wip

ref/appset-local-charts.yaml

@@ -0,0 +1,45 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: local-charts
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions:
+    - missingkey=error
+  generators:
+    - matrix:
+        generators:
+          - git:
+              repoURL: "cnoe://configs"
+              revision: HEAD
+              files:
+                - path: "**/config.yaml"
+          - list:
+              elementsYaml: "{{ .packages | toJson }}"
+            selector:
+              matchExpressions:
+                - key: install
+                  operator: In
+                  values:
+                    - "true"
+  template:
+    metadata:
+      name: "{{ .name }}"
+      labels:
+        environment: "{{ .environment }}"
+        cnoe.io/package-name: ref-impl
+    spec:
+      project: default
+      sources:
+        - repoURL: "cnoe://packages"
+          targetRevision: HEAD
+          path: "{{ .manifestPath }}"
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        syncOptions:
+          - CreateNamespace=true
+        automated:
+          selfHeal: true

ref/appset-local-manifests.yaml

@@ -0,0 +1,44 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: local-charts
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions:
+    - missingkey=error
+  generators:
+    - matrix:
+        generators:
+          - git:
+              repoURL: "cnoe://configs"
+              revision: HEAD
+              files:
+                - path: "**/config.yaml"
+          - list:
+              elementsYaml: "{{ .packages | toJson }}"
+            selector:
+              matchExpressions:
+                - key: install
+                  operator: In
+                  values:
+                    - "true"
+  template:
+    metadata:
+      name: "{{ .name }}"
+      labels:
+        environment: "{{ .environment }}"
+    spec:
+      project: default
+      sources:
+        - repoURL: "cnoe://packages"
+          targetRevision: HEAD
+          path: "{{ .manifestPath }}"
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        syncOptions:
+          - CreateNamespace=true
+        automated:
+          selfHeal: true

ref/configs/local/config.yaml

@@ -0,0 +1,18 @@
+environment: local
+packages:
+  - name: external-secrets
+    namespace: external-secrets
+    install: "true"
+    manifestPath: "external-secrets/manifests"
+#  - name: keycloak
+#    namespace: keycloak
+#    install: "true"
+#    manifestPath: "keycloak/manifests"
+#  - name: argo-workflows
+#    namespace: argo
+#    install: "true"
+#    manifestPath: "argo-workflows/manifests/dev"
+#  - name: backstage
+#    namespace: backstage
+#    install: "true"
+#    manifestPath: "backstage/manifests"

ref/packages/argo-workflows/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

ref/packages/argo-workflows/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: argo-workflows
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

ref/packages/argo-workflows/values.yaml

@@ -0,0 +1,7 @@
+# Default values for argo-workflows.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+networking:
+  host: cnoe.localtest.me
+  protocol: https
+  port: 8443

ref/packages/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml

@@ -0,0 +1,30 @@
+apiVersion: backstage.io/v1alpha1
+kind: Resource
+metadata:
+  name: ${{values.name}}-bucket
+  description: Stores things
+  annotations:
+    argocd/app-name: ${{values.name | dump}}
+spec:
+  type: s3-bucket
+  owner: guest
+---
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: ${{values.name | dump}}
+  description: This is for testing purposes
+  annotations:
+    backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}'
+    backstage.io/kubernetes-namespace: default
+    argocd/app-name: ${{values.name | dump}}
+  links:
+    - url: https://cnoe.localtest.me:8443/gitea
+      title: Repo URL
+      icon: github
+spec:
+  owner: guest
+  lifecycle: experimental
+  type: service
+  dependsOn:
+    - resource:default/${{values.name}}-bucket

ref/packages/backstage-templates/entities/app-with-bucket/skeleton/go.mod

@@ -0,0 +1,3 @@
+module ${{ values.name }}
+
+go 1.19

ref/packages/backstage-templates/entities/app-with-bucket/skeleton/kustomize/base/kustomization.yaml

@@ -0,0 +1,3 @@
+resources:
+  - nginx.yaml
+  - ${{ values.name }}.yaml

ref/packages/backstage-templates/entities/app-with-bucket/skeleton/kustomize/base/nginx.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.14.2
+        ports:
+        - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  ports:
+  - port: 80
+    targetPort: 80
+  selector:
+    app: nginx

ref/packages/backstage-templates/entities/app-with-bucket/skeleton/kustomize/dev/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - ../base

ref/packages/backstage-templates/entities/app-with-bucket/skeleton/kustomize/prod/kustomization.yaml

@@ -0,0 +1,35 @@
+{%- if values.awsResources %}
+resources:
+{%- if 'Bucket' in values.awsResources %}
+  - ../base/
+{%- endif %}
+{%- if 'Table' in values.awsResources %}
+  - ../base/table.yaml
+{%- endif %}
+{%- endif %}
+namespace: default
+
+patches:
+  - target:
+      kind: Deployment
+    patch: |
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: not-used
+        labels:
+          backstage.io/kubernetes-id: ${{values.name}}
+      spec:
+        template:
+          metadata:
+            labels:
+              backstage.io/kubernetes-id: ${{values.name}}
+  - target:
+      kind: Service
+    patch: |
+      apiVersion: apps/v1
+      kind: Service
+      metadata:
+        name: not-used
+        labels:
+          backstage.io/kubernetes-id: ${{values.name}}

ref/packages/backstage-templates/entities/app-with-bucket/skeleton/main.go

@@ -0,0 +1,5 @@
+package main
+
+func main() {
+	
+}

ref/packages/backstage-templates/entities/app-with-bucket/template.yaml

@@ -0,0 +1,126 @@
+apiVersion: scaffolder.backstage.io/v1beta3
+kind: Template
+metadata:
+  description: Adds a Go application with AWS resources
+  name: app-with-aws-resources
+  title: Add a Go App with AWS resources
+spec:
+  owner: guest
+  type: service
+  parameters:
+    - properties:
+        name:
+          title: Application Name
+          type: string
+          description: Unique name of the component
+          ui:autofocus: true
+        labels:
+          title: Labels
+          type: object
+          additionalProperties:
+            type: string
+          description: Labels to apply to the application
+          ui:autofocus: true
+      required:
+        - name
+      title: Choose your repository location
+    - description: Configure your bucket
+      properties:
+        apiVersion:
+          default: awsblueprints.io/v1alpha1
+          description: APIVersion for the resource
+          type: string
+        kind:
+          default: ObjectStorage
+          description: Kind for the resource
+          type: string
+        config:
+          description: ObjectStorageSpec defines the desired state of ObjectStorage
+          properties:
+            resourceConfig:
+              description: ResourceConfig defines general properties of this AWS resource.
+              properties:
+                deletionPolicy:
+                  description: Defaults to Delete
+                  enum:
+                    - Delete
+                    - Orphan
+                  type: string
+                region:
+                  type: string
+                providerConfigName:
+                  type: string
+                  default: default
+                tags:
+                  items:
+                    properties:
+                      key:
+                        type: string
+                      value:
+                        type: string
+                    required:
+                      - key
+                      - value
+                    type: object
+                  type: array
+              required:
+                - region
+              type: object
+          required:
+            - resourceConfig
+          title: Bucket configuration options
+          type: object
+  steps:
+    - id: template
+      name: Generating component
+      action: fetch:template
+      input:
+        url: ./skeleton
+        values:
+          name: ${{parameters.name}}
+    - action: roadiehq:utils:serialize:yaml
+      id: serialize
+      input:
+        data:
+          apiVersion: awsblueprints.io/v1alpha1
+          kind: ${{ parameters.kind }}
+          metadata:
+            name: ${{ parameters.name }}
+          spec: ${{ parameters.config }}
+      name: serialize
+    - action: roadiehq:utils:fs:write
+      id: write
+      input:
+        content: ${{ steps['serialize'].output.serialized }}
+        path: kustomize/base/${{ parameters.name }}.yaml
+      name: write-to-file
+    - id: publish
+      name: Publishing to a gitea git repository
+      action: publish:gitea
+      input:
+        description: This is an example app
+        # Hard coded value for this demo purposes only.
+        repoUrl: cnoe.localtest.me:8443/gitea?repo=${{parameters.name}}
+        defaultBranch: main
+    - id: create-argocd-app
+      name: Create ArgoCD App
+      action: cnoe:create-argocd-app
+      input:
+        appName: ${{parameters.name}}
+        appNamespace: default
+        argoInstance: in-cluster
+        projectName: default
+        # necessary until we generate our own cert
+        repoUrl: http://my-gitea-http.gitea.svc.cluster.local:3000/giteaAdmin/${{parameters.name}}
+        path: "kustomize/base"
+    - id: register
+      name: Register
+      action: catalog:register
+      input:
+        repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }}
+        catalogInfoPath: 'catalog-info.yaml'
+  output:
+    links:
+      - title: Open in catalog
+        icon: catalog
+        entityRef: ${{ steps['register'].output.entityRef }}

ref/packages/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: ${{values.name | dump}}
+  description: This is for testing purposes
+  annotations:
+    backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}'
+    backstage.io/kubernetes-namespace: argo
+    argocd/app-name: ${{values.name | dump}}
+    argo-workflows.cnoe.io/label-selector: env=dev,entity-id=${{values.name}}
+    argo-workflows.cnoe.io/cluster-name: local
+    apache-spark.cnoe.io/label-selector: env=dev,entity-id=${{values.name}}
+    apache-spark.cnoe.io/cluster-name: local
+  links:
+    - url: https://cnoe.localtest.me:8443/gitea
+      title: Repo URL
+      icon: github
+spec:
+  owner: guest
+  lifecycle: experimental
+  type: service

ref/packages/backstage-templates/entities/argo-workflows/skeleton/manifests/deployment.yaml

@@ -0,0 +1,109 @@
+# apiVersion: argoproj.io/v1alpha1
+# kind: Workflow
+# metadata:
+#   name: ${{values.name}}
+#   namespace: argo
+#   labels:
+#     env: dev
+#     entity-id: ${{values.name}}
+# spec:
+#   serviceAccountName: admin
+#   entrypoint: whalesay
+#   templates:
+#   - name: whalesay
+#     container:
+#       image: docker/whalesay:latest
+#       command: [cowsay]
+#       args: ["hello world"]
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  name: ${{values.name}}
+  namespace: argo
+  labels:
+    env: dev
+    entity-id: ${{values.name}}
+spec:
+  serviceAccountName: admin
+  entrypoint: main
+  action: create
+  templates:
+    - name: main
+      steps:
+        - - name: spark-job
+            template: spark-job
+        - - name: wait
+            template: wait
+            arguments:
+              parameters:
+              - name: spark-job-name
+                value: '{{steps.spark-job.outputs.parameters.spark-job-name}}'
+
+    - name: wait
+      inputs:
+        parameters:
+          - name: spark-job-name
+      resource:
+        action: get
+        successCondition: status.applicationState.state == COMPLETED
+        failureCondition: status.applicationState.state == FAILED
+        manifest: |
+          apiVersion: "sparkoperator.k8s.io/v1beta2"
+          kind: SparkApplication
+          metadata:
+            name: {{inputs.parameters.spark-job-name}}
+            namespace: argo
+
+    - name: spark-job
+      outputs:
+        parameters:
+          - name: spark-job-name
+            valueFrom:
+              jsonPath: '{.metadata.name}'
+      resource:
+        action: create
+        setOwnerReference: true
+        manifest: |
+          apiVersion: "sparkoperator.k8s.io/v1beta2"
+          kind: SparkApplication
+          metadata:
+            name: spark-pi-${{values.name}}
+            namespace: argo
+            labels:
+              env: dev
+              entity-id: ${{values.name}}
+          spec:
+            type: Scala
+            mode: cluster
+            image: "docker.io/apache/spark:v3.1.3"
+            imagePullPolicy: IfNotPresent
+            mainClass: org.apache.spark.examples.SparkPi
+            mainApplicationFile: "local:///opt/spark/examples/jars/spark-examples_2.12-3.1.3.jar"
+            sparkVersion: "3.1.1"
+            restartPolicy:
+              type: Never
+            volumes:
+              - name: "test-volume"
+                hostPath:
+                  path: "/tmp"
+                  type: Directory
+            driver:
+              cores: 1
+              coreLimit: "1200m"
+              memory: "512m"
+              labels:
+                version: 3.1.1
+              serviceAccount: admin
+              volumeMounts:
+                - name: "test-volume"
+                  mountPath: "/tmp"
+            executor:
+              cores: 1
+              instances: 1
+              memory: "512m"
+              labels:
+                version: 3.1.1
+              volumeMounts:
+                - name: "test-volume"
+                  mountPath: "/tmp"

ref/packages/backstage-templates/entities/argo-workflows/template.yaml

@@ -0,0 +1,62 @@
+apiVersion: scaffolder.backstage.io/v1beta3
+kind: Template
+metadata:
+  description: Creates a Basic Kubernetes Deployment
+  name: argo-workflows-basic
+  title: Basic Argo Workflow with a Spark Job
+spec:
+  owner: guest
+  type: service
+  parameters:
+    - title: Configuration Options
+      required:
+        - name
+      properties:
+        name:
+          type: string
+          description: name of this application
+        mainApplicationFile:
+          type: string
+          default: 'local:///opt/spark/examples/jars/spark-examples_2.12-3.1.3.jar'
+          description: Path to the main application file
+        
+  steps:
+    - id: template
+      name: Generating component
+      action: fetch:template
+      input:
+        url: ./skeleton
+        values:
+          name: ${{parameters.name}}
+
+    - id: publish
+      name: Publishing to a gitea git repository
+      action: publish:gitea
+      input:
+        description: This is an example app
+        # Hard coded value for this demo purposes only.
+        repoUrl: cnoe.localtest.me:8443/gitea?repo=${{parameters.name}}
+        defaultBranch: main
+    - id: create-argocd-app
+      name: Create ArgoCD App
+      action: cnoe:create-argocd-app
+      input:
+        appName: ${{parameters.name}}
+        appNamespace: ${{parameters.name}}
+        argoInstance: in-cluster
+        projectName: default
+        # necessary until we generate our own cert
+        repoUrl: http://my-gitea-http.gitea.svc.cluster.local:3000/giteaAdmin/${{parameters.name}}
+        path: "manifests"
+    - id: register
+      name: Register
+      action: catalog:register
+      input:
+        repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }}
+        catalogInfoPath: 'catalog-info.yaml'
+
+  output:
+    links:
+      - title: Open in catalog
+        icon: catalog
+        entityRef: ${{ steps['register'].output.entityRef }}

ref/packages/backstage-templates/entities/basic/skeleton/catalog-info.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: ${{values.name | dump}}
+  description: This is for testing purposes
+  annotations:
+    backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}'
+    backstage.io/kubernetes-namespace: default
+    argocd/app-name: ${{values.name | dump}}
+  links:
+    - url: https://cnoe.localtest.me:8443/gitea
+      title: Repo URL
+      icon: github
+spec:
+  owner: guest
+  lifecycle: experimental
+  type: service

ref/packages/backstage-templates/entities/basic/skeleton/manifests/deployment.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${{values.name | dump}}
+  namespace: default
+  labels:
+    entity-id: ${{values.name}}
+    app: nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+        entity-id: ${{values.name}}
+    spec:
+      containers:
+        - name: nginx
+          image: nginx:1.14.2
+          ports:
+            - containerPort: 80

ref/packages/backstage-templates/entities/basic/template.yaml

@@ -0,0 +1,58 @@
+apiVersion: scaffolder.backstage.io/v1beta3
+kind: Template
+metadata:
+  description: Creates a Basic Kubernetes Deployment
+  name: basic
+  title: Create a Basic Deployment
+spec:
+  owner: guest
+  type: service
+  parameters:
+    - title: Configuration Options
+      required:
+        - name
+      properties:
+        name:
+          type: string
+          description: name of this application
+        
+  steps:
+    - id: template
+      name: Generating component
+      action: fetch:template
+      input:
+        url: ./skeleton
+        values:
+          name: ${{parameters.name}}
+
+    - id: publish
+      name: Publishing to a gitea git repository
+      action: publish:gitea
+      input:
+        description: This is an example app
+        # Hard coded value for this demo purposes only.
+        repoUrl: cnoe.localtest.me:8443/gitea?repo=${{parameters.name}}
+        defaultBranch: main
+    - id: create-argocd-app
+      name: Create ArgoCD App
+      action: cnoe:create-argocd-app
+      input:
+        appName: ${{parameters.name}}
+        appNamespace: ${{parameters.name}}
+        argoInstance: in-cluster
+        projectName: default
+        # necessary until we generate our own cert
+        repoUrl: http://my-gitea-http.gitea.svc.cluster.local:3000/giteaAdmin/${{parameters.name}}
+        path: "manifests"
+    - id: register
+      name: Register
+      action: catalog:register
+      input:
+        repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }}
+        catalogInfoPath: 'catalog-info.yaml'
+
+  output:
+    links:
+      - title: Open in catalog
+        icon: catalog
+        entityRef: ${{ steps['register'].output.entityRef }}

ref/packages/backstage-templates/entities/catalog-info.yaml

@@ -0,0 +1,10 @@
+apiVersion: backstage.io/v1alpha1
+kind: Location
+metadata:
+  name: basic-example-templates
+  description: A collection of example templates
+spec:
+  targets:
+    - ./basic/template.yaml
+    - ./argo-workflows/template.yaml
+    - ./app-with-bucket/template.yaml

ref/packages/backstage/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

ref/packages/backstage/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: backstage
+description: Helm chart for CNOE backstage ref implementation
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

ref/packages/backstage/templates/backstage/argocd-secrets.yaml

@@ -0,0 +1,77 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eso-store
+  namespace: argocd
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: eso-store
+  namespace: argocd
+rules:
+  - apiGroups: [""]
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - selfsubjectrulesreviews
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: eso-store
+  namespace: argocd
+subjects:
+  - kind: ServiceAccount
+    name: eso-store
+    namespace: argocd
+roleRef:
+  kind: Role
+  name: eso-store
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: argocd
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: argocd
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          namespace: argocd
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: eso-store
+          namespace: argocd
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: argocd-credentials
+  namespace: backstage
+spec:
+  secretStoreRef:
+    name: argocd
+    kind: ClusterSecretStore
+  refreshInterval: "0"
+  target:
+    name: argocd-credentials
+  data:
+    - secretKey: ARGOCD_ADMIN_PASSWORD
+      remoteRef:
+        key: argocd-initial-admin-secret
+        property: password

ref/packages/backstage/templates/backstage/config-map.yaml

@@ -0,0 +1,128 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: backstage-config
+  namespace: backstage
+data:
+  app-config.yaml: |
+    app:
+      title: CNOE Backstage
+      baseUrl: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}
+    organization:
+      name: CNOE
+    backend:
+      # Used for enabling authentication, secret is shared by all backend plugins
+      # See https://backstage.io/docs/tutorials/backend-to-backend-auth for
+      # information on the format
+      # auth:
+      #   keys:
+      #     - secret: ${BACKEND_SECRET}
+      baseUrl: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}
+      listen:
+        port: 7007
+        # Uncomment the following host directive to bind to specific interfaces
+        # host: 127.0.0.1
+      csp:
+        connect-src: ["'self'", 'http:', 'https:']
+        # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
+        # Default Helmet Content-Security-Policy values can be removed by setting the key to false
+      cors:
+        origin: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}
+        methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
+        credentials: true
+      database:
+        client: pg
+        connection:
+          host: ${POSTGRES_HOST}
+          port: ${POSTGRES_PORT}
+          user: ${POSTGRES_USER}
+          password: ${POSTGRES_PASSWORD}
+      cache:
+        store: memory
+      # workingDirectory: /tmp # Use this to configure a working directory for the scaffolder, defaults to the OS temp-dir
+
+    integrations:
+      gitea:
+        - baseUrl: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/gitea
+          host: {{ .Values.networking.host }}:{{ .Values.networking.port }}
+          username: ${GITEA_USERNAME}
+          password: ${GITEA_PASSWORD}
+        - baseUrl: https://{{ .Values.networking.host }}/gitea
+          host: {{ .Values.networking.host }}
+          username: ${GITEA_USERNAME}
+          password: ${GITEA_PASSWORD}
+    #  github:
+    #    - host: github.com
+    #      apps:
+    #        - $include: github-integration.yaml
+    #    - host: github.com
+    #      # This is a Personal Access Token or PAT from GitHub. You can find out how to generate this token, and more information
+    #      # about setting up the GitHub integration here: https://backstage.io/docs/getting-started/configuration#setting-up-a-github-integration
+    #      token: ${GITHUB_TOKEN}
+        ### Example for how to add your GitHub Enterprise instance using the API:
+        # - host: ghe.example.net
+        #   apiBaseUrl: https://ghe.example.net/api/v3
+        #   token: ${GHE_TOKEN}
+
+    # Reference documentation http://backstage.io/docs/features/techdocs/configuration
+    # Note: After experimenting with basic setup, use CI/CD to generate docs
+    # and an external cloud storage when deploying TechDocs for production use-case.
+    # https://backstage.io/docs/features/techdocs/how-to-guides#how-to-migrate-from-techdocs-basic-to-recommended-deployment-approach
+    techdocs:
+      builder: 'local' # Alternatives - 'external'
+      generator:
+        runIn: 'docker' # Alternatives - 'local'
+      publisher:
+        type: 'local' # Alternatives - 'googleGcs' or 'awsS3'. Read documentation for using alternatives.
+
+    auth:
+      environment: development
+      session:
+        secret: MW2sV-sIPngEl26vAzatV-6VqfsgAx4bPIz7PuE_2Lk=
+      providers:
+        keycloak-oidc:
+          development:
+            metadataUrl: ${KEYCLOAK_NAME_METADATA}
+            clientId: backstage
+            clientSecret: ${KEYCLOAK_CLIENT_SECRET}
+            scope: 'openid profile email groups'
+            prompt: auto
+
+    scaffolder:
+      # see https://backstage.io/docs/features/software-templates/configuration for software template options
+        defaultAuthor:
+          name: backstage-scaffolder
+          email: noreply
+        defaultCommitMessage: "backstage scaffolder"
+    catalog:
+      import:
+        entityFilename: catalog-info.yaml
+        pullRequestBranchName: backstage-integration
+      rules:
+        - allow: [Component, System, API, Resource, Location, Template]
+      locations:
+        # Examples from a public GitHub repository.
+        - type: url
+          target: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/gitea/giteaAdmin/idpbuilder-localdev-ref-impl-packages/raw/branch/main/backstage-templates/entities/catalog-info.yaml
+        ## Uncomment these lines to add an example org
+        # - type: url
+        #   target: https://github.com/backstage/backstage/blob/master/packages/catalog-model/examples/acme-corp.yaml
+        #   rules:
+        #     - allow: [User, Group]
+    kubernetes:
+      serviceLocatorMethod:
+        type: 'multiTenant'
+      clusterLocatorMethods:
+        - $include: k8s-config.yaml
+    argocd:
+      username: admin
+      password: ${ARGOCD_ADMIN_PASSWORD}
+      appLocatorMethods:
+        - type: 'config'
+          instances:
+            - name: in-cluster
+              url: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/argocd
+              username: admin
+              password: ${ARGOCD_ADMIN_PASSWORD}
+    argoWorkflows:
+        baseUrl: ${ARGO_WORKFLOWS_URL}

ref/packages/backstage/templates/backstage/deployment.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backstage
+  namespace: backstage
+  annotations:
+    argocd.argoproj.io/sync-wave: "20"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backstage
+  template:
+    metadata:
+      labels:
+        app: backstage
+    spec:
+      containers:
+        - command:
+            - node
+            - packages/backend
+            - --config
+            - config/app-config.yaml
+          env:
+            - name: LOG_LEVEL
+              value: debug
+            - name: NODE_TLS_REJECT_UNAUTHORIZED
+              value: "0"
+          envFrom:
+            - secretRef:
+                name: backstage-env-vars
+            - secretRef:
+                name: gitea-credentials
+            - secretRef:
+                name: argocd-credentials
+          image: public.ecr.aws/cnoe-io/backstage:rc1
+          name: backstage
+          ports:
+            - containerPort: 7007
+              name: http
+          volumeMounts:
+            - mountPath: /app/config
+              name: backstage-config
+              readOnly: true
+      serviceAccountName: backstage
+      volumes:
+        - name: backstage-config
+          projected:
+            sources:
+              - configMap:
+                  items:
+                    - key: app-config.yaml
+                      path: app-config.yaml
+                  name: backstage-config
+              - secret:
+                  items:
+                    - key: k8s-config.yaml
+                      path: k8s-config.yaml
+                  name: k8s-config

ref/packages/backstage/templates/backstage/ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: backstage
+  namespace: backstage
+spec:
+  ingressClassName: "nginx"
+  rules:
+    - host: localhost
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: backstage
+                port:
+                  name: http
+    - host: {{ .Values.networking.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: backstage
+                port:
+                  name: http

ref/packages/backstage/templates/backstage/rbac.yaml

@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: backstage-argo-worfklows
+rules:
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - workflows
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: read-all
+rules:
+  - apiGroups:
+      - '*'
+    resources:
+      - '*'
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backstage-argo-worfklows
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: backstage-argo-worfklows
+subjects:
+  - kind: ServiceAccount
+    name: backstage
+    namespace: backstage
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backstage-read-all
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: read-all
+subjects:
+  - kind: ServiceAccount
+    name: backstage
+    namespace: backstage

ref/packages/backstage/templates/backstage/secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: k8s-config
+  namespace: backstage
+stringData:
+  k8s-config.yaml: "type: 'config'\nclusters:\n  - url: https://kubernetes.default.svc.cluster.local\n
+    \   name: local\n    authProvider: 'serviceAccount'\n    skipTLSVerify: true\n
+    \   skipMetricsLookup: true\n    serviceAccountToken: \n      $file: /var/run/secrets/kubernetes.io/serviceaccount/token\n
+    \   caData: \n      $file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt\n"

ref/packages/backstage/templates/backstage/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backstage
+  namespace: backstage
+spec:
+  ports:
+    - name: http
+      port: 7007
+      targetPort: http
+  selector:
+    app: backstage

ref/packages/backstage/templates/backstage/serviceaccount.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backstage
+  namespace: backstage
+---

ref/packages/backstage/templates/postgresql/external-secrets.yaml

@@ -0,0 +1,79 @@
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: backstage
+  namespace: backstage
+spec:
+  length: 36
+  digits: 5
+  symbols: 5
+  symbolCharacters: "/-+"
+  noUpper: false
+  allowRepeat: true
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: backstage-oidc
+  namespace: backstage
+spec:
+  secretStoreRef:
+    name: keycloak
+    kind: ClusterSecretStore
+  refreshInterval: "0"
+  target:
+    name: backstage-env-vars
+    template:
+      engineVersion: v2
+      data:
+        BACKSTAGE_FRONTEND_URL: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/backstage
+        POSTGRES_HOST: postgresql.backstage.svc.cluster.local
+        POSTGRES_PORT: '5432'
+        POSTGRES_DB: backstage
+        POSTGRES_USER: backstage
+        POSTGRES_PASSWORD: "{{.POSTGRES_PASSWORD}}"
+        ARGO_WORKFLOWS_URL: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/argo-workflows
+        KEYCLOAK_NAME_METADATA: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/keycloak/realms/cnoe/.well-known/openid-configuration
+        KEYCLOAK_CLIENT_SECRET: "{{.BACKSTAGE_CLIENT_SECRET}}"
+        ARGOCD_AUTH_TOKEN: "argocd.token={{.ARGOCD_SESSION_TOKEN}}"
+        ARGO_CD_URL: 'https://argocd-server.argocd.svc.cluster.local/api/v1/'
+  data:
+    - secretKey: ARGOCD_SESSION_TOKEN
+      remoteRef:
+        key: keycloak-clients
+        property: ARGOCD_SESSION_TOKEN
+    - secretKey: BACKSTAGE_CLIENT_SECRET
+      remoteRef:
+        key: keycloak-clients
+        property: BACKSTAGE_CLIENT_SECRET
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: backstage
+      rewrite:
+        - transform:
+            template: "POSTGRES_PASSWORD"
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: gitea-credentials
+  namespace: backstage
+spec:
+  secretStoreRef:
+    name: gitea
+    kind: ClusterSecretStore
+  refreshInterval: "0"
+  target:
+    name: gitea-credentials
+  data:
+    - secretKey: GITEA_USERNAME
+      remoteRef:
+        key: gitea-credential
+        property: username
+    - secretKey: GITEA_PASSWORD
+      remoteRef:
+        key: gitea-credential
+        property: password

ref/packages/backstage/templates/postgresql/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: postgresql
+  name: postgresql
+  namespace: backstage
+spec:
+  clusterIP: None
+  ports:
+    - name: postgres
+      port: 5432
+  selector:
+    app: postgresql

ref/packages/backstage/templates/postgresql/stateful-set.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app: postgresql
+  name: postgresql
+  namespace: backstage
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgresql
+  serviceName: service-postgresql
+  template:
+    metadata:
+      labels:
+        app: postgresql
+    spec:
+      containers:
+        - env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: backstage-env-vars
+                  key: POSTGRES_DB
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: backstage-env-vars
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: backstage-env-vars
+                  key: POSTGRES_PASSWORD
+          image: docker.io/library/postgres:15.3-alpine3.18
+          name: postgres
+          ports:
+            - containerPort: 5432
+              name: postgresdb
+          resources:
+            limits:
+              memory: 500Mi
+            requests:
+              cpu: 100m
+              memory: 300Mi
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: "500Mi"

ref/packages/backstage/values.yaml

@@ -0,0 +1,7 @@
+# Default values for backstage.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+networking:
+  host: cnoe.localtest.me
+  protocol: https
+  port: 8443

ref/packages/keycloak/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

ref/packages/keycloak/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: keycloak
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

ref/packages/keycloak/templates/keycloak/ingress.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak-ingress-localhost
+  namespace: keycloak
+  annotations:
+    argocd.argoproj.io/sync-wave: "100"
+spec:
+  ingressClassName: "nginx"
+  rules:
+    - host: localhost
+      http:
+        paths:
+          - path: /keycloak
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: keycloak
+                port:
+                  name: http
+    - host: {{ .Values.networking.host }}
+      http:
+        paths:
+          - path: /keycloak
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: keycloak
+                port:
+                  name: http

ref/packages/keycloak/templates/keycloak/install.yaml

@@ -0,0 +1,165 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: keycloak
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+  selector:
+    app: keycloak
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: keycloak
+  name: keycloak
+  namespace: keycloak
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      containers:
+        - args:
+            - start-dev
+          env:
+            - name: KEYCLOAK_ADMIN
+              value: cnoe-admin
+            - name: KEYCLOAK_LOGLEVEL
+              value: ALL
+            - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY
+              value: 'true'
+          envFrom:
+            - secretRef:
+                name: keycloak-config
+          image: quay.io/keycloak/keycloak:22.0.3
+          name: keycloak
+          ports:
+            - containerPort: 8080
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /keycloak/realms/master
+              port: 8080
+          volumeMounts:
+            - mountPath: /opt/keycloak/conf
+              name: keycloak-config
+              readOnly: true
+      volumes:
+        - configMap:
+            name: keycloak-config
+          name: keycloak-config
+---
+apiVersion: v1
+data:
+  keycloak.conf: |
+    # Database
+    # The database vendor.
+    db=postgres
+    
+    # The username of the database user.
+    db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres
+
+    # The proxy address forwarding mode if the server is behind a reverse proxy.
+    proxy=edge
+    
+    # hostname configuration
+    hostname={{ .Values.networking.host }}
+    {{- if not (eq (int .Values.networking.port) 443) }}
+    hostname-port={{ .Values.networking.port }}
+    
+    # the admin url requires its own configuration to reflect correct url
+    hostname-admin={{ .Values.networking.host }}:{{ .Values.networking.port }}
+    {{- end }}
+    
+    http-relative-path=keycloak
+    hostname-debug=true
+    
+    # this should only be allowed in development. NEVER in production.
+    hostname-strict=false
+    hostname-strict-backchannel=false
+    
+
+kind: ConfigMap
+metadata:
+  name: keycloak-config
+  namespace: keycloak
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: postgresql
+  name: postgresql
+  namespace: keycloak
+spec:
+  clusterIP: None
+  ports:
+    - name: postgres
+      port: 5432
+  selector:
+    app: postgresql
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app: postgresql
+  name: postgresql
+  namespace: keycloak
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgresql
+  serviceName: service-postgresql
+  template:
+    metadata:
+      labels:
+        app: postgresql
+    spec:
+      containers:
+        - envFrom:
+            - secretRef:
+                name: keycloak-config
+          image: docker.io/library/postgres:15.3-alpine3.18
+          name: postgres
+          ports:
+            - containerPort: 5432
+              name: postgresdb
+          resources:
+            limits:
+              memory: 500Mi
+            requests:
+              cpu: 100m
+              memory: 300Mi
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+  - metadata:
+      name: data
+    spec:
+      accessModes: ["ReadWriteOnce"]
+      resources:
+        requests:
+          storage: "500Mi"

ref/packages/keycloak/templates/keycloak/keycloak-config.yaml

@@ -0,0 +1,366 @@
+# resources here are used to configure keycloak instance for SSO
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: keycloak-config
+  namespace: keycloak
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: keycloak-config
+  namespace: keycloak
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: keycloak-config
+  namespace: keycloak
+subjects:
+  - kind: ServiceAccount
+    name: keycloak-config
+    namespace: keycloak
+roleRef:
+  kind: Role
+  name: keycloak-config
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: keycloak-config
+  namespace: argocd
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: keycloak-config
+  namespace: argocd
+subjects:
+  - kind: ServiceAccount
+    name: keycloak-config
+    namespace: keycloak
+roleRef:
+  kind: Role
+  name: keycloak-config
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-job
+  namespace: keycloak
+data:
+  client-scope-groups-payload.json: |
+    {
+      "name": "groups",
+      "description": "groups a user belongs to",
+      "attributes": {
+          "consent.screen.text": "Access to groups a user belongs to.",
+          "display.on.consent.screen": "true",
+          "include.in.token.scope": "true",
+          "gui.order": ""
+      },
+      "type": "default",
+      "protocol": "openid-connect"
+    }
+  group-admin-payload.json: |
+    {"name":"admin"}
+  group-base-user-payload.json: |
+    {"name":"base-user"}
+  group-mapper-payload.json: |
+    {
+        "protocol": "openid-connect",
+        "protocolMapper": "oidc-group-membership-mapper",
+        "name": "groups",
+        "config": {
+          "claim.name": "groups",
+          "full.path": "false",
+          "id.token.claim": "true",
+          "access.token.claim": "true",
+          "userinfo.token.claim": "true"
+        }
+    }
+  realm-payload.json: |
+    {"realm":"cnoe","enabled":true}
+  user-password.json: |
+    {
+        "temporary": false,
+        "type": "password",
+        "value": "${USER1_PASSWORD}"
+    }
+  user-user1.json: |
+    {
+        "username": "user1",
+        "email": "",
+        "firstName": "user",
+        "lastName": "one",
+        "requiredActions": [],
+        "emailVerified": false,
+        "groups": [
+          "/admin"
+        ],
+        "enabled": true
+    }
+  user-user2.json: |
+    {
+        "username": "user2",
+        "email": "",
+        "firstName": "user",
+        "lastName": "two",
+        "requiredActions": [],
+        "emailVerified": false,
+        "groups": [
+          "/base-user"
+        ],
+        "enabled": true
+    }
+  argo-client-payload.json: |
+    {
+      "protocol": "openid-connect",
+      "clientId": "argo-workflows",
+      "name": "Argo Workflows Client",
+      "description": "Used for Argo Workflows SSO",
+      "publicClient": false,
+      "authorizationServicesEnabled": false,
+      "serviceAccountsEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": true,
+      "standardFlowEnabled": true,
+      "frontchannelLogout": true,
+      "attributes": {
+        "saml_idp_initiated_sso_url_name": "",
+        "oauth2.device.authorization.grant.enabled": false,
+        "oidc.ciba.grant.enabled": false
+      },
+      "alwaysDisplayInConsole": false,
+      "rootUrl": "",
+      "baseUrl": "",
+      "redirectUris": [
+        "https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/argo-workflows/oauth2/callback"
+      ],
+      "webOrigins": [
+        "/*"
+      ]
+    }
+
+  backstage-client-payload.json: |
+    {
+      "protocol": "openid-connect",
+      "clientId": "backstage",
+      "name": "Backstage Client",
+      "description": "Used for Backstage SSO",
+      "publicClient": false,
+      "authorizationServicesEnabled": false,
+      "serviceAccountsEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": true,
+      "standardFlowEnabled": true,
+      "frontchannelLogout": true,
+      "attributes": {
+        "saml_idp_initiated_sso_url_name": "",
+        "oauth2.device.authorization.grant.enabled": false,
+        "oidc.ciba.grant.enabled": false
+      },
+      "alwaysDisplayInConsole": false,
+      "rootUrl": "",
+      "baseUrl": "",
+      "redirectUris": [
+        "https://{{ .Values.networking.host }}:{{ .Values.networking.port }}/api/auth/keycloak-oidc/handler/frame"
+      ],
+      "webOrigins": [
+        "/*"
+      ]
+    }
+
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: config
+  namespace: keycloak
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+spec:
+  template:
+    metadata:
+      generateName: config
+    spec:
+      serviceAccountName: keycloak-config
+      restartPolicy: Never
+      volumes:
+        - name: keycloak-config
+          secret:
+            secretName: keycloak-config
+        - name: config-payloads
+          configMap:
+            name: config-job
+      containers:
+        - name: kubectl
+          image: docker.io/library/ubuntu:22.04
+          volumeMounts:
+            - name: keycloak-config
+              readOnly: true
+              mountPath: "/var/secrets/"
+            - name: config-payloads
+              readOnly: true
+              mountPath: "/var/config/"
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              #! /bin/bash
+  
+              set -ex -o pipefail
+              
+              apt -qq update && apt -qq install curl jq -y
+              
+              ADMIN_PASSWORD=$(cat /var/secrets/KEYCLOAK_ADMIN_PASSWORD)
+              USER1_PASSWORD=$(cat /var/secrets/USER_PASSWORD)
+
+              KEYCLOAK_URL=http://keycloak.keycloak.svc.cluster.local:8080/keycloak
+
+              KEYCLOAK_TOKEN=$(curl -sS  --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \
+                --data-urlencode "username=cnoe-admin" \
+                --data-urlencode "password=${ADMIN_PASSWORD}" \
+                --data-urlencode "grant_type=password" \
+                --data-urlencode "client_id=admin-cli" \
+                ${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token | jq -e -r '.access_token')
+                
+              set +e
+              
+              curl --fail-with-body -H "Authorization: bearer ${KEYCLOAK_TOKEN}"  "${KEYCLOAK_URL}/admin/realms/cnoe"  &> /dev/null
+              if [ $? -eq 0 ]; then
+                exit 0
+              fi
+              set -e
+              
+              curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/amd64/kubectl"
+              chmod +x kubectl
+              
+              echo "creating cnoe realm and groups"
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/realm-payload.json \
+                ${KEYCLOAK_URL}/admin/realms
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/client-scope-groups-payload.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/group-admin-payload.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/groups
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/group-base-user-payload.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/groups
+              
+              # Create scope mapper
+                echo 'adding group claim to tokens'
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/group-mapper-payload.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes/${CLIENT_SCOPE_GROUPS_ID}/protocol-mappers/models
+                
+              echo "creating test users"
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/user-user1.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/users
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/user-user2.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/users
+              
+              USER1ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=one" | jq -r '.[0].id')
+              USER2ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=two" | jq -r '.[0].id')
+              
+              echo "setting user passwords"
+              jq -r --arg pass ${USER1_PASSWORD}  '.value = $pass' /var/config/user-password.json > /tmp/user-password-to-be-applied.json
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT --data @/tmp/user-password-to-be-applied.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER1ID}/reset-password
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT --data @/tmp/user-password-to-be-applied.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER2ID}/reset-password
+            
+              echo "creating Argo Workflows client"
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                  -X POST --data @/var/config/argo-client-payload.json \
+                  ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+              
+              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "argo-workflows") | .id')
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
+              
+              ARGO_WORKFLOWS_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
+              -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+              -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
+              
+              echo "creating Backstage client"
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/backstage-client-payload.json \
+                  ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+              
+              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "backstage") | .id')
+              
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
+              
+              BACKSTAGE_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
+              
+              ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{ printf "{{.data.password | base64decode }}" }}')
+              
+              ARGOCD_SESSION_TOKEN=$(curl -k -sS http://argocd-server.argocd.svc.cluster.local:443/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token)
+              
+              echo \
+              "apiVersion: v1
+              kind: Secret
+              metadata:
+                name: keycloak-clients
+                namespace: keycloak
+              type: Opaque
+              stringData:
+                ARGO_WORKFLOWS_CLIENT_SECRET: ${ARGO_WORKFLOWS_CLIENT_SECRET}
+                ARGO_WORKFLOWS_CLIENT_ID: argo-workflows
+                ARGOCD_SESSION_TOKEN: ${ARGOCD_SESSION_TOKEN}
+                BACKSTAGE_CLIENT_SECRET: ${BACKSTAGE_CLIENT_SECRET}
+                BACKSTAGE_CLIENT_ID: backstage
+              " > /tmp/secret.yaml
+              
+              ./kubectl apply -f /tmp/secret.yaml
+              

ref/packages/keycloak/templates/keycloak/secret-gen.yaml

@@ -0,0 +1,179 @@
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: keycloak
+  namespace: keycloak
+spec:
+  length: 36
+  digits: 5
+  symbols: 5
+  symbolCharacters: "/-+"
+  noUpper: false
+  allowRepeat: true
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: keycloak-config
+  namespace: keycloak
+spec:
+  refreshInterval: "0"
+  target:
+    name: keycloak-config
+    template:
+      metadata:
+        labels:
+          cnoe.io/cli-secret: "true"
+          cnoe.io/package-name: keycloak
+      engineVersion: v2
+      data:
+        KEYCLOAK_ADMIN_PASSWORD: "{{.KEYCLOAK_ADMIN_PASSWORD}}"
+        KC_DB_USERNAME: keycloak
+        KC_DB_PASSWORD: "{{.KC_DB_PASSWORD}}"
+        POSTGRES_DB: keycloak
+        POSTGRES_USER: keycloak
+        POSTGRES_PASSWORD: "{{.KC_DB_PASSWORD}}"
+        USER_PASSWORD: "{{.USER_PASSWORD}}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: keycloak
+      rewrite:
+        - transform:
+            template: "KEYCLOAK_ADMIN_PASSWORD"
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: keycloak
+      rewrite:
+        - transform:
+            template: "KC_DB_PASSWORD"
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: keycloak
+      rewrite:
+        - transform:
+            template: "USER_PASSWORD"
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eso-store
+  namespace: keycloak
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: keycloak
+  name: eso-store
+rules:
+  - apiGroups: [""]
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - selfsubjectrulesreviews
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: eso-store
+  namespace: keycloak
+subjects:
+  - kind: ServiceAccount
+    name: eso-store
+    namespace: keycloak
+roleRef:
+  kind: Role
+  name: eso-store
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: keycloak
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: keycloak
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          namespace: keycloak
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: eso-store
+          namespace: keycloak
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eso-store
+  namespace: gitea
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: eso-store
+  namespace: gitea
+rules:
+  - apiGroups: [""]
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - selfsubjectrulesreviews
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: eso-store
+  namespace: gitea
+subjects:
+  - kind: ServiceAccount
+    name: eso-store
+    namespace: gitea
+roleRef:
+  kind: Role
+  name: eso-store
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: gitea
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: gitea
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          namespace: gitea
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: eso-store
+          namespace: gitea

ref/packages/keycloak/values.yaml

@@ -0,0 +1,7 @@
+# Default values for keycloak.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+networking:
+  host: cnoe.localtest.me
+  protocol: https
+  port: 8443