POC service and worker cluster

component/class/defaults.yml

@@ -13,6 +13,9 @@ parameters:
       keycloak:
         source: https://codecentric.github.io/helm-charts
         version: 2.3.0
+      forgejo:
+        source: oci://code.forgejo.org/forgejo-helm
+        version: 7.0.0
     images:
       provider-kubernetes:
         registry: xpkg.upbound.io
@@ -49,7 +52,7 @@ parameters:
       appcat:
         registry: ghcr.io
         repository: vshn/appcat
-        tag: v4.75.0
+        tag: add/forgejo
       apiserver:
         registry: ghcr.io
         repository: vshn/appcat-apiserver
@@ -345,6 +348,8 @@ parameters:
           uptime: ${appcat:slos:uptimeDefaults}
         Keycloak:
           uptime: ${appcat:slos:uptimeDefaults}
+        Forgejo:
+          uptime: ${appcat:slos:uptimeDefaults}
 
     providers:
       cloudscale:
@@ -753,6 +758,58 @@ parameters:
                 cpu: "2"
                 memory: "8Gi"
                 disk: 16Gi
+        forgejo:
+          billing: true
+          serviceName: VSHNForgejo
+          compFunctionsOnly: true
+          connectionSecretKeys:
+            - FORGEJO_HOST
+            - FORGEJO_PASSWORD
+            - FORGEJO_URL
+            - FORGEJO_USERNAME
+            - ca.crt
+          mode: standalone
+          offered: true
+          enabled: false
+          restoreSA: forgejoserviceaccount
+          restoreRoleRules: ${appcat:defaultRestoreRoleRules}
+          additionalInputs: {}
+          openshiftTemplate:
+            serviceName: forgejovshn
+            description: "Forgejo"
+            message: 'Forgejo'
+            url: https://vs.hn/vshn-keycloak
+            tags: "idp,forgejo"
+            icon: "icon-keycloak"
+            defaultVersion: "22"
+          enableNetworkPolicy: false
+          secretNamespace: ${appcat:services:vshn:secretNamespace}
+          helmChartVersion: ${appcat:charts:forgejo:version}
+          imageRegistry: ""
+          bucket_region: "lpg"
+          grpcEndpoint: ${appcat:grpcEndpoint}
+          proxyFunction: ${appcat:proxyFunction}
+          defaultPlan: standard-2
+          sla: 99.25
+          plans:
+            standard-2:
+              size:
+                enabled: true
+                cpu: "500m"
+                memory: "2Gi"
+                disk: 16Gi
+            standard-4:
+              size:
+                enabled: true
+                cpu: "1"
+                memory: "4Gi"
+                disk: 16Gi
+            standard-8:
+              size:
+                enabled: true
+                cpu: "2"
+                memory: "8Gi"
+                disk: 16Gi
 
       # Config for exoscale composites
       exoscale:

component/component/provider.jsonnet

@@ -305,6 +305,11 @@ local runtimeConfigRef(name) = {
           resources: [ 'ingresses' ],
           verbs: [ 'get', 'list', 'watch', 'update', 'patch', 'create', 'delete' ],
         },
+        {
+          apiGroups: [ 'policy' ],
+          resources: [ 'poddisruptionbudgets' ],
+          verbs: [ 'get', 'list', 'watch', 'update', 'patch', 'create', 'delete' ],
+        },
       ],
     };
     local rolebinding = kube.ClusterRoleBinding('crossplane:provider:provider-helm:system:custom') {

component/component/vshn_postgres.jsonnet

@@ -495,7 +495,7 @@ local xobjectBucket = {
         region: pgParams.bucket_region,
       },
       writeConnectionSecretToRef: {
-        namespace: '',
+        namespace: params.crossplaneNamespace,
         name: '',
       },
     },
@@ -505,7 +505,7 @@ local xobjectBucket = {
     comp.FromCompositeFieldPath('metadata.name', 'metadata.name'),
     comp.FromCompositeFieldPath('metadata.name', 'spec.parameters.bucketName'),
 
-    comp.FromCompositeFieldPathWithTransformPrefix('metadata.name', 'spec.writeConnectionSecretToRef.namespace', 'vshn-postgresql'),
+    // comp.FromCompositeFieldPathWithTransformPrefix('metadata.name', 'spec.writeConnectionSecretToRef.namespace', 'vshn-postgresql'),
     comp.FromCompositeFieldPathWithTransformPrefix('metadata.name', 'spec.writeConnectionSecretToRef.name', 'pgbucket'),
   ],
 };

component/tests/golden/vshn/appcat/appcat/10_function_appcat.yaml

@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.75.0-func
+  package: ghcr.io/vshn/appcat:add_forgejo-func
   runtimeConfigRef:
     name: function-appcat

component/tests/golden/vshn/appcat/appcat/10_provider_helm.yaml

@@ -39,7 +39,11 @@ metadata:
   name: helm
 spec:
   credentials:
-    source: InjectedIdentity
+    secretRef:
+      key: kubeconfig
+      name: worker-cluster
+      namespace: syn-appcat
+    source: Secret
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -146,6 +150,18 @@ rules:
       - patch
       - create
       - delete
+  - apiGroups:
+      - policy
+    resources:
+      - poddisruptionbudgets
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - create
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

component/tests/golden/vshn/appcat/appcat/10_provider_kubernetes.yaml

@@ -39,7 +39,11 @@ metadata:
   name: kubernetes
 spec:
   credentials:
-    source: InjectedIdentity
+    secretRef:
+      key: kubeconfig
+      name: worker-cluster
+      namespace: syn-appcat
+    source: Secret
 ---
 apiVersion: v1
 kind: ServiceAccount

component/tests/golden/vshn/appcat/appcat/10_provider_minio.yaml

@@ -42,7 +42,7 @@ spec:
     apiSecretRef:
       name: minio-secret
       namespace: syn-crossplane
-  minioURL: http://minio-server.minio.svc:9000/
+  minioURL: http://minio.192.168.228.1.nip.io:8088/
 ---
 apiVersion: v1
 kind: ServiceAccount

component/tests/golden/vshn/appcat/appcat/20_plans_vshn_forgejo.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+data:
+  plans: '{"standard-2": {"size": {"cpu": "500m", "disk": "16Gi", "enabled": true,
+    "memory": "2Gi"}}, "standard-4": {"size": {"cpu": "1", "disk": "16Gi", "enabled":
+    true, "memory": "4Gi"}}, "standard-8": {"size": {"cpu": "2", "disk": "16Gi", "enabled":
+    true, "memory": "8Gi"}}}'
+kind: ConfigMap
+metadata:
+  annotations: {}
+  labels:
+    name: vshnforgejoplans
+  name: vshnforgejoplans
+  namespace: syn-appcat

component/tests/golden/vshn/appcat/appcat/20_rbac_vshn_forgejo.yaml

@@ -0,0 +1,36 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: 'true'
+  name: appcat:composite:xvshnforgejos.vshn.appcat.vshn.io:claim-view
+rules:
+  - apiGroups:
+      - vshn.appcat.vshn.io
+    resources:
+      - vshnforgejoes
+      - vshnforgejoes/status
+      - vshnforgejoes/finalizers
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
+    rbac.authorization.k8s.io/aggregate-to-edit: 'true'
+  name: appcat:composite:xvshnforgejos.vshn.appcat.vshn.io:claim-edit
+rules:
+  - apiGroups:
+      - vshn.appcat.vshn.io
+    resources:
+      - vshnforgejoes
+      - vshnforgejoes/status
+      - vshnforgejoes/finalizers
+    verbs:
+      - '*'

component/tests/golden/vshn/appcat/appcat/20_role_vshn_forgejo_restore.yaml

@@ -0,0 +1,80 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: crossplane-appcat-job-forgejo-restorejob
+  name: crossplane:appcat:job:forgejo:restorejob
+rules:
+  - apiGroups:
+      - vshn.appcat.vshn.io
+    resources:
+      - '*'
+    verbs:
+      - get
+  - apiGroups:
+      - k8up.io
+    resources:
+      - snapshots
+    verbs:
+      - get
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - get
+      - create
+      - delete
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets/scale
+    verbs:
+      - update
+      - patch
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets
+    verbs:
+      - get
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - get
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - get
+      - create
+      - patch
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    name: forgejoserviceaccount
+  name: forgejoserviceaccount
+  namespace: syn-appcat-control
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: appcat-job-forgejo-restorejob
+  name: appcat:job:forgejo:restorejob
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crossplane:appcat:job:forgejo:restorejob
+subjects:
+  - kind: ServiceAccount
+    name: forgejoserviceaccount
+    namespace: syn-appcat-control