Initial commit

2025-07-16 14:39:01 +02:00 · 2025-07-16 14:39:01 +02:00 · 53ac79fbc6
commit 53ac79fbc6
27 changed files with 3472 additions and 0 deletions
--- a/clusters/t09.de/abc/stacks.yaml
+++ b/clusters/t09.de/abc/stacks.yaml
@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: abcd
+spec:
+  generators:
+    - list:
+        elements:
+          - stack: core
+            revision: 'v1.0.0'
+          - stack: otc
+            revision: 'v1.2.3'
+          - stack: forgejo
+            revision: 'HEAD'
+          - stack: observability-client
+            revision: 'v2.3.4'
+  template:
+    metadata:
+      name: '{{stack}}'
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/your-org/gitops-repo
+        path: registry/overlays/abcd/{{stack}}
+        targetRevision: '{{revision}}'
+      destination:
+        server: 'https://kubernetes.default.svc'
+        namespace: 'argocd'
--- a/registry/base/core/argocd.yaml
+++ b/registry/base/core/argocd.yaml
@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: argocd
+  sources:
+    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/argocd-helm.git
+      path: charts/argo-cd
+      # TODO: RIRE Can be updated when https://github.com/argoproj/argo-cd/issues/20790 is fixed and merged
+      # As logout make problems, it is suggested to switch from path based routing to an own argocd domain,
+      # similar to the CNOE amazon reference implementation and in our case, Forgejo
+      targetRevision: argo-cd-7.8.14-depends
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/manifests"
--- a/registry/base/core/argocd/manifests/argocd-server-ingress.yaml
+++ b/registry/base/core/argocd/manifests/argocd-server-ingress.yaml
@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: main
+{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
+    dns.gardener.cloud/class: garden
+    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_ARGOCD }}}
+    dns.gardener.cloud/ttl: "600"
+{{{ end }}}
+  name: argocd-server
+  namespace: argocd
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: {{{ .Env.DOMAIN_ARGOCD }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: argocd-server
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - {{{ .Env.DOMAIN_ARGOCD }}}
+    secretName: argocd-net-tls
--- a/registry/base/core/argocd/values.yaml
+++ b/registry/base/core/argocd/values.yaml
@ -0,0 +1,33 @@
+global:
+  domain: {{{ .Env.DOMAIN_ARGOCD }}}
+
+configs:
+  params:
+    server.insecure: true
+  cm:
+    application.resourceTrackingMethod: annotation
+    timeout.reconciliation: 60s
+    resource.exclusions: |
+      - apiGroups:
+        - "*"
+        kinds:
+        - ProviderConfigUsage
+      - apiGroups:
+        - cilium.io
+        kinds:
+        - CiliumIdentity
+        clusters:
+        - "*"
+    accounts.provider-argocd: apiKey
+    url: https://{{{ .Env.DOMAIN_ARGOCD }}}
+  rbac:
+    policy.csv: 'g, provider-argocd, role:admin'
+
+  tls:
+    certificates:
+
+notifications:
+  enabled: false
+
+dex:
+  enabled: false
--- a/registry/base/forgejo/forgejo-runner.yaml
+++ b/registry/base/forgejo/forgejo-runner.yaml
@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo-runner
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    server: "https://kubernetes.default.svc"
+  source:
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    targetRevision: HEAD
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-runner"
--- a/registry/base/forgejo/forgejo-runner/dind-docker.yaml
+++ b/registry/base/forgejo/forgejo-runner/dind-docker.yaml
@ -0,0 +1,104 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: forgejo-runner
+  name: forgejo-runner
+  namespace: gitea
+spec:
+  # Two replicas means that if one is busy, the other can pick up jobs.
+  replicas: 1
+  selector:
+    matchLabels:
+      app: forgejo-runner
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: forgejo-runner
+    spec:
+      restartPolicy: Always
+      volumes:
+      - name: docker-certs
+        emptyDir: {}
+      - name: runner-data
+        emptyDir: {}
+      # Initialise our configuration file using offline registration
+      # https://forgejo.org/docs/v1.21/admin/actions/#offline-registration
+      initContainers:
+        - name: runner-register
+          image: code.forgejo.org/forgejo/runner:6.3.1
+          command:
+          - "sh"
+          - "-c"
+          - |
+            forgejo-runner \
+              register \
+              --no-interactive \
+              --token ${RUNNER_SECRET} \
+              --name ${RUNNER_NAME} \
+              --instance ${FORGEJO_INSTANCE_URL} \
+              --labels docker:docker://node:20-bookworm,ubuntu-22.04:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04,ubuntu-latest:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04
+          env:
+            - name: RUNNER_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: RUNNER_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-runner-token
+                  key: token
+            - name: FORGEJO_INSTANCE_URL
+              value: https://{{{ .Env.DOMAIN_GITEA }}}
+          volumeMounts:
+            - name: runner-data
+              mountPath: /data
+      containers:
+      - name: runner
+        image: code.forgejo.org/forgejo/runner:6.3.1
+        command: 
+          - "sh"
+          - "-c"
+          - |
+            while ! nc -z 127.0.0.1 2376 </dev/null; do
+              echo 'waiting for docker daemon...';
+              sleep 5;
+            done
+            forgejo-runner generate-config > config.yml ;
+            sed -i -e "s|privileged: .*|privileged: true|" config.yml
+            sed -i -e "s|network: .*|network: host|" config.yml ;
+            sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://127.0.0.1:2376\n    DOCKER_TLS_VERIFY: 1\n    DOCKER_CERT_PATH: /certs/client|" config.yml ;
+            sed -i -e "s|^  options:|  options: -v /certs/client:/certs/client|" config.yml ;
+            sed -i -e "s|  valid_volumes: \[\]$$|  valid_volumes:\n    - /certs/client|" config.yml ;
+            /bin/forgejo-runner --config config.yml daemon
+        securityContext:
+          allowPrivilegeEscalation: true
+          privileged: true
+          readOnlyRootFilesystem: false
+          runAsGroup: 0
+          runAsNonRoot: false
+          runAsUser: 0
+        env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs
+        - name: runner-data
+          mountPath: /data
+      - name: daemon
+        image: docker:28.0.4-dind
+        env:
+        - name: DOCKER_TLS_CERTDIR
+          value: /certs
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs
--- a/registry/base/forgejo/forgejo-server.yaml
+++ b/registry/base/forgejo/forgejo-server.yaml
@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo-server
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: gitea
+  sources:
+    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/forgejo-helm.git
+      path: .
+      # first check out the desired version (example v9.0.0): https://code.forgejo.org/forgejo-helm/forgejo-helm/src/tag/v9.0.0/Chart.yaml
+      # (note that the chart version is not the same as the forgejo application version, which is specified in the above Chart.yaml file)
+      # then use the devops pipeline and select development, forgejo and the desired version (example v9.0.0):
+      # https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/devops-pipelines/actions?workflow=update-helm-depends.yaml&actor=0&status=0
+      # finally update the desired version here and include "-depends", it is created by the devops pipeline. 
+      # why do we have an added "-depends" tag? it resolves rate limitings when downloading helm OCI dependencies
+      targetRevision: v9.0.0-depends
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/manifests"
--- a/registry/base/forgejo/forgejo-server/manifests/forgejo-ingress.yaml
+++ b/registry/base/forgejo/forgejo-server/manifests/forgejo-ingress.yaml
@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 512m
+    cert-manager.io/cluster-issuer: main
+{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
+    dns.gardener.cloud/class: garden
+    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_GITEA }}}
+    dns.gardener.cloud/ttl: "600"
+{{{ end }}}
+  name: forgejo-server
+  namespace: gitea
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: {{{ .Env.DOMAIN_GITEA }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: forgejo-server-http
+            port:
+              number: 3000
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - {{{ .Env.DOMAIN_GITEA }}}
+    secretName: forgejo-net-tls
--- a/registry/base/forgejo/forgejo-server/values.yaml
+++ b/registry/base/forgejo/forgejo-server/values.yaml
@ -0,0 +1,175 @@
+# We use recreate to make sure only one instance with one version is running, because Forgejo might break or data gets inconsistant. 
+strategy:
+  type: Recreate
+
+redis-cluster:
+  enabled: false
+
+redis:
+  enabled: false
+
+postgresql:
+  enabled: false
+
+postgresql-ha:
+  enabled: false
+
+persistence:
+  enabled: true
+  size: 200Gi
+  annotations:
+    everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
+
+test:
+  enabled: false
+
+deployment:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/ssl/forgejo
+
+extraVolumeMounts:
+  - mountPath: /etc/ssl/forgejo
+    name: custom-database-certs-volume
+    readOnly: true
+
+extraVolumes:
+  - name: custom-database-certs-volume
+    secret:
+      secretName: custom-database-certs
+
+gitea:
+  additionalConfigFromEnvs:
+    - name: FORGEJO__storage__MINIO_ACCESS_KEY_ID
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-cloud-credentials
+          key: access-key
+    - name: FORGEJO__storage__MINIO_SECRET_ACCESS_KEY
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-cloud-credentials
+          key: secret-key
+    - name: FORGEJO__queue__CONN_STR
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__session__PROVIDER_CONFIG
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__cache__HOST
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__database__HOST
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: host_port
+    - name: FORGEJO__database__NAME
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: database
+    - name: FORGEJO__database__USER
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: username
+    - name: FORGEJO__database__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: password
+    - name: FORGEJO__indexer__ISSUE_INDEXER_CONN_STR
+      valueFrom:
+        secretKeyRef:
+          name: elasticsearch-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__mailer__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: email-user-credentials
+          key: connection-string
+
+  admin:
+    existingSecret: gitea-credential
+
+  config:
+    indexer:
+      ISSUE_INDEXER_ENABLED: true
+      ISSUE_INDEXER_TYPE: elasticsearch
+      # TODO next
+      REPO_INDEXER_ENABLED: false
+      # REPO_INDEXER_TYPE: meilisearch # not yet working
+
+    storage:
+      MINIO_ENDPOINT: obs.eu-de.otc.t-systems.com:443
+      STORAGE_TYPE: minio
+      MINIO_LOCATION: eu-de
+      MINIO_BUCKET: edp-forgejo-{{{ .Env.CLUSTER_ENVIRONMENT }}}
+      MINIO_USE_SSL: true
+
+    queue:
+      TYPE: redis
+
+    session:
+      PROVIDER: redis
+
+    cache:
+      ENABLED: true
+      ADAPTER: redis
+
+    service:
+      DISABLE_REGISTRATION: true
+
+    other:
+      SHOW_FOOTER_VERSION: false
+      SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
+
+    database:
+      DB_TYPE: postgres
+      SSL_MODE: verify-ca
+
+    server:
+      DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
+      ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
+
+    mailer:
+      ENABLED: true
+      USER: ipcei-cis-devfw@mms-support.de
+      PROTOCOL: smtps
+      FROM: '"IPCEI CIS DevFW" <ipcei-cis-devfw@mms-support.de>'
+      SMTP_ADDR: mail.mms-support.de
+      SMTP_PORT: 465
+
+service:
+  ssh:
+    type: NodePort
+    nodePort: 32222
+    externalTrafficPolicy: Local
+
+image:
+  pullPolicy: "IfNotPresent"
+  # Overrides the image tag whose default is the chart appVersion.
+  #tag: "8.0.3"
+  # Adds -rootless suffix to image name
+  rootless: true
+
+forgejo:
+  runner:
+    enabled: true
+    image:
+      tag: latest
+    # replicas: 3
+    config:
+      runner:
+        labels:
+          - docker:docker://node:16-bullseye
+          - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+          - ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+          - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04
--- a/registry/base/observability-client/metrics-server.yaml
+++ b/registry/base/observability-client/metrics-server.yaml
@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: metrics-server
+      repoURL: https://kubernetes-sigs.github.io/metrics-server/
+      targetRevision: 3.12.2
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/metrics-server/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
--- a/registry/base/observability-client/metrics-server/values.yaml
+++ b/registry/base/observability-client/metrics-server/values.yaml
@ -0,0 +1,4 @@
+metrics:
+  enabled: true
+serviceMonitor:
+  enabled: true
--- a/registry/base/observability-client/vector.yaml
+++ b/registry/base/observability-client/vector.yaml
@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vector
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: vector
+      repoURL: https://helm.vector.dev
+      targetRevision: 0.43.0
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vector/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
--- a/registry/base/observability-client/vector/values.yaml
+++ b/registry/base/observability-client/vector/values.yaml
@ -0,0 +1,58 @@
+# -- Enable deployment of vector
+role: Agent
+dataDir: /vector-data-dir
+resources: {}
+args:
+  - -w
+  - --config-dir
+  - /etc/vector/
+containerPorts:
+  - name: prom-exporter
+    containerPort: 9090
+    protocol: TCP
+service:
+  enabled: false
+customConfig:
+  data_dir: /vector-data-dir
+  api:
+    enabled: false
+    address: 0.0.0.0:8686
+    playground: true
+  sources:
+    k8s:
+      type: kubernetes_logs
+    internal_metrics:
+      type: internal_metrics
+  transforms:
+    parser:
+      type: remap
+      inputs: [k8s]
+      source: |
+        .log = parse_json(.message) ?? .message
+        del(.message)
+  sinks:
+    exporter:
+      type: prometheus_exporter
+      address: 0.0.0.0:9090
+      inputs: [internal_metrics]
+    vlogs:
+      type: elasticsearch
+      inputs: [parser]
+      endpoints: 
+        - https://o12y.observability.think-ahead.cloud/insert/elasticsearch/
+      auth:
+        strategy: basic
+        user: simple-user
+        password: simple-password  
+      mode: bulk
+      api_version: v8
+      compression: gzip
+      healthcheck:
+        enabled: false
+      request:
+        headers:
+          VL-Time-Field: timestamp
+          VL-Stream-Fields: stream,kubernetes.pod_name,kubernetes.container_name,kubernetes.pod_namespace
+          VL-Msg-Field: message,msg,_msg,log.msg,log.message,log
+          AccountID: "0"
+          ProjectID: "0"
--- a/registry/base/observability-client/vm-client-stack.yaml
+++ b/registry/base/observability-client/vm-client-stack.yaml
@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vm-client
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: victoria-metrics-k8s-stack
+      repoURL: https://victoriametrics.github.io/helm-charts/
+      targetRevision: 0.48.1
+      releaseName: vm-client
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/manifests"
--- a/registry/base/observability-client/vm-client-stack/manifests/simple-user-secret.yaml
+++ b/registry/base/observability-client/vm-client-stack/manifests/simple-user-secret.yaml
@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: simple-user-secret
+  namespace: observability
+type: Opaque
+stringData:
+  username: simple-user
+  password: simple-password
--- a/registry/base/observability-client/vm-client-stack/values.yaml
+++ b/registry/base/observability-client/vm-client-stack/values.yaml
--- a/registry/base/observability/victoria-k8s-stack.yaml
+++ b/registry/base/observability/victoria-k8s-stack.yaml
@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: o12y
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: victoria-metrics-k8s-stack
+      repoURL: https://victoriametrics.github.io/helm-charts/
+      targetRevision: 0.48.1
+      releaseName: o12y
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/manifests"
--- a/registry/base/observability/victoria-k8s-stack/manifests/vlogs.yaml
+++ b/registry/base/observability/victoria-k8s-stack/manifests/vlogs.yaml
@ -0,0 +1,21 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VLogs
+metadata:
+  name: victorialogs
+  namespace: observability
+spec:
+  retentionPeriod: "12"
+  removePvcAfterDelete: true
+  storage:
+    accessModes:
+      - ReadWriteOnce
+    resources:
+      requests:
+        storage: 50Gi
+  resources:
+    requests:
+      memory: 500Mi
+      cpu: 500m
+    limits:
+      memory: 10Gi
+      cpu: 2
--- a/registry/base/observability/victoria-k8s-stack/manifests/vmauth.yaml
+++ b/registry/base/observability/victoria-k8s-stack/manifests/vmauth.yaml
@ -0,0 +1,15 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  name: simple-user
+  namespace: observability
+spec:
+  username: simple-user
+  password: simple-password
+  targetRefs:
+    - static:
+        url: http://vmsingle-o12y:8429
+      paths: ["/api/v1/write"]
+    - static:
+        url: http://vlogs-victorialogs:9428
+      paths: ["/insert/elasticsearch/.*"]
--- a/registry/base/observability/victoria-k8s-stack/values.yaml
+++ b/registry/base/observability/victoria-k8s-stack/values.yaml
--- a/registry/base/otc/cert-manager/manifests/clusterissuer.yaml
+++ b/registry/base/otc/cert-manager/manifests/clusterissuer.yaml
@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: main
+spec:
+  acme:
+    email: admin@think-ahead.tech
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: cluster-issuer-account-key
+    solvers:
+    - http01:
+        ingress:
+          ingressClassName: nginx
--- a/registry/base/otc/cert-manager/values.yaml
+++ b/registry/base/otc/cert-manager/values.yaml
@ -0,0 +1,4 @@
+crds:
+  enabled: true
+
+replicaCount: 1
--- a/registry/base/otc/cert-manger.yaml
+++ b/registry/base/otc/cert-manger.yaml
@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: cert-manager
+  sources:
+    - chart: cert-manager
+      repoURL: https://charts.jetstack.io
+      targetRevision: v1.17.2
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/manifests"
--- a/registry/base/otc/ingress-nginx.yaml
+++ b/registry/base/otc/ingress-nginx.yaml
@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-nginx
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: ingress-nginx
+  sources:
+    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/ingress-nginx-helm.git
+      path: charts/ingress-nginx
+      targetRevision: helm-chart-4.12.1-depends
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/ingress-nginx/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
--- a/registry/base/otc/ingress-nginx/values.yaml
+++ b/registry/base/otc/ingress-nginx/values.yaml
@ -0,0 +1,31 @@
+controller:
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  service:
+    annotations:
+      kubernetes.io/elb.class: union
+      kubernetes.io/elb.port: '80'
+      kubernetes.io/elb.id: {{{ .Env.LOADBALANCER_ID }}}
+      kubernetes.io/elb.ip: {{{ .Env.LOADBALANCER_IP }}}
+
+  ingressClassResource:
+    name: nginx
+
+  # added for idpbuilder
+  allowSnippetAnnotations: true
+
+  # added for idpbuilder
+  config:
+    proxy-buffer-size: 32k
+    use-forwarded-headers: "true"
+
+  # monitoring nginx
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels: 
+        release: "ingress-nginx"  
+      enabled: true
--- a/registry/base/otc/storageclass.yaml
+++ b/registry/base/otc/storageclass.yaml
@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: storageclass
+  namespace: argocd
+  labels:
+    example: otc
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: default
+    server: "https://kubernetes.default.svc"
+  source:
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    targetRevision: HEAD
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/storageclass"
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
--- a/registry/base/otc/storageclass/storageclass.yaml
+++ b/registry/base/otc/storageclass/storageclass.yaml
@ -0,0 +1,18 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations:
+    storageclass.beta.kubernetes.io/is-default-class: "true"
+  labels:
+    kubernetes.io/cluster-service: "true"
+  name: default
+parameters:
+  kubernetes.io/description: ""
+  kubernetes.io/hw:passthrough: "true"
+  kubernetes.io/storagetype: BS
+  kubernetes.io/volumetype: SATA
+  kubernetes.io/zone: eu-de-02
+provisioner: flexvolume-huawei.com/fuxivol
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+allowVolumeExpansion: true