sync upstream changes

.github/workflows/pr.yaml

@@ -16,4 +16,9 @@ jobs:
       - name: Run tests
         run: |
           make build
+          if [[ -n $(git status --porcelain) ]]; then
+            echo "git is in dirty state";
+            git status --porcelain=2 --branch
+            exit 1
+          fi
           make test

pkg/build/templates/coredns/cm-coredns-default.yaml.tmpl

@@ -5,9 +5,12 @@ metadata:
   namespace: kube-system
 data:
   default.conf: |
-    # subdomain names resolves to ingress IP. e.g. gitea.cnoe.localtest.me becomes ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    # Goal: Rewrite rules for in-cluster access to a service: gitea, argocd, etc using the same FQDN as for external access
+
+    # subdomain names e.g. gitea.cnoe.localtest.me resolves to the IP address of the kubernetes ingress service and then will become ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite stop {
-        name regex (.*).{{ .Host }} ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        name regex (.*).{{ .Host }} ingress-nginx-controller.ingress-nginx.svc.cluster.local answer auto
     }
-    # host name resolves to ingress IP
+
+    # host name resolves to the IP address of the kubernetes ingress service
     rewrite name exact {{ .Host }} ingress-nginx-controller.ingress-nginx.svc.cluster.local

pkg/controllers/gitrepository/controller.go

@@ -2,7 +2,6 @@ package gitrepository
 
 import (
 	"context"
-	"crypto/tls"
 	"errors"
 	"fmt"
 	"net"
@@ -73,15 +72,7 @@ func getFallbackRepositoryURL(repo *v1alpha1.GitRepository, info repoInfo) strin
 func GetGitProvider(ctx context.Context, repo *v1alpha1.GitRepository, kubeClient client.Client, scheme *runtime.Scheme, tmplConfig util.CorePackageTemplateConfig) (gitProvider, error) {
 	switch repo.Spec.Provider.Name {
 	case v1alpha1.GitProviderGitea:
-		tr := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-			DialContext: (&net.Dialer{
-				Timeout:   gitTCPTimeout,
-				KeepAlive: 30 * time.Second, // from http.DefaultTransport
-			}).DialContext,
-		}
-		c := &http.Client{Transport: tr, Timeout: gitHTTPTimeout}
-		giteaClient, err := NewGiteaClient(repo.Spec.Provider.GitURL, gitea.SetHTTPClient(c))
+		giteaClient, err := NewGiteaClient(repo.Spec.Provider.GitURL, gitea.SetHTTPClient(util.GetHttpClient()))
 		if err != nil {
 			return nil, err
 		}

pkg/controllers/localbuild/gitea.go

@@ -2,28 +2,33 @@ package localbuild
 
 import (
 	"context"
-	"crypto/tls"
 	"embed"
+	"encoding/base64"
 	"fmt"
 	"net/http"
-	"time"
 
+	"code.gitea.io/sdk/gitea"
 	"github.com/adhar-io/adhar/api/v1alpha1"
 	"github.com/adhar-io/adhar/pkg/k8s"
 	"github.com/adhar-io/adhar/pkg/util"
 	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 )
 
 const (
 	// hardcoded values from what we have in the yaml installation file.
-	giteaNamespace   = "gitea"
-	giteaAdminSecret = "gitea-credential"
+	giteaNamespace           = "gitea"
+	giteaAdminSecret         = "gitea-credential"
+	giteaAdminTokenName      = "admin"
+	giteaAdminTokenFieldName = "token"
 	// this is the URL accessible outside cluster. resolves to localhost
 	giteaIngressURL = "%s://gitea.adhar.localtest.me:%s"
 	// this is the URL accessible within cluster for ArgoCD to fetch resources.
@@ -38,11 +43,7 @@ func RawGiteaInstallResources(templateData any, config v1alpha1.PackageCustomiza
 	return k8s.BuildCustomizedManifests(config.FilePath, "resources/gitea/k8s", installGiteaFS, scheme, templateData)
 }
 
-func newGiteaAdminSecret() (corev1.Secret, error) {
-	pass, err := util.GeneratePassword()
-	if err != nil {
-		return corev1.Secret{}, err
-	}
+func giteaAdminSecretObject() corev1.Secret {
 	return corev1.Secret{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "Secret",
@@ -52,11 +53,20 @@ func newGiteaAdminSecret() (corev1.Secret, error) {
 			Name:      giteaAdminSecret,
 			Namespace: giteaNamespace,
 		},
-		StringData: map[string]string{
-			"username": v1alpha1.GiteaAdminUserName,
-			"password": pass,
-		},
-	}, nil
+	}
+}
+
+func newGiteaAdminSecret() (corev1.Secret, error) {
+	pass, err := util.GeneratePassword()
+	if err != nil {
+		return corev1.Secret{}, err
+	}
+	obj := giteaAdminSecretObject()
+	obj.StringData = map[string]string{
+		"username": v1alpha1.GiteaAdminUserName,
+		"password": pass,
+	}
+	return obj, nil
 }
 
 func (r *LocalbuildReconciler) ReconcileGitea(ctx context.Context, req ctrl.Request, resource *v1alpha1.Localbuild) (ctrl.Result, error) {
@@ -75,13 +85,25 @@ func (r *LocalbuildReconciler) ReconcileGitea(ctx context.Context, req ctrl.Requ
 		},
 	}
 
-	giteCreds, err := newGiteaAdminSecret()
+	sec := giteaAdminSecretObject()
+	err := r.Client.Get(ctx, types.NamespacedName{
+		Namespace: sec.GetNamespace(),
+		Name:      sec.GetName(),
+	}, &sec)
+
 	if err != nil {
-		return ctrl.Result{}, fmt.Errorf("generating gitea admin secret: %w", err)
+		if k8serrors.IsNotFound(err) {
+			giteaCreds, err := newGiteaAdminSecret()
+			if err != nil {
+				return ctrl.Result{}, fmt.Errorf("generating gitea admin secret: %w", err)
+			}
+			gitea.unmanagedResources = []client.Object{&giteaCreds}
+			sec = giteaCreds
+		} else {
+			return ctrl.Result{}, fmt.Errorf("getting gitea secret: %w", err)
+		}
 	}
 
-	gitea.unmanagedResources = []client.Object{&giteCreds}
-
 	v, ok := resource.Spec.PackageConfigs.CorePackageCustomization[v1alpha1.GiteaPackageName]
 	if ok {
 		gitea.customization = v
@@ -94,16 +116,8 @@ func (r *LocalbuildReconciler) ReconcileGitea(ctx context.Context, req ctrl.Requ
 	baseUrl := giteaBaseUrl(r.Config)
 	// need this to ensure gitrepository controller can reach the api endpoint.
 	logger.V(1).Info("checking gitea api endpoint", "url", baseUrl)
-	c := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				InsecureSkipVerify: true,
-			},
-		},
-		Timeout: 2 * time.Second,
-	}
+	c := util.GetHttpClient()
 	resp, err := c.Get(baseUrl)
-
 	if err != nil {
 		return ctrl.Result{}, err
 	}
@@ -115,6 +129,11 @@ func (r *LocalbuildReconciler) ReconcileGitea(ctx context.Context, req ctrl.Requ
 		}
 	}
 
+	err = r.setGiteaToken(ctx, sec, baseUrl)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("creating gitea token: %w", err)
+	}
+
 	resource.Status.Gitea.ExternalURL = baseUrl
 	resource.Status.Gitea.InternalURL = giteaInternalBaseUrl(r.Config)
 	resource.Status.Gitea.AdminUserSecretName = giteaAdminSecret
@@ -123,6 +142,74 @@ func (r *LocalbuildReconciler) ReconcileGitea(ctx context.Context, req ctrl.Requ
 	return ctrl.Result{}, nil
 }
 
+func (r *LocalbuildReconciler) setGiteaToken(ctx context.Context, secret corev1.Secret, baseUrl string) error {
+	_, ok := secret.Data[giteaAdminTokenFieldName]
+	if ok {
+		return nil
+	}
+
+	u := unstructured.Unstructured{}
+	u.SetName(giteaAdminSecret)
+	u.SetNamespace(giteaNamespace)
+	u.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Secret"))
+
+	user, ok := secret.Data["username"]
+	if !ok {
+		return fmt.Errorf("username field not found in gitea secret")
+	}
+
+	pass, ok := secret.Data["password"]
+	if !ok {
+		return fmt.Errorf("password field not found in gitea secret")
+	}
+
+	t, err := getGiteaToken(ctx, baseUrl, string(user), string(pass))
+	if err != nil {
+		return fmt.Errorf("getting gitea token: %w", err)
+	}
+
+	token := base64.StdEncoding.EncodeToString([]byte(t))
+	err = unstructured.SetNestedField(u.Object, token, "data", giteaAdminTokenFieldName)
+	if err != nil {
+		return fmt.Errorf("setting gitea token field: %w", err)
+	}
+
+	return r.Client.Patch(ctx, &u, client.Apply, client.ForceOwnership, client.FieldOwner(v1alpha1.FieldManager))
+}
+
+func getGiteaToken(ctx context.Context, baseUrl, username, password string) (string, error) {
+
+	giteaClient := gitea.NewClientWithHTTP(baseUrl, util.GetHttpClient())
+	giteaClient.SetBasicAuth(username, password)
+	giteaClient.SetContext(ctx)
+	tokens, resp, err := giteaClient.ListAccessTokens(gitea.ListAccessTokensOptions{})
+	if err != nil {
+		return "", fmt.Errorf("listing gitea access tokens. status: %s error : %w", resp.Status, err)
+	}
+
+	for i := range tokens {
+		if tokens[i].Name == giteaAdminTokenName {
+			resp, err := giteaClient.DeleteAccessToken(tokens[i].ID)
+			if err != nil {
+				return "", fmt.Errorf("deleting gitea access tokens. status: %s error : %w", resp.Status, err)
+			}
+			break
+		}
+	}
+
+	token, resp, err := giteaClient.CreateAccessToken(gitea.CreateAccessTokenOption{
+		Name: giteaAdminTokenName,
+		Scopes: []gitea.AccessTokenScope{
+			gitea.AccessTokenScopeAll,
+		},
+	})
+	if err != nil {
+		return "", fmt.Errorf("deleting gitea access tokens. status: %s error : %w", resp.Status, err)
+	}
+
+	return token.Token, nil
+}
+
 func giteaBaseUrl(config util.CorePackageTemplateConfig) string {
 	return fmt.Sprintf(giteaIngressURL, config.Protocol, config.Port)
 }

pkg/util/util.go

@@ -3,12 +3,16 @@ package util
 import (
 	"context"
 	"crypto/rand"
+	"crypto/tls"
 	"fmt"
 	"math"
 	"math/big"
 	mathrand "math/rand"
+	"net"
+	"net/http"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/adhar-io/adhar/api/v1alpha1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -133,3 +137,14 @@ func IsYamlFile(input string) bool {
 	extension := filepath.Ext(input)
 	return extension == ".yaml" || extension == ".yml"
 }
+
+func GetHttpClient() *http.Client {
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		DialContext: (&net.Dialer{
+			Timeout:   5 * time.Second,
+			KeepAlive: 30 * time.Second, // from http.DefaultTransport
+		}).DialContext,
+	}
+	return &http.Client{Transport: tr, Timeout: 30 * time.Second}
+}

platform/stack/adhar-appset-charts.yaml

@@ -32,6 +32,7 @@ spec:
       name: "{{ .name }}"
       labels:
         environment: "{{ .environment }}"
+        cnoe.io/package-name: adhar-stack
     spec:
       project: default
       sources:

platform/stack/environments/local/config.yaml

@@ -31,8 +31,13 @@ packages:
     install: "true"
     manifestPath: "application/argo-workflows"
     isChart: "true"
-  - name: backstage
+  - name: adhar-console
     namespace: backstage
     install: "true"
-    manifestPath: "application/backstage"
-    isChart: "true"
+    manifestPath: "core/adhar-console"
+    isChart: "true"
+  - name: adhar-templates
+    namespace: backstage
+    install: "true"
+    manifestPath: "application/adhar-templates"
+    isChart: "false"

platform/stack/packages/application/backstage-templates/app-with-bucket/skeleton/catalog-info.yaml → platform/stack/packages/application/adhar-templates/app-with-bucket/skeleton/catalog-info.yaml

@@ -19,7 +19,7 @@ metadata:
     backstage.io/kubernetes-namespace: default
     argocd/app-name: ${{values.name | dump}}
   links:
-    - url: https://cnoe.localtest.me:8443/gitea
+    - url: https://adhar.localtest.me:8443/gitea
       title: Repo URL
       icon: github
 spec:

platform/stack/packages/application/backstage-templates/basic/skeleton/catalog-info.yaml → platform/stack/packages/application/adhar-templates/basic/skeleton/catalog-info.yaml

@@ -9,7 +9,7 @@ metadata:
     backstage.io/kubernetes-namespace: default
     argocd/app-name: ${{values.name | dump}}
   links:
-    - url: https://cnoe.localtest.me:8443/gitea
+    - url: https://adhar.localtest.me:8443/gitea
       title: Repo URL
       icon: github
 spec:

platform/stack/packages/application/backstage/Chart.yaml → platform/stack/packages/core/adhar-console/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
-name: backstage
-description: Helm chart for CNOE backstage ref implementation
+name: adhar-console
+description: Helm chart for ADHAR backstage ref implementation
 
 # A chart can be either an 'application' or a 'library' chart.
 #

platform/stack/packages/application/backstage/templates/backstage/config-map.yaml → platform/stack/packages/core/adhar-console/templates/backstage/config-map.yaml

@@ -6,10 +6,10 @@ metadata:
 data:
   app-config.yaml: |
     app:
-      title: CNOE Backstage
+      title: Adhar Backstage
       baseUrl: https://{{ .Values.networking.host }}:{{ .Values.networking.port }}
     organization:
-      name: CNOE
+      name: Adhar
     backend:
       # Used for enabling authentication, secret is shared by all backend plugins
       # See https://backstage.io/docs/tutorials/backend-to-backend-auth for

platform/stack/packages/security/keycloak/templates/secret-gen.yaml

@@ -27,13 +27,13 @@ spec:
           cnoe.io/package-name: keycloak
       engineVersion: v2
       data:
-        KEYCLOAK_ADMIN_PASSWORD: password #"{{.KEYCLOAK_ADMIN_PASSWORD}}"
+        KEYCLOAK_ADMIN_PASSWORD: "{{.KEYCLOAK_ADMIN_PASSWORD}}"
         KC_DB_USERNAME: keycloak
-        KC_DB_PASSWORD: password #"{{.KC_DB_PASSWORD}}"
+        KC_DB_PASSWORD: "{{.KC_DB_PASSWORD}}"
         POSTGRES_DB: keycloak
         POSTGRES_USER: keycloak
-        POSTGRES_PASSWORD: password #"{{.KC_DB_PASSWORD}}"
-        USER_PASSWORD: password #"{{.USER_PASSWORD}}"
+        POSTGRES_PASSWORD: "{{.KC_DB_PASSWORD}}"
+        USER_PASSWORD: "{{.USER_PASSWORD}}"
   dataFrom:
     - sourceRef:
         generatorRef: