apps/templates/vault.yaml | 3 +++ app-of-apps/values.yaml | 3 +++ vault/templates/cm-vault-setup.yaml | 3 +++ vault/values.yaml | 3 +++ 4 files changed, 12 insertions(+) diff --git a/app-of-apps/templates/vault.yaml b/app-of-apps/templates/vault.yaml index 4ea4eda..119ee7f 100644 --- a/app-of-apps/templates/vault.yaml +++ b/app-of-apps/templates/vault.yaml @@ -38,6 +38,9 @@ spec: token: {{ .Values.vault.secrets.orchestrator.token | quote }} common: password: {{ .Values.vault.secrets.common.password | quote }} + litellm: + apiUrl: {{ .Values.vault.secrets.litellm.apiUrl | quote }} + apiKey: {{ .Values.vault.secrets.litellm.apiKey | quote }} syncPolicy: automated: {} syncOptions: diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 258546c..511d07f 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -31,6 +31,9 @@ vault: token: "" common: password: "" + litellm: + apiUrl: "" + apiKey: "" externalSecrets: name: external-secrets diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index 679e7a5..05dd696 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -122,3 +122,6 @@ data: - 'vault kv put kv/secrets/rhdh/postgresql-password value={{ $.Values.secrets.rhdh.postgresqlPassword }}' - 'vault kv put kv/secrets/rhdh/orchestrator-token value={{ $.Values.secrets.orchestrator.token }}' - 'vault kv put kv/secrets/common/password value={{ $.Values.secrets.common.password }}' +{{- if and $.Values.secrets.litellm.apiUrl $.Values.secrets.litellm.apiKey }} + - 'vault kv put kv/secrets/litellm/credentials base_url={{ $.Values.secrets.litellm.apiUrl }} api_key={{ $.Values.secrets.litellm.apiKey }}' +{{- end }} diff --git a/vault/values.yaml b/vault/values.yaml index 6c161fd..6be85b0 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -22,3 +22,6 @@ secrets: token: "" common: password: "" + litellm: + apiUrl: "" + apiKey: "" From 98fd7d9170489f83f909c5949a2b765a0cb18681 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 17 Feb 2026 10:00:38 -0800 Subject: [PATCH 27/49] fix: vault tty usage --- vault/templates/cronjob-auto-unseal.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vault/templates/cronjob-auto-unseal.yaml b/vault/templates/cronjob-auto-unseal.yaml index 8fb42e5..feced08 100644 --- a/vault/templates/cronjob-auto-unseal.yaml +++ b/vault/templates/cronjob-auto-unseal.yaml @@ -72,7 +72,7 @@ spec: else # Vault is not initialized - initialize it echo "Initializing Vault for the first time..." - oc exec {{ include "vault.name" . }}-0 --namespace={{ .Release.Namespace }} --stdin --tty -- vault operator init -format=yaml > /tmp/vault-auto-unseal-keys.txt + oc exec {{ include "vault.name" . }}-0 --namespace={{ .Release.Namespace }} -- vault operator init -format=yaml > /tmp/vault-auto-unseal-keys.txt echo "Copying unseal keys to Vault pod..." cat /tmp/vault-auto-unseal-keys.txt | oc exec -i -n {{ .Release.Namespace }} {{ include "vault.name" . }}-0 -c {{ include "vault.name" . }} "--" sh -c "cat > /vault/data/vault-auto-unseal-keys.txt" @@ -81,7 +81,7 @@ spec: cat /vault-unseal-config/unseal.sh | oc exec -i -n {{ .Release.Namespace }} {{ include "vault.name" . }}-0 -c {{ include "vault.name" . }} "--" sh -c "cat > /vault/data/unseal.sh" echo "Unsealing Vault..." - oc exec {{ include "vault.name" . }}-0 --namespace={{ .Release.Namespace }} --stdin --tty -- /bin/sh /vault/data/unseal.sh + oc exec {{ include "vault.name" . }}-0 --namespace={{ .Release.Namespace }} -- /bin/sh /vault/data/unseal.sh # Verify unsealing succeeded set +e From 534c75ae9bb01b45ceefd01a000ecac68ff3d4c8 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 14:26:45 -0800 Subject: [PATCH 28/49] feat: add amq streams Co-authored-by: Bernard Tison --- amq-streams/Chart.yaml | 19 ++++ .../amq-streams-console-operator/Chart.yaml | 5 + .../templates/_helpers.tpl | 77 ++++++++++++++++ .../amq-streams-console-subscription.yaml | 14 +++ .../amq-streams-console-operator/values.yaml | 16 ++++ amq-streams/amq-streams-console/Chart.yaml | 5 + .../templates/_helpers.tpl | 64 +++++++++++++ .../templates/console-cr.yaml | 28 ++++++ .../templates/console-kafka-user.yaml | 44 +++++++++ amq-streams/amq-streams-console/values.yaml | 15 +++ amq-streams/amq-streams-operator/Chart.yaml | 5 + .../templates/_helpers.tpl | 77 ++++++++++++++++ .../templates/amq-streams-subscription.yaml | 14 +++ amq-streams/amq-streams-operator/values.yaml | 16 ++++ amq-streams/kafka-broker/Chart.yaml | 5 + .../kafka-broker/templates/_helpers.tpl | 91 +++++++++++++++++++ .../kafka-broker/templates/kafka-cr.yaml | 45 +++++++++ .../templates/kafka-namespace.yaml | 10 ++ .../kafka-nodepool-broker-controller.yaml | 26 ++++++ .../kafka-broker/templates/kafka-topic.yaml | 23 +++++ .../kafka-broker/templates/kafka-user-cr.yaml | 54 +++++++++++ .../templates/kafka-user-secret.yaml | 26 ++++++ amq-streams/kafka-broker/values.yaml | 60 ++++++++++++ amq-streams/values.yaml | 8 ++ app-of-apps/templates/amq-streams.yaml | 22 +++++ app-of-apps/templates/vault.yaml | 2 + app-of-apps/values.yaml | 7 ++ vault/templates/cm-vault-setup.yaml | 3 + vault/values.yaml | 2 + 29 files changed, 783 insertions(+) create mode 100644 amq-streams/Chart.yaml create mode 100644 amq-streams/amq-streams-console-operator/Chart.yaml create mode 100644 amq-streams/amq-streams-console-operator/templates/_helpers.tpl create mode 100644 amq-streams/amq-streams-console-operator/templates/amq-streams-console-subscription.yaml create mode 100644 amq-streams/amq-streams-console-operator/values.yaml create mode 100644 amq-streams/amq-streams-console/Chart.yaml create mode 100644 amq-streams/amq-streams-console/templates/_helpers.tpl create mode 100644 amq-streams/amq-streams-console/templates/console-cr.yaml create mode 100644 amq-streams/amq-streams-console/templates/console-kafka-user.yaml create mode 100644 amq-streams/amq-streams-console/values.yaml create mode 100644 amq-streams/amq-streams-operator/Chart.yaml create mode 100644 amq-streams/amq-streams-operator/templates/_helpers.tpl create mode 100644 amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml create mode 100644 amq-streams/amq-streams-operator/values.yaml create mode 100644 amq-streams/kafka-broker/Chart.yaml create mode 100644 amq-streams/kafka-broker/templates/_helpers.tpl create mode 100644 amq-streams/kafka-broker/templates/kafka-cr.yaml create mode 100644 amq-streams/kafka-broker/templates/kafka-namespace.yaml create mode 100644 amq-streams/kafka-broker/templates/kafka-nodepool-broker-controller.yaml create mode 100644 amq-streams/kafka-broker/templates/kafka-topic.yaml create mode 100644 amq-streams/kafka-broker/templates/kafka-user-cr.yaml create mode 100644 amq-streams/kafka-broker/templates/kafka-user-secret.yaml create mode 100644 amq-streams/kafka-broker/values.yaml create mode 100644 amq-streams/values.yaml create mode 100644 app-of-apps/templates/amq-streams.yaml diff --git a/amq-streams/Chart.yaml b/amq-streams/Chart.yaml new file mode 100644 index 0000000..672752d --- /dev/null +++ b/amq-streams/Chart.yaml @@ -0,0 +1,19 @@ +apiVersion: v2 +name: amq-streams +description: A Helm chart for AMQ Streams (Kafka) with Streams Console +type: application +version: 0.1.0 + +dependencies: + - name: amq-streams-operator + version: 0.1.0 + repository: file://amq-streams-operator + - name: amq-streams-console-operator + version: 0.1.0 + repository: file://amq-streams-console-operator + - name: kafka-broker + version: 0.1.0 + repository: file://kafka-broker + - name: amq-streams-console + version: 0.1.0 + repository: file://amq-streams-console diff --git a/amq-streams/amq-streams-console-operator/Chart.yaml b/amq-streams/amq-streams-console-operator/Chart.yaml new file mode 100644 index 0000000..e5dc69f --- /dev/null +++ b/amq-streams/amq-streams-console-operator/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: amq-streams-console-operator +description: A Helm chart for Kubernetes +type: application +version: 0.1.0 diff --git a/amq-streams/amq-streams-console-operator/templates/_helpers.tpl b/amq-streams/amq-streams-console-operator/templates/_helpers.tpl new file mode 100644 index 0000000..063297f --- /dev/null +++ b/amq-streams/amq-streams-console-operator/templates/_helpers.tpl @@ -0,0 +1,77 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "amq-streams-console-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "amq-streams-console-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "amq-streams-console-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "amq-streams-console-operator.labels" -}} +helm.sh/chart: {{ include "amq-streams-console-operator.chart" . }} +{{ include "amq-streams-console-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "amq-streams-console-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "amq-streams-console-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Determine target namespace +*/}} +{{- define "amq-streams-console-operator.namespace" -}} +{{- if .Values.namespace }} +{{- printf "%s" .Values.namespace}} +{{- else }} +{{- printf "%s" .Release.Namespace }} +{{- end }} +{{- end }} + +{{/* +ArgoCD Syncwave +*/}} +{{- define "amq-streams-console-operator.argocd-syncwave" -}} +{{- if .Values.argocd }} +{{- if and (.Values.argocd.operator.syncwave) (.Values.argocd.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.operator.syncwave }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} diff --git a/amq-streams/amq-streams-console-operator/templates/amq-streams-console-subscription.yaml b/amq-streams/amq-streams-console-operator/templates/amq-streams-console-subscription.yaml new file mode 100644 index 0000000..8035bc1 --- /dev/null +++ b/amq-streams/amq-streams-console-operator/templates/amq-streams-console-subscription.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: {{ include "amq-streams-console-operator.name" . }}-operator + namespace: {{ include "amq-streams-console-operator.namespace" . }} + annotations: + {{- include "amq-streams-console-operator.argocd-syncwave" . | nindent 4 }} +spec: + channel: {{ .Values.subscription.channel }} + installPlanApproval: {{ .Values.subscription.installPlanApproval }} + name: {{ .Values.subscription.name }} + source: {{ .Values.subscription.source }} + sourceNamespace: {{ .Values.subscription.sourceNamespace }} diff --git a/amq-streams/amq-streams-console-operator/values.yaml b/amq-streams/amq-streams-console-operator/values.yaml new file mode 100644 index 0000000..05b84a0 --- /dev/null +++ b/amq-streams/amq-streams-console-operator/values.yaml @@ -0,0 +1,16 @@ +nameOverride: "amq-streams-console" +fullnameOverride: "" + +namespace: openshift-operators + +subscription: + channel: amq-streams-2.9.x + installPlanApproval: Automatic + name: amq-streams-console + source: redhat-operators + sourceNamespace: openshift-marketplace + +argocd: + enabled: true + operator: + syncwave: "-2" diff --git a/amq-streams/amq-streams-console/Chart.yaml b/amq-streams/amq-streams-console/Chart.yaml new file mode 100644 index 0000000..17f6d8d --- /dev/null +++ b/amq-streams/amq-streams-console/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: amq-streams-console +description: A Helm chart for Kubernetes +type: application +version: 0.1.0 diff --git a/amq-streams/amq-streams-console/templates/_helpers.tpl b/amq-streams/amq-streams-console/templates/_helpers.tpl new file mode 100644 index 0000000..5800722 --- /dev/null +++ b/amq-streams/amq-streams-console/templates/_helpers.tpl @@ -0,0 +1,64 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "amq-streams-console.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "amq-streams-console.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "amq-streams-console.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "amq-streams-console.labels" -}} +helm.sh/chart: {{ include "amq-streams-console.chart" . }} +{{ include "amq-streams-console.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "amq-streams-console.selectorLabels" -}} +app.kubernetes.io/name: {{ include "amq-streams-console.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +ArgoCD Syncwave +*/}} +{{- define "amq-streams-console.argocd-syncwave" -}} +{{- if and (.Values.argocd) (.Values.argocd.syncwave) }} +{{- if (.Values.argocd.syncwave.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.syncwave.console }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} diff --git a/amq-streams/amq-streams-console/templates/console-cr.yaml b/amq-streams/amq-streams-console/templates/console-cr.yaml new file mode 100644 index 0000000..0bdc815 --- /dev/null +++ b/amq-streams/amq-streams-console/templates/console-cr.yaml @@ -0,0 +1,28 @@ +apiVersion: console.streamshub.github.com/v1alpha1 +kind: Console +metadata: + name: {{ include "amq-streams-console.name" . }} + {{- if .Values.namespace }} + namespace: {{ .Values.namespace }} + {{- end }} + labels: + {{- include "amq-streams-console.labels" . | nindent 4 }} + annotations: + {{- include "amq-streams-console.argocd-syncwave" . | nindent 4 }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + hostname: {{ include "amq-streams-console.name" . }}.{{ .Values.subdomain }} + metricsSources: + - name: ocp-prometheus + type: openshift-monitoring + kafkaClusters: + - name: {{ .Values.kafka.name }} + namespace: {{ .Values.namespace }} + listener: plain + metricsSource: ocp-prometheus + properties: + values: [] + valuesFrom: [] + credentials: + kafkaUser: + name: {{ include "amq-streams-console.name" . }}-kafka-user diff --git a/amq-streams/amq-streams-console/templates/console-kafka-user.yaml b/amq-streams/amq-streams-console/templates/console-kafka-user.yaml new file mode 100644 index 0000000..cf1005c --- /dev/null +++ b/amq-streams/amq-streams-console/templates/console-kafka-user.yaml @@ -0,0 +1,44 @@ +{{- if eq .Values.kafka.authentication.saslMechanism "SCRAM-SHA-512" -}} +--- +apiVersion: kafka.strimzi.io/v1beta2 +kind: KafkaUser +metadata: + name: {{ include "amq-streams-console.name" . }}-kafka-user + {{- if .Values.namespace }} + namespace: {{ .Values.namespace }} + {{- end }} + labels: + {{- include "amq-streams-console.labels" . | nindent 4 }} + strimzi.io/cluster: {{ .Values.kafka.name }} + annotations: + {{- include "amq-streams-console.argocd-syncwave" . | nindent 4 }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + authentication: + type: scram-sha-512 + {{- if eq .Values.kafka.authorization "simple" }} + authorization: + type: simple + acls: + - operations: + - Describe + - DescribeConfigs + resource: + type: cluster + - operations: + - Read + - Describe + - DescribeConfigs + resource: + name: '*' + patternType: literal + type: topic + - operations: + - Read + - Describe + resource: + name: '*' + patternType: literal + type: group + {{- end }} +{{- end }} diff --git a/amq-streams/amq-streams-console/values.yaml b/amq-streams/amq-streams-console/values.yaml new file mode 100644 index 0000000..b2fbe1b --- /dev/null +++ b/amq-streams/amq-streams-console/values.yaml @@ -0,0 +1,15 @@ +nameOverride: streams-console + +namespace: +subdomain: + +kafka: + name: kafka + authentication: + saslMechanism: SCRAM-SHA-512 + authorization: simple + +argocd: + syncwave: + enabled: true + console: "1" diff --git a/amq-streams/amq-streams-operator/Chart.yaml b/amq-streams/amq-streams-operator/Chart.yaml new file mode 100644 index 0000000..083db3f --- /dev/null +++ b/amq-streams/amq-streams-operator/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: amq-streams-operator +description: A Helm chart for Kubernetes +type: application +version: 0.1.0 diff --git a/amq-streams/amq-streams-operator/templates/_helpers.tpl b/amq-streams/amq-streams-operator/templates/_helpers.tpl new file mode 100644 index 0000000..a6645fb --- /dev/null +++ b/amq-streams/amq-streams-operator/templates/_helpers.tpl @@ -0,0 +1,77 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "amq-streams-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "amq-streams-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "amq-streams-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "amq-streams-operator.labels" -}} +helm.sh/chart: {{ include "amq-streams-operator.chart" . }} +{{ include "amq-streams-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "amq-streams-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "amq-streams-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Determine target namespace +*/}} +{{- define "amq-streams-operator.namespace" -}} +{{- if .Values.namespace }} +{{- printf "%s" .Values.namespace}} +{{- else }} +{{- printf "%s" .Release.Namespace }} +{{- end }} +{{- end }} + +{{/* +ArgoCD Syncwave +*/}} +{{- define "amq-streams-operator.argocd-syncwave" -}} +{{- if .Values.argocd }} +{{- if and (.Values.argocd.operator.syncwave) (.Values.argocd.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.operator.syncwave }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} diff --git a/amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml b/amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml new file mode 100644 index 0000000..5c6d75b --- /dev/null +++ b/amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: {{ include "amq-streams-operator.name" . }}-operator + namespace: {{ include "amq-streams-operator.namespace" . }} + annotations: + {{- include "amq-streams-operator.argocd-syncwave" . | nindent 4 }} +spec: + channel: {{ .Values.subscription.channel }} + installPlanApproval: {{ .Values.subscription.installPlanApproval }} + name: {{ .Values.subscription.name }} + source: {{ .Values.subscription.source }} + sourceNamespace: {{ .Values.subscription.sourceNamespace }} diff --git a/amq-streams/amq-streams-operator/values.yaml b/amq-streams/amq-streams-operator/values.yaml new file mode 100644 index 0000000..5d49078 --- /dev/null +++ b/amq-streams/amq-streams-operator/values.yaml @@ -0,0 +1,16 @@ +nameOverride: "amq-streams" +fullnameOverride: "" + +namespace: openshift-operators + +subscription: + channel: stable + installPlanApproval: Automatic + name: amq-streams + source: redhat-operators + sourceNamespace: openshift-marketplace + +argocd: + enabled: true + operator: + syncwave: "-2" diff --git a/amq-streams/kafka-broker/Chart.yaml b/amq-streams/kafka-broker/Chart.yaml new file mode 100644 index 0000000..854e021 --- /dev/null +++ b/amq-streams/kafka-broker/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: kafka-broker +description: A Helm chart for AMQ Streams broker +type: application +version: 0.1.0 diff --git a/amq-streams/kafka-broker/templates/_helpers.tpl b/amq-streams/kafka-broker/templates/_helpers.tpl new file mode 100644 index 0000000..0f3a25a --- /dev/null +++ b/amq-streams/kafka-broker/templates/_helpers.tpl @@ -0,0 +1,91 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "kafka-broker.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "kafka-broker.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "kafka-broker.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "kafka-broker.labels" -}} +helm.sh/chart: {{ include "kafka-broker.chart" . }} +{{ include "kafka-broker.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "kafka-broker.selectorLabels" -}} +app.kubernetes.io/name: {{ include "kafka-broker.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Kafka authentication +*/}} +{{- define "kafka-broker.authentication" -}} +{{- if eq .Values.authentication.saslMechanism "SCRAM-SHA-512" -}} +authentication: + type: scram-sha-512 +{{- else }} +authentication: {} +{{- end }} +{{- end }} + +{{/* +ArgoCD Syncwave for Kafka resources +*/}} +{{- define "kafka-broker.argocd-syncwave" -}} +{{- if and (.Values.argocd) (.Values.argocd.syncwave) }} +{{- if (.Values.argocd.syncwave.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.syncwave.kafka }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} + +{{/* +ArgoCD Syncwave for Namespace +*/}} +{{- define "kafka-namespace.argocd-syncwave" -}} +{{- if and (.Values.argocd) (.Values.argocd.syncwave) }} +{{- if (.Values.argocd.syncwave.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.syncwave.namespace }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} diff --git a/amq-streams/kafka-broker/templates/kafka-cr.yaml b/amq-streams/kafka-broker/templates/kafka-cr.yaml new file mode 100644 index 0000000..7117f45 --- /dev/null +++ b/amq-streams/kafka-broker/templates/kafka-cr.yaml @@ -0,0 +1,45 @@ +{{- if .Values.kafka.enabled -}} +apiVersion: kafka.strimzi.io/v1beta2 +kind: Kafka +metadata: + name: {{ include "kafka-broker.name" . }} + {{- if .Values.namespace }} + namespace: {{ .Values.namespace }} + {{- end }} + labels: + {{- include "kafka-broker.labels" . | nindent 4 }} + annotations: + strimzi.io/node-pools: enabled + strimzi.io/kraft: enabled + {{- include "kafka-broker.argocd-syncwave" . | nindent 4 }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + kafka: + version: {{ .Values.kafka.version }} + metadataVersion: {{ .Values.kafka.metadataVersion }} + {{- if eq .Values.authorization "simple" }} + authorization: + type: simple + {{- end }} + listeners: + - name: plain + port: 9092 + type: internal + tls: false + {{- include "kafka-broker.authentication" . | nindent 6 }} + config: + allow.everyone.if.no.acl.found: 'true' + auto.create.topics.enable: {{ .Values.kafka.config.autoCreateTopics }} + offsets.topic.replication.factor: {{ .Values.kafka.config.offsetsTopicReplicationFactor }} + transaction.state.log.min.isr: {{ .Values.kafka.config.transactionStateLogMinIsr }} + transaction.state.log.replication.factor: {{ .Values.kafka.config.transactionStateLogReplicationFactor }} + default.replication.factor: {{ .Values.kafka.config.defaultReplicationFactor }} + min.insync.replicas: {{ .Values.kafka.config.minInsyncReplicas }} + entityOperator: + topicOperator: + resources: + {{- toYaml .Values.kafka.entityOperator.topicOperator.resources | nindent 8 }} + userOperator: + resources: + {{- toYaml .Values.kafka.entityOperator.userOperator.resources | nindent 8 }} +{{- end }} diff --git a/amq-streams/kafka-broker/templates/kafka-namespace.yaml b/amq-streams/kafka-broker/templates/kafka-namespace.yaml new file mode 100644 index 0000000..0266c24 --- /dev/null +++ b/amq-streams/kafka-broker/templates/kafka-namespace.yaml @@ -0,0 +1,10 @@ +{{- if .Values.namespace }} +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Values.namespace }} + annotations: + {{- include "kafka-namespace.argocd-syncwave" . | nindent 4 }} + labels: + argocd.argoproj.io/managed-by: openshift-gitops +{{- end }} diff --git a/amq-streams/kafka-broker/templates/kafka-nodepool-broker-controller.yaml b/amq-streams/kafka-broker/templates/kafka-nodepool-broker-controller.yaml new file mode 100644 index 0000000..6c9fdf0 --- /dev/null +++ b/amq-streams/kafka-broker/templates/kafka-nodepool-broker-controller.yaml @@ -0,0 +1,26 @@ +{{- if not .Values.kafka.controller.enabled -}} +apiVersion: kafka.strimzi.io/v1beta2 +kind: KafkaNodePool +metadata: + name: {{ include "kafka-broker.name" . }}-broker + {{- if .Values.namespace }} + namespace: {{ .Values.namespace }} + {{- end }} + labels: + strimzi.io/cluster: {{ include "kafka-broker.name" . }} + annotations: + {{- include "kafka-broker.argocd-syncwave" . | nindent 4 }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + replicas: {{ .Values.kafka.broker.replicas }} + roles: + - broker + - controller + resources: + {{- toYaml .Values.kafka.resources | nindent 4 }} + storage: + type: jbod + volumes: + - id: 0 + type: ephemeral +{{ end }} diff --git a/amq-streams/kafka-broker/templates/kafka-topic.yaml b/amq-streams/kafka-broker/templates/kafka-topic.yaml new file mode 100644 index 0000000..f0db723 --- /dev/null +++ b/amq-streams/kafka-broker/templates/kafka-topic.yaml @@ -0,0 +1,23 @@ +{{- range .Values.topics }} +--- +apiVersion: kafka.strimzi.io/v1beta2 +kind: KafkaTopic +metadata: + name: {{ .name | replace "_" "-" }} + {{- if $.Values.namespace }} + namespace: {{ $.Values.namespace }} + {{- end }} + labels: + strimzi.io/cluster: {{ include "kafka-broker.name" $ }} + {{- include "kafka-broker.labels" $ | nindent 4 }} + annotations: + {{- include "kafka-broker.argocd-syncwave" $ | nindent 4 }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + partitions: {{ .partitions }} + replicas: {{ $.Values.kafka.config.defaultReplicationFactor }} + config: + retention.ms: {{ .retention }} + segment.bytes: 1073741824 + topicName: {{ .name }} +{{- end }} diff --git a/amq-streams/kafka-broker/templates/kafka-user-cr.yaml b/amq-streams/kafka-broker/templates/kafka-user-cr.yaml new file mode 100644 index 0000000..36700c7 --- /dev/null +++ b/amq-streams/kafka-broker/templates/kafka-user-cr.yaml @@ -0,0 +1,54 @@ +{{- if eq .Values.authentication.saslMechanism "SCRAM-SHA-512" -}} +apiVersion: kafka.strimzi.io/v1beta2 +kind: KafkaUser +metadata: + name: {{ .Values.authentication.clientId }} + {{- if .Values.namespace }} + namespace: {{ .Values.namespace }} + {{- end }} + labels: + {{- include "kafka-broker.labels" . | nindent 4 }} + strimzi.io/cluster: {{ include "kafka-broker.name" . }} + annotations: + {{- include "kafka-broker.argocd-syncwave" . | nindent 4 }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + authentication: + type: scram-sha-512 + password: + valueFrom: + secretKeyRef: + name: {{ .Values.authentication.clientId }}-user-secret + key: clientSecret + {{- if eq .Values.authorization "simple" }} + authorization: + type: simple + acls: + - operations: + - Describe + resource: + type: cluster + - operations: + - Create + - Describe + - Read + - Write + resource: + name: '*' + patternType: literal + type: topic + - operations: + - Read + resource: + name: '*' + patternType: literal + type: group + - operations: + - Read + - Describe + resource: + name: '*' + patternType: literal + type: transactionalId + {{- end }} +{{- end }} diff --git a/amq-streams/kafka-broker/templates/kafka-user-secret.yaml b/amq-streams/kafka-broker/templates/kafka-user-secret.yaml new file mode 100644 index 0000000..1e838ae --- /dev/null +++ b/amq-streams/kafka-broker/templates/kafka-user-secret.yaml @@ -0,0 +1,26 @@ +{{- if eq .Values.authentication.saslMechanism "SCRAM-SHA-512" -}} +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: {{ .Values.authentication.clientId }}-user-secret + {{- if .Values.namespace }} + namespace: {{ .Values.namespace }} + {{- end }} + labels: + {{- include "kafka-broker.labels" . | nindent 4 }} + annotations: + {{- include "kafka-broker.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: {{ .Values.authentication.clientId }}-user-secret + creationPolicy: Owner + data: + - secretKey: clientSecret + remoteRef: + key: secrets/kafka/user-password + property: value +{{- end }} diff --git a/amq-streams/kafka-broker/values.yaml b/amq-streams/kafka-broker/values.yaml new file mode 100644 index 0000000..23188d0 --- /dev/null +++ b/amq-streams/kafka-broker/values.yaml @@ -0,0 +1,60 @@ +nameOverride: "kafka" + +kafka: + enabled: true + version: 4.1.0 + metadataVersion: 3.7-IV0 + broker: + replicas: 1 + controller: + enabled: false + config: + autoCreateTopics: false + defaultReplicationFactor: 1 + offsetsTopicReplicationFactor: 1 + transactionStateLogReplicationFactor: 1 + transactionStateLogMinIsr: 1 + minInsyncReplicas: 1 + entityOperator: + topicOperator: + resources: + limits: + cpu: 500m + memory: 500M + requests: + cpu: 250m + memory: 250M + userOperator: + resources: + limits: + cpu: 250m + memory: 250M + requests: + cpu: 150m + memory: 150M + resources: + limits: + cpu: '1' + memory: 2G + requests: + cpu: 300m + memory: 500M + +namespace: + +authentication: + clientId: parasol + saslMechanism: SCRAM-SHA-512 + +authorization: simple + +topics: + - name: intake + partitions: 1 + retention: -1 + +argocd: + syncwave: + enabled: true + kafka: "0" + namespace: "-1" diff --git a/amq-streams/values.yaml b/amq-streams/values.yaml new file mode 100644 index 0000000..6a20f07 --- /dev/null +++ b/amq-streams/values.yaml @@ -0,0 +1,8 @@ +kafka-broker: + namespace: kafka + authentication: + clientId: parasol + +amq-streams-console: + namespace: kafka + subdomain: "" diff --git a/app-of-apps/templates/amq-streams.yaml b/app-of-apps/templates/amq-streams.yaml new file mode 100644 index 0000000..2ff2654 --- /dev/null +++ b/app-of-apps/templates/amq-streams.yaml @@ -0,0 +1,22 @@ +{{- if .Values.amqStreams.enabled }} +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.amqStreams.name "namespace" .Values.argocd.namespace "syncWave" "0") }} +spec: + destination: + namespace: {{ .Values.amqStreams.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: amq-streams + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + kafka-broker: + namespace: {{ .Values.amqStreams.namespace }} + amq-streams-console: + namespace: {{ .Values.amqStreams.namespace }} + subdomain: {{ .Values.cluster.subdomain }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} +{{- end }} diff --git a/app-of-apps/templates/vault.yaml b/app-of-apps/templates/vault.yaml index 119ee7f..25d714a 100644 --- a/app-of-apps/templates/vault.yaml +++ b/app-of-apps/templates/vault.yaml @@ -41,6 +41,8 @@ spec: litellm: apiUrl: {{ .Values.vault.secrets.litellm.apiUrl | quote }} apiKey: {{ .Values.vault.secrets.litellm.apiKey | quote }} + kafka: + userPassword: {{ .Values.vault.secrets.kafka.userPassword | quote }} syncPolicy: automated: {} syncOptions: diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 511d07f..f4c951a 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -34,6 +34,8 @@ vault: litellm: apiUrl: "" apiKey: "" + kafka: + userPassword: "" externalSecrets: name: external-secrets @@ -153,6 +155,11 @@ devspaces: name: devspaces namespace: openshift-devspaces +amqStreams: + enabled: true + name: amq-streams + namespace: kafka + orchestrator: name: orchestrator namespace: backstage diff --git a/vault/templates/cm-vault-setup.yaml b/vault/templates/cm-vault-setup.yaml index 05dd696..1dcebbc 100644 --- a/vault/templates/cm-vault-setup.yaml +++ b/vault/templates/cm-vault-setup.yaml @@ -122,6 +122,9 @@ data: - 'vault kv put kv/secrets/rhdh/postgresql-password value={{ $.Values.secrets.rhdh.postgresqlPassword }}' - 'vault kv put kv/secrets/rhdh/orchestrator-token value={{ $.Values.secrets.orchestrator.token }}' - 'vault kv put kv/secrets/common/password value={{ $.Values.secrets.common.password }}' +{{- if $.Values.secrets.kafka.userPassword }} + - 'vault kv put kv/secrets/kafka/user-password value={{ $.Values.secrets.kafka.userPassword }}' +{{- end }} {{- if and $.Values.secrets.litellm.apiUrl $.Values.secrets.litellm.apiKey }} - 'vault kv put kv/secrets/litellm/credentials base_url={{ $.Values.secrets.litellm.apiUrl }} api_key={{ $.Values.secrets.litellm.apiKey }}' {{- end }} diff --git a/vault/values.yaml b/vault/values.yaml index 6be85b0..eceabdf 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -25,3 +25,5 @@ secrets: litellm: apiUrl: "" apiKey: "" + kafka: + userPassword: "" From de04403393142b2822659e75381e3c7a16cb9177 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 14:54:21 -0800 Subject: [PATCH 29/49] choreL rename kafka user --- amq-streams/kafka-broker/templates/kafka-user-cr.yaml | 2 +- amq-streams/kafka-broker/templates/kafka-user-secret.yaml | 4 ++-- amq-streams/kafka-broker/values.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/amq-streams/kafka-broker/templates/kafka-user-cr.yaml b/amq-streams/kafka-broker/templates/kafka-user-cr.yaml index 36700c7..4b4ebcc 100644 --- a/amq-streams/kafka-broker/templates/kafka-user-cr.yaml +++ b/amq-streams/kafka-broker/templates/kafka-user-cr.yaml @@ -18,7 +18,7 @@ spec: password: valueFrom: secretKeyRef: - name: {{ .Values.authentication.clientId }}-user-secret + name: {{ include "kafka-broker.name" . }}-user-secret key: clientSecret {{- if eq .Values.authorization "simple" }} authorization: diff --git a/amq-streams/kafka-broker/templates/kafka-user-secret.yaml b/amq-streams/kafka-broker/templates/kafka-user-secret.yaml index 1e838ae..9e1cc1c 100644 --- a/amq-streams/kafka-broker/templates/kafka-user-secret.yaml +++ b/amq-streams/kafka-broker/templates/kafka-user-secret.yaml @@ -2,7 +2,7 @@ apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: - name: {{ .Values.authentication.clientId }}-user-secret + name: {{ include "kafka-broker.name" . }}-user-secret {{- if .Values.namespace }} namespace: {{ .Values.namespace }} {{- end }} @@ -16,7 +16,7 @@ spec: name: vault-secret-store kind: ClusterSecretStore target: - name: {{ .Values.authentication.clientId }}-user-secret + name: {{ include "kafka-broker.name" . }}-user-secret creationPolicy: Owner data: - secretKey: clientSecret diff --git a/amq-streams/kafka-broker/values.yaml b/amq-streams/kafka-broker/values.yaml index 23188d0..5eee019 100644 --- a/amq-streams/kafka-broker/values.yaml +++ b/amq-streams/kafka-broker/values.yaml @@ -43,7 +43,7 @@ kafka: namespace: authentication: - clientId: parasol + clientId: franz saslMechanism: SCRAM-SHA-512 authorization: simple From 25118573eab095075af2de26f455ed6f9bcb4946 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 16:05:34 -0800 Subject: [PATCH 30/49] fix(amq-streams): update kafka metadata version to 4.1-IV1 Co-Authored-By: Claude Opus 4.6 --- amq-streams/kafka-broker/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/amq-streams/kafka-broker/values.yaml b/amq-streams/kafka-broker/values.yaml index 5eee019..b32d18c 100644 --- a/amq-streams/kafka-broker/values.yaml +++ b/amq-streams/kafka-broker/values.yaml @@ -3,7 +3,7 @@ nameOverride: "kafka" kafka: enabled: true version: 4.1.0 - metadataVersion: 3.7-IV0 + metadataVersion: 4.1-IV1 broker: replicas: 1 controller: From 9ce933effa65c431426e680cad6ba7207f5ac843 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 16:44:49 -0800 Subject: [PATCH 31/49] feat(app-of-apps): add parasol application Co-Authored-By: Claude Opus 4.6 --- app-of-apps/templates/parasol.yaml | 55 ++++++++++++++++++++++++++++++ app-of-apps/values.yaml | 4 +++ 2 files changed, 59 insertions(+) create mode 100644 app-of-apps/templates/parasol.yaml diff --git a/app-of-apps/templates/parasol.yaml b/app-of-apps/templates/parasol.yaml new file mode 100644 index 0000000..c57b532 --- /dev/null +++ b/app-of-apps/templates/parasol.yaml @@ -0,0 +1,55 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.parasol.name "namespace" .Values.argocd.namespace "syncWave" "2") }} +spec: + destination: + namespace: {{ .Values.parasol.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: parasol + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + keycloak-realm-import: + keycloak: + namespace: {{ .Values.keycloak.namespace }} + parasol: + gitlab: + rootPassword: {{ .Values.gitlab.rootPassword | quote }} + host: {{ .Values.gitlab.host }} + registry: + host: {{ .Values.quay.host }} + username: {{ .Values.quay.adminUser }} + password: {{ .Values.quay.adminUserPassword | quote }} + parasol: + web: + sso: + dev: + host: {{ .Values.keycloak.route.host }} + staging: + host: {{ .Values.keycloak.route.host }} + prod: + host: {{ .Values.keycloak.route.host }} + cluster: + subdomain: {{ .Values.cluster.subdomain }} + parasol-build: + gitlab: + rootPassword: {{ .Values.gitlab.rootPassword | quote }} + host: {{ .Values.gitlab.host }} + registry: + host: {{ .Values.quay.host }} + username: {{ .Values.quay.adminUser }} + password: {{ .Values.quay.adminUserPassword | quote }} + cluster: + subdomain: {{ .Values.cluster.subdomain }} + parasol-templates: + gitlab: + rootPassword: {{ .Values.gitlab.rootPassword | quote }} + host: {{ .Values.gitlab.host }} + gitops: + namespace: {{ .Values.rhdhGitops.namespace }} + cluster: + subdomain: {{ .Values.cluster.subdomain }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index f4c951a..593fdee 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -160,6 +160,10 @@ amqStreams: name: amq-streams namespace: kafka +parasol: + name: parasol + namespace: parasol-dev + orchestrator: name: orchestrator namespace: backstage From 8e7c75edb0e84cf10ba8087e0ba5871a557887db Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 16:58:23 -0800 Subject: [PATCH 32/49] fix(parasol): add RBAC for parasol jobs to manage ArgoCD applications Jobs need a ServiceAccount with permissions to create ArgoCD Application CRs. Adds SA, RoleBinding (admin in namespace), and ClusterRoleBinding for applications.argoproj.io. Co-Authored-By: Claude Opus 4.6 --- .../templates/job-parasol-store-build.yaml | 1 + .../job-parasol-store-templates.yaml | 1 + .../parasol/templates/crb-parasol-argocd.yaml | 37 +++++++++++++++++++ parasol/parasol/templates/job-parasol-db.yaml | 1 + .../parasol/templates/job-parasol-images.yaml | 1 + .../parasol/templates/job-parasol-store.yaml | 1 + .../parasol/templates/job-parasol-web.yaml | 1 + parasol/parasol/templates/rb-parasol.yaml | 14 +++++++ parasol/parasol/templates/sa-parasol.yaml | 8 ++++ 9 files changed, 65 insertions(+) create mode 100644 parasol/parasol/templates/crb-parasol-argocd.yaml create mode 100644 parasol/parasol/templates/rb-parasol.yaml create mode 100644 parasol/parasol/templates/sa-parasol.yaml diff --git a/parasol/parasol-build/templates/job-parasol-store-build.yaml b/parasol/parasol-build/templates/job-parasol-store-build.yaml index 9ca44b3..8be9d1f 100644 --- a/parasol/parasol-build/templates/job-parasol-store-build.yaml +++ b/parasol/parasol-build/templates/job-parasol-store-build.yaml @@ -8,6 +8,7 @@ spec: backoffLimit: 100 template: spec: + serviceAccountName: parasol containers: - name: parasol-store-build command: diff --git a/parasol/parasol-templates/templates/job-parasol-store-templates.yaml b/parasol/parasol-templates/templates/job-parasol-store-templates.yaml index 5c580af..c65441d 100644 --- a/parasol/parasol-templates/templates/job-parasol-store-templates.yaml +++ b/parasol/parasol-templates/templates/job-parasol-store-templates.yaml @@ -8,6 +8,7 @@ spec: backoffLimit: 100 template: spec: + serviceAccountName: parasol containers: - name: parasol-templates command: diff --git a/parasol/parasol/templates/crb-parasol-argocd.yaml b/parasol/parasol/templates/crb-parasol-argocd.yaml new file mode 100644 index 0000000..5472a70 --- /dev/null +++ b/parasol/parasol/templates/crb-parasol-argocd.yaml @@ -0,0 +1,37 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: parasol-argocd-applications + annotations: + argocd.argoproj.io/sync-wave: "-1" + labels: + app: parasol +rules: + - apiGroups: + - argoproj.io + resources: + - applications + verbs: + - create + - delete + - get + - list + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: parasol-argocd-applications + annotations: + argocd.argoproj.io/sync-wave: "-1" + labels: + app: parasol +subjects: + - kind: ServiceAccount + name: parasol + namespace: {{ $.Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: parasol-argocd-applications diff --git a/parasol/parasol/templates/job-parasol-db.yaml b/parasol/parasol/templates/job-parasol-db.yaml index ffc96df..17828dc 100644 --- a/parasol/parasol/templates/job-parasol-db.yaml +++ b/parasol/parasol/templates/job-parasol-db.yaml @@ -8,6 +8,7 @@ spec: backoffLimit: 100 template: spec: + serviceAccountName: parasol containers: - name: parasol-db command: diff --git a/parasol/parasol/templates/job-parasol-images.yaml b/parasol/parasol/templates/job-parasol-images.yaml index 23b62f3..334b61d 100644 --- a/parasol/parasol/templates/job-parasol-images.yaml +++ b/parasol/parasol/templates/job-parasol-images.yaml @@ -8,6 +8,7 @@ spec: backoffLimit: 100 template: spec: + serviceAccountName: parasol containers: - name: skopeo command: diff --git a/parasol/parasol/templates/job-parasol-store.yaml b/parasol/parasol/templates/job-parasol-store.yaml index f2b1f68..70abf52 100644 --- a/parasol/parasol/templates/job-parasol-store.yaml +++ b/parasol/parasol/templates/job-parasol-store.yaml @@ -8,6 +8,7 @@ spec: backoffLimit: 100 template: spec: + serviceAccountName: parasol containers: - name: parasol-store command: diff --git a/parasol/parasol/templates/job-parasol-web.yaml b/parasol/parasol/templates/job-parasol-web.yaml index 58c2252..a80627d 100644 --- a/parasol/parasol/templates/job-parasol-web.yaml +++ b/parasol/parasol/templates/job-parasol-web.yaml @@ -8,6 +8,7 @@ spec: backoffLimit: 100 template: spec: + serviceAccountName: parasol containers: - name: parasol-web command: diff --git a/parasol/parasol/templates/rb-parasol.yaml b/parasol/parasol/templates/rb-parasol.yaml new file mode 100644 index 0000000..70082d5 --- /dev/null +++ b/parasol/parasol/templates/rb-parasol.yaml @@ -0,0 +1,14 @@ +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: parasol-admin + annotations: + argocd.argoproj.io/sync-wave: "-1" +subjects: + - kind: ServiceAccount + name: parasol + namespace: {{ $.Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: admin diff --git a/parasol/parasol/templates/sa-parasol.yaml b/parasol/parasol/templates/sa-parasol.yaml new file mode 100644 index 0000000..0a84840 --- /dev/null +++ b/parasol/parasol/templates/sa-parasol.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: parasol + annotations: + argocd.argoproj.io/sync-wave: "-2" + labels: + app: parasol From 08582ffe5e89e03aa0fb39fcc981c18a199f846f Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 17:23:34 -0800 Subject: [PATCH 33/49] fix: missing default namespace --- parasol/parasol-build/values.yaml | 2 +- parasol/parasol/values.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/parasol/parasol-build/values.yaml b/parasol/parasol-build/values.yaml index 15091f3..4fb2046 100644 --- a/parasol/parasol-build/values.yaml +++ b/parasol/parasol-build/values.yaml @@ -20,7 +20,7 @@ parasol: - argocd/app-build.yaml argocd: name: parasol-store-build - namespace: + namespace: openshift-gitops image: name: parasol-store gitlab: diff --git a/parasol/parasol/values.yaml b/parasol/parasol/values.yaml index a2e72bb..cf4c619 100644 --- a/parasol/parasol/values.yaml +++ b/parasol/parasol/values.yaml @@ -32,7 +32,7 @@ parasol: - app/argocd/app.yaml argocd: name: parasol-db - namespace: + namespace: openshift-gitops store: templates: - project: parasol-store-manifests @@ -61,7 +61,7 @@ parasol: - app/argocd/app.yaml argocd: name: parasol-store - namespace: + namespace: openshift-gitops image: source: image: quay.io/redhat_pe_workshop/parasol-store @@ -108,7 +108,7 @@ parasol: - app/argocd/app.yaml argocd: name: parasol-web - namespace: + namespace: openshift-gitops image: source: image: quay.io/redhat_pe_workshop/parasol-web From ae7ced101f0cc3d62c7c658f44ab4568b1e2b210 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 17:38:09 -0800 Subject: [PATCH 34/49] chore: add clarity to init commits --- gitlab/templates/cm-gitlab-templates.yaml | 2 +- .../parasol-build/templates/parasol-store-build-manifests.yaml | 2 +- .../parasol-templates/templates/parasol-store-templates.yaml | 2 +- parasol/parasol/templates/parasol-store-manifests.yaml | 2 +- parasol/parasol/templates/parasol-web-manifests.yaml | 2 +- .../templates/rhdh-config-template.yaml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/gitlab/templates/cm-gitlab-templates.yaml b/gitlab/templates/cm-gitlab-templates.yaml index 70cda53..19d47dc 100644 --- a/gitlab/templates/cm-gitlab-templates.yaml +++ b/gitlab/templates/cm-gitlab-templates.yaml @@ -102,7 +102,7 @@ data: chdir: >- /tmp/{{ $item.project }} cmd: >- - git commit -a -m 'Updates for starting scenario.' + git commit -a -m 'gitlab init: updates for starting scenario.' ignore_errors: true - name: Push all changes back to the project repository diff --git a/parasol/parasol-build/templates/parasol-store-build-manifests.yaml b/parasol/parasol-build/templates/parasol-store-build-manifests.yaml index 0e489b3..7ff6946 100644 --- a/parasol/parasol-build/templates/parasol-store-build-manifests.yaml +++ b/parasol/parasol-build/templates/parasol-store-build-manifests.yaml @@ -114,7 +114,7 @@ data: chdir: >- /tmp/{{ $item.project }} cmd: >- - git commit -a -m 'Updates for starting scenario.' + git commit -a -m 'parasol init: updates for starting scenario.' ignore_errors: true - name: Push all changes back to the project repository diff --git a/parasol/parasol-templates/templates/parasol-store-templates.yaml b/parasol/parasol-templates/templates/parasol-store-templates.yaml index 2d59447..91f8b94 100644 --- a/parasol/parasol-templates/templates/parasol-store-templates.yaml +++ b/parasol/parasol-templates/templates/parasol-store-templates.yaml @@ -103,7 +103,7 @@ data: chdir: >- /tmp/{{ $item.project }} cmd: >- - git commit -a -m 'Updates for starting scenario.' + git commit -a -m 'parasol init: updates for starting scenario.' ignore_errors: true - name: Push all changes back to the project repository diff --git a/parasol/parasol/templates/parasol-store-manifests.yaml b/parasol/parasol/templates/parasol-store-manifests.yaml index e280ef9..01988a5 100644 --- a/parasol/parasol/templates/parasol-store-manifests.yaml +++ b/parasol/parasol/templates/parasol-store-manifests.yaml @@ -103,7 +103,7 @@ data: chdir: >- /tmp/{{ $item.project }} cmd: >- - git commit -a -m 'Updates for starting scenario.' + git commit -a -m 'parasol init: updates for starting scenario.' ignore_errors: true - name: Push all changes back to the project repository diff --git a/parasol/parasol/templates/parasol-web-manifests.yaml b/parasol/parasol/templates/parasol-web-manifests.yaml index d19de5d..517ba94 100644 --- a/parasol/parasol/templates/parasol-web-manifests.yaml +++ b/parasol/parasol/templates/parasol-web-manifests.yaml @@ -107,7 +107,7 @@ data: chdir: >- /tmp/{{ $item.project }} cmd: >- - git commit -a -m 'Updates for starting scenario.' + git commit -a -m 'parasol init: : updates for starting scenario.' ignore_errors: true - name: Push all changes back to the project repository diff --git a/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml b/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml index 8ccd7ce..b392118 100644 --- a/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml +++ b/redhat-developer-hub/redhat-developer-hub-config-template/templates/rhdh-config-template.yaml @@ -103,7 +103,7 @@ data: chdir: >- /tmp/{{ $item.project }} cmd: >- - git commit -a -m 'Updates for starting scenario.' + git commit -a -m 'rhdh init: updates for starting scenario.' ignore_errors: true - name: Push all changes back to the project repository From ee4bac92bd72a0086efc4f0c043089863f561245 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Thu, 19 Feb 2026 17:55:43 -0800 Subject: [PATCH 35/49] chore: add clarity to init commits --- parasol/parasol/templates/parasol-db-manifests.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/parasol/parasol/templates/parasol-db-manifests.yaml b/parasol/parasol/templates/parasol-db-manifests.yaml index e1526b0..4bad4a6 100644 --- a/parasol/parasol/templates/parasol-db-manifests.yaml +++ b/parasol/parasol/templates/parasol-db-manifests.yaml @@ -96,7 +96,7 @@ data: chdir: >- /tmp/{{ $item.project }} cmd: >- - git commit -a -m 'Updates for starting scenario.' + git commit -a -m 'parasol init: updates for starting scenario.' ignore_errors: true - name: Push all changes back to the project repository From d2fc431e2a39e27c5f04667e52fb9fb1011d6da5 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 23 Feb 2026 14:02:25 -0800 Subject: [PATCH 36/49] feat(gitlab): set dev as default branch for template repos Add defaultBranch support to the gitlab init job and configure 5 template repos to use dev branch after import. Also increase ArgoCD retry maxDuration to 5m and limit to 20. Co-Authored-By: Claude Opus 4.6 --- app-of-apps/templates/_helpers.tpl | 4 ++-- gitlab/templates/cm-gitlab-init.yaml | 23 +++++++++++++++++++++++ gitlab/values.yaml | 5 +++++ 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/app-of-apps/templates/_helpers.tpl b/app-of-apps/templates/_helpers.tpl index 357bf5b..734672b 100644 --- a/app-of-apps/templates/_helpers.tpl +++ b/app-of-apps/templates/_helpers.tpl @@ -11,8 +11,8 @@ syncPolicy: backoff: duration: 5s factor: 2 - maxDuration: 3m0s - limit: 10 + maxDuration: 5m0s + limit: 20 syncOptions: - CreateNamespace=true - RespectIgnoreDifferences=true diff --git a/gitlab/templates/cm-gitlab-init.yaml b/gitlab/templates/cm-gitlab-init.yaml index d41f814..5b29fdf 100644 --- a/gitlab/templates/cm-gitlab-init.yaml +++ b/gitlab/templates/cm-gitlab-init.yaml @@ -193,6 +193,29 @@ data: url: {{ $item1.url }} checkPipeline: {{ include "gitlab.repo.check-pipeline" $item1 }} {{- end }} + + - name: Set default branch for imported repositories + ansible.builtin.uri: + url: https://{{ $.Values.gitlab.host }}/api/v4/projects/{{ $item.name }}%2F{{ "{{" }} item.name {{ "}}" }} + method: PUT + body_format: form-urlencoded + body: + default_branch: '{{ "{{" }} item.defaultBranch {{ "}}" }}' + headers: + PRIVATE-TOKEN: '{{ "{{" }} root_token {{ "}}" }}' + validate_certs: false + status_code: + - 200 + retries: 10 + delay: 5 + register: r_default_branch + until: r_default_branch.status == 200 + when: item.defaultBranch != 'main' + loop: +{{- range $item1 := $item.repo }} + - name: {{ $item1.name }} + defaultBranch: {{ $item1.defaultBranch | default "main" }} +{{- end }} {{- end }} {{- if $item.project }} diff --git a/gitlab/values.yaml b/gitlab/values.yaml index 498ff86..52b3c20 100644 --- a/gitlab/values.yaml +++ b/gitlab/values.yaml @@ -34,16 +34,21 @@ gitlab: repo: - name: template-quarkus-simple url: https://github.com/redhat-pe-workshop/rhdh-template-quarkus-simple.git + defaultBranch: dev - name: parasol-store-dev-template url: https://github.com/redhat-pe-workshop/parasol-store-dev-templates.git + defaultBranch: dev - name: parasol-store-dev-template-secure url: https://github.com/redhat-pe-workshop/parasol-store-dev-template-secured.git + defaultBranch: dev - name: developer-hub-config url: https://github.com/redhat-pe-workshop/developer-hub-config.git - name: import-existing-app-template url: https://github.com/redhat-pe-workshop/import-existing-app-template.git + defaultBranch: dev - name: import-existing-api-template url: https://github.com/redhat-pe-workshop/import-api-template.git + defaultBranch: dev - name: rhdh-entities url: https://github.com/redhat-pe-workshop/pe-workshop-entities.git - name: template-developer-self-service From f4ef2a6a8e9ecd5ed7183ea411ec885d387a6800 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 23 Feb 2026 16:42:04 -0800 Subject: [PATCH 37/49] feat: add llm secrets for continue --- .../templates/es-continue-llm.yaml | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 devspaces/devspaces-instance/templates/es-continue-llm.yaml diff --git a/devspaces/devspaces-instance/templates/es-continue-llm.yaml b/devspaces/devspaces-instance/templates/es-continue-llm.yaml new file mode 100644 index 0000000..3e327e4 --- /dev/null +++ b/devspaces/devspaces-instance/templates/es-continue-llm.yaml @@ -0,0 +1,34 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: continue-llm-credentials + namespace: {{ include "devspaces-instance.namespace" . }} + annotations: + {{- include "devspaces-instance.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: continue-llm-credentials + creationPolicy: Owner + template: + metadata: + labels: + app.kubernetes.io/part-of: che.eclipse.org + app.kubernetes.io/component: workspaces-config + annotations: + controller.devfile.io/mount-as: env + data: + LLM_API_KEY: "{{ printf "{{ .api_key }}" }}" + LLM_BASE_URL: "{{ printf "{{ .base_url }}" }}" + data: + - secretKey: api_key + remoteRef: + key: secrets/litellm/credentials + property: api_key + - secretKey: base_url + remoteRef: + key: secrets/litellm/credentials + property: base_url From 2b0b6f957e314b2245886e7d16ab2054aea4d760 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 23 Feb 2026 17:31:16 -0800 Subject: [PATCH 38/49] chore: add devfile repo import to gitlab --- gitlab/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gitlab/values.yaml b/gitlab/values.yaml index 52b3c20..c45d6a4 100644 --- a/gitlab/values.yaml +++ b/gitlab/values.yaml @@ -49,6 +49,8 @@ gitlab: - name: import-existing-api-template url: https://github.com/redhat-pe-workshop/import-api-template.git defaultBranch: dev + - name: devfiles + url: https://github.com/redhat-pe-workshop/devfiles.git - name: rhdh-entities url: https://github.com/redhat-pe-workshop/pe-workshop-entities.git - name: template-developer-self-service From 46483a5eded363b57c222801b50dadbf22b28326 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Mon, 23 Feb 2026 20:28:06 -0800 Subject: [PATCH 39/49] fix: simplify argocd checks to use dedicated label --- app-of-apps/templates/_helpers.tpl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app-of-apps/templates/_helpers.tpl b/app-of-apps/templates/_helpers.tpl index 734672b..1724a33 100644 --- a/app-of-apps/templates/_helpers.tpl +++ b/app-of-apps/templates/_helpers.tpl @@ -27,6 +27,8 @@ Usage: {{ include "app-of-apps.metadata" (dict "name" "my-app" "namespace" .Valu metadata: name: {{ .name }} namespace: {{ .namespace }} + labels: + app.kubernetes.io/part-of: app-of-apps annotations: argocd.argoproj.io/sync-wave: "{{ .syncWave }}" finalizers: From 4abaff1783886d1111f5dbe59c8fe8688d572e7f Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 24 Feb 2026 11:53:35 -0800 Subject: [PATCH 40/49] chore: change to dev branches --- gitlab/values.yaml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/gitlab/values.yaml b/gitlab/values.yaml index c45d6a4..e72a393 100644 --- a/gitlab/values.yaml +++ b/gitlab/values.yaml @@ -113,17 +113,27 @@ gitlab: templates: - group: rhdh project: template-quarkus-simple - branch: main + branch: dev templates: - template.yaml - group: rhdh project: import-existing-app-template - branch: main + branch: dev templates: - template.yaml - group: rhdh project: import-existing-api-template - branch: main + branch: dev + templates: + - template.yaml + - group: rhdh + project: parasol-store-dev-template + branch: dev + templates: + - template.yaml + - group: rhdh + project: parasol-store-dev-template-secure + branch: dev templates: - template.yaml - group: global From 95d52add1ca9cb4d8e765bf73d3c6a0f97292385 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Tue, 24 Feb 2026 15:40:34 -0800 Subject: [PATCH 41/49] fix: use correct namespace for parasol apps --- parasol/parasol-build/values.yaml | 2 +- parasol/parasol/values.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/parasol/parasol-build/values.yaml b/parasol/parasol-build/values.yaml index 4fb2046..942c5f6 100644 --- a/parasol/parasol-build/values.yaml +++ b/parasol/parasol-build/values.yaml @@ -20,7 +20,7 @@ parasol: - argocd/app-build.yaml argocd: name: parasol-store-build - namespace: openshift-gitops + namespace: rhdh-gitops image: name: parasol-store gitlab: diff --git a/parasol/parasol/values.yaml b/parasol/parasol/values.yaml index cf4c619..ac9b3db 100644 --- a/parasol/parasol/values.yaml +++ b/parasol/parasol/values.yaml @@ -32,7 +32,7 @@ parasol: - app/argocd/app.yaml argocd: name: parasol-db - namespace: openshift-gitops + namespace: rhdh-gitops store: templates: - project: parasol-store-manifests @@ -61,7 +61,7 @@ parasol: - app/argocd/app.yaml argocd: name: parasol-store - namespace: openshift-gitops + namespace: rhdh-gitops image: source: image: quay.io/redhat_pe_workshop/parasol-store @@ -108,7 +108,7 @@ parasol: - app/argocd/app.yaml argocd: name: parasol-web - namespace: openshift-gitops + namespace: rhdh-gitops image: source: image: quay.io/redhat_pe_workshop/parasol-web From 94f88bef81ff0baf05cdfed577ac074660c98e2c Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 09:04:44 -0800 Subject: [PATCH 42/49] fix: increase strimzi memory, and timeout --- README.md | 10 ++++++++++ .../templates/amq-streams-subscription.yaml | 4 ++++ amq-streams/amq-streams-operator/values.yaml | 1 + amq-streams/kafka-broker/values.yaml | 8 ++++---- app-of-apps/templates/_helpers.tpl | 4 ++-- 5 files changed, 21 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 9955997..b7b958b 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,16 @@ The workshop stands up the following on a single OpenShift cluster: | **Red Hat Developer Hub** | `redhat-developer-hub/` | Internal developer portal (Backstage) | | **Trusted Artifact Signer** | `rhtas/` | Sigstore-based container image signing (Fulcio, Rekor, etc.) | +## Deployment settling time + +A full deployment can take around 30 minutes before all Argo CD Applications report as Synced and Healthy. The main bottleneck is GitLab — its own initialisation is slow, and our init Jobs (user/group/repo creation, PAT generation, Vault secret writes) can only run after GitLab is fully ready. Several downstream components then depend on secrets that GitLab's init writes to Vault: + +- **ExternalSecrets** like DevSpaces' `gitlab-oauth-config` won't sync until the corresponding Vault entry exists, which only happens after the GitLab init Job completes +- **Red Hat Developer Hub** depends on the GitLab PAT and webhook secret being in Vault before its own ExternalSecrets can resolve +- **Operators** (AMQ Streams, DevSpaces, OpenShift Pipelines) install via OLM Subscriptions, which can add a few minutes while CSVs install and operands start + +If an Application appears stuck, check whether its upstream dependency (usually GitLab or Vault) has finished initialising. + ## App-of-apps pattern The `app-of-apps/` chart is the root. It renders one Argo CD `Application` CR per component, each pointing back into this same repository at the appropriate chart path. Argo CD then syncs each child Application independently. diff --git a/amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml b/amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml index 5c6d75b..1c71b4b 100644 --- a/amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml +++ b/amq-streams/amq-streams-operator/templates/amq-streams-subscription.yaml @@ -12,3 +12,7 @@ spec: name: {{ .Values.subscription.name }} source: {{ .Values.subscription.source }} sourceNamespace: {{ .Values.subscription.sourceNamespace }} + config: + env: + - name: STRIMZI_OPERATION_TIMEOUT_MS + value: "{{ .Values.subscription.operationTimeoutMs }}" diff --git a/amq-streams/amq-streams-operator/values.yaml b/amq-streams/amq-streams-operator/values.yaml index 5d49078..7e8c769 100644 --- a/amq-streams/amq-streams-operator/values.yaml +++ b/amq-streams/amq-streams-operator/values.yaml @@ -9,6 +9,7 @@ subscription: name: amq-streams source: redhat-operators sourceNamespace: openshift-marketplace + operationTimeoutMs: "600000" argocd: enabled: true diff --git a/amq-streams/kafka-broker/values.yaml b/amq-streams/kafka-broker/values.yaml index b32d18c..b9f5b37 100644 --- a/amq-streams/kafka-broker/values.yaml +++ b/amq-streams/kafka-broker/values.yaml @@ -20,18 +20,18 @@ kafka: resources: limits: cpu: 500m - memory: 500M + memory: 512M requests: cpu: 250m - memory: 250M + memory: 256M userOperator: resources: limits: cpu: 250m - memory: 250M + memory: 512M requests: cpu: 150m - memory: 150M + memory: 256M resources: limits: cpu: '1' diff --git a/app-of-apps/templates/_helpers.tpl b/app-of-apps/templates/_helpers.tpl index 1724a33..28e635e 100644 --- a/app-of-apps/templates/_helpers.tpl +++ b/app-of-apps/templates/_helpers.tpl @@ -11,8 +11,8 @@ syncPolicy: backoff: duration: 5s factor: 2 - maxDuration: 5m0s - limit: 20 + maxDuration: 2m0s + limit: 30 syncOptions: - CreateNamespace=true - RespectIgnoreDifferences=true From 627c707ef5e93f17bbb00bcceb52f1848b5e657d Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 09:09:21 -0800 Subject: [PATCH 43/49] fix: increase strimzi user operator cpu --- amq-streams/kafka-broker/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/amq-streams/kafka-broker/values.yaml b/amq-streams/kafka-broker/values.yaml index b9f5b37..ae8ef17 100644 --- a/amq-streams/kafka-broker/values.yaml +++ b/amq-streams/kafka-broker/values.yaml @@ -27,10 +27,10 @@ kafka: userOperator: resources: limits: - cpu: 250m + cpu: 500m memory: 512M requests: - cpu: 150m + cpu: 250m memory: 256M resources: limits: From 03e20e3fe386394e066a4707590cbe355c853fc0 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 14:18:48 -0800 Subject: [PATCH 44/49] feat: add operator based deployment --- app-of-apps/templates/developer-hub.yaml | 28 ++++ app-of-apps/values.yaml | 14 ++ developer-hub/Chart.yaml | 5 + developer-hub/templates/_helpers.tpl | 64 ++++++++ developer-hub/templates/backstage-cr.yaml | 32 ++++ ...cluster-role-binding-default-sa-admin.yaml | 14 ++ .../templates/cm-sa-token-writer.yaml | 83 ++++++++++ .../templates/configmap-app-config.yaml | 64 ++++++++ .../templates/configmap-dynamic-plugins.yaml | 24 +++ .../templates/configmap-rbac-policy.yaml | 18 +++ .../templates/es-argocd-password.yaml | 21 +++ developer-hub/templates/es-gitlab-token.yaml | 21 +++ .../templates/es-kubernetes-sa-token.yaml | 21 +++ developer-hub/templates/es-oauth-client.yaml | 25 +++ .../templates/es-orchestrator-token.yaml | 21 +++ developer-hub/templates/job-sa-token.yaml | 29 ++++ developer-hub/templates/namespace.yaml | 8 + developer-hub/templates/operator-group.yaml | 11 ++ .../templates/secret-backstage-npmrc.yaml | 11 ++ developer-hub/templates/subscription.yaml | 15 ++ developer-hub/values.yaml | 142 ++++++++++++++++++ 21 files changed, 671 insertions(+) create mode 100644 app-of-apps/templates/developer-hub.yaml create mode 100644 developer-hub/Chart.yaml create mode 100644 developer-hub/templates/_helpers.tpl create mode 100644 developer-hub/templates/backstage-cr.yaml create mode 100644 developer-hub/templates/cluster-role-binding-default-sa-admin.yaml create mode 100644 developer-hub/templates/cm-sa-token-writer.yaml create mode 100644 developer-hub/templates/configmap-app-config.yaml create mode 100644 developer-hub/templates/configmap-dynamic-plugins.yaml create mode 100644 developer-hub/templates/configmap-rbac-policy.yaml create mode 100644 developer-hub/templates/es-argocd-password.yaml create mode 100644 developer-hub/templates/es-gitlab-token.yaml create mode 100644 developer-hub/templates/es-kubernetes-sa-token.yaml create mode 100644 developer-hub/templates/es-oauth-client.yaml create mode 100644 developer-hub/templates/es-orchestrator-token.yaml create mode 100644 developer-hub/templates/job-sa-token.yaml create mode 100644 developer-hub/templates/namespace.yaml create mode 100644 developer-hub/templates/operator-group.yaml create mode 100644 developer-hub/templates/secret-backstage-npmrc.yaml create mode 100644 developer-hub/templates/subscription.yaml create mode 100644 developer-hub/values.yaml diff --git a/app-of-apps/templates/developer-hub.yaml b/app-of-apps/templates/developer-hub.yaml new file mode 100644 index 0000000..f0ddd9e --- /dev/null +++ b/app-of-apps/templates/developer-hub.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" .Values.developerHub.name "namespace" .Values.argocd.namespace "syncWave" "2") }} +spec: + destination: + namespace: {{ .Values.developerHub.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: developer-hub + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + vault: + namespace: {{ .Values.vault.namespace }} + name: {{ .Values.vault.name }} + appConfig: + app: + title: {{ .Values.developerHub.appConfig.app.title }} + baseUrl: {{ .Values.developerHub.appConfig.app.baseUrl }} + gitlab: + host: {{ .Values.developerHub.appConfig.gitlab.host }} + argocd: + host: {{ .Values.developerHub.appConfig.argocd.host }} + kubernetes: + apiUrl: {{ .Values.developerHub.appConfig.kubernetes.apiUrl }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 593fdee..8d109a1 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -102,6 +102,20 @@ quay: - parasol users: [] +developerHub: + name: developer-hub + namespace: rhdh + appConfig: + app: + title: Red Hat Developer Hub + baseUrl: "" + gitlab: + host: "" + argocd: + host: "" + kubernetes: + apiUrl: "" + rhdhGitops: name: rhdh-gitops namespace: rhdh-gitops diff --git a/developer-hub/Chart.yaml b/developer-hub/Chart.yaml new file mode 100644 index 0000000..fd86ce9 --- /dev/null +++ b/developer-hub/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: developer-hub +description: Deploys Red Hat Developer Hub via the RHDH Operator +type: application +version: 0.1.0 diff --git a/developer-hub/templates/_helpers.tpl b/developer-hub/templates/_helpers.tpl new file mode 100644 index 0000000..4b3f4b6 --- /dev/null +++ b/developer-hub/templates/_helpers.tpl @@ -0,0 +1,64 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "developer-hub.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "developer-hub.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "developer-hub.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "developer-hub.labels" -}} +helm.sh/chart: {{ include "developer-hub.chart" . }} +{{ include "developer-hub.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "developer-hub.selectorLabels" -}} +app.kubernetes.io/name: {{ include "developer-hub.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +ArgoCD Syncwave +*/}} +{{- define "developer-hub.argocd-syncwave" -}} +{{- if .Values.argocd }} +{{- if and (.Values.argocd.syncwave) (.Values.argocd.enabled) -}} +argocd.argoproj.io/sync-wave: "{{ .Values.argocd.syncwave }}" +{{- else }} +{{- "{}" }} +{{- end }} +{{- else }} +{{- "{}" }} +{{- end }} +{{- end }} diff --git a/developer-hub/templates/backstage-cr.yaml b/developer-hub/templates/backstage-cr.yaml new file mode 100644 index 0000000..4fe8363 --- /dev/null +++ b/developer-hub/templates/backstage-cr.yaml @@ -0,0 +1,32 @@ +apiVersion: rhdh.redhat.com/v1alpha3 +kind: Backstage +metadata: + name: {{ .Values.backstage.name }} + namespace: {{ .Values.namespace }} + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + application: + appConfig: + mountPath: /opt/app-root/src + {{- with .Values.backstage.appConfig.configMaps }} + configMaps: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.backstage.dynamicPluginsConfigMapName }} + dynamicPluginsConfigMapName: {{ . }} + {{- end }} + extraEnvs: + {{- with .Values.backstage.extraEnvs.secrets }} + secrets: + {{- toYaml . | nindent 8 }} + {{- end }} + extraFiles: + mountPath: /opt/app-root/src + replicas: {{ .Values.backstage.replicas }} + route: + enabled: {{ .Values.backstage.route.enabled }} + database: + enableLocalDb: true diff --git a/developer-hub/templates/cluster-role-binding-default-sa-admin.yaml b/developer-hub/templates/cluster-role-binding-default-sa-admin.yaml new file mode 100644 index 0000000..368c0b6 --- /dev/null +++ b/developer-hub/templates/cluster-role-binding-default-sa-admin.yaml @@ -0,0 +1,14 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cluster-admin-default-{{ .Release.Namespace }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +subjects: + - kind: ServiceAccount + namespace: {{ .Release.Namespace }} + name: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin diff --git a/developer-hub/templates/cm-sa-token-writer.yaml b/developer-hub/templates/cm-sa-token-writer.yaml new file mode 100644 index 0000000..1be02a2 --- /dev/null +++ b/developer-hub/templates/cm-sa-token-writer.yaml @@ -0,0 +1,83 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: sa-token-writer + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "1" +data: + playbook.yaml: | + --- + - name: Write SA token to Vault + hosts: localhost + vars: + namespace: {{ .Release.Namespace }} + vault_namespace: {{ .Values.vault.namespace }} + vault_name: {{ .Values.vault.name }} + tasks: + - name: Create service account token secret + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: Secret + type: kubernetes.io/service-account-token + metadata: + name: default-token + namespace: '{{ "{{" }} namespace {{ "}}" }}' + annotations: + kubernetes.io/service-account.name: default + + - name: Wait for token to be populated + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: default-token + namespace: '{{ "{{" }} namespace {{ "}}" }}' + register: r_token_secret + retries: 60 + delay: 5 + until: + - r_token_secret.resources is defined + - r_token_secret.resources | length > 0 + - r_token_secret.resources[0].data is defined + - r_token_secret.resources[0].data.token is defined + - r_token_secret.resources[0].data.token | length > 0 + + - name: Decode token + ansible.builtin.set_fact: + sa_token: '{{ "{{" }} r_token_secret.resources[0].data.token | b64decode {{ "}}" }}' + + - name: Retrieve Vault Pod + kubernetes.core.k8s_info: + kind: Pod + name: '{{ "{{" }} vault_name {{ "}}" }}-0' + namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' + register: r_vault + retries: 120 + delay: 5 + until: + - r_vault.resources is defined + - r_vault.resources | length > 0 + - r_vault.resources[0].status is defined + - r_vault.resources[0].status.phase is defined + - r_vault.resources[0].status.phase == 'Running' + + - name: Read Vault token + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: vault-token + namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' + register: r_vault_token + + - name: Set Vault token + ansible.builtin.set_fact: + vault_token: '{{ "{{" }} r_vault_token.resources[0].data.token | b64decode {{ "}}" }}' + + - name: Write SA token to Vault + kubernetes.core.k8s_exec: + namespace: '{{ "{{" }} vault_namespace {{ "}}" }}' + pod: '{{ "{{" }} vault_name {{ "}}" }}-0' + command: 'sh -c "VAULT_TOKEN={{ "{{" }} vault_token {{ "}}" }} vault kv put kv/secrets/rhdh/kubernetes-sa-token value={{ "{{" }} sa_token {{ "}}" }}"' diff --git a/developer-hub/templates/configmap-app-config.yaml b/developer-hub/templates/configmap-app-config.yaml new file mode 100644 index 0000000..cb098dc --- /dev/null +++ b/developer-hub/templates/configmap-app-config.yaml @@ -0,0 +1,64 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: app-config-rhdh + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +data: + app-config-rhdh.yaml: | + app: + title: {{ .Values.appConfig.app.title }} + baseUrl: https://{{ .Values.appConfig.app.baseUrl }} + + auth: + providers: + guest: + dangerouslyAllowOutsideDevelopment: true + + backend: + baseUrl: https://{{ .Values.appConfig.app.baseUrl }} + listen: + port: 7007 + host: 0.0.0.0 + + integrations: + gitlab: + - apiBaseUrl: https://{{ .Values.appConfig.gitlab.host }}/api/v4 + baseUrl: https://{{ .Values.appConfig.gitlab.host }} + host: {{ .Values.appConfig.gitlab.host }} + token: ${GITLAB_TOKEN} + + catalog: + rules: + - allow: [Component, System, API, Resource, Location, Template, Domain] + locations: [] + + argocd: + appLocatorMethods: + - type: config + instances: + - name: main + url: https://{{ .Values.appConfig.argocd.host }} + username: admin + password: ${ARGOCD_PASSWORD} + + kubernetes: + serviceLocatorMethod: + type: multiTenant + clusterLocatorMethods: + - clusters: + - name: dev-cluster + url: {{ .Values.appConfig.kubernetes.apiUrl }} + authProvider: serviceAccount + skipTLSVerify: true + serviceAccountToken: ${KUBERNETES_SA_TOKEN} + type: config + customResources: + - group: tekton.dev + apiVersion: v1beta1 + plural: pipelineruns + - group: tekton.dev + apiVersion: v1beta1 + plural: taskruns diff --git a/developer-hub/templates/configmap-dynamic-plugins.yaml b/developer-hub/templates/configmap-dynamic-plugins.yaml new file mode 100644 index 0000000..569a29f --- /dev/null +++ b/developer-hub/templates/configmap-dynamic-plugins.yaml @@ -0,0 +1,24 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: dynamic-plugins + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +data: + dynamic-plugins.yaml: | + includes: + - dynamic-plugins.default.yaml + plugins: + {{- range $plugin := .Values.dynamicPlugins }} + - package: {{ $plugin.package }} + disabled: {{ $plugin.disabled | default false }} + {{- with $plugin.pluginConfig }} + pluginConfig: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- with $plugin.integrity }} + integrity: {{ . }} + {{- end }} + {{- end }} diff --git a/developer-hub/templates/configmap-rbac-policy.yaml b/developer-hub/templates/configmap-rbac-policy.yaml new file mode 100644 index 0000000..b1fa77f --- /dev/null +++ b/developer-hub/templates/configmap-rbac-policy.yaml @@ -0,0 +1,18 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: rbac-policy + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +data: + rbac-policy.csv: | + {{- range $item := .Values.rbacPolicy }} + {{ $item }} + {{- end }} + rbac-conditional-policies.yaml: | + {{- range $item := .Values.rbacConditionalPolicies }} + --- + {{- toYaml $item | nindent 4 }} + {{- end }} diff --git a/developer-hub/templates/es-argocd-password.yaml b/developer-hub/templates/es-argocd-password.yaml new file mode 100644 index 0000000..3e3644a --- /dev/null +++ b/developer-hub/templates/es-argocd-password.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-password + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: argocd-password + creationPolicy: Owner + data: + - secretKey: ARGOCD_PASSWORD + remoteRef: + key: secrets/rhdh/argocd-password + property: value diff --git a/developer-hub/templates/es-gitlab-token.yaml b/developer-hub/templates/es-gitlab-token.yaml new file mode 100644 index 0000000..bf927cb --- /dev/null +++ b/developer-hub/templates/es-gitlab-token.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-token + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: gitlab-token + creationPolicy: Owner + data: + - secretKey: GITLAB_TOKEN + remoteRef: + key: secrets/gitlab/token + property: value diff --git a/developer-hub/templates/es-kubernetes-sa-token.yaml b/developer-hub/templates/es-kubernetes-sa-token.yaml new file mode 100644 index 0000000..a197825 --- /dev/null +++ b/developer-hub/templates/es-kubernetes-sa-token.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: kubernetes-sa-token + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: kubernetes-sa-token + creationPolicy: Owner + data: + - secretKey: KUBERNETES_SA_TOKEN + remoteRef: + key: secrets/rhdh/kubernetes-sa-token + property: value diff --git a/developer-hub/templates/es-oauth-client.yaml b/developer-hub/templates/es-oauth-client.yaml new file mode 100644 index 0000000..8725feb --- /dev/null +++ b/developer-hub/templates/es-oauth-client.yaml @@ -0,0 +1,25 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: oauth-client + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: oauth-client + creationPolicy: Owner + data: + - secretKey: OAUTH_CLIENT_ID + remoteRef: + key: secrets/keycloak/client-secret + property: clientId + - secretKey: OAUTH_CLIENT_SECRET + remoteRef: + key: secrets/keycloak/client-secret + property: clientSecret diff --git a/developer-hub/templates/es-orchestrator-token.yaml b/developer-hub/templates/es-orchestrator-token.yaml new file mode 100644 index 0000000..0d2d816 --- /dev/null +++ b/developer-hub/templates/es-orchestrator-token.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: backstage-orchestrator-token + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: backstage-orchestrator-token + creationPolicy: Owner + data: + - secretKey: ORCHESTRATOR_TOKEN + remoteRef: + key: secrets/rhdh/orchestrator-token + property: value diff --git a/developer-hub/templates/job-sa-token.yaml b/developer-hub/templates/job-sa-token.yaml new file mode 100644 index 0000000..337b3ca --- /dev/null +++ b/developer-hub/templates/job-sa-token.yaml @@ -0,0 +1,29 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: sa-token-writer + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "1" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation +spec: + backoffLimit: 10 + template: + spec: + serviceAccountName: default + restartPolicy: OnFailure + containers: + - name: sa-token-writer + image: quay.io/agnosticd/ee-multicloud:latest + command: + - ansible-playbook + - /playbook/playbook.yaml + volumeMounts: + - name: playbook + mountPath: /playbook + volumes: + - name: playbook + configMap: + name: sa-token-writer diff --git a/developer-hub/templates/namespace.yaml b/developer-hub/templates/namespace.yaml new file mode 100644 index 0000000..441fb9a --- /dev/null +++ b/developer-hub/templates/namespace.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Values.namespace }} + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "-2" diff --git a/developer-hub/templates/operator-group.yaml b/developer-hub/templates/operator-group.yaml new file mode 100644 index 0000000..313f256 --- /dev/null +++ b/developer-hub/templates/operator-group.yaml @@ -0,0 +1,11 @@ +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: rhdh-operator + namespace: {{ .Values.namespace }} + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "-2" +spec: + upgradeStrategy: Default diff --git a/developer-hub/templates/secret-backstage-npmrc.yaml b/developer-hub/templates/secret-backstage-npmrc.yaml new file mode 100644 index 0000000..ff03f02 --- /dev/null +++ b/developer-hub/templates/secret-backstage-npmrc.yaml @@ -0,0 +1,11 @@ +kind: Secret +apiVersion: v1 +metadata: + name: backstage-dynamic-plugins-npmrc + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} +stringData: + .npmrc: '@redhat:registry=https://npm.registry.redhat.com' +type: Opaque diff --git a/developer-hub/templates/subscription.yaml b/developer-hub/templates/subscription.yaml new file mode 100644 index 0000000..047f1ce --- /dev/null +++ b/developer-hub/templates/subscription.yaml @@ -0,0 +1,15 @@ +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: rhdh + namespace: {{ .Values.namespace }} + labels: + {{- include "developer-hub.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: "-2" +spec: + channel: {{ .Values.operator.channel }} + installPlanApproval: Automatic + name: rhdh + source: redhat-operators + sourceNamespace: openshift-marketplace diff --git a/developer-hub/values.yaml b/developer-hub/values.yaml new file mode 100644 index 0000000..bdc02a0 --- /dev/null +++ b/developer-hub/values.yaml @@ -0,0 +1,142 @@ +nameOverride: "backstage" + +namespace: rhdh + +vault: + namespace: vault + name: vault + +operator: + channel: fast-1.8 + +backstage: + name: developer-hub + replicas: 1 + route: + enabled: true + appConfig: + configMaps: + - name: app-config-rhdh + dynamicPluginsConfigMapName: dynamic-plugins + extraEnvs: + secrets: + - name: gitlab-token + - name: argocd-password + - name: kubernetes-sa-token + - name: oauth-client + - name: backstage-orchestrator-token + +appConfig: + app: + title: Red Hat Developer Hub + baseUrl: "" + gitlab: + host: "" + argocd: + host: "" + kubernetes: + apiUrl: "" + +dynamicPlugins: + - package: ./dynamic-plugins/dist/backstage-plugin-scaffolder-backend-module-gitlab-dynamic + disabled: false + - package: ./dynamic-plugins/dist/roadiehq-scaffolder-backend-argocd-dynamic + disabled: false + - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes-backend-dynamic + disabled: false + - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes + disabled: false + - package: ./dynamic-plugins/dist/backstage-community-plugin-topology + disabled: false + - package: ./dynamic-plugins/dist/backstage-community-plugin-tekton + disabled: false + - package: ./dynamic-plugins/dist/backstage-community-plugin-catalog-backend-module-keycloak-dynamic + disabled: false + - package: ./dynamic-plugins/dist/roadiehq-backstage-plugin-argo-cd-backend-dynamic + disabled: false + - package: ./dynamic-plugins/dist/backstage-community-plugin-redhat-argocd + disabled: false + +rbacPolicy: + - "p, role:default/location_read, catalog.entity.read, read, allow" + - "p, role:default/location_read, catalog.location.read, read, allow" + + - "p, role:default/location_read_developer, catalog.entity.read, read, allow" + - "p, role:default/location_read_developer, catalog.location.read, read, allow" + + - "p, role:default/platformengineer, catalog.entity.create, create, allow" + - "p, role:default/platformengineer, catalog.entity.refresh, update, allow" + - "p, role:default/platformengineer, catalog.entity.delete, delete, allow" + - "p, role:default/platformengineer, catalog.location.create, create, allow" + - "p, role:default/platformengineer, catalog.location.delete, delete, allow" + + - "p, role:default/scaffolder_execute, scaffolder.action.execute, use, allow" + - "p, role:default/scaffolder_execute, scaffolder.template.parameter.read, read, allow" + - "p, role:default/scaffolder_execute, scaffolder.template.step.read, read, allow" + - "p, role:default/scaffolder_execute, scaffolder.task.create, create, allow" + - "p, role:default/scaffolder_execute, scaffolder.task.cancel, use, allow" + - "p, role:default/scaffolder_execute, scaffolder.task.read, read, allow" + - "p, role:default/scaffolder_execute, catalog.location.create, create, allow" + + - "p, role:default/plugins, topology.view.read, read, allow" + - "p, role:default/plugins, tekton.view.read, read, allow" + - "p, role:default/plugins, argocd.view.read, read, allow" + - "p, role:default/plugins, kubernetes.proxy, use, allow" + - "p, role:default/plugins, kubernetes.clusters.read, read, allow" + - "p, role:default/plugins, kubernetes.resources.read, read, allow" + - "p, role:default/plugins, adoption-insights.events.read, read, allow" + + - "p, role:default/workflowUser, orchestrator.workflow.create-ocp-namespace-swt, read, allow" + - "p, role:default/workflowUser, orchestrator.workflow.use.create-ocp-namespace-swt, update, allow" + - "p, role:default/workflowUser, orchestrator.instanceAdminView, read, allow" + + - "p, role:default/workflowAdmin, orchestrator.workflow, read, allow" + - "p, role:default/workflowAdmin, orchestrator.workflow.use, update, allow" + - "p, role:default/workflowAdmin, orchestrator.workflowAdminView, read, allow" + - "p, role:default/workflowAdmin, orchestrator.instanceAdminView, read, allow" + + - "g, group:default/platformengineers, role:default/location_read" + - "g, group:default/platformengineers, role:default/platformengineer" + - "g, group:default/platformengineers, role:default/scaffolder_execute" + - "g, group:default/platformengineers, role:default/plugins" + + - "g, group:default/developers, role:default/location_read_developer" + - "g, group:default/developers, role:default/developer" + - "g, group:default/developers, role:default/scaffolder_execute" + - "g, group:default/developers, role:default/plugins" + + - "g, group:default/developers, role:default/workflowUser" + - "g, group:default/platformengineers, role:default/workflowAdmin" + +rbacConditionalPolicies: + - result: CONDITIONAL + roleEntityRef: 'role:default/location_read_developer' + resourceType: catalog-entity + pluginId: catalog + permissionMapping: + - read + conditions: + not: + rule: HAS_ANNOTATION + resourceType: catalog-entity + params: + annotation: backstage.io/managed-by + value: orchestrator + + - conditions: + params: + claims: + - $ownerRefs + resourceType: catalog-entity + rule: IS_ENTITY_OWNER + permissionMapping: + - delete + - update + pluginId: catalog + resourceType: catalog-entity + result: CONDITIONAL + roleEntityRef: role:default/developer + +argocd: + enabled: true + syncwave: "-1" From 11ad2b070dd20bf16dc6ff3adcae34c3551cf56b Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 21:14:32 -0800 Subject: [PATCH 45/49] chore: testing rhdh via operator deployment --- app-of-apps/templates/developer-hub.yaml | 29 ++-- app-of-apps/values.yaml | 19 ++- developer-hub/Chart.lock | 9 ++ developer-hub/Chart.yaml | 8 + .../developer-hub-application-0.1.0.tgz | Bin 0 -> 1219 bytes .../charts/developer-hub-prereqs-0.1.0.tgz | Bin 0 -> 3349 bytes .../developer-hub-application/Chart.yaml | 5 + .../templates/_helpers.tpl | 60 ++++++++ .../templates/dh-application.yaml | 33 ++++ .../developer-hub-application/values.yaml | 12 ++ .../developer-hub-prereqs/Chart.yaml | 5 + .../templates/_helpers.tpl | 18 +-- ...cluster-role-binding-default-sa-admin.yaml | 2 +- .../templates/cm-dh-config-template.yaml | 105 +++++++++++++ .../templates/cm-sa-token-writer.yaml | 2 +- .../templates/job-dh-config-template.yaml | 29 ++++ .../templates/job-sa-token.yaml | 2 +- .../templates/namespace.yaml | 2 +- .../templates/operator-group.yaml | 2 +- .../templates/subscription.yaml | 2 +- .../developer-hub-prereqs/values.yaml | 49 ++++++ developer-hub/templates/backstage-cr.yaml | 32 ---- .../templates/configmap-app-config.yaml | 64 -------- .../templates/configmap-dynamic-plugins.yaml | 24 --- .../templates/configmap-rbac-policy.yaml | 18 --- .../templates/es-argocd-password.yaml | 21 --- developer-hub/templates/es-gitlab-token.yaml | 21 --- .../templates/es-kubernetes-sa-token.yaml | 21 --- developer-hub/templates/es-oauth-client.yaml | 25 ---- .../templates/es-orchestrator-token.yaml | 21 --- .../templates/secret-backstage-npmrc.yaml | 11 -- developer-hub/values.yaml | 141 ------------------ gitlab/values.yaml | 2 + 33 files changed, 363 insertions(+), 431 deletions(-) create mode 100644 developer-hub/Chart.lock create mode 100644 developer-hub/charts/developer-hub-application-0.1.0.tgz create mode 100644 developer-hub/charts/developer-hub-prereqs-0.1.0.tgz create mode 100644 developer-hub/developer-hub-application/Chart.yaml create mode 100644 developer-hub/developer-hub-application/templates/_helpers.tpl create mode 100644 developer-hub/developer-hub-application/templates/dh-application.yaml create mode 100644 developer-hub/developer-hub-application/values.yaml create mode 100644 developer-hub/developer-hub-prereqs/Chart.yaml rename developer-hub/{ => developer-hub-prereqs}/templates/_helpers.tpl (72%) rename developer-hub/{ => developer-hub-prereqs}/templates/cluster-role-binding-default-sa-admin.yaml (81%) create mode 100644 developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml rename developer-hub/{ => developer-hub-prereqs}/templates/cm-sa-token-writer.yaml (97%) create mode 100644 developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml rename developer-hub/{ => developer-hub-prereqs}/templates/job-sa-token.yaml (91%) rename developer-hub/{ => developer-hub-prereqs}/templates/namespace.yaml (68%) rename developer-hub/{ => developer-hub-prereqs}/templates/operator-group.yaml (77%) rename developer-hub/{ => developer-hub-prereqs}/templates/subscription.yaml (84%) create mode 100644 developer-hub/developer-hub-prereqs/values.yaml delete mode 100644 developer-hub/templates/backstage-cr.yaml delete mode 100644 developer-hub/templates/configmap-app-config.yaml delete mode 100644 developer-hub/templates/configmap-dynamic-plugins.yaml delete mode 100644 developer-hub/templates/configmap-rbac-policy.yaml delete mode 100644 developer-hub/templates/es-argocd-password.yaml delete mode 100644 developer-hub/templates/es-gitlab-token.yaml delete mode 100644 developer-hub/templates/es-kubernetes-sa-token.yaml delete mode 100644 developer-hub/templates/es-oauth-client.yaml delete mode 100644 developer-hub/templates/es-orchestrator-token.yaml delete mode 100644 developer-hub/templates/secret-backstage-npmrc.yaml diff --git a/app-of-apps/templates/developer-hub.yaml b/app-of-apps/templates/developer-hub.yaml index f0ddd9e..97e90d8 100644 --- a/app-of-apps/templates/developer-hub.yaml +++ b/app-of-apps/templates/developer-hub.yaml @@ -12,17 +12,24 @@ spec: targetRevision: {{ .Values.gitops.targetRevision }} helm: valuesObject: - vault: - namespace: {{ .Values.vault.namespace }} - name: {{ .Values.vault.name }} - appConfig: - app: - title: {{ .Values.developerHub.appConfig.app.title }} - baseUrl: {{ .Values.developerHub.appConfig.app.baseUrl }} + developer-hub-prereqs: + vault: + namespace: {{ .Values.vault.namespace }} + name: {{ .Values.vault.name }} gitlab: - host: {{ .Values.developerHub.appConfig.gitlab.host }} - argocd: - host: {{ .Values.developerHub.appConfig.argocd.host }} + rootPassword: {{ .Values.developerHub.configTemplate.gitlab.rootPassword | quote }} + host: {{ .Values.developerHub.configTemplate.gitlab.host }} + backstage: + host: {{ .Values.developerHub.configTemplate.backstage.host }} + gitops: + host: {{ .Values.developerHub.configTemplate.gitops.host }} kubernetes: - apiUrl: {{ .Values.developerHub.appConfig.kubernetes.apiUrl }} + api: {{ .Values.developerHub.configTemplate.kubernetes.api }} + cluster: + subdomain: {{ .Values.developerHub.configTemplate.cluster.subdomain }} + developer-hub-application: + gitops: + namespace: {{ .Values.developerHub.application.gitops.namespace }} + git: + host: {{ .Values.developerHub.application.git.host }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 8d109a1..9a2d592 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -105,16 +105,23 @@ quay: developerHub: name: developer-hub namespace: rhdh - appConfig: - app: - title: Red Hat Developer Hub - baseUrl: "" + configTemplate: gitlab: + rootPassword: "" host: "" - argocd: + backstage: + host: "" + gitops: host: "" kubernetes: - apiUrl: "" + api: "" + cluster: + subdomain: "" + application: + gitops: + namespace: openshift-gitops + git: + host: "" rhdhGitops: name: rhdh-gitops diff --git a/developer-hub/Chart.lock b/developer-hub/Chart.lock new file mode 100644 index 0000000..c7a59c7 --- /dev/null +++ b/developer-hub/Chart.lock @@ -0,0 +1,9 @@ +dependencies: +- name: developer-hub-prereqs + repository: file://developer-hub-prereqs + version: 0.1.0 +- name: developer-hub-application + repository: file://developer-hub-application + version: 0.1.0 +digest: sha256:e51b1d1ced5d76324880d24c42f16cd09f6f107f443d1ab5b0d659d035c5c4f9 +generated: "2026-02-25T15:14:06.275726-08:00" diff --git a/developer-hub/Chart.yaml b/developer-hub/Chart.yaml index fd86ce9..91009c3 100644 --- a/developer-hub/Chart.yaml +++ b/developer-hub/Chart.yaml @@ -3,3 +3,11 @@ name: developer-hub description: Deploys Red Hat Developer Hub via the RHDH Operator type: application version: 0.1.0 + +dependencies: + - name: developer-hub-prereqs + version: 0.1.0 + repository: file://developer-hub-prereqs + - name: developer-hub-application + version: 0.1.0 + repository: file://developer-hub-application diff --git a/developer-hub/charts/developer-hub-application-0.1.0.tgz b/developer-hub/charts/developer-hub-application-0.1.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..155328a30a585eae0c54a755817fee6a28262ee8 GIT binary patch literal 1219 zcmV;!1U&m6iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI*%Z`-yL&$B+oLHHL1`iEr6bsRuIABtvJ2NcVYY<(?g>11)G zNS36GXpX=8AX1Vg$3g65NHEOzB8uc4e|Nk)9+}|^nUJW0qFMw*N=8#+sNj=N1yLrf zNy*NhNl_F<^V!UPqbS<_M$_r}S$rPPE-s=tx|p9u@q9X)oA@;EIl0m2206^K|T3aAd{$cXylVp!6WhiKAz9V z@jtcGPx1c(v|dl%c|YAs!ZR=h+QsJ05Z%eNAMr?nXuvZA=u6* z6*CaJQu5bEbokXBE5p14cVJY-Q<%TEO8wTAg9WoMhs#v@XO->U^Gjs|r|#iTFm z*XunjckrVU26qf~UrI?hSz;C}YA2}kz8h34n(p#DL*KOEpJ3`;y@S1=+#TmIOS+^I z?$?fTZ3s_stlKbjM~eO4=4e}eff10QWTFNmj?L3n!rolBmA{kZ?hOo+#0dL%*1c$d z?NjeW9UW5tWyQ#Oj=m8-Qvb#07qgxEZyHDMPxaqR(D40-sHKof{Ap8nOqeW4?0u&^ zONMViUWtZe#E|YH_=Ge#xZoG_<>@Ap4jR0rzRCel_h0F7#eDuK6!F;XX!$spmk z)m^Ap>01w=0g9|Ma@L_;9fNN}a!~C-3Lg6LNb5zJv)ZmS+k8n(kw9qM8CABD=r=-P hS}BbQDc zVQyr3R8em|NM&qo0PH;dZ`(MQ{aJs-gE5QT?m@Dg&w+q0Hq*|ud)H};rq{*ca4=}; z*PnOWYr%k(_=&si@!)EDyZ|RV-<)?f-ABHWXA*jSA*M!t+X7;AJs`B_*I!gm*8W zzl1kAN}`4IILR=AUcK`4D#r*&o--N~vx&E?HV=bI5PA>Ij(@qp;!CB;0!N-TWR;T`Bams5dft*0Oh+C-W5o8A zUDbb{D1CvM8>fVGWD(4X(*7j)+4B}uGcq%SQV9K)DD_#$#QdKMWjDZ#P-Y$gNRmiY zDuR()_BWX(n28`3*~m^vsLB~xy|xI9Uf4+^&x-}0)5Uwtaz->7SPLnNyrcy{VlE;` zQr}JV0A`Z#IE^49lzRZWT&f%%KGeMNV`)vJ>~{b%lKUjjOK|<;$%>PV#(vI<1?8%L zlAMv)&jq9LsyP9bPvkx??~_*z^d?+jfQGn5=PDqoS_8G;l#^+X<@ zQ&idtbaSo3SfcjVyy1B!V>iRAd)Klx!WX$}bgYpxog}A`=f$j08m<1QVwMOalF0KM z1FV8@GGmxTpk;w(){4iU${ITOS2`{QuEW*zx~| zVK_N`^#AwKuCB&^@qYc16Q0;u&iHWIaDK83kDd-^*c!)Ja7`#z zC6M49G9(J!+6vEB=M9m|CFOb!qdzJCPioYG`D zpr0zrl_osKHcd?vZ4q=X7vkA-xG3Y9p#+toVHF1Tx-vJXAzfo*|JEK2DhPkx7%4-p zKRaf*KJzD+;-ewdtn|wm%#hj-7p|{I8-8YVb=~VN2262}4}FUMaofK5uZ+ZfDH!@Q z$`i^LetA}zWP&6a<$DSR`|5wEhm%hHcXIL=|J_f!q&$h>nUnH6!SEL+W3O2lG%0Cd zGDIQi|Jk}-aQUR968iow2%6D@)h?*#d$wUI4>E80qGJYx^X(8;tH}*L}OPz4o8^b&bTYx^Gw*+++V|$0wco|KZ{B(b=Q@-$yIe(#rRDlJ{8i zrue^`#kMXZCSHX{&d6#e#HCfc2)??~lkb-$D2L|rmn9YJ!kry=btV-76ER`tx$M?N zU6#l<;XF$*z6AV2l|~-hT-X*4>xqVVMQ03ySwWemJSZfM8p8mEWD%rV=PDYHr4Ty0 zx`Lmoh{zS{f@bX#uCM>rGsR#F*Vki`)A90nZ1GUz=EQcDGq5u%hgG!jMrjx{Crn{uhQtN6RXC7SMwiG@sn)QT6jcP1!?4kvAS0^?Ce6NrYs#8n z0;P#A6g+(jhhgY#2;l|QWkuALf_E@K7FkA&4lmYge1E~jj4+cn%D_UfF=>~-b|fe( z%r-Jz??V?{NSvaSLaMUPxC>9yaVIow+PfXgMw$CInEp~wme|cD=E7*`4rCST>72y6 zt<}>7)ziwjrUuOPTPyki)!sG7l4eq=F7@v)6H5fa5|oYsbNk%XXO$u|N}7Q$=P=e; zeygqe{71?48@rH$t1F`sCh^(AeG{^bu5D^`aIZ#x`ps?r850~~0L!;?aX~vOOX3)F zJvHieiL3gyVBO|In!saz8jadAs?NaCj+O4Vso?O6zrOqXZ~q;^$Phi+B6>q?Yy@&Q+1FrzD&RuHoKS{|XLEN+_yXZ4 zsxgD;DQuy$KFxcr?KjkMI@DP06uaH^bsZ(ZT#5`NWLH<({-(`tWa)fPm%z~&oHM96=-40^F}U;Y9Utx z!lAYx(uB$g{_3}SVenbpf|Vuil>s100>O>rrDr0`Or(|?C-o!JwgJfnmKJNDfSp%C=IwhC=<)Dr>cu-!w4K4$* z`kt{<{pqPH?YU-}jBZvV`iDUoF3!PHV7%3b^7S>?UMFe?3`48MZe_vrw6mi0TXrnq zyO(WQv7WrGhUKo)Re5nrT(!HT+P$&W@P>^;KNb>$%bz;|l1bb!f?T3Pt~;UH+?*{& zeLDWNqgd_1suzbO{Zmq(7@7k7Fn@QhVKHKs4t7glhZhb*-{9gk0o>anH$aDNZS$i%vqE)9G@HShfmf9|Ld6yk@>> zflfD6b7#tVvXODNu<|=#1Bpr$GDc;RQFoo53|;XR81jWq;ja)5T=PHS{{}`OZ@yc# zGH^1#>-rY%8w&OuW04?qr8=x6sE9+ME%?EB%}$RKw|!GXda8Fu3zq1-HM|u!*L$bi z?Uj{cH&I{v-Udp3crZlYJMMmf)-M~U59}?e572jaMhsH)?$n(c-kEF!SyuCg@33AJ zR!&kf*RlWq*% z-J*8~V%r3TUoeio9ajNzk=(-k>#Ljtm4Y9`=)?Jcy?Q@=|K>k`ef@L;n4@qF&2_`& z67s_Q89Ohj#xhOPanGCjE=6wwuDoso>geE>sp-D_@1vOA`2~P|-~Swk-S>YEPtG2{ z|GAge4AW;s$LYAv0{=tI9`iNo3B$(MKaQMgrZa#0)-|rPLVp))+CHPtM;2TtP2*&Y z=w}7fG-jemBI^y-4tgnAk>T$qgHdgwGSl~#=rpQ#?n@?WRxL$^i$r6J`fVw&*SNIh zh4pqj7`}!APAb-Pr&CVD-O; zIwN)-5vui;>FZX7r`OlL;lB~e3W;0Kn6=Z}6u{kFdGFz5w(A}%o#FaC*>bRKKP1+) z^n!-g8Pb{3ISF=x>OBay>G4Aw;sdpP{=ZJ5?(ky(``-UQ+VuZN;mM=_zmL{?|5M*) z^!WeAjYQ}6;^EE#|M2mX?_0Kg_Fw&!gKyuzyqy!+XaC1X-S59AN5_xf|J+M!+J7Z$ zS8@~PPqq#Rs~`BW-@5cT2AL+QUxDy8Zc2YdpHanZMZSFav=Vh?=(9-$- zZJ+(CVpjhm)OX7N!qcOpuKiEK$NcYJ+5r0}EKf=01uh!;u*C`dv24HoeWC`U6(fRj z(CuQsY>+b9*G>eO6gqt8IhN$ f?GFz83pk(0_ShcVgSP(<009600ms$J08{_~x}mSP literal 0 HcmV?d00001 diff --git a/developer-hub/developer-hub-application/Chart.yaml b/developer-hub/developer-hub-application/Chart.yaml new file mode 100644 index 0000000..259b6c1 --- /dev/null +++ b/developer-hub/developer-hub-application/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: developer-hub-application +description: ArgoCD Application for Developer Hub config from GitLab +type: application +version: 0.1.0 diff --git a/developer-hub/developer-hub-application/templates/_helpers.tpl b/developer-hub/developer-hub-application/templates/_helpers.tpl new file mode 100644 index 0000000..159a16e --- /dev/null +++ b/developer-hub/developer-hub-application/templates/_helpers.tpl @@ -0,0 +1,60 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "developer-hub-application.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "developer-hub-application.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "developer-hub-application.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "developer-hub-application.labels" -}} +helm.sh/chart: {{ include "developer-hub-application.chart" . }} +{{ include "developer-hub-application.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "developer-hub-application.selectorLabels" -}} +app.kubernetes.io/name: {{ include "developer-hub-application.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +The namespace to deploy to +*/}} +{{- define "developer-hub-application.namespace" -}} +{{- if .Values.namespace }} +{{- .Values.namespace }} +{{- else }} +{{- .Release.Namespace }} +{{- end }} +{{- end }} diff --git a/developer-hub/developer-hub-application/templates/dh-application.yaml b/developer-hub/developer-hub-application/templates/dh-application.yaml new file mode 100644 index 0000000..be6d213 --- /dev/null +++ b/developer-hub/developer-hub-application/templates/dh-application.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ include "developer-hub-application.name" . }} + namespace: {{ .Values.gitops.namespace }} + finalizers: + - resources-finalizer.argocd.argoproj.io/foreground +spec: + destination: + name: "" + namespace: {{ include "developer-hub-application.namespace" . }} + server: 'https://kubernetes.default.svc' + project: default + syncPolicy: + automated: + prune: true + selfHeal: true + retry: + backoff: + duration: 10s + factor: 2 + maxDuration: 10m + limit: 15 + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + - ApplyOutOfSyncOnly=true + source: + repoURL: 'https://{{ .Values.git.host }}/{{ .Values.git.group }}/{{ .Values.git.repo }}.git' + targetRevision: {{ .Values.git.revision }} + path: . + directory: + recurse: false diff --git a/developer-hub/developer-hub-application/values.yaml b/developer-hub/developer-hub-application/values.yaml new file mode 100644 index 0000000..7044e8f --- /dev/null +++ b/developer-hub/developer-hub-application/values.yaml @@ -0,0 +1,12 @@ +nameOverride: "backstage" + +namespace: rhdh + +gitops: + namespace: openshift-gitops + +git: + host: + group: rhdh + repo: dh-config + revision: main diff --git a/developer-hub/developer-hub-prereqs/Chart.yaml b/developer-hub/developer-hub-prereqs/Chart.yaml new file mode 100644 index 0000000..7ca39f3 --- /dev/null +++ b/developer-hub/developer-hub-prereqs/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: developer-hub-prereqs +description: Prerequisites for Developer Hub via the RHDH Operator +type: application +version: 0.1.0 diff --git a/developer-hub/templates/_helpers.tpl b/developer-hub/developer-hub-prereqs/templates/_helpers.tpl similarity index 72% rename from developer-hub/templates/_helpers.tpl rename to developer-hub/developer-hub-prereqs/templates/_helpers.tpl index 4b3f4b6..072d815 100644 --- a/developer-hub/templates/_helpers.tpl +++ b/developer-hub/developer-hub-prereqs/templates/_helpers.tpl @@ -1,14 +1,14 @@ {{/* Expand the name of the chart. */}} -{{- define "developer-hub.name" -}} +{{- define "developer-hub-prereqs.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} {{- end }} {{/* Create a default fully qualified app name. */}} -{{- define "developer-hub.fullname" -}} +{{- define "developer-hub-prereqs.fullname" -}} {{- if .Values.fullnameOverride }} {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} {{- else }} @@ -24,16 +24,16 @@ Create a default fully qualified app name. {{/* Create chart name and version as used by the chart label. */}} -{{- define "developer-hub.chart" -}} +{{- define "developer-hub-prereqs.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} {{/* Common labels */}} -{{- define "developer-hub.labels" -}} -helm.sh/chart: {{ include "developer-hub.chart" . }} -{{ include "developer-hub.selectorLabels" . }} +{{- define "developer-hub-prereqs.labels" -}} +helm.sh/chart: {{ include "developer-hub-prereqs.chart" . }} +{{ include "developer-hub-prereqs.selectorLabels" . }} {{- if .Chart.AppVersion }} app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} {{- end }} @@ -43,15 +43,15 @@ app.kubernetes.io/managed-by: {{ .Release.Service }} {{/* Selector labels */}} -{{- define "developer-hub.selectorLabels" -}} -app.kubernetes.io/name: {{ include "developer-hub.name" . }} +{{- define "developer-hub-prereqs.selectorLabels" -}} +app.kubernetes.io/name: {{ include "developer-hub-prereqs.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} {{/* ArgoCD Syncwave */}} -{{- define "developer-hub.argocd-syncwave" -}} +{{- define "developer-hub-prereqs.argocd-syncwave" -}} {{- if .Values.argocd }} {{- if and (.Values.argocd.syncwave) (.Values.argocd.enabled) -}} argocd.argoproj.io/sync-wave: "{{ .Values.argocd.syncwave }}" diff --git a/developer-hub/templates/cluster-role-binding-default-sa-admin.yaml b/developer-hub/developer-hub-prereqs/templates/cluster-role-binding-default-sa-admin.yaml similarity index 81% rename from developer-hub/templates/cluster-role-binding-default-sa-admin.yaml rename to developer-hub/developer-hub-prereqs/templates/cluster-role-binding-default-sa-admin.yaml index 368c0b6..10d2235 100644 --- a/developer-hub/templates/cluster-role-binding-default-sa-admin.yaml +++ b/developer-hub/developer-hub-prereqs/templates/cluster-role-binding-default-sa-admin.yaml @@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cluster-admin-default-{{ .Release.Namespace }} annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} + {{- include "developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} subjects: - kind: ServiceAccount namespace: {{ .Release.Namespace }} diff --git a/developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml b/developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml new file mode 100644 index 0000000..f7aeaad --- /dev/null +++ b/developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml @@ -0,0 +1,105 @@ +kind: ConfigMap +metadata: + name: dh-config-template + annotations: + {{- include "developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} +apiVersion: v1 +data: + playbook.yaml: | + --- + - name: DH Config templates + hosts: localhost + tasks: + - name: Check existence of group + ansible.builtin.uri: + url: https://root:{{ $.Values.gitlab.rootPassword }}@{{ $.Values.gitlab.host }}/api/v4/groups/{{ $.Values.configTemplate.group }} + method: GET + validate_certs: false + register: r_liveness + retries: 120 + delay: 10 + until: r_liveness.status == 200 + + - name: Git config email + ansible.builtin.command: git config --global user.email "{{ $.Values.gitlab.email.address }}" + ignore_errors: true + + - name: Git config name + ansible.builtin.command: git config --global user.name "{{ $.Values.gitlab.email.displayName }}" + ignore_errors: true + + - name: Build git repo url + ansible.builtin.set_fact: + _git_template_repo_url: https://root:{{ $.Values.gitlab.rootPassword }}@{{ $.Values.gitlab.host }}/{{ $.Values.configTemplate.group }}/{{ $.Values.configTemplate.repo }} + + - name: Remove older repo folders + shell: rm -rf /tmp/{{ $.Values.configTemplate.repo }} + + - name: Check existence of git repo + ansible.builtin.uri: + url: '{{ "{{" }} _git_template_repo_url {{ "}}" }}' + method: GET + validate_certs: false + register: r_liveness + retries: 60 + delay: 10 + until: r_liveness.status == 200 + + - name: Clone {{ $.Values.configTemplate.repo }} + ansible.builtin.git: + accept_hostkey: true + force: true + repo: '{{ "{{" }} _git_template_repo_url {{ "}}" }}' + dest: "/tmp/{{ $.Values.configTemplate.repo }}" + version: "{{ $.Values.configTemplate.branch }}" + environment: + GIT_SSL_NO_VERIFY: "true" + register: r_git_clone + retries: 60 + delay: 10 + until: r_git_clone is not failed + +{{- range $item := .Values.configTemplate.templates }} + + - name: Fetch /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} template from remote host + run_once: true + ansible.builtin.fetch: + src: /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} + dest: /tmp/{{ $item }} + flat: true + fail_on_missing: true + + - name: Apply template /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} + ansible.builtin.template: + src: /tmp/{{ $item }} + dest: /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} + mode: "0660" + vars: + cluster_subdomain: "{{ $.Values.cluster.subdomain }}" + backstage_host: "{{ $.Values.backstage.host }}" + gitlab_host: "{{ $.Values.gitlab.host }}" + argocd_host: "{{ $.Values.gitops.host }}" + kubernetes_api_url: "{{ $.Values.kubernetes.api }}" +{{- end }} + + - name: Add new files to the repository + ansible.builtin.command: + chdir: >- + /tmp/{{ $.Values.configTemplate.repo }} + cmd: "git add ." + ignore_errors: true + + - name: Commit changes to the repository + ansible.builtin.command: + chdir: >- + /tmp/{{ $.Values.configTemplate.repo }} + cmd: >- + git commit -a -m 'dh-config init: render env-specific values.' + ignore_errors: true + + - name: Push all changes back to the project repository + ansible.builtin.command: + chdir: >- + /tmp/{{ $.Values.configTemplate.repo }} + cmd: >- + git push {{ "{{" }} _git_template_repo_url {{ "}}" }} diff --git a/developer-hub/templates/cm-sa-token-writer.yaml b/developer-hub/developer-hub-prereqs/templates/cm-sa-token-writer.yaml similarity index 97% rename from developer-hub/templates/cm-sa-token-writer.yaml rename to developer-hub/developer-hub-prereqs/templates/cm-sa-token-writer.yaml index 1be02a2..d55fafa 100644 --- a/developer-hub/templates/cm-sa-token-writer.yaml +++ b/developer-hub/developer-hub-prereqs/templates/cm-sa-token-writer.yaml @@ -3,7 +3,7 @@ kind: ConfigMap metadata: name: sa-token-writer labels: - {{- include "developer-hub.labels" . | nindent 4 }} + {{- include "developer-hub-prereqs.labels" . | nindent 4 }} annotations: argocd.argoproj.io/sync-wave: "1" data: diff --git a/developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml b/developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml new file mode 100644 index 0000000..54e715f --- /dev/null +++ b/developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml @@ -0,0 +1,29 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: dh-config-template + annotations: + {{- include "developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation +spec: + backoffLimit: 100 + template: + spec: + containers: + - name: dh-config-template + command: + - /bin/bash + - '-c' + - | + set -x + ansible-playbook -i localhost /scripts/playbook.yaml + image: quay.io/agnosticd/ee-multicloud:latest + volumeMounts: + - mountPath: /scripts + name: dh-config-vol + restartPolicy: Never + volumes: + - name: dh-config-vol + configMap: + name: dh-config-template diff --git a/developer-hub/templates/job-sa-token.yaml b/developer-hub/developer-hub-prereqs/templates/job-sa-token.yaml similarity index 91% rename from developer-hub/templates/job-sa-token.yaml rename to developer-hub/developer-hub-prereqs/templates/job-sa-token.yaml index 337b3ca..ddea2c0 100644 --- a/developer-hub/templates/job-sa-token.yaml +++ b/developer-hub/developer-hub-prereqs/templates/job-sa-token.yaml @@ -3,7 +3,7 @@ kind: Job metadata: name: sa-token-writer labels: - {{- include "developer-hub.labels" . | nindent 4 }} + {{- include "developer-hub-prereqs.labels" . | nindent 4 }} annotations: argocd.argoproj.io/sync-wave: "1" argocd.argoproj.io/hook: Sync diff --git a/developer-hub/templates/namespace.yaml b/developer-hub/developer-hub-prereqs/templates/namespace.yaml similarity index 68% rename from developer-hub/templates/namespace.yaml rename to developer-hub/developer-hub-prereqs/templates/namespace.yaml index 441fb9a..b822529 100644 --- a/developer-hub/templates/namespace.yaml +++ b/developer-hub/developer-hub-prereqs/templates/namespace.yaml @@ -3,6 +3,6 @@ kind: Namespace metadata: name: {{ .Values.namespace }} labels: - {{- include "developer-hub.labels" . | nindent 4 }} + {{- include "developer-hub-prereqs.labels" . | nindent 4 }} annotations: argocd.argoproj.io/sync-wave: "-2" diff --git a/developer-hub/templates/operator-group.yaml b/developer-hub/developer-hub-prereqs/templates/operator-group.yaml similarity index 77% rename from developer-hub/templates/operator-group.yaml rename to developer-hub/developer-hub-prereqs/templates/operator-group.yaml index 313f256..829b227 100644 --- a/developer-hub/templates/operator-group.yaml +++ b/developer-hub/developer-hub-prereqs/templates/operator-group.yaml @@ -4,7 +4,7 @@ metadata: name: rhdh-operator namespace: {{ .Values.namespace }} labels: - {{- include "developer-hub.labels" . | nindent 4 }} + {{- include "developer-hub-prereqs.labels" . | nindent 4 }} annotations: argocd.argoproj.io/sync-wave: "-2" spec: diff --git a/developer-hub/templates/subscription.yaml b/developer-hub/developer-hub-prereqs/templates/subscription.yaml similarity index 84% rename from developer-hub/templates/subscription.yaml rename to developer-hub/developer-hub-prereqs/templates/subscription.yaml index 047f1ce..0c2ee7c 100644 --- a/developer-hub/templates/subscription.yaml +++ b/developer-hub/developer-hub-prereqs/templates/subscription.yaml @@ -4,7 +4,7 @@ metadata: name: rhdh namespace: {{ .Values.namespace }} labels: - {{- include "developer-hub.labels" . | nindent 4 }} + {{- include "developer-hub-prereqs.labels" . | nindent 4 }} annotations: argocd.argoproj.io/sync-wave: "-2" spec: diff --git a/developer-hub/developer-hub-prereqs/values.yaml b/developer-hub/developer-hub-prereqs/values.yaml new file mode 100644 index 0000000..cd84994 --- /dev/null +++ b/developer-hub/developer-hub-prereqs/values.yaml @@ -0,0 +1,49 @@ +nameOverride: "backstage" + +namespace: rhdh + +vault: + namespace: vault + name: vault + +operator: + channel: fast-1.8 + +gitlab: + rootPassword: + host: + email: + address: "gitlab@rhdemo.com" + displayName: "Gitlab" + +configTemplate: + group: rhdh + repo: dh-config + branch: main + templates: + - backstage-cr.yaml + - configmap-app-config.yaml + - configmap-dynamic-plugins.yaml + - configmap-rbac-policy.yaml + - es-argocd-password.yaml + - es-gitlab-token.yaml + - es-kubernetes-sa-token.yaml + - es-oauth-client.yaml + - es-orchestrator-token.yaml + - secret-backstage-npmrc.yaml + +backstage: + host: + +gitops: + host: + +kubernetes: + api: + +cluster: + subdomain: + +argocd: + enabled: true + syncwave: "-1" diff --git a/developer-hub/templates/backstage-cr.yaml b/developer-hub/templates/backstage-cr.yaml deleted file mode 100644 index 4fe8363..0000000 --- a/developer-hub/templates/backstage-cr.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: rhdh.redhat.com/v1alpha3 -kind: Backstage -metadata: - name: {{ .Values.backstage.name }} - namespace: {{ .Values.namespace }} - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - application: - appConfig: - mountPath: /opt/app-root/src - {{- with .Values.backstage.appConfig.configMaps }} - configMaps: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.backstage.dynamicPluginsConfigMapName }} - dynamicPluginsConfigMapName: {{ . }} - {{- end }} - extraEnvs: - {{- with .Values.backstage.extraEnvs.secrets }} - secrets: - {{- toYaml . | nindent 8 }} - {{- end }} - extraFiles: - mountPath: /opt/app-root/src - replicas: {{ .Values.backstage.replicas }} - route: - enabled: {{ .Values.backstage.route.enabled }} - database: - enableLocalDb: true diff --git a/developer-hub/templates/configmap-app-config.yaml b/developer-hub/templates/configmap-app-config.yaml deleted file mode 100644 index cb098dc..0000000 --- a/developer-hub/templates/configmap-app-config.yaml +++ /dev/null @@ -1,64 +0,0 @@ -kind: ConfigMap -apiVersion: v1 -metadata: - name: app-config-rhdh - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -data: - app-config-rhdh.yaml: | - app: - title: {{ .Values.appConfig.app.title }} - baseUrl: https://{{ .Values.appConfig.app.baseUrl }} - - auth: - providers: - guest: - dangerouslyAllowOutsideDevelopment: true - - backend: - baseUrl: https://{{ .Values.appConfig.app.baseUrl }} - listen: - port: 7007 - host: 0.0.0.0 - - integrations: - gitlab: - - apiBaseUrl: https://{{ .Values.appConfig.gitlab.host }}/api/v4 - baseUrl: https://{{ .Values.appConfig.gitlab.host }} - host: {{ .Values.appConfig.gitlab.host }} - token: ${GITLAB_TOKEN} - - catalog: - rules: - - allow: [Component, System, API, Resource, Location, Template, Domain] - locations: [] - - argocd: - appLocatorMethods: - - type: config - instances: - - name: main - url: https://{{ .Values.appConfig.argocd.host }} - username: admin - password: ${ARGOCD_PASSWORD} - - kubernetes: - serviceLocatorMethod: - type: multiTenant - clusterLocatorMethods: - - clusters: - - name: dev-cluster - url: {{ .Values.appConfig.kubernetes.apiUrl }} - authProvider: serviceAccount - skipTLSVerify: true - serviceAccountToken: ${KUBERNETES_SA_TOKEN} - type: config - customResources: - - group: tekton.dev - apiVersion: v1beta1 - plural: pipelineruns - - group: tekton.dev - apiVersion: v1beta1 - plural: taskruns diff --git a/developer-hub/templates/configmap-dynamic-plugins.yaml b/developer-hub/templates/configmap-dynamic-plugins.yaml deleted file mode 100644 index 569a29f..0000000 --- a/developer-hub/templates/configmap-dynamic-plugins.yaml +++ /dev/null @@ -1,24 +0,0 @@ -kind: ConfigMap -apiVersion: v1 -metadata: - name: dynamic-plugins - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -data: - dynamic-plugins.yaml: | - includes: - - dynamic-plugins.default.yaml - plugins: - {{- range $plugin := .Values.dynamicPlugins }} - - package: {{ $plugin.package }} - disabled: {{ $plugin.disabled | default false }} - {{- with $plugin.pluginConfig }} - pluginConfig: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with $plugin.integrity }} - integrity: {{ . }} - {{- end }} - {{- end }} diff --git a/developer-hub/templates/configmap-rbac-policy.yaml b/developer-hub/templates/configmap-rbac-policy.yaml deleted file mode 100644 index b1fa77f..0000000 --- a/developer-hub/templates/configmap-rbac-policy.yaml +++ /dev/null @@ -1,18 +0,0 @@ -kind: ConfigMap -apiVersion: v1 -metadata: - name: rbac-policy - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -data: - rbac-policy.csv: | - {{- range $item := .Values.rbacPolicy }} - {{ $item }} - {{- end }} - rbac-conditional-policies.yaml: | - {{- range $item := .Values.rbacConditionalPolicies }} - --- - {{- toYaml $item | nindent 4 }} - {{- end }} diff --git a/developer-hub/templates/es-argocd-password.yaml b/developer-hub/templates/es-argocd-password.yaml deleted file mode 100644 index 3e3644a..0000000 --- a/developer-hub/templates/es-argocd-password.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-password - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -spec: - refreshInterval: 5m - secretStoreRef: - name: vault-secret-store - kind: ClusterSecretStore - target: - name: argocd-password - creationPolicy: Owner - data: - - secretKey: ARGOCD_PASSWORD - remoteRef: - key: secrets/rhdh/argocd-password - property: value diff --git a/developer-hub/templates/es-gitlab-token.yaml b/developer-hub/templates/es-gitlab-token.yaml deleted file mode 100644 index bf927cb..0000000 --- a/developer-hub/templates/es-gitlab-token.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: gitlab-token - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -spec: - refreshInterval: 5m - secretStoreRef: - name: vault-secret-store - kind: ClusterSecretStore - target: - name: gitlab-token - creationPolicy: Owner - data: - - secretKey: GITLAB_TOKEN - remoteRef: - key: secrets/gitlab/token - property: value diff --git a/developer-hub/templates/es-kubernetes-sa-token.yaml b/developer-hub/templates/es-kubernetes-sa-token.yaml deleted file mode 100644 index a197825..0000000 --- a/developer-hub/templates/es-kubernetes-sa-token.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: kubernetes-sa-token - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - argocd.argoproj.io/sync-wave: "2" -spec: - refreshInterval: 5m - secretStoreRef: - name: vault-secret-store - kind: ClusterSecretStore - target: - name: kubernetes-sa-token - creationPolicy: Owner - data: - - secretKey: KUBERNETES_SA_TOKEN - remoteRef: - key: secrets/rhdh/kubernetes-sa-token - property: value diff --git a/developer-hub/templates/es-oauth-client.yaml b/developer-hub/templates/es-oauth-client.yaml deleted file mode 100644 index 8725feb..0000000 --- a/developer-hub/templates/es-oauth-client.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: oauth-client - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -spec: - refreshInterval: 5m - secretStoreRef: - name: vault-secret-store - kind: ClusterSecretStore - target: - name: oauth-client - creationPolicy: Owner - data: - - secretKey: OAUTH_CLIENT_ID - remoteRef: - key: secrets/keycloak/client-secret - property: clientId - - secretKey: OAUTH_CLIENT_SECRET - remoteRef: - key: secrets/keycloak/client-secret - property: clientSecret diff --git a/developer-hub/templates/es-orchestrator-token.yaml b/developer-hub/templates/es-orchestrator-token.yaml deleted file mode 100644 index 0d2d816..0000000 --- a/developer-hub/templates/es-orchestrator-token.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: backstage-orchestrator-token - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -spec: - refreshInterval: 5m - secretStoreRef: - name: vault-secret-store - kind: ClusterSecretStore - target: - name: backstage-orchestrator-token - creationPolicy: Owner - data: - - secretKey: ORCHESTRATOR_TOKEN - remoteRef: - key: secrets/rhdh/orchestrator-token - property: value diff --git a/developer-hub/templates/secret-backstage-npmrc.yaml b/developer-hub/templates/secret-backstage-npmrc.yaml deleted file mode 100644 index ff03f02..0000000 --- a/developer-hub/templates/secret-backstage-npmrc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: Secret -apiVersion: v1 -metadata: - name: backstage-dynamic-plugins-npmrc - labels: - {{- include "developer-hub.labels" . | nindent 4 }} - annotations: - {{- include "developer-hub.argocd-syncwave" . | nindent 4 }} -stringData: - .npmrc: '@redhat:registry=https://npm.registry.redhat.com' -type: Opaque diff --git a/developer-hub/values.yaml b/developer-hub/values.yaml index bdc02a0..8b13789 100644 --- a/developer-hub/values.yaml +++ b/developer-hub/values.yaml @@ -1,142 +1 @@ -nameOverride: "backstage" -namespace: rhdh - -vault: - namespace: vault - name: vault - -operator: - channel: fast-1.8 - -backstage: - name: developer-hub - replicas: 1 - route: - enabled: true - appConfig: - configMaps: - - name: app-config-rhdh - dynamicPluginsConfigMapName: dynamic-plugins - extraEnvs: - secrets: - - name: gitlab-token - - name: argocd-password - - name: kubernetes-sa-token - - name: oauth-client - - name: backstage-orchestrator-token - -appConfig: - app: - title: Red Hat Developer Hub - baseUrl: "" - gitlab: - host: "" - argocd: - host: "" - kubernetes: - apiUrl: "" - -dynamicPlugins: - - package: ./dynamic-plugins/dist/backstage-plugin-scaffolder-backend-module-gitlab-dynamic - disabled: false - - package: ./dynamic-plugins/dist/roadiehq-scaffolder-backend-argocd-dynamic - disabled: false - - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes-backend-dynamic - disabled: false - - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes - disabled: false - - package: ./dynamic-plugins/dist/backstage-community-plugin-topology - disabled: false - - package: ./dynamic-plugins/dist/backstage-community-plugin-tekton - disabled: false - - package: ./dynamic-plugins/dist/backstage-community-plugin-catalog-backend-module-keycloak-dynamic - disabled: false - - package: ./dynamic-plugins/dist/roadiehq-backstage-plugin-argo-cd-backend-dynamic - disabled: false - - package: ./dynamic-plugins/dist/backstage-community-plugin-redhat-argocd - disabled: false - -rbacPolicy: - - "p, role:default/location_read, catalog.entity.read, read, allow" - - "p, role:default/location_read, catalog.location.read, read, allow" - - - "p, role:default/location_read_developer, catalog.entity.read, read, allow" - - "p, role:default/location_read_developer, catalog.location.read, read, allow" - - - "p, role:default/platformengineer, catalog.entity.create, create, allow" - - "p, role:default/platformengineer, catalog.entity.refresh, update, allow" - - "p, role:default/platformengineer, catalog.entity.delete, delete, allow" - - "p, role:default/platformengineer, catalog.location.create, create, allow" - - "p, role:default/platformengineer, catalog.location.delete, delete, allow" - - - "p, role:default/scaffolder_execute, scaffolder.action.execute, use, allow" - - "p, role:default/scaffolder_execute, scaffolder.template.parameter.read, read, allow" - - "p, role:default/scaffolder_execute, scaffolder.template.step.read, read, allow" - - "p, role:default/scaffolder_execute, scaffolder.task.create, create, allow" - - "p, role:default/scaffolder_execute, scaffolder.task.cancel, use, allow" - - "p, role:default/scaffolder_execute, scaffolder.task.read, read, allow" - - "p, role:default/scaffolder_execute, catalog.location.create, create, allow" - - - "p, role:default/plugins, topology.view.read, read, allow" - - "p, role:default/plugins, tekton.view.read, read, allow" - - "p, role:default/plugins, argocd.view.read, read, allow" - - "p, role:default/plugins, kubernetes.proxy, use, allow" - - "p, role:default/plugins, kubernetes.clusters.read, read, allow" - - "p, role:default/plugins, kubernetes.resources.read, read, allow" - - "p, role:default/plugins, adoption-insights.events.read, read, allow" - - - "p, role:default/workflowUser, orchestrator.workflow.create-ocp-namespace-swt, read, allow" - - "p, role:default/workflowUser, orchestrator.workflow.use.create-ocp-namespace-swt, update, allow" - - "p, role:default/workflowUser, orchestrator.instanceAdminView, read, allow" - - - "p, role:default/workflowAdmin, orchestrator.workflow, read, allow" - - "p, role:default/workflowAdmin, orchestrator.workflow.use, update, allow" - - "p, role:default/workflowAdmin, orchestrator.workflowAdminView, read, allow" - - "p, role:default/workflowAdmin, orchestrator.instanceAdminView, read, allow" - - - "g, group:default/platformengineers, role:default/location_read" - - "g, group:default/platformengineers, role:default/platformengineer" - - "g, group:default/platformengineers, role:default/scaffolder_execute" - - "g, group:default/platformengineers, role:default/plugins" - - - "g, group:default/developers, role:default/location_read_developer" - - "g, group:default/developers, role:default/developer" - - "g, group:default/developers, role:default/scaffolder_execute" - - "g, group:default/developers, role:default/plugins" - - - "g, group:default/developers, role:default/workflowUser" - - "g, group:default/platformengineers, role:default/workflowAdmin" - -rbacConditionalPolicies: - - result: CONDITIONAL - roleEntityRef: 'role:default/location_read_developer' - resourceType: catalog-entity - pluginId: catalog - permissionMapping: - - read - conditions: - not: - rule: HAS_ANNOTATION - resourceType: catalog-entity - params: - annotation: backstage.io/managed-by - value: orchestrator - - - conditions: - params: - claims: - - $ownerRefs - resourceType: catalog-entity - rule: IS_ENTITY_OWNER - permissionMapping: - - delete - - update - pluginId: catalog - resourceType: catalog-entity - result: CONDITIONAL - roleEntityRef: role:default/developer - -argocd: - enabled: true - syncwave: "-1" diff --git a/gitlab/values.yaml b/gitlab/values.yaml index e72a393..d465e2e 100644 --- a/gitlab/values.yaml +++ b/gitlab/values.yaml @@ -43,6 +43,8 @@ gitlab: defaultBranch: dev - name: developer-hub-config url: https://github.com/redhat-pe-workshop/developer-hub-config.git + - name: dh-config + url: https://github.com/redhat-ads-tech/rhdh-config.git - name: import-existing-app-template url: https://github.com/redhat-pe-workshop/import-existing-app-template.git defaultBranch: dev From 5038fe0ff5b015f969e57d59e3746e282d880b71 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 21:25:24 -0800 Subject: [PATCH 46/49] chore: separate the prereqs and main rhdh crs --- app-of-apps/templates/developer-hub.yaml | 58 +++++++++++------- developer-hub/Chart.lock | 9 --- developer-hub/Chart.yaml | 8 --- .../developer-hub-application-0.1.0.tgz | Bin 1219 -> 0 bytes .../charts/developer-hub-prereqs-0.1.0.tgz | Bin 3349 -> 0 bytes 5 files changed, 36 insertions(+), 39 deletions(-) delete mode 100644 developer-hub/Chart.lock delete mode 100644 developer-hub/charts/developer-hub-application-0.1.0.tgz delete mode 100644 developer-hub/charts/developer-hub-prereqs-0.1.0.tgz diff --git a/app-of-apps/templates/developer-hub.yaml b/app-of-apps/templates/developer-hub.yaml index 97e90d8..93ec397 100644 --- a/app-of-apps/templates/developer-hub.yaml +++ b/app-of-apps/templates/developer-hub.yaml @@ -1,35 +1,49 @@ apiVersion: argoproj.io/v1alpha1 kind: Application -{{ include "app-of-apps.metadata" (dict "name" .Values.developerHub.name "namespace" .Values.argocd.namespace "syncWave" "2") }} +{{ include "app-of-apps.metadata" (dict "name" (printf "%s-prereqs" .Values.developerHub.name) "namespace" .Values.argocd.namespace "syncWave" "2") }} spec: destination: namespace: {{ .Values.developerHub.namespace }} server: https://kubernetes.default.svc project: default source: - path: developer-hub + path: developer-hub/developer-hub-prereqs repoURL: {{ .Values.gitops.repoURL }} targetRevision: {{ .Values.gitops.targetRevision }} helm: valuesObject: - developer-hub-prereqs: - vault: - namespace: {{ .Values.vault.namespace }} - name: {{ .Values.vault.name }} - gitlab: - rootPassword: {{ .Values.developerHub.configTemplate.gitlab.rootPassword | quote }} - host: {{ .Values.developerHub.configTemplate.gitlab.host }} - backstage: - host: {{ .Values.developerHub.configTemplate.backstage.host }} - gitops: - host: {{ .Values.developerHub.configTemplate.gitops.host }} - kubernetes: - api: {{ .Values.developerHub.configTemplate.kubernetes.api }} - cluster: - subdomain: {{ .Values.developerHub.configTemplate.cluster.subdomain }} - developer-hub-application: - gitops: - namespace: {{ .Values.developerHub.application.gitops.namespace }} - git: - host: {{ .Values.developerHub.application.git.host }} + vault: + namespace: {{ .Values.vault.namespace }} + name: {{ .Values.vault.name }} + gitlab: + rootPassword: {{ .Values.developerHub.configTemplate.gitlab.rootPassword | quote }} + host: {{ .Values.developerHub.configTemplate.gitlab.host }} + backstage: + host: {{ .Values.developerHub.configTemplate.backstage.host }} + gitops: + host: {{ .Values.developerHub.configTemplate.gitops.host }} + kubernetes: + api: {{ .Values.developerHub.configTemplate.kubernetes.api }} + cluster: + subdomain: {{ .Values.developerHub.configTemplate.cluster.subdomain }} +{{ include "app-of-apps.syncPolicy" . | indent 2 }} +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +{{ include "app-of-apps.metadata" (dict "name" (printf "%s-application" .Values.developerHub.name) "namespace" .Values.argocd.namespace "syncWave" "3") }} +spec: + destination: + namespace: {{ .Values.developerHub.namespace }} + server: https://kubernetes.default.svc + project: default + source: + path: developer-hub/developer-hub-application + repoURL: {{ .Values.gitops.repoURL }} + targetRevision: {{ .Values.gitops.targetRevision }} + helm: + valuesObject: + gitops: + namespace: {{ .Values.developerHub.application.gitops.namespace }} + git: + host: {{ .Values.developerHub.application.git.host }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/developer-hub/Chart.lock b/developer-hub/Chart.lock deleted file mode 100644 index c7a59c7..0000000 --- a/developer-hub/Chart.lock +++ /dev/null @@ -1,9 +0,0 @@ -dependencies: -- name: developer-hub-prereqs - repository: file://developer-hub-prereqs - version: 0.1.0 -- name: developer-hub-application - repository: file://developer-hub-application - version: 0.1.0 -digest: sha256:e51b1d1ced5d76324880d24c42f16cd09f6f107f443d1ab5b0d659d035c5c4f9 -generated: "2026-02-25T15:14:06.275726-08:00" diff --git a/developer-hub/Chart.yaml b/developer-hub/Chart.yaml index 91009c3..fd86ce9 100644 --- a/developer-hub/Chart.yaml +++ b/developer-hub/Chart.yaml @@ -3,11 +3,3 @@ name: developer-hub description: Deploys Red Hat Developer Hub via the RHDH Operator type: application version: 0.1.0 - -dependencies: - - name: developer-hub-prereqs - version: 0.1.0 - repository: file://developer-hub-prereqs - - name: developer-hub-application - version: 0.1.0 - repository: file://developer-hub-application diff --git a/developer-hub/charts/developer-hub-application-0.1.0.tgz b/developer-hub/charts/developer-hub-application-0.1.0.tgz deleted file mode 100644 index 155328a30a585eae0c54a755817fee6a28262ee8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1219 zcmV;!1U&m6iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI*%Z`-yL&$B+oLHHL1`iEr6bsRuIABtvJ2NcVYY<(?g>11)G zNS36GXpX=8AX1Vg$3g65NHEOzB8uc4e|Nk)9+}|^nUJW0qFMw*N=8#+sNj=N1yLrf zNy*NhNl_F<^V!UPqbS<_M$_r}S$rPPE-s=tx|p9u@q9X)oA@;EIl0m2206^K|T3aAd{$cXylVp!6WhiKAz9V z@jtcGPx1c(v|dl%c|YAs!ZR=h+QsJ05Z%eNAMr?nXuvZA=u6* z6*CaJQu5bEbokXBE5p14cVJY-Q<%TEO8wTAg9WoMhs#v@XO->U^Gjs|r|#iTFm z*XunjckrVU26qf~UrI?hSz;C}YA2}kz8h34n(p#DL*KOEpJ3`;y@S1=+#TmIOS+^I z?$?fTZ3s_stlKbjM~eO4=4e}eff10QWTFNmj?L3n!rolBmA{kZ?hOo+#0dL%*1c$d z?NjeW9UW5tWyQ#Oj=m8-Qvb#07qgxEZyHDMPxaqR(D40-sHKof{Ap8nOqeW4?0u&^ zONMViUWtZe#E|YH_=Ge#xZoG_<>@Ap4jR0rzRCel_h0F7#eDuK6!F;XX!$spmk z)m^Ap>01w=0g9|Ma@L_;9fNN}a!~C-3Lg6LNb5zJv)ZmS+k8n(kw9qM8CABD=r=-P hS}BbQDc zVQyr3R8em|NM&qo0PH;dZ`(MQ{aJs-gE5QT?m@Dg&w+q0Hq*|ud)H};rq{*ca4=}; z*PnOWYr%k(_=&si@!)EDyZ|RV-<)?f-ABHWXA*jSA*M!t+X7;AJs`B_*I!gm*8W zzl1kAN}`4IILR=AUcK`4D#r*&o--N~vx&E?HV=bI5PA>Ij(@qp;!CB;0!N-TWR;T`Bams5dft*0Oh+C-W5o8A zUDbb{D1CvM8>fVGWD(4X(*7j)+4B}uGcq%SQV9K)DD_#$#QdKMWjDZ#P-Y$gNRmiY zDuR()_BWX(n28`3*~m^vsLB~xy|xI9Uf4+^&x-}0)5Uwtaz->7SPLnNyrcy{VlE;` zQr}JV0A`Z#IE^49lzRZWT&f%%KGeMNV`)vJ>~{b%lKUjjOK|<;$%>PV#(vI<1?8%L zlAMv)&jq9LsyP9bPvkx??~_*z^d?+jfQGn5=PDqoS_8G;l#^+X<@ zQ&idtbaSo3SfcjVyy1B!V>iRAd)Klx!WX$}bgYpxog}A`=f$j08m<1QVwMOalF0KM z1FV8@GGmxTpk;w(){4iU${ITOS2`{QuEW*zx~| zVK_N`^#AwKuCB&^@qYc16Q0;u&iHWIaDK83kDd-^*c!)Ja7`#z zC6M49G9(J!+6vEB=M9m|CFOb!qdzJCPioYG`D zpr0zrl_osKHcd?vZ4q=X7vkA-xG3Y9p#+toVHF1Tx-vJXAzfo*|JEK2DhPkx7%4-p zKRaf*KJzD+;-ewdtn|wm%#hj-7p|{I8-8YVb=~VN2262}4}FUMaofK5uZ+ZfDH!@Q z$`i^LetA}zWP&6a<$DSR`|5wEhm%hHcXIL=|J_f!q&$h>nUnH6!SEL+W3O2lG%0Cd zGDIQi|Jk}-aQUR968iow2%6D@)h?*#d$wUI4>E80qGJYx^X(8;tH}*L}OPz4o8^b&bTYx^Gw*+++V|$0wco|KZ{B(b=Q@-$yIe(#rRDlJ{8i zrue^`#kMXZCSHX{&d6#e#HCfc2)??~lkb-$D2L|rmn9YJ!kry=btV-76ER`tx$M?N zU6#l<;XF$*z6AV2l|~-hT-X*4>xqVVMQ03ySwWemJSZfM8p8mEWD%rV=PDYHr4Ty0 zx`Lmoh{zS{f@bX#uCM>rGsR#F*Vki`)A90nZ1GUz=EQcDGq5u%hgG!jMrjx{Crn{uhQtN6RXC7SMwiG@sn)QT6jcP1!?4kvAS0^?Ce6NrYs#8n z0;P#A6g+(jhhgY#2;l|QWkuALf_E@K7FkA&4lmYge1E~jj4+cn%D_UfF=>~-b|fe( z%r-Jz??V?{NSvaSLaMUPxC>9yaVIow+PfXgMw$CInEp~wme|cD=E7*`4rCST>72y6 zt<}>7)ziwjrUuOPTPyki)!sG7l4eq=F7@v)6H5fa5|oYsbNk%XXO$u|N}7Q$=P=e; zeygqe{71?48@rH$t1F`sCh^(AeG{^bu5D^`aIZ#x`ps?r850~~0L!;?aX~vOOX3)F zJvHieiL3gyVBO|In!saz8jadAs?NaCj+O4Vso?O6zrOqXZ~q;^$Phi+B6>q?Yy@&Q+1FrzD&RuHoKS{|XLEN+_yXZ4 zsxgD;DQuy$KFxcr?KjkMI@DP06uaH^bsZ(ZT#5`NWLH<({-(`tWa)fPm%z~&oHM96=-40^F}U;Y9Utx z!lAYx(uB$g{_3}SVenbpf|Vuil>s100>O>rrDr0`Or(|?C-o!JwgJfnmKJNDfSp%C=IwhC=<)Dr>cu-!w4K4$* z`kt{<{pqPH?YU-}jBZvV`iDUoF3!PHV7%3b^7S>?UMFe?3`48MZe_vrw6mi0TXrnq zyO(WQv7WrGhUKo)Re5nrT(!HT+P$&W@P>^;KNb>$%bz;|l1bb!f?T3Pt~;UH+?*{& zeLDWNqgd_1suzbO{Zmq(7@7k7Fn@QhVKHKs4t7glhZhb*-{9gk0o>anH$aDNZS$i%vqE)9G@HShfmf9|Ld6yk@>> zflfD6b7#tVvXODNu<|=#1Bpr$GDc;RQFoo53|;XR81jWq;ja)5T=PHS{{}`OZ@yc# zGH^1#>-rY%8w&OuW04?qr8=x6sE9+ME%?EB%}$RKw|!GXda8Fu3zq1-HM|u!*L$bi z?Uj{cH&I{v-Udp3crZlYJMMmf)-M~U59}?e572jaMhsH)?$n(c-kEF!SyuCg@33AJ zR!&kf*RlWq*% z-J*8~V%r3TUoeio9ajNzk=(-k>#Ljtm4Y9`=)?Jcy?Q@=|K>k`ef@L;n4@qF&2_`& z67s_Q89Ohj#xhOPanGCjE=6wwuDoso>geE>sp-D_@1vOA`2~P|-~Swk-S>YEPtG2{ z|GAge4AW;s$LYAv0{=tI9`iNo3B$(MKaQMgrZa#0)-|rPLVp))+CHPtM;2TtP2*&Y z=w}7fG-jemBI^y-4tgnAk>T$qgHdgwGSl~#=rpQ#?n@?WRxL$^i$r6J`fVw&*SNIh zh4pqj7`}!APAb-Pr&CVD-O; zIwN)-5vui;>FZX7r`OlL;lB~e3W;0Kn6=Z}6u{kFdGFz5w(A}%o#FaC*>bRKKP1+) z^n!-g8Pb{3ISF=x>OBay>G4Aw;sdpP{=ZJ5?(ky(``-UQ+VuZN;mM=_zmL{?|5M*) z^!WeAjYQ}6;^EE#|M2mX?_0Kg_Fw&!gKyuzyqy!+XaC1X-S59AN5_xf|J+M!+J7Z$ zS8@~PPqq#Rs~`BW-@5cT2AL+QUxDy8Zc2YdpHanZMZSFav=Vh?=(9-$- zZJ+(CVpjhm)OX7N!qcOpuKiEK$NcYJ+5r0}EKf=01uh!;u*C`dv24HoeWC`U6(fRj z(CuQsY>+b9*G>eO6gqt8IhN$ f?GFz83pk(0_ShcVgSP(<009600ms$J08{_~x}mSP From 8ab827edf7f8d797d147627a8545f449a7c24852 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 21:44:25 -0800 Subject: [PATCH 47/49] fix: correct namespace for rhdh --- developer-hub/developer-hub-application/values.yaml | 2 +- developer-hub/developer-hub-prereqs/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/developer-hub/developer-hub-application/values.yaml b/developer-hub/developer-hub-application/values.yaml index 7044e8f..c981cb8 100644 --- a/developer-hub/developer-hub-application/values.yaml +++ b/developer-hub/developer-hub-application/values.yaml @@ -1,4 +1,4 @@ -nameOverride: "backstage" +nameOverride: "dh-config" namespace: rhdh diff --git a/developer-hub/developer-hub-prereqs/values.yaml b/developer-hub/developer-hub-prereqs/values.yaml index cd84994..05908d9 100644 --- a/developer-hub/developer-hub-prereqs/values.yaml +++ b/developer-hub/developer-hub-prereqs/values.yaml @@ -1,4 +1,4 @@ -nameOverride: "backstage" +nameOverride: "developer-hub-prereqs" namespace: rhdh From 125f4a70f8d316ab63da2ef4e784350fa72d3e68 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 22:06:00 -0800 Subject: [PATCH 48/49] refactor(developer-hub): replace template job with Helm-based dh-config Move developer-hub-application from subchart to direct ArgoCD Application in app-of-apps, pointing to GitLab-hosted dh-config Helm chart. Remove Ansible template job since values are now passed through ArgoCD helm valuesObject. Simplify developerHub values structure. Co-Authored-By: Claude Opus 4.6 --- app-of-apps/templates/developer-hub.yaml | 29 ++--- app-of-apps/values.yaml | 18 ++- .../developer-hub-application/Chart.yaml | 5 - .../templates/_helpers.tpl | 60 ---------- .../templates/dh-application.yaml | 33 ------ .../developer-hub-application/values.yaml | 12 -- .../templates/cm-dh-config-template.yaml | 105 ------------------ .../templates/job-dh-config-template.yaml | 29 ----- .../developer-hub-prereqs/values.yaml | 35 ------ 9 files changed, 19 insertions(+), 307 deletions(-) delete mode 100644 developer-hub/developer-hub-application/Chart.yaml delete mode 100644 developer-hub/developer-hub-application/templates/_helpers.tpl delete mode 100644 developer-hub/developer-hub-application/templates/dh-application.yaml delete mode 100644 developer-hub/developer-hub-application/values.yaml delete mode 100644 developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml delete mode 100644 developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml diff --git a/app-of-apps/templates/developer-hub.yaml b/app-of-apps/templates/developer-hub.yaml index 93ec397..53e1ad1 100644 --- a/app-of-apps/templates/developer-hub.yaml +++ b/app-of-apps/templates/developer-hub.yaml @@ -15,17 +15,6 @@ spec: vault: namespace: {{ .Values.vault.namespace }} name: {{ .Values.vault.name }} - gitlab: - rootPassword: {{ .Values.developerHub.configTemplate.gitlab.rootPassword | quote }} - host: {{ .Values.developerHub.configTemplate.gitlab.host }} - backstage: - host: {{ .Values.developerHub.configTemplate.backstage.host }} - gitops: - host: {{ .Values.developerHub.configTemplate.gitops.host }} - kubernetes: - api: {{ .Values.developerHub.configTemplate.kubernetes.api }} - cluster: - subdomain: {{ .Values.developerHub.configTemplate.cluster.subdomain }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} --- apiVersion: argoproj.io/v1alpha1 @@ -37,13 +26,17 @@ spec: server: https://kubernetes.default.svc project: default source: - path: developer-hub/developer-hub-application - repoURL: {{ .Values.gitops.repoURL }} - targetRevision: {{ .Values.gitops.targetRevision }} + repoURL: https://{{ .Values.developerHub.application.git.host }}/{{ .Values.developerHub.application.git.group }}/{{ .Values.developerHub.application.git.repo }}.git + targetRevision: {{ .Values.developerHub.application.git.revision }} + path: . helm: valuesObject: - gitops: - namespace: {{ .Values.developerHub.application.gitops.namespace }} - git: - host: {{ .Values.developerHub.application.git.host }} + backstage: + host: {{ .Values.developerHub.config.backstage.host }} + gitlab: + host: {{ .Values.developerHub.config.gitlab.host }} + argocd: + host: {{ .Values.developerHub.config.argocd.host }} + kubernetes: + apiUrl: {{ .Values.developerHub.config.kubernetes.apiUrl }} {{ include "app-of-apps.syncPolicy" . | indent 2 }} diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 9a2d592..4975ecc 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -105,23 +105,21 @@ quay: developerHub: name: developer-hub namespace: rhdh - configTemplate: - gitlab: - rootPassword: "" - host: "" + config: backstage: host: "" - gitops: + gitlab: + host: "" + argocd: host: "" kubernetes: - api: "" - cluster: - subdomain: "" + apiUrl: "" application: - gitops: - namespace: openshift-gitops git: host: "" + group: rhdh + repo: dh-config + revision: main rhdhGitops: name: rhdh-gitops diff --git a/developer-hub/developer-hub-application/Chart.yaml b/developer-hub/developer-hub-application/Chart.yaml deleted file mode 100644 index 259b6c1..0000000 --- a/developer-hub/developer-hub-application/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: developer-hub-application -description: ArgoCD Application for Developer Hub config from GitLab -type: application -version: 0.1.0 diff --git a/developer-hub/developer-hub-application/templates/_helpers.tpl b/developer-hub/developer-hub-application/templates/_helpers.tpl deleted file mode 100644 index 159a16e..0000000 --- a/developer-hub/developer-hub-application/templates/_helpers.tpl +++ /dev/null @@ -1,60 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "developer-hub-application.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -*/}} -{{- define "developer-hub-application.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "developer-hub-application.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "developer-hub-application.labels" -}} -helm.sh/chart: {{ include "developer-hub-application.chart" . }} -{{ include "developer-hub-application.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "developer-hub-application.selectorLabels" -}} -app.kubernetes.io/name: {{ include "developer-hub-application.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -The namespace to deploy to -*/}} -{{- define "developer-hub-application.namespace" -}} -{{- if .Values.namespace }} -{{- .Values.namespace }} -{{- else }} -{{- .Release.Namespace }} -{{- end }} -{{- end }} diff --git a/developer-hub/developer-hub-application/templates/dh-application.yaml b/developer-hub/developer-hub-application/templates/dh-application.yaml deleted file mode 100644 index be6d213..0000000 --- a/developer-hub/developer-hub-application/templates/dh-application.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ include "developer-hub-application.name" . }} - namespace: {{ .Values.gitops.namespace }} - finalizers: - - resources-finalizer.argocd.argoproj.io/foreground -spec: - destination: - name: "" - namespace: {{ include "developer-hub-application.namespace" . }} - server: 'https://kubernetes.default.svc' - project: default - syncPolicy: - automated: - prune: true - selfHeal: true - retry: - backoff: - duration: 10s - factor: 2 - maxDuration: 10m - limit: 15 - syncOptions: - - CreateNamespace=true - - RespectIgnoreDifferences=true - - ApplyOutOfSyncOnly=true - source: - repoURL: 'https://{{ .Values.git.host }}/{{ .Values.git.group }}/{{ .Values.git.repo }}.git' - targetRevision: {{ .Values.git.revision }} - path: . - directory: - recurse: false diff --git a/developer-hub/developer-hub-application/values.yaml b/developer-hub/developer-hub-application/values.yaml deleted file mode 100644 index c981cb8..0000000 --- a/developer-hub/developer-hub-application/values.yaml +++ /dev/null @@ -1,12 +0,0 @@ -nameOverride: "dh-config" - -namespace: rhdh - -gitops: - namespace: openshift-gitops - -git: - host: - group: rhdh - repo: dh-config - revision: main diff --git a/developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml b/developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml deleted file mode 100644 index f7aeaad..0000000 --- a/developer-hub/developer-hub-prereqs/templates/cm-dh-config-template.yaml +++ /dev/null @@ -1,105 +0,0 @@ -kind: ConfigMap -metadata: - name: dh-config-template - annotations: - {{- include "developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} -apiVersion: v1 -data: - playbook.yaml: | - --- - - name: DH Config templates - hosts: localhost - tasks: - - name: Check existence of group - ansible.builtin.uri: - url: https://root:{{ $.Values.gitlab.rootPassword }}@{{ $.Values.gitlab.host }}/api/v4/groups/{{ $.Values.configTemplate.group }} - method: GET - validate_certs: false - register: r_liveness - retries: 120 - delay: 10 - until: r_liveness.status == 200 - - - name: Git config email - ansible.builtin.command: git config --global user.email "{{ $.Values.gitlab.email.address }}" - ignore_errors: true - - - name: Git config name - ansible.builtin.command: git config --global user.name "{{ $.Values.gitlab.email.displayName }}" - ignore_errors: true - - - name: Build git repo url - ansible.builtin.set_fact: - _git_template_repo_url: https://root:{{ $.Values.gitlab.rootPassword }}@{{ $.Values.gitlab.host }}/{{ $.Values.configTemplate.group }}/{{ $.Values.configTemplate.repo }} - - - name: Remove older repo folders - shell: rm -rf /tmp/{{ $.Values.configTemplate.repo }} - - - name: Check existence of git repo - ansible.builtin.uri: - url: '{{ "{{" }} _git_template_repo_url {{ "}}" }}' - method: GET - validate_certs: false - register: r_liveness - retries: 60 - delay: 10 - until: r_liveness.status == 200 - - - name: Clone {{ $.Values.configTemplate.repo }} - ansible.builtin.git: - accept_hostkey: true - force: true - repo: '{{ "{{" }} _git_template_repo_url {{ "}}" }}' - dest: "/tmp/{{ $.Values.configTemplate.repo }}" - version: "{{ $.Values.configTemplate.branch }}" - environment: - GIT_SSL_NO_VERIFY: "true" - register: r_git_clone - retries: 60 - delay: 10 - until: r_git_clone is not failed - -{{- range $item := .Values.configTemplate.templates }} - - - name: Fetch /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} template from remote host - run_once: true - ansible.builtin.fetch: - src: /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} - dest: /tmp/{{ $item }} - flat: true - fail_on_missing: true - - - name: Apply template /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} - ansible.builtin.template: - src: /tmp/{{ $item }} - dest: /tmp/{{ $.Values.configTemplate.repo }}/{{ $item }} - mode: "0660" - vars: - cluster_subdomain: "{{ $.Values.cluster.subdomain }}" - backstage_host: "{{ $.Values.backstage.host }}" - gitlab_host: "{{ $.Values.gitlab.host }}" - argocd_host: "{{ $.Values.gitops.host }}" - kubernetes_api_url: "{{ $.Values.kubernetes.api }}" -{{- end }} - - - name: Add new files to the repository - ansible.builtin.command: - chdir: >- - /tmp/{{ $.Values.configTemplate.repo }} - cmd: "git add ." - ignore_errors: true - - - name: Commit changes to the repository - ansible.builtin.command: - chdir: >- - /tmp/{{ $.Values.configTemplate.repo }} - cmd: >- - git commit -a -m 'dh-config init: render env-specific values.' - ignore_errors: true - - - name: Push all changes back to the project repository - ansible.builtin.command: - chdir: >- - /tmp/{{ $.Values.configTemplate.repo }} - cmd: >- - git push {{ "{{" }} _git_template_repo_url {{ "}}" }} diff --git a/developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml b/developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml deleted file mode 100644 index 54e715f..0000000 --- a/developer-hub/developer-hub-prereqs/templates/job-dh-config-template.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: dh-config-template - annotations: - {{- include "developer-hub-prereqs.argocd-syncwave" . | nindent 4 }} - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: BeforeHookCreation -spec: - backoffLimit: 100 - template: - spec: - containers: - - name: dh-config-template - command: - - /bin/bash - - '-c' - - | - set -x - ansible-playbook -i localhost /scripts/playbook.yaml - image: quay.io/agnosticd/ee-multicloud:latest - volumeMounts: - - mountPath: /scripts - name: dh-config-vol - restartPolicy: Never - volumes: - - name: dh-config-vol - configMap: - name: dh-config-template diff --git a/developer-hub/developer-hub-prereqs/values.yaml b/developer-hub/developer-hub-prereqs/values.yaml index 05908d9..bec4247 100644 --- a/developer-hub/developer-hub-prereqs/values.yaml +++ b/developer-hub/developer-hub-prereqs/values.yaml @@ -9,41 +9,6 @@ vault: operator: channel: fast-1.8 -gitlab: - rootPassword: - host: - email: - address: "gitlab@rhdemo.com" - displayName: "Gitlab" - -configTemplate: - group: rhdh - repo: dh-config - branch: main - templates: - - backstage-cr.yaml - - configmap-app-config.yaml - - configmap-dynamic-plugins.yaml - - configmap-rbac-policy.yaml - - es-argocd-password.yaml - - es-gitlab-token.yaml - - es-kubernetes-sa-token.yaml - - es-oauth-client.yaml - - es-orchestrator-token.yaml - - secret-backstage-npmrc.yaml - -backstage: - host: - -gitops: - host: - -kubernetes: - api: - -cluster: - subdomain: - argocd: enabled: true syncwave: "-1" From a025056cbd8d318ca02fcfd54f3fd9f7f8457bd9 Mon Sep 17 00:00:00 2001 From: Evan Shortiss Date: Wed, 25 Feb 2026 22:17:26 -0800 Subject: [PATCH 49/49] fix: default to upstream rhdh config chart --- app-of-apps/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app-of-apps/values.yaml b/app-of-apps/values.yaml index 4975ecc..c89c7ad 100644 --- a/app-of-apps/values.yaml +++ b/app-of-apps/values.yaml @@ -116,9 +116,9 @@ developerHub: apiUrl: "" application: git: - host: "" - group: rhdh - repo: dh-config + host: "github.com" + group: redhat-ads-tech + repo: ocp-app-platform-demo-developer-hub-config revision: main rhdhGitops: