Add new images for static forgejo runners

Refs: DevFW/infra-deploy#116

.gitignore

@@ -0,0 +1 @@
+/.history

README.md

@@ -1,7 +1,3 @@
 # edpbuilder stacks
 
-This repository contains the building blocks to instanciate Internal Developer Platform's.
-
-### Install edpbuilder
-
-To get started, you need to install [edpbuilder](https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW/edpbuilder).
+This repository contains the building blocks to instantiate Internal Developer Platforms.

template/edfbuilder.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: registry
-    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/registry"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/coder.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: ref-implementation
+  name: coder-reg
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/ref-implementation
-    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/coder"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/core.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/core
-    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/docs.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: docs-reg
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    name: in-cluster
+    namespace: argocd
+  source:
+    path: argocd-stack
+    repoURL: "https://edp.buildth.ing/DevFW-CICD/website-and-documentation"
+    targetRevision: HEAD
+  project: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  syncOptions:
+    - CreateNamespace=true

template/registry/forgejo.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: second-cluster
+  name: forgejo
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/second-cluster
-    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/garm.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: monitoring
+  name: garm-reg
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/monitoring
-    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/garm"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/observability-client.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: observability-client
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    name: in-cluster
+    namespace: argocd
+  source:
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    targetRevision: HEAD
+  project: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

template/registry/observability.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: observability
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    name: in-cluster
+    namespace: argocd
+  source:
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    targetRevision: HEAD
+  project: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

template/registry/otc.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: local-backup
+  name: otc
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/local-backup
-    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/terralist.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: terralist-reg
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    name: in-cluster
+    namespace: argocd
+  source:
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/terralist"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    targetRevision: HEAD
+  project: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

template/stacks/coder/coder.yaml

@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: coder
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: coder
+  sources:
+    - repoURL: https://helm.coder.com/v2
+      chart: coder
+      targetRevision: 2.28.3
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/coder/coder/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/coder/coder/manifests"

template/stacks/coder/coder/manifests/postgres.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: coder-db
+  namespace: coder
+spec:
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  resources:
+    requests:
+      memory: "1Gi"
+      cpu: "1"
+    limits:
+      memory: "1Gi"
+      cpu: "1"
+  managed:
+    roles:
+      - name: coder
+        createdb: true
+        login: true
+        passwordSecret:
+          name: coder-db-user
+  storage:
+    size: 10Gi
+    storageClass: csi-disk
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: coder
+  namespace: coder
+spec:
+  cluster:
+    name: coder-db
+  name: coder
+  owner: coder
+---

template/stacks/coder/coder/values.yaml

@@ -0,0 +1,61 @@
+coder:
+  # You can specify any environment variables you'd like to pass to Coder
+  # here. Coder consumes environment variables listed in
+  # `coder server --help`, and these environment variables are also passed
+  # to the workspace provisioner (so you can consume them in your Terraform
+  # templates for auth keys etc.).
+  #
+  # Please keep in mind that you should not set `CODER_HTTP_ADDRESS`,
+  # `CODER_TLS_ENABLE`, `CODER_TLS_CERT_FILE` or `CODER_TLS_KEY_FILE` as
+  # they are already set by the Helm chart and will cause conflicts.
+  env:
+    - name: CODER_ACCESS_URL
+      value: https://coder.{{{ .Env.DOMAIN_GITEA }}}
+    - name: CODER_PG_CONNECTION_URL
+      valueFrom:
+        secretKeyRef:
+          # You'll need to create a secret called coder-db-url with your
+          # Postgres connection URL like:
+          # postgres://coder:password@postgres:5432/coder?sslmode=disable
+          name: coder-db-user
+          key: url
+    # For production deployments, we recommend configuring your own GitHub
+    # OAuth2 provider and disabling the default one.
+    - name: CODER_OAUTH2_GITHUB_DEFAULT_PROVIDER_ENABLE
+      value: "false"
+    - name: EDGE_CONNECT_ENDPOINT
+      valueFrom:
+        secretKeyRef:
+          name: edge-credential
+          key: endpoint
+    - name: EDGE_CONNECT_USERNAME
+      valueFrom:
+        secretKeyRef:
+          name: edge-credential
+          key: username
+    - name: EDGE_CONNECT_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: edge-credential
+          key: password
+
+    # (Optional) For production deployments the access URL should be set.
+    # If you're just trying Coder, access the dashboard via the service IP.
+    # - name: CODER_ACCESS_URL
+    #   value: "https://coder.example.com"
+
+  #tls:
+  #  secretNames:
+  #    - my-tls-secret-name
+  service:
+    type: ClusterIP
+
+  ingress:
+    enable: true
+    className: nginx
+    host: coder.{{{ .Env.DOMAIN_GITEA }}}
+    annotations:
+      cert-manager.io/cluster-issuer: main
+    tls:
+      enable: true
+      secretName: coder-tls-secret

template/stacks/core/argocd.yaml

@@ -12,16 +12,24 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+    retry:
+      limit: -1
   destination:
     name: in-cluster
     namespace: argocd
   sources:
-    - repoURL: https://github.com/argoproj/argo-helm
+    - repoURL: https://github.com/argoproj/argo-helm.git
       path: charts/argo-cd
-      targetRevision: argo-cd-7.7.5
+      # TODO: RIRE Can be updated when https://github.com/argoproj/argo-cd/issues/20790 is fixed and merged
+      # As logout make problems, it is suggested to switch from path based routing to an own argocd domain,
+      # similar to the CNOE amazon reference implementation and in our case, Forgejo
+      targetRevision: argo-cd-9.1.5
       helm:
         valueFiles:
-          - $values/stacks/core/argocd/values.yaml
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/manifests"

template/stacks/core/argocd/manifests/argocd-server-ingress.yaml

@@ -4,11 +4,10 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
-    nginx.ingress.kubernetes.io/use-regex: "true"
+    cert-manager.io/cluster-issuer: main
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
     dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN }}}
+    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_ARGOCD }}}
     dns.gardener.cloud/ttl: "600"
 {{{ end }}}
   name: argocd-server
@@ -16,7 +15,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: {{{ .Env.DOMAIN }}}
+  - host: {{{ .Env.DOMAIN_ARGOCD }}}
     http:
       paths:
       - backend:
@@ -24,9 +23,9 @@ spec:
             name: argocd-server
             port:
               number: 80
-        path: /argocd(/|$)(.*)
-        pathType: ImplementationSpecific
+        path: /
+        pathType: Prefix
   tls:
   - hosts:
-    - {{{ .Env.DOMAIN }}}
+    - {{{ .Env.DOMAIN_ARGOCD }}}
     secretName: argocd-net-tls

template/stacks/core/argocd/values.yaml

@@ -1,11 +1,20 @@
 global:
-  domain: {{{ .Env.DOMAIN }}}
+  domain: {{{ .Env.DOMAIN_ARGOCD }}}
 
 configs:
   params:
     server.insecure: true
-    server.basehref: /argocd
   cm:
+    oidc.config: |
+      name: FORGEJO
+      issuer: https://{{{ .Env.DOMAIN_DEX }}}
+      clientID: controller-argocd-dex
+      clientSecret: $dex-argo-client:clientSecret
+      requestedScopes:
+      - openid
+      - profile
+      - email
+      - groups
     application.resourceTrackingMethod: annotation
     timeout.reconciliation: 60s
     resource.exclusions: |
@@ -19,9 +28,9 @@ configs:
         - CiliumIdentity
         clusters:
         - "*"
-    accounts.provider-argocd: apiKey
+    url: https://{{{ .Env.DOMAIN_ARGOCD }}}
   rbac:
-    policy.csv: 'g, provider-argocd, role:admin'
+    policy.csv: 'g, DevFW, role:admin'
 
   tls:
     certificates:

template/stacks/core/cloudnative-pg.yaml

@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cloudnative-pg
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: cloudnative-pg
+  sources:
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      targetRevision: 0.26.1
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/cloudnative-pg/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values

template/stacks/core/cloudnative-pg/values.yaml

@@ -0,0 +1 @@
+# No need for values here.

template/stacks/core/crossplane-compositions.yaml

@@ -1,23 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: crossplane-compositions
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: crossplane-system
-  source:
-    path: stacks/core/crossplane-compositions
-    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    directory:
-      recurse: true

template/stacks/core/crossplane-compositions/edfbuilder/definition.yaml

@@ -1,30 +0,0 @@
-apiVersion: apiextensions.crossplane.io/v1
-kind: CompositeResourceDefinition
-metadata:
-  name: edfbuilders.edfbuilder.crossplane.io
-spec:
-  connectionSecretKeys:
-    - kubeconfig
-  group: edfbuilder.crossplane.io
-  names:
-    kind: EDFBuilder
-    listKind: EDFBuilderList
-    plural: edfbuilders
-    singular: edfbuilders
-  versions:
-    - name: v1alpha1
-      served: true
-      referenceable: true
-      schema:
-        openAPIV3Schema:
-          description: A EDFBuilder is a composite resource that represents a K8S Cluster with edfbuilder Installed
-          type: object
-          properties:
-            spec:
-              type: object
-              properties:
-                repoURL:
-                  type: string
-                  description: URL to ArgoCD stack of stacks repo
-              required:
-                - repoURL

template/stacks/core/crossplane-providers.yaml

@@ -1,23 +0,0 @@
-{{{ if eq .Env.CLUSTER_TYPE "kind" }}}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: crossplane-providers
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: crossplane-system
-  source:
-    path: stacks/core/crossplane-providers
-    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-{{{ end }}}

template/stacks/core/crossplane-providers/function-patch-and-transform.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Function
-metadata:
-  name: crossplane-contrib-function-patch-and-transform
-spec:
-  package: xpkg.upbound.io/crossplane-contrib/function-patch-and-transform:v0.7.0
-  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
-  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
-  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-argocd-config.yaml

@@ -1,14 +0,0 @@
-apiVersion: argocd.crossplane.io/v1alpha1
-kind: ProviderConfig
-metadata:
-  name: argocd-provider
-spec:
-  serverAddr: argocd-server.argocd.svc.cluster.local:80
-  insecure: true
-  plainText: true
-  credentials:
-    source: Secret
-    secretRef:
-      namespace: crossplane-system
-      name: argocd-credentials
-      key: authToken

template/stacks/core/crossplane-providers/provider-argocd.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Provider
-metadata:
-  name: provider-argocd
-spec:
-  package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.9.1
-  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
-  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
-  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-kind-config.yaml

@@ -1,14 +0,0 @@
-apiVersion: kind.crossplane.io/v1alpha1
-kind: ProviderConfig
-metadata:
-  name: kind-provider
-spec:
-  credentials:
-    source: Secret
-    secretRef:
-      namespace: crossplane-system
-      name: kind-credentials
-      key: credentials
-  endpoint:
-    # the url is managed by crossplane-edfbuilder
-    url: https://DOCKER_HOST:SERVER_PORT/api/v1/kindserver

template/stacks/core/crossplane-providers/provider-kind.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Provider
-metadata:
-  name: provider-kind
-spec:
-  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-kind:v0.1.0
-  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
-  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
-  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-shell.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Provider
-metadata:
-  name: provider-shell
-spec:
-  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-shell:v0.1.1
-  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
-  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
-  revisionHistoryLimit: 1

template/stacks/core/crossplane.yaml

@@ -1,23 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: crossplane
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: crossplane-system
-  source:
-    chart: crossplane
-    repoURL: https://charts.crossplane.io/stable
-    targetRevision: 1.18.0
-    helm:
-      releaseName: crossplane

template/stacks/core/dex.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: forgejo
+  name: dex
   namespace: argocd
   labels:
     env: dev
@@ -12,16 +12,18 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+    retry:
+      limit: -1
   destination:
     name: in-cluster
-    namespace: gitea
+    namespace: dex
   sources:
-    - repoURL: https://code.forgejo.org/forgejo-helm/forgejo-helm.git
-      path: .
-      targetRevision: v10.1.1
+    - repoURL: https://charts.dexidp.io
+      chart: dex
+      targetRevision: 0.23.0
       helm:
         valueFiles:
-          - $values/stacks/core/forgejo/values.yaml
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/dex/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values

template/stacks/core/dex/values.yaml

@@ -0,0 +1,76 @@
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: main
+  hosts:
+    - host: {{{ .Env.DOMAIN_DEX }}}
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - {{{ .Env.DOMAIN_DEX }}}
+      secretName: dex-cert
+
+envVars:
+  - name: FORGEJO_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: dex-forgejo-client
+        key: clientSecret
+  - name: FORGEJO_CLIENT_ID
+    valueFrom:
+      secretKeyRef:
+        name: dex-forgejo-client
+        key: clientID
+  - name: OIDC_DEX_GRAFANA_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: dex-grafana-client
+        key: clientSecret
+  - name: OIDC_DEX_ARGO_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: dex-argo-client
+        key: clientSecret
+  - name: LOG_LEVEL
+    value: debug
+
+config:
+  # Set it to a valid URL
+  issuer: https://{{{ .Env.DOMAIN_DEX }}}
+
+  # See https://dexidp.io/docs/storage/ for more options
+  storage:
+    type: memory
+
+  oauth2:
+    skipApprovalScreen: true
+    alwaysShowLoginScreen: false
+
+  connectors:
+    - type: gitea
+      id: gitea
+      name: Forgejo
+      config:
+        clientID: "$FORGEJO_CLIENT_ID"
+        clientSecret: "$FORGEJO_CLIENT_SECRET"
+        redirectURI: https://{{{ .Env.DOMAIN_DEX }}}/callback
+        baseURL: https://edp.buildth.ing
+        # loadAllGroups: true
+        orgs:
+          - name: DevFW
+  enablePasswordDB: false
+
+  staticClients:
+    - id: controller-argocd-dex
+      name: ArgoCD Client
+      redirectURIs:
+        - "https://{{{ .Env.DOMAIN_ARGOCD }}}/auth/callback"
+      secretEnv: "OIDC_DEX_ARGO_CLIENT_SECRET"
+    - id: grafana
+      redirectURIs:
+        - "https://{{{ .Env.DOMAIN_GRAFANA }}}/login/generic_oauth"
+      name: "Grafana"
+      secretEnv: "OIDC_DEX_GRAFANA_CLIENT_SECRET"

template/stacks/core/forgejo/hydrated/install.yaml

@@ -1,619 +0,0 @@
----
-# Source: forgejo/templates/gitea/config.yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: forgejo-inline-config
-  namespace: "gitea"
-  labels:
-    helm.sh/chart: forgejo-0.0.0
-    app: forgejo
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
-    app.kubernetes.io/version: "9.0.2"
-    version: "9.0.2"
-    app.kubernetes.io/managed-by: Helm
-type: Opaque
-stringData:
-  _generals_: |-
-    APP_NAME=Forgejo: Beyond coding. We forge.
-    RUN_MODE=prod
-  cache: |-
-    ADAPTER=memory
-    HOST=
-  database: DB_TYPE=sqlite3
-  indexer: ISSUE_INDEXER_TYPE=db
-  metrics: ENABLED=false
-  queue: |-
-    CONN_STR=
-    TYPE=level
-  repository: ROOT=/data/git/gitea-repositories
-  security: INSTALL_LOCK=true
-  server: |-
-    APP_DATA_PATH=/data
-    DOMAIN=gitea.runner.c-one-infra.de
-    ENABLE_PPROF=false
-    HTTP_PORT=3000
-    PROTOCOL=http
-    ROOT_URL=https://gitea.runner.c-one-infra.de:443
-    SSH_DOMAIN=gitea.runner.c-one-infra.de
-    SSH_LISTEN_PORT=2222
-    SSH_PORT=22
-    START_SSH_SERVER=true
-  session: |-
-    PROVIDER=memory
-    PROVIDER_CONFIG=
----
-# Source: forgejo/templates/gitea/config.yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: forgejo
-  labels:
-    helm.sh/chart: forgejo-0.0.0
-    app: forgejo
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
-    app.kubernetes.io/version: "9.0.2"
-    version: "9.0.2"
-    app.kubernetes.io/managed-by: Helm
-type: Opaque
-stringData:
-  assertions: |
-  config_environment.sh: |-
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    function env2ini::log() {
-      printf "${1}\n"
-    }
-
-    function env2ini::read_config_to_env() {
-      local section="${1}"
-      local line="${2}"
-
-      if [[ -z "${line}" ]]; then
-        # skip empty line
-        return
-      fi
-
-      # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-      local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
-
-      if [[ -z "${setting}" ]]; then
-        env2ini::log '  ! invalid setting'
-        exit 1
-      fi
-
-      local value=''
-      local regex="^${setting}(\s*)=(\s*)(.*)"
-      if [[ $line =~ $regex ]]; then
-        value="${BASH_REMATCH[3]}"
-      else
-        env2ini::log '  ! invalid setting'
-        exit 1
-      fi
-
-      env2ini::log "    + '${setting}'"
-
-      if [[ -z "${section}" ]]; then
-        export "FORGEJO____${setting^^}=${value}"                           # '^^' makes the variable content uppercase
-        return
-      fi
-
-      local masked_section="${section//./_0X2E_}"                           # '//' instructs to replace all matches
-      masked_section="${masked_section//-/_0X2D_}"
-
-      export "FORGEJO__${masked_section^^}__${setting^^}=${value}"          # '^^' makes the variable content uppercase
-    }
-
-    function env2ini::reload_preset_envs() {
-      env2ini::log "Reloading preset envs..."
-
-      while read -r line; do
-        if [[ -z "${line}" ]]; then
-          # skip empty line
-          return
-        fi
-
-        # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-        local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
-
-        if [[ -z "${setting}" ]]; then
-          env2ini::log '  ! invalid setting'
-          exit 1
-        fi
-
-        local value=''
-        local regex="^${setting}(\s*)=(\s*)(.*)"
-        if [[ $line =~ $regex ]]; then
-          value="${BASH_REMATCH[3]}"
-        else
-          env2ini::log '  ! invalid setting'
-          exit 1
-        fi
-
-        env2ini::log "  + '${setting}'"
-
-        export "${setting^^}=${value}"                           # '^^' makes the variable content uppercase
-      done < "/tmp/existing-envs"
-
-      rm /tmp/existing-envs
-    }
-
-
-    function env2ini::process_config_file() {
-      local config_file="${1}"
-      local section="$(basename "${config_file}")"
-
-      if [[ $section == '_generals_' ]]; then
-        env2ini::log "  [ini root]"
-        section=''
-      else
-        env2ini::log "  ${section}"
-      fi
-
-      while read -r line; do
-        env2ini::read_config_to_env "${section}" "${line}"
-      done < <(awk 1 "${config_file}")                             # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
-    }
-
-    function env2ini::load_config_sources() {
-      local path="${1}"
-
-      if [[ -d "${path}" ]]; then
-        env2ini::log "Processing $(basename "${path}")..."
-
-        while read -d '' configFile; do
-          env2ini::process_config_file "${configFile}"
-        done < <(find "${path}" -type l -not -name '..data' -print0)
-
-        env2ini::log "\n"
-      fi
-    }
-
-    function env2ini::generate_initial_secrets() {
-      # These environment variables will either be
-      #   - overwritten with user defined values,
-      #   - initially used to set up Forgejo
-      # Anyway, they won't harm existing app.ini files
-
-      export FORGEJO__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
-      export FORGEJO__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
-      export FORGEJO__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
-      export FORGEJO__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
-
-      env2ini::log "...Initial secrets generated\n"
-    }
-
-    # save existing envs prior to script execution. Necessary to keep order of
-    # preexisting and custom envs
-    env | (grep -e '^FORGEJO__' || [[ $? == 1 ]]) > /tmp/existing-envs
-
-    # MUST BE CALLED BEFORE OTHER CONFIGURATION
-    env2ini::generate_initial_secrets
-
-    env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
-    env2ini::load_config_sources '/env-to-ini-mounts/additionals/'
-
-    # load existing envs to override auto generated envs
-    env2ini::reload_preset_envs
-
-    env2ini::log "=== All configuration sources loaded ===\n"
-
-    # safety to prevent rewrite of secret keys if an app.ini already exists
-    if [ -f ${GITEA_APP_INI} ]; then
-      env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
-      env2ini::log '  - security.INTERNAL_TOKEN'
-      env2ini::log '  - security.SECRET_KEY'
-      env2ini::log '  - oauth2.JWT_SECRET'
-      env2ini::log '  - server.LFS_JWT_SECRET'
-
-      unset FORGEJO__SECURITY__INTERNAL_TOKEN
-      unset FORGEJO__SECURITY__SECRET_KEY
-      unset FORGEJO__OAUTH2__JWT_SECRET
-      unset FORGEJO__SERVER__LFS_JWT_SECRET
-    fi
-
-    environment-to-ini -o $GITEA_APP_INI
----
-# Source: forgejo/templates/gitea/init.yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: forgejo-init
-  namespace: "gitea"
-  labels:
-    helm.sh/chart: forgejo-0.0.0
-    app: forgejo
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
-    app.kubernetes.io/version: "9.0.2"
-    version: "9.0.2"
-    app.kubernetes.io/managed-by: Helm
-type: Opaque
-stringData:
-  configure_gpg_environment.sh: |-
-    #!/usr/bin/env bash
-    set -eu
-
-    gpg --batch --import /raw/private.asc
-  init_directory_structure.sh: |-
-    #!/usr/bin/env bash
-
-    set -euo pipefail
-
-    set -x
-    mkdir -p /data/git/.ssh
-    chmod -R 700 /data/git/.ssh
-    [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
-
-    # prepare temp directory structure
-    mkdir -p "${GITEA_TEMP}"
-    chmod ug+rwx "${GITEA_TEMP}"
-
-    
-
-  configure_gitea.sh: |-
-    #!/usr/bin/env bash
-
-    set -euo pipefail
-
-    echo '==== BEGIN GITEA CONFIGURATION ===='
-
-    { # try
-      gitea migrate
-    } || { # catch
-      echo "Forgejo migrate might fail due to database connection...This init-container will try again in a few seconds"
-      exit 1
-    }
-    function configure_admin_user() {
-      local full_admin_list=$(gitea admin user list --admin)
-      local actual_user_table=''
-
-      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-      local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
-      if [[ "${full_admin_list}" =~ $regex ]]; then
-        actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-      else
-        # This code block should never be reached, as long as the output table header remains the same.
-        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-        echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
-        echo "       Please review the output of 'gitea admin user list --admin' shown below."
-        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-chart/issues."
-        echo "DEBUG: Output of 'gitea admin user list --admin'"
-        echo "--"
-        echo "${full_admin_list}"
-        echo "--"
-        exit 1
-      fi
-
-      local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
-      if [[ -z "${ACCOUNT_ID}" ]]; then
-        local -a create_args
-        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain")
-        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
-          create_args+=(--must-change-password=true)
-        else
-          create_args+=(--must-change-password=false)
-        fi
-        echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
-        gitea admin user create "${create_args[@]}"
-        echo '...created.'
-      else
-        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
-          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
-          local -a change_args
-          change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --must-change-password=false)
-          gitea admin user change-password "${change_args[@]}"
-          echo '...password sync done.'
-        else
-          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
-        fi
-      fi
-    }
-
-    configure_admin_user
-
-    function configure_ldap() {
-        echo 'no ldap configuration... skipping.'
-    }
-
-    configure_ldap
-
-    function configure_oauth() {
-        echo 'no oauth configuration... skipping.'
-    }
-
-    configure_oauth
-
-    echo '==== END GITEA CONFIGURATION ===='
----
-# Source: forgejo/templates/gitea/pvc.yaml
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: gitea-shared-storage
-  namespace: "gitea"
-  annotations:
-    helm.sh/resource-policy: keep
-spec:
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  
-  resources:
-    requests:
-      storage: 5Gi
----
-# Source: forgejo/templates/gitea/http-svc.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: forgejo-http
-  namespace: "gitea"
-  labels:
-    helm.sh/chart: forgejo-0.0.0
-    app: forgejo
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
-    app.kubernetes.io/version: "9.0.2"
-    version: "9.0.2"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-  - name: http
-    port: 3000
-    targetPort: 
-  selector:
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
----
-# Source: forgejo/templates/gitea/ssh-svc.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: forgejo-ssh
-  namespace: "gitea"
-  labels:
-    helm.sh/chart: forgejo-0.0.0
-    app: forgejo
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
-    app.kubernetes.io/version: "9.0.2"
-    version: "9.0.2"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: NodePort
-  externalTrafficPolicy: Local
-  ports:
-  - name: ssh
-    port: 22
-    targetPort: 2222
-    protocol: TCP
-    nodePort: 32222
-  selector:
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
----
-# Source: forgejo/templates/gitea/deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: forgejo
-  namespace: "gitea"
-  annotations:
-  labels:
-    helm.sh/chart: forgejo-0.0.0
-    app: forgejo
-    app.kubernetes.io/name: forgejo
-    app.kubernetes.io/instance: forgejo
-    app.kubernetes.io/version: "9.0.2"
-    version: "9.0.2"
-    app.kubernetes.io/managed-by: Helm
-spec:
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 100%
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: forgejo
-      app.kubernetes.io/instance: forgejo
-  template:
-    metadata:
-      annotations:
-        checksum/config: bd40d1abc2e2692fafe0821e9345e231261f194a19fbee5aef7dd9cdfc106596
-      labels:
-        helm.sh/chart: forgejo-0.0.0
-        app: forgejo
-        app.kubernetes.io/name: forgejo
-        app.kubernetes.io/instance: forgejo
-        app.kubernetes.io/version: "9.0.2"
-        version: "9.0.2"
-        app.kubernetes.io/managed-by: Helm
-    spec:
-      
-      securityContext:
-        fsGroup: 1000
-      initContainers:
-        - name: init-directories
-          image: "code.forgejo.org/forgejo/forgejo:9.0.2-rootless"
-          imagePullPolicy: IfNotPresent
-          command: ["/usr/sbin/init_directory_structure.sh"]
-          env:
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-          volumeMounts:
-            - name: init
-              mountPath: /usr/sbin
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-            
-          securityContext:
-            {}
-          resources:
-            limits: {}
-            requests:
-              cpu: 100m
-              memory: 128Mi
-        - name: init-app-ini
-          image: "code.forgejo.org/forgejo/forgejo:9.0.2-rootless"
-          imagePullPolicy: IfNotPresent
-          command: ["/usr/sbin/config_environment.sh"]
-          env:
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-          volumeMounts:
-            - name: config
-              mountPath: /usr/sbin
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-            - name: inline-config-sources
-              mountPath: /env-to-ini-mounts/inlines/
-            
-          securityContext:
-            {}
-          resources:
-            limits: {}
-            requests:
-              cpu: 100m
-              memory: 128Mi
-        - name: configure-gitea
-          image: "code.forgejo.org/forgejo/forgejo:9.0.2-rootless"
-          command: ["/usr/sbin/configure_gitea.sh"]
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 1000
-          env:
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-            - name: HOME
-              value: /data/gitea/git
-            - name: GITEA_ADMIN_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  key:  username
-                  name: gitea-credential
-            - name: GITEA_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  key:  password
-                  name: gitea-credential
-            - name: GITEA_ADMIN_PASSWORD_MODE
-              value: keepUpdated
-          volumeMounts:
-            - name: init
-              mountPath: /usr/sbin
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-            
-          resources:
-            limits: {}
-            requests:
-              cpu: 100m
-              memory: 128Mi
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: forgejo
-          image: "code.forgejo.org/forgejo/forgejo:9.0.2-rootless"
-          imagePullPolicy: IfNotPresent
-          env:
-            # SSH Port values have to be set here as well for openssh configuration
-            - name: SSH_LISTEN_PORT
-              value: "2222"
-            - name: SSH_PORT
-              value: "22"
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-            - name: TMPDIR
-              value: /tmp/gitea
-            - name: HOME
-              value: /data/gitea/git
-          ports:
-            - name: ssh
-              containerPort: 2222
-            - name: http
-              containerPort: 3000
-          livenessProbe:
-            failureThreshold: 10
-            initialDelaySeconds: 200
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: http
-            timeoutSeconds: 1
-          readinessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: http
-            timeoutSeconds: 1
-          resources:
-            {}
-          securityContext:
-            {}
-          volumeMounts:
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-            
-      volumes:
-        - name: init
-          secret:
-            secretName: forgejo-init
-            defaultMode: 110
-        - name: config
-          secret:
-            secretName: forgejo
-            defaultMode: 110
-        - name: inline-config-sources
-          secret:
-            secretName: forgejo-inline-config
-        - name: temp
-          emptyDir: {}
-        - name: data
-          persistentVolumeClaim:
-            claimName: gitea-shared-storage

template/stacks/core/forgejo/values.yaml

@@ -1,55 +0,0 @@
-redis-cluster:
-  enabled: false
-postgresql:
-  enabled: false
-postgresql-ha:
-  enabled: false
-
-persistence:
-  enabled: true
-  size: 5Gi
-
-test:
-  enabled: false
-
-gitea:
-  admin:
-    existingSecret: gitea-credential
-  config:
-    database:
-      DB_TYPE: sqlite3
-    session:
-      PROVIDER: memory
-    cache:
-      ADAPTER: memory
-    queue:
-      TYPE: level
-    server:
-      DOMAIN: 'gitea.{{{ .Env.DOMAIN }}}'
-      ROOT_URL: 'https://gitea.{{{ .Env.DOMAIN }}}:443'
-
-service:
-  ssh:
-    type: NodePort
-    nodePort: 32222
-    externalTrafficPolicy: Local
-
-image:
-  pullPolicy: "IfNotPresent"
-  # Overrides the image tag whose default is the chart appVersion.
-  #tag: "8.0.3"
-  # Adds -rootless suffix to image name
-  rootless: true
-
-forgejo:
-  runner:
-    enabled: true
-    image:
-      tag: latest
-    # replicas: 3
-    config:
-      runner:
-        labels:
-          - docker:docker://node:16-bullseye
-          - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
-          - ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04

template/stacks/core/ingress-apps.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ingress-apps
-  namespace: argocd
-  labels:
-    example: ref-implementation
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    server: "https://kubernetes.default.svc"
-  source:
-    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/core/ingress-apps"
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

template/stacks/core/ingress-apps/argo-workflows-ingress.yaml

@@ -1,31 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
-    nginx.ingress.kubernetes.io/use-regex: "true"
-  name: argo-workflows-ingress
-  namespace: argo
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: localhost
-    http:
-      paths:
-      - backend:
-          service:
-            name: argo-server
-            port:
-              name: web
-        path: /argo-workflows(/|$)(.*)
-        pathType: ImplementationSpecific
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: argo-server
-            port:
-              name: web
-        path: /argo-workflows(/|$)(.*)
-        pathType: ImplementationSpecific

template/stacks/core/ingress-apps/backstage.yaml

@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: backstage
-  namespace: backstage
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: localhost
-    http:
-      paths:
-      - backend:
-          service:
-            name: backstage
-            port:
-              name: http
-        path: /
-        pathType: Prefix
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: backstage
-            port:
-              name: http
-        path: /
-        pathType: Prefix

template/stacks/core/ingress-apps/fibonacci-service.yaml

@@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fibonacci-service
-  namespace: fibonacci-app
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: fibonacci-service
-            port:
-              number: 9090
-        path: /fibonacci
-        pathType: Prefix

template/stacks/core/ingress-apps/keycloak-ingress-localhost.yaml

@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: keycloak-ingress-localhost
-  namespace: keycloak
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: localhost
-    http:
-      paths:
-      - backend:
-          service:
-            name: keycloak
-            port:
-              name: http
-        path: /keycloak
-        pathType: ImplementationSpecific
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: keycloak
-            port:
-              name: http
-        path: /keycloak
-        pathType: ImplementationSpecific

template/stacks/core/ingress-apps/kube-prometheus-stack-grafana.yaml

@@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kube-prometheus-stack-grafana
-  namespace: monitoring
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: kube-prometheus-stack-grafana
-            port:
-              number: 80
-        path: /grafana
-        pathType: Prefix

template/stacks/core/ingress-apps/minio-console.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: minio-console
-  namespace: minio-backup
-{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
-  annotations:
-    dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: minio-backup.{{{ .Env.DOMAIN }}}
-    dns.gardener.cloud/ttl: "600"
-{{{ end }}}
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: minio-backup.{{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: minio-console
-            port:
-              number: 9001
-        path: /
-        pathType: Prefix

template/stacks/core/ingress-apps/openbao.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: openbao
-  namespace: openbao
-{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
-  annotations:
-    dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: openbao.{{{ .Env.DOMAIN }}}
-    dns.gardener.cloud/ttl: "600"
-{{{ end }}}
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: openbao.{{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: openbao
-            port:
-              number: 8200
-        path: /
-        pathType: Prefix

template/stacks/core/ingress-nginx/hydrated/install.yaml

@@ -1,816 +0,0 @@
----
-# Source: ingress-nginx/templates/controller-serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx
-  namespace: ingress-nginx
-automountServiceAccountToken: true
----
-# Source: ingress-nginx/templates/controller-configmap.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-data:
-  allow-snippet-annotations: "true"
-  proxy-buffer-size: "32k"
-  use-forwarded-headers: "true"
----
-# Source: ingress-nginx/templates/clusterrole.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-  name: ingress-nginx
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - endpoints
-      - nodes
-      - pods
-      - secrets
-      - namespaces
-    verbs:
-      - list
-      - watch
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - list
-      - watch
-      - get
----
-# Source: ingress-nginx/templates/clusterrolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-  name: ingress-nginx
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ingress-nginx
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/controller-role.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx
-  namespace: ingress-nginx
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - pods
-      - secrets
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  # Omit Ingress status permissions if `--update-status` is disabled.
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    resourceNames:
-      - ingress-nginx-leader
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - create
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - list
-      - watch
-      - get
----
-# Source: ingress-nginx/templates/controller-rolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx
-  namespace: ingress-nginx
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ingress-nginx
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/controller-service-metrics.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller-metrics
-  namespace: ingress-nginx
-spec:
-  type: ClusterIP
-  ports:
-    - name: metrics
-      port: 10254
-      protocol: TCP
-      targetPort: metrics
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/component: controller
----
-# Source: ingress-nginx/templates/controller-service-webhook.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller-admission
-  namespace: ingress-nginx
-spec:
-  type: ClusterIP
-  ports:
-    - name: https-webhook
-      port: 443
-      targetPort: webhook
-      appProtocol: https
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/component: controller
----
-# Source: ingress-nginx/templates/controller-service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-spec:
-  type: NodePort
-  ipFamilyPolicy: SingleStack
-  ipFamilies: 
-    - IPv4
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-      appProtocol: http
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: https
-      appProtocol: https
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/component: controller
----
-# Source: ingress-nginx/templates/controller-deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/component: controller
-  replicas: 1
-  revisionHistoryLimit: 10
-  strategy: 
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  minReadySeconds: 0
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: ingress-nginx-4.11.3
-        app.kubernetes.io/name: ingress-nginx
-        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: "1.11.3"
-        app.kubernetes.io/part-of: ingress-nginx
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: controller
-    spec:
-      dnsPolicy: ClusterFirst
-      containers:
-        - name: controller
-          image: registry.k8s.io/ingress-nginx/controller:v1.11.3@sha256:d56f135b6462cfc476447cfe564b83a45e8bb7da2774963b00d12161112270b7
-          imagePullPolicy: IfNotPresent
-          lifecycle: 
-            preStop:
-              exec:
-                command:
-                - /wait-shutdown
-          args: 
-            - /nginx-ingress-controller
-            - --election-id=ingress-nginx-leader
-            - --controller-class=k8s.io/ingress-nginx
-            - --ingress-class=nginx
-            - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
-            - --validating-webhook=:8443
-            - --validating-webhook-certificate=/usr/local/certificates/cert
-            - --validating-webhook-key=/usr/local/certificates/key
-            - --enable-ssl-passthrough
-            - --publish-status-address=localhost
-          securityContext: 
-            runAsNonRoot: true
-            runAsUser: 101
-            allowPrivilegeEscalation: false
-            seccompProfile: 
-              type: RuntimeDefault
-            capabilities:
-              drop:
-              - ALL
-              add:
-              - NET_BIND_SERVICE
-            readOnlyRootFilesystem: false
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: LD_PRELOAD
-              value: /usr/local/lib/libmimalloc.so
-          livenessProbe: 
-            failureThreshold: 5
-            httpGet:
-              path: /healthz
-              port: 10254
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 1
-          readinessProbe: 
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 10254
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 1
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-              hostPort: 80
-            - name: https
-              containerPort: 443
-              protocol: TCP
-              hostPort: 443
-            - name: metrics
-              containerPort: 10254
-              protocol: TCP
-            - name: webhook
-              containerPort: 8443
-              protocol: TCP
-          volumeMounts:
-            - name: webhook-cert
-              mountPath: /usr/local/certificates/
-              readOnly: true
-          resources: 
-            requests:
-              cpu: 100m
-              memory: 90Mi
-      nodeSelector: 
-        ingress-ready: "true"
-        kubernetes.io/os: linux
-      tolerations: 
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/master
-          operator: Equal
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/control-plane
-          operator: Equal
-      serviceAccountName: ingress-nginx
-      terminationGracePeriodSeconds: 0
-      volumes:
-        - name: webhook-cert
-          secret:
-            secretName: ingress-nginx-admission
----
-# Source: ingress-nginx/templates/controller-ingressclass.yaml
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: nginx
-spec:
-  controller: k8s.io/ingress-nginx
----
-# Source: ingress-nginx/templates/controller-poddisruptionbudget.yaml
-# PDB is not supported for DaemonSets.
-# https://github.com/kubernetes/kubernetes/issues/108124
----
-# Source: ingress-nginx/templates/controller-servicemonitor.yaml
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-    release: ingress-nginx
-spec:
-  endpoints:
-    - port: metrics
-      interval: 30s
-  namespaceSelector:
-    matchNames:
-      - ingress-nginx
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/component: controller
----
-# Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
-# before changing this value, check the required kubernetes version
-# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  annotations:
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-  name: ingress-nginx-admission
-webhooks:
-  - name: validate.nginx.ingress.kubernetes.io
-    matchPolicy: Equivalent
-    rules:
-      - apiGroups:
-          - networking.k8s.io
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - ingresses
-    failurePolicy: Fail
-    sideEffects: None
-    admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: ingress-nginx-controller-admission
-        namespace: ingress-nginx
-        port: 443
-        path: /networking/v1/ingresses
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ingress-nginx-admission
-  namespace: ingress-nginx
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-automountServiceAccountToken: true
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ingress-nginx-admission
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-rules:
-  - apiGroups:
-      - admissionregistration.k8s.io
-    resources:
-      - validatingwebhookconfigurations
-    verbs:
-      - get
-      - update
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ingress-nginx-admission
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ingress-nginx-admission
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx-admission
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: ingress-nginx-admission
-  namespace: ingress-nginx
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - create
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: ingress-nginx-admission
-  namespace: ingress-nginx
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ingress-nginx-admission
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx-admission
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ingress-nginx-admission-create
-  namespace: ingress-nginx
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-spec:
-  template:
-    metadata:
-      name: ingress-nginx-admission-create
-      labels:
-        helm.sh/chart: ingress-nginx-4.11.3
-        app.kubernetes.io/name: ingress-nginx
-        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: "1.11.3"
-        app.kubernetes.io/part-of: ingress-nginx
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: admission-webhook
-    spec:
-      containers:
-        - name: create
-          image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.4@sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f
-          imagePullPolicy: IfNotPresent
-          args:
-            - create
-            - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
-            - --namespace=$(POD_NAMESPACE)
-            - --secret-name=ingress-nginx-admission
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          securityContext: 
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 65532
-            seccompProfile:
-              type: RuntimeDefault
-      restartPolicy: OnFailure
-      serviceAccountName: ingress-nginx-admission
-      nodeSelector: 
-        kubernetes.io/os: linux
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ingress-nginx-admission-patch
-  namespace: ingress-nginx
-  annotations:
-    "helm.sh/hook": post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.11.3
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.11.3"
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-spec:
-  template:
-    metadata:
-      name: ingress-nginx-admission-patch
-      labels:
-        helm.sh/chart: ingress-nginx-4.11.3
-        app.kubernetes.io/name: ingress-nginx
-        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: "1.11.3"
-        app.kubernetes.io/part-of: ingress-nginx
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: admission-webhook
-    spec:
-      containers:
-        - name: patch
-          image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.4@sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f
-          imagePullPolicy: IfNotPresent
-          args:
-            - patch
-            - --webhook-name=ingress-nginx-admission
-            - --namespace=$(POD_NAMESPACE)
-            - --patch-mutating=false
-            - --secret-name=ingress-nginx-admission
-            - --patch-failure-policy=Fail
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          securityContext: 
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 65532
-            seccompProfile:
-              type: RuntimeDefault
-      restartPolicy: OnFailure
-      serviceAccountName: ingress-nginx-admission
-      nodeSelector: 
-        kubernetes.io/os: linux

template/stacks/core/ingress-nginx/values.yaml

@@ -1,49 +0,0 @@
-controller:
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-
-  ingressClassResource:
-    name: nginx
-
-  # added for idpbuilder
-  allowSnippetAnnotations: true
-
-  # added for idpbuilder
-  config:
-    proxy-buffer-size: 32k
-    use-forwarded-headers: "true"
-
-  # monitoring nginx
-  metrics:
-    enabled: true
-    serviceMonitor:
-      additionalLabels: 
-        release: "ingress-nginx"  
-      enabled: true
-
-{{{ if eq .Env.CLUSTER_TYPE "kind" }}}
-  hostPort:
-    enabled: true
-  terminationGracePeriodSeconds: 0
-  service:
-    type: NodePort
-
-  nodeSelector:
-    ingress-ready: "true"
-  tolerations:
-    - key: "node-role.kubernetes.io/master"
-      operator: "Equal"
-      effect: "NoSchedule"
-    - key: "node-role.kubernetes.io/control-plane"
-      operator: "Equal"
-      effect: "NoSchedule"
-
-  publishService:
-    enabled: false
-  extraArgs:
-    publish-status-address: localhost
-    # added for idpbuilder
-    enable-ssl-passthrough: ""
-{{{ end }}}

template/stacks/forgejo/forgejo-runner.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: backstage
+  name: forgejo-runner
   namespace: argocd
   labels:
     env: dev
@@ -9,17 +9,16 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: default
-  source:
-    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/ref-implementation/backstage/manifests"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: backstage
   syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
     automated:
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
     retry:
       limit: -1
+  destination:
+    server: "https://kubernetes.default.svc"
+  source:
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    targetRevision: HEAD
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-runner"

template/stacks/forgejo/forgejo-runner/dind-docker.yaml

@@ -0,0 +1,104 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: forgejo-runner
+  name: forgejo-runner
+  namespace: gitea
+spec:
+  # Two replicas means that if one is busy, the other can pick up jobs.
+  replicas: 3
+  selector:
+    matchLabels:
+      app: forgejo-runner
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: forgejo-runner
+    spec:
+      restartPolicy: Always
+      volumes:
+      - name: docker-certs
+        emptyDir: {}
+      - name: runner-data
+        emptyDir: {}
+      # Initialise our configuration file using offline registration
+      # https://forgejo.org/docs/v1.21/admin/actions/#offline-registration
+      initContainers:
+        - name: runner-register
+          image: code.forgejo.org/forgejo/runner:12.6.4
+          command:
+          - "sh"
+          - "-c"
+          - |
+            forgejo-runner \
+              register \
+              --no-interactive \
+              --token ${RUNNER_SECRET} \
+              --name ${RUNNER_NAME} \
+              --instance ${FORGEJO_INSTANCE_URL} \
+              --labels docker:docker://node:24-bookworm,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-24.04,ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04
+          env:
+            - name: RUNNER_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: RUNNER_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-runner-token
+                  key: token
+            - name: FORGEJO_INSTANCE_URL
+              value: https://{{{ .Env.DOMAIN_GITEA }}}
+          volumeMounts:
+            - name: runner-data
+              mountPath: /data
+      containers:
+      - name: runner
+        image: code.forgejo.org/forgejo/runner:12.6.4
+        command:
+          - "sh"
+          - "-c"
+          - |
+            while ! nc -z 127.0.0.1 2376 </dev/null; do
+              echo 'waiting for docker daemon...';
+              sleep 5;
+            done
+            forgejo-runner generate-config > config.yml ;
+            sed -i -e "s|privileged: .*|privileged: true|" config.yml
+            sed -i -e "s|network: .*|network: host|" config.yml ;
+            sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://127.0.0.1:2376\n    DOCKER_TLS_VERIFY: 1\n    DOCKER_CERT_PATH: /certs/client|" config.yml ;
+            sed -i -e "s|^  options:|  options: -v /certs/client:/certs/client|" config.yml ;
+            sed -i -e "s|  valid_volumes: \[\]$$|  valid_volumes:\n    - /certs/client|" config.yml ;
+            /bin/forgejo-runner --config config.yml daemon
+        securityContext:
+          allowPrivilegeEscalation: true
+          privileged: true
+          readOnlyRootFilesystem: false
+          runAsGroup: 0
+          runAsNonRoot: false
+          runAsUser: 0
+        env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs
+        - name: runner-data
+          mountPath: /data
+      - name: daemon
+        image: docker:28.0.4-dind
+        env:
+        - name: DOCKER_TLS_CERTDIR
+          value: /certs
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs

template/stacks/forgejo/forgejo-server.yaml

@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo-server
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: gitea
+  sources:
+    - repoURL: https://code.forgejo.org/forgejo-helm/forgejo-helm.git
+      path: .
+      targetRevision: v12.0.0
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/manifests"

template/stacks/forgejo/forgejo-server/manifests/forgejo-ingress.yaml

@@ -4,27 +4,28 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
     nginx.ingress.kubernetes.io/proxy-body-size: 512m
+    cert-manager.io/cluster-issuer: main
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
     dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: gitea.{{{ .Env.DOMAIN }}}
+    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_GITEA }}}
     dns.gardener.cloud/ttl: "600"
 {{{ end }}}
-  name: forgejo
+  name: forgejo-server
   namespace: gitea
 spec:
   ingressClassName: nginx
   rules:
-  - host: gitea.{{{ .Env.DOMAIN }}}
+  - host: {{{ .Env.DOMAIN_GITEA }}}
     http:
       paths:
       - backend:
           service:
-            name: forgejo-http
+            name: forgejo-server-http
             port:
               number: 3000
         path: /
         pathType: Prefix
   tls:
   - hosts:
-    - gitea.{{{ .Env.DOMAIN }}}
+    - {{{ .Env.DOMAIN_GITEA }}}
     secretName: forgejo-net-tls

template/stacks/forgejo/forgejo-server/manifests/forgejo-s3-backup-cronjob.yaml

@@ -0,0 +1,91 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: forgejo-s3-backup
+  namespace: gitea
+spec:
+  schedule: "0 1 * * *"
+  concurrencyPolicy: "Forbid"
+  successfulJobsHistoryLimit: 5
+  failedJobsHistoryLimit: 5
+  startingDeadlineSeconds: 600 # 10 minutes
+  jobTemplate:
+    spec:
+      # 60 min until backup - 10 min start - (backoffLimit * activeDeadlineSeconds) - some time sync buffer
+      activeDeadlineSeconds: 1350
+      backoffLimit: 2
+      ttlSecondsAfterFinished: 259200 #
+      template:
+        spec:
+          containers:
+            - name: rclone
+              image: rclone/rclone:1.70
+              imagePullPolicy: IfNotPresent
+              env:
+                - name: SOURCE_BUCKET
+                  valueFrom:
+                    secretKeyRef:
+                      name: forgejo-cloud-credentials
+                      key: bucket-name
+                - name: AWS_ACCESS_KEY_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: forgejo-cloud-credentials
+                      key: access-key
+                - name: AWS_SECRET_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: forgejo-cloud-credentials
+                      key: secret-key
+              volumeMounts:
+                - name: rclone-config
+                  mountPath: /config/rclone
+                  readOnly: true
+                - name: backup-dir
+                  mountPath: /backup
+                  readOnly: false
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  rclone sync source:/${SOURCE_BUCKET} /backup -v --ignore-checksum
+          restartPolicy: OnFailure
+          volumes:
+            - name: rclone-config
+              secret:
+                secretName: forgejo-s3-backup
+            - name: backup-dir
+              persistentVolumeClaim:
+                claimName: s3-backup
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: s3-backup
+  namespace: gitea
+  annotations:
+    everest.io/disk-volume-type: GPSSD
+    everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
+spec:
+  storageClassName: csi-disk
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: forgejo-s3-backup
+  namespace: gitea
+type: Opaque
+stringData:
+  rclone.conf: |
+    [source]
+    type = s3
+    provider = HuaweiOBS
+    env_auth = true
+    endpoint = obs.eu-de.otc.t-systems.com
+    region = eu-de
+    acl = private

template/stacks/forgejo/forgejo-server/values.yaml

@@ -0,0 +1,203 @@
+# This is only used for deploying older versions of infra-catalogue where the bucket name is not an output of the terragrunt modules
+{{{- define "BUCKET_NAME" -}}}
+{{{- if (getenv "FORGEJO_BUCKET_NAME") -}}}
+{{{ getenv "FORGEJO_BUCKET_NAME" }}}
+{{{- else -}}}
+edp-forgejo-{{{ getenv "CLUSTER_ENVIRONMENT" }}}
+{{{- end -}}}
+{{{- end -}}}
+
+
+
+# We use recreate to make sure only one instance with one version is running, because Forgejo might break or data gets inconsistant.
+strategy:
+  type: Recreate
+
+redis-cluster:
+  enabled: false
+
+redis:
+  enabled: false
+
+postgresql:
+  enabled: false
+
+postgresql-ha:
+  enabled: false
+
+persistence:
+  enabled: true
+  size: 200Gi
+  storageClass: csi-disk
+  annotations:
+    everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
+    everest.io/disk-volume-type: GPSSD
+
+test:
+  enabled: false
+
+deployment:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/ssl/forgejo
+
+extraVolumeMounts:
+  - mountPath: /etc/ssl/forgejo
+    name: custom-database-certs-volume
+    readOnly: true
+
+extraVolumes:
+  - name: custom-database-certs-volume
+    secret:
+      secretName: custom-database-certs
+
+gitea:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+  additionalConfigFromEnvs:
+    - name: FORGEJO__storage__MINIO_ACCESS_KEY_ID
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-cloud-credentials
+          key: access-key
+    - name: FORGEJO__storage__MINIO_SECRET_ACCESS_KEY
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-cloud-credentials
+          key: secret-key
+    - name: FORGEJO__queue__CONN_STR
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__session__PROVIDER_CONFIG
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__cache__HOST
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__database__HOST
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: host_port
+    - name: FORGEJO__database__NAME
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: database
+    - name: FORGEJO__database__USER
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: username
+    - name: FORGEJO__database__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: password
+    # Either 'elasticsearch' or 'bleve' (go in memory search engine)
+    - name: FORGEJO__indexer__ISSUE_INDEXER_TYPE
+      valueFrom:
+        secretKeyRef:
+          name: elasticsearch-cloud-credentials
+          key: type
+    - name: FORGEJO__indexer__ISSUE_INDEXER_CONN_STR
+      valueFrom:
+        secretKeyRef:
+          name: elasticsearch-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__indexer__ISSUE_INDEXER_ENABLED
+      valueFrom:
+        secretKeyRef:
+          name: elasticsearch-cloud-credentials
+          key: enabled
+    - name: FORGEJO__mailer__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: email-user-credentials
+          key: connection-string
+
+  admin:
+    existingSecret: gitea-credential
+
+  config:
+    APP_NAME: 'EDP'
+    APP_SLOGAN: 'Build your thing in minutes'
+    storage:
+      MINIO_ENDPOINT: obs.eu-de.otc.t-systems.com:443
+      STORAGE_TYPE: minio
+      MINIO_LOCATION: eu-de
+      MINIO_BUCKET: "{{{ template "BUCKET_NAME" }}}"
+      MINIO_USE_SSL: true
+
+    queue:
+      TYPE: redis
+
+    session:
+      PROVIDER: redis
+
+    cache:
+      ENABLED: true
+      ADAPTER: redis
+
+    service:
+      DISABLE_REGISTRATION: true
+      ENABLE_NOTIFY_MAIL: true
+
+    other:
+      SHOW_FOOTER_VERSION: false
+      SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
+
+    database:
+      DB_TYPE: postgres
+      SSL_MODE: verify-ca
+
+    server:
+      DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
+      ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
+
+    mailer:
+      ENABLED: true
+      USER: ipcei-cis-devfw@mms-support.de
+      PROTOCOL: smtps
+      FROM: '"IPCEI CIS DevFW" <ipcei-cis-devfw@mms-support.de>'
+      SMTP_ADDR: mail.mms-support.de
+      SMTP_PORT: 465
+
+service:
+  ssh:
+    type: LoadBalancer
+    nodePort: 32222
+    externalTrafficPolicy: Cluster
+    annotations:
+      kubernetes.io/elb.id: {{{ .Env.LOADBALANCER_ID }}}
+
+image:
+  pullPolicy: "IfNotPresent"
+  # Overrides the image tag whose default is the chart appVersion.
+  #tag: "8.0.3"
+  # Adds -rootless suffix to image name
+  # rootless: true
+  fullOverride: {{{ getenv "CLIENT_REPO_DOMAIN" }}}/devfw-cicd/edp-forgejo:{{{ .Env.FORGEJO_IMAGE_TAG }}}
+
+forgejo:
+  # This appears to be governed by forgejo-runner, as intuition would suggest
+  # runner:
+  #   enabled: true
+  #   image:
+  #     tag: latest
+  #   # replicas: 3
+  #   config:
+  #     runner:
+  #       labels:
+  #         - docker:docker://node:16-bullseye
+  #         - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+  #         - ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+  #         - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04

template/stacks/garm/garm.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: garm
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: garm
+  sources:
+    - repoURL: https://edp.buildth.ing/DevFW-CICD/garm-helm
+      path: charts/garm
+      targetRevision: v0.0.6
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/garm/garm/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values

template/stacks/garm/garm/values.yaml

@@ -0,0 +1,36 @@
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: main
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+  hosts:
+    - host: garm.{{{ .Env.DOMAIN_GITEA }}}
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: garm-net-tls
+      hosts:
+        - garm.{{{ .Env.DOMAIN_GITEA }}}
+
+# Credentials and Secrets
+credentials:
+  edgeConnect:
+    existingSecretName: "edge-credential"
+  gitea:
+    url: "https://{{{ .Env.DOMAIN_GITEA }}}"  # Required
+
+providerConfig:
+  edgeConnect:
+    organization: edp2
+    region: EU
+    edgeConnectUrl: "https://hub.apps.edge.platform.mg3.mdb.osc.live"
+    cloudlet:
+      name: Hamburg
+      organization: TelekomOP
+
+garm:
+  logging:
+    logLevel: info

template/stacks/garm/optimiser-receiver.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: argo-workflows
+  name: optimiser-receiver
   namespace: argocd
   labels:
     env: dev
@@ -9,17 +9,17 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: default
-  source:
-    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/ref-implementation/argo-workflows/manifests/dev"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: argo
   syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
     automated:
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
     retry:
       limit: -1
+  destination:
+    name: in-cluster
+    namespace: garm
+  source:
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    targetRevision: HEAD
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/garm/optimiser-receiver"

template/stacks/garm/optimiser-receiver/deployment.yaml

@@ -0,0 +1,93 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: optimiser-receiver
+  labels:
+    app: optimiser-receiver
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: optimiser-receiver
+  template:
+    metadata:
+      labels:
+        app: optimiser-receiver
+    spec:
+      containers:
+        - name: receiver
+          image: edp.buildth.ing/devfw-cicd/forgejo-runner-optimiser-receiver:0.0.3
+          args:
+            - --db=/data/metrics.db
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: RECEIVER_READ_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: optimiser-tokens
+                  key: read-token
+            - name: RECEIVER_HMAC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: optimiser-tokens
+                  key: hmac-key
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: optimiser-receiver-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: optimiser-receiver
+  labels:
+    app: optimiser-receiver
+spec:
+  selector:
+    app: optimiser-receiver
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: optimiser-receiver-data
+  labels:
+    app: optimiser-receiver
+  annotations:
+    everest.io/disk-volume-type: GPSSD
+spec:
+  storageClassName: csi-disk
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

template/stacks/garm/optimiser-receiver/ingress.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: main
+{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
+    dns.gardener.cloud/class: garden
+    dns.gardener.cloud/dnsnames: optimiser.{{{ .Env.DOMAIN }}}
+    dns.gardener.cloud/ttl: "600"
+{{{ end }}}
+  name: optimiser-receiver
+  namespace: garm
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: optimiser.{{{ .Env.DOMAIN }}}
+      http:
+        paths:
+          - backend:
+              service:
+                name: optimiser-receiver
+                port:
+                  number: 8080
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - optimiser.{{{ .Env.DOMAIN }}}
+      secretName: optimiser-receiver-tls

template/stacks/local-backup/README.md

@@ -1,126 +0,0 @@
-# Local Backup with Velero and Minio
-
-This is example is adapted from the original icpbuilder stack.
-
-The two significant changes from the original were made:
-
-* disabled `hostPath` mount to persist backups within kind, since backups do not work sufficiently in this example due to PVC issues, see below.
-* renamed `minio` namespace to `minio-backup` so it does not collide with other minio examples.
-
-Within kind, it can only backup kubernetes objects. Data from PVC's is skipped, see below why.
-
-[Velero](https://velero.io/) requires some compatible storage providers as its backup target. This local installation uses [MinIO](https://min.io/) as an example.
-However, MinIO is not officially supported by Velero but works due to S3 compatibility.
-
-The current setup does NOT persist backups but stores them in MinIO's PVCs. Proper backups should configure external storage, see [Supported Providers](https://velero.io/docs/main/supported-providers/).
-
-## Installation
-
-The stack is installed as part of the `./example.sh` run.
-
-In order to persist a local backup you have to mount a local directory within `main.go`:
-
-```yaml
-nodes:
-  - role: control-plane
-    extraMounts:
-      - hostPath: /some/path/backup # replace with your own path
-        containerPath: /backup
-```
-
-Kind creates the directory on the host but you might have to adjust the permissions, otherwise the minio pod fails to start.
-
-## Using it
-
-After the installation velero and minio should be visible in ArgoCD.
-
-During the installation credentials for minio are generated and shared with velero. You can access them manually:
-
-```bash
-kubectl -n minio-backup get secret root-creds -o go-template='{{ range $key, $value := .data }}{{ printf "%s: %s\n" $key ($value | base64decode) }}{{ end }}'
-# example output
-# rootPassword: aKKZzLnyry6OYZts17vMTf32H5ghFL4WYgu6bHujm
-# rootUser: ge8019yksArb7BICt3MLY9
-```
-
-A bucket in minio was created and velero uses it for its backups by default, see helm `values.yaml` files.
-
-
-### Backup and Restore
-
-Backups and subsequent restores can be scheduled by either using the velero cli or by creating CRD objects.
-
-Check the `./demo` directory for equivalent CRD manifests.
-
-Create a backup of the backstage namespace, see `schedule` task for more permanent setups:
-
-```shell
-velero backup create backstage-backup --include-namespaces backstage
-```
-
-There are more options to create a fine granular backup and to set the backup storage.
-See velero's docs for details.
-
-Check the backup with:
-```shell
-velero backup get
-```
-
-To get more details on the backup you need to be able to connect to velero's backup storage, i.e. minio.
-Using `kubefwd` here helps a lot (this is not necessary for restore).
-
-```shell
-kubefwd services -n minio-backup
-```
-
-More details with `describe` and `logs`:
-
-```shell
-velero backup describe backstage-backup --details
-velero backup logs backstage-backup
-```
-
-Restore the backup into the original namespace, you might want to delete the existing namespace beforehand:
-
-```shell
-kubectl delete namespace backstage
-velero restore create --from-backup backstage-backup
-```
-
-When restoring, velero does not replace existing objects in the backup target.
-
-ArgoCD does pickup on the changes and also validates that the backup is in sync.
-
-
-## Issues with Persistent Volumes
-
-Velero has no issue to backup kubernetes objects like Deployments, ConfigMaps, etc. since they are just yaml/json definitions.
-Volumes containing data are, however, more complex. The preferred type of backup are kubernetes' VolumeSnapshots as they consistently store the state
-of a volume at a given point in time in an atomic action. Those snapshots live within the cluster and are subsequently downloaded into one of velero's
-storage backends for safekeeping.
-
-However, VolumeSnapshots are only possible on storage backends that support them via CSI drivers.
-Backends like `nfs` or `hostPath` do NOT support them. Here, velero uses an alternative method
-called [File System Backups](https://velero.io/docs/main/file-system-backup/).
-In essence, this a simple copy operation based on the file system. Even though
-this uses more sophisticated tooling under the hood, i.e. kopia, it is not
-possible to create a backup in an atomic transaction. Thus, the resulting backup
-might be inconsistent.
-
-Furthermore, for file system backups to work velero installs a node-agent as a
-DaemonSet on each Kubernetes node. The agent is aware of the node's internal
-storage and accesses the directories on the host directly to copy the files.
-This is not supported for hostPath volumes as they mount an arbitrary path
-on the host. In theory, a backup is possible but due extra config and security
-considerations intentionally skipped. Kind's local-path provider storage uses
-a hostPath and is thus not supported for any kind of backup.
-
-## TODOs
-
-* The MinIO -backup installation is only intended as an example and must either
-be configured properly or replaced.
-
-* The current example does not automatically schedule backups.
-
-* velero chart must be properly parameterized
-

template/stacks/local-backup/demo/backup.yaml

@@ -1,9 +0,0 @@
-# velero backup create backstage-backup --include-namespaces backstage
-apiVersion: velero.io/v1
-kind: Backup
-metadata:
-  name: backstage-backup
-  namespace: velero
-spec:
-  includedNamespaces:
-    - 'backstage'

template/stacks/local-backup/demo/restore.yaml

@@ -1,10 +0,0 @@
-# velero restore create --from-backup backstage-backup
-apiVersion: velero.io/v1
-kind: Restore
-metadata:
-  name: backstage-backup
-  namespace: velero
-spec:
-  backupName: backstage-backup
-  includedNamespaces:
-    - 'backstage'

template/stacks/local-backup/minio.yaml

@@ -1,33 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: minio
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  sources:
-    - repoURL: 'https://charts.min.io'
-      targetRevision: 5.0.15
-      helm:
-        releaseName: minio
-        valueFiles:
-          - $values/stacks/local-backup/minio/helm/values.yaml
-      chart: minio
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      path: "stacks/local-backup/minio/manifests"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: minio-backup
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      selfHeal: true

template/stacks/local-backup/minio/helm/values.yaml

@@ -1,17 +0,0 @@
-replicas: 1
-mode: standalone
-
-resources:
-  requests:
-    memory: 128Mi
-
-persistence:
-  enabled: true
-  storageClass: standard
-  size: 512Mi
-  # volumeName: backup # re-enable this to mount a local host path, see minio-pv.yaml
-
-buckets:
-  - name: edfbuilder-backups
-
-existingSecret: root-creds

template/stacks/local-backup/minio/manifests/minio-pv.yaml

@@ -1,13 +0,0 @@
-# re-enable this config to mount a local host path, see `../helm/values.yaml`
-# apiVersion: v1
-# kind: PersistentVolume
-# metadata:
-#   name: backup
-# spec:
-#   storageClassName: standard
-#   accessModes:
-#     - ReadWriteOnce
-#   capacity:
-#     storage: 512Mi
-#   hostPath:
-#     path: /backup

template/stacks/local-backup/minio/manifests/secret-sync.yaml

@@ -1,154 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: secret-sync
-  namespace: minio-backup
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/sync-wave: "-20"
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: secret-sync
-  namespace: minio-backup
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/sync-wave: "-20"
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: secret-sync
-  namespace: minio-backup
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/sync-wave: "-20"
-subjects:
-  - kind: ServiceAccount
-    name: secret-sync
-    namespace: minio-backup
-roleRef:
-  kind: Role
-  name: secret-sync
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: secret-sync
-  namespace: velero
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/sync-wave: "-20"
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: secret-sync
-  namespace: velero
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/sync-wave: "-20"
-subjects:
-  - kind: ServiceAccount
-    name: secret-sync
-    namespace: minio-backup
-roleRef:
-  kind: Role
-  name: secret-sync
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: secret-sync
-  namespace: minio-backup
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-spec:
-  template:
-    metadata:
-      generateName: secret-sync
-    spec:
-      serviceAccountName: secret-sync
-      restartPolicy: Never
-      containers:
-        - name: kubectl
-          image: docker.io/bitnami/kubectl
-          command: ["/bin/bash", "-c"]
-          args:
-            - |
-              set -e
-              kubectl get secrets -n minio-backup root-creds -o json > /tmp/secret
-              ACCESS=$(jq -r '.data.rootUser | @base64d'  /tmp/secret)
-              SECRET=$(jq -r '.data.rootPassword | @base64d'  /tmp/secret)
-              
-              echo \
-              "apiVersion: v1
-              kind: Secret
-              metadata:
-                name: secret-key
-                namespace: velero
-              type: Opaque
-              stringData:
-                aws: |
-                  [default]
-                    aws_access_key_id=${ACCESS}
-                    aws_secret_access_key=${SECRET}
-              " > /tmp/secret.yaml
-              
-              kubectl apply -f /tmp/secret.yaml
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: minio-root-creds
-  namespace: minio-backup
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/sync-wave: "-10"
-spec:
-  template:
-    metadata:
-      generateName: minio-root-creds
-    spec:
-      serviceAccountName: secret-sync
-      restartPolicy: Never
-      containers:
-        - name: kubectl
-          image: docker.io/bitnami/kubectl
-          command: ["/bin/bash", "-c"]
-          args:
-            - |
-              kubectl get secrets -n minio-backup root-creds
-              if [ $? -eq 0 ]; then
-                exit 0
-              fi
-              
-              set -e
-              
-              NAME=$(openssl rand -base64 24)
-              PASS=$(openssl rand -base64 36)
-              
-              echo \
-              "apiVersion: v1
-              kind: Secret
-              metadata:
-                name: root-creds
-                namespace: minio-backup
-              type: Opaque
-              stringData:
-                rootUser: "${NAME}"
-                rootPassword: "${PASS}"
-              " > /tmp/secret.yaml
-              
-              kubectl apply -f /tmp/secret.yaml

template/stacks/local-backup/velero.yaml

@@ -1,31 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: velero
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  sources:
-    - repoURL: 'https://vmware-tanzu.github.io/helm-charts'
-      targetRevision: 8.0.0
-      helm:
-        releaseName: velero
-        valueFiles:
-          - $values/stacks/local-backup/velero/helm/values.yaml
-      chart: velero
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: velero
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      prune: true
-      selfHeal: true

template/stacks/local-backup/velero/helm/values.yaml

@@ -1,25 +0,0 @@
-resources:
-  requests:
-    memory: 128Mi
-initContainers:
-  - name: velero-plugin-for-aws
-    image: velero/velero-plugin-for-aws:v1.11.0
-    imagePullPolicy: IfNotPresent
-    volumeMounts:
-      - mountPath: /target
-        name: plugins
-# snapshotsEnabled: false # create snapshot crd?
-# deployNodeAgent: true # install node agent as daemonset for file system backups?
-configuration:
-  # defaultVolumesToFsBackup: true # backup pod volumes via fsb without explicit annotation?
-  backupStorageLocation:
-    - name: default
-      provider: aws
-      bucket: edfbuilder-backups
-      credential:
-        name: secret-key # this key is created within the minio-backup/secret-sync and injected into the velero namespace
-        key: aws
-      config:
-        region: minio
-        s3Url: http://minio.minio-backup.svc.cluster.local:9000 # internal resolution, external access for velero cli via fwd
-        s3ForcePathStyle: "true"

template/stacks/monitoring/grafana-dashboards.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: grafana-dashboards
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/monitoring/kube-prometheus/dashboards"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: monitoring
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      selfHeal: true
-    retry:
-      limit: -1

template/stacks/monitoring/kube-prometheus.yaml

@@ -1,30 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kube-prometheus-stack
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true  # do not copy metdata, since (because of its large size) it can lead to sync failure
-  destination:
-    name: in-cluster
-    namespace: monitoring
-  sources:
-    - repoURL: https://github.com/prometheus-community/helm-charts
-      path: charts/kube-prometheus-stack
-      targetRevision: HEAD
-      helm:
-        valueFiles:
-          - $values/stacks/monitoring/kube-prometheus/values.yaml
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_apps.yaml

@@ -1,268 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-dashboard-1
-  labels:
-    grafana_dashboard: "1"
-data:
-  k8s-dashboard-01.json: |
-    {
-        "annotations": {
-            "list": [
-                {
-                    "builtIn": 1,
-                    "datasource": {
-                        "type": "grafana",
-                        "uid": "-- Grafana --"
-                    },
-                    "enable": true,
-                    "hide": true,
-                    "iconColor": "rgba(0, 211, 255, 1)",
-                    "name": "Annotations & Alerts",
-                    "type": "dashboard"
-                }
-            ]
-        },
-        "editable": true,
-        "fiscalYearStartMonth": 0,
-        "graphTooltip": 0,
-        "id": 1,
-        "links": [
-        ],
-        "panels": [
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 0
-                },
-                "id": 5,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"crossplane\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App crossplane",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 8
-                },
-                "id": 4,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"argo-server\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App argo-server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 16
-                },
-                "id": 3,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"forgejo\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App forgejo",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 24
-                },
-                "id": 2,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"backstage\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App backstage",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 32
-                },
-                "id": 1,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"shoot-control-plane\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App shoot-control-plane",
-                "type": "logs"
-            }
-        ],
-        "preload": false,
-        "schemaVersion": 40,
-        "tags": [
-        ],
-        "templating": {
-            "list": [
-            ]
-        },
-        "time": {
-            "from": "now-6h",
-            "to": "now"
-        },
-        "timepicker": {
-        },
-        "timezone": "browser",
-        "title": "Loki Logs: Apps",
-        "uid": "ee4iuluru756of",
-        "version": 2,
-        "weekStart": ""
-    }

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_components.yaml

@@ -1,845 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-dashboard-2
-  labels:
-    grafana_dashboard: "1"
-data:
-  k8s-dashboard-02.json: |
-    {
-        "annotations": {
-            "list": [
-                {
-                    "builtIn": 1,
-                    "datasource": {
-                        "type": "grafana",
-                        "uid": "-- Grafana --"
-                    },
-                    "enable": true,
-                    "hide": true,
-                    "iconColor": "rgba(0, 211, 255, 1)",
-                    "name": "Annotations & Alerts",
-                    "type": "dashboard"
-                }
-            ]
-        },
-        "editable": true,
-        "fiscalYearStartMonth": 0,
-        "graphTooltip": 0,
-        "id": 30,
-        "links": [
-        ],
-        "panels": [
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 0
-                },
-                "id": 19,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 8
-                },
-                "id": 17,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"repo-server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component repo-server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 16
-                },
-                "id": 16,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"redis\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component redis",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 24
-                },
-                "id": 15,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"query-frontend\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component query-frontend",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 32
-                },
-                "id": 14,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"querier\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component querier",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 40
-                },
-                "id": 13,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"prometheus-operator-webhook\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component prometheus-operator-webhook",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 48
-                },
-                "id": 12,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"prometheus-operator\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component prometheus-operator",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 56
-                },
-                "id": 11,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"metrics\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component metrics",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 64
-                },
-                "id": 10,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"kube-scheduler\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component kube-scheduler",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 72
-                },
-                "id": 9,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"kube-controller-manager\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component kube-controller-manager",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 80
-                },
-                "id": 8,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"kube-apiserver\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component kube-apiserver",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 88
-                },
-                "id": 7,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"ingester\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component ingester",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 96
-                },
-                "id": 6,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"gateway\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component gateway",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 104
-                },
-                "id": 5,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"etcd\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component etcd",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 112
-                },
-                "id": 4,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"distributor\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component distributor",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 120
-                },
-                "id": 3,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"controller\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component controller",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 128
-                },
-                "id": 2,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"cloud-infrastructure-controller\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component cloud-infrastructure-controller",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 136
-                },
-                "id": 1,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"applicationset-controller\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component application-controller",
-                "type": "logs"
-            }
-        ],
-        "preload": false,
-        "schemaVersion": 40,
-        "tags": [
-        ],
-        "templating": {
-            "list": [
-            ]
-        },
-        "time": {
-            "from": "now-6h",
-            "to": "now"
-        },
-        "timepicker": {
-        },
-        "timezone": "browser",
-        "title": "Loki Logs: Components",
-        "uid": "ae4zuyp1kui9sc",
-        "version": 2,
-        "weekStart": ""
-    }

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_container.yaml

@@ -1,537 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-dashboard-3
-  labels:
-    grafana_dashboard: "1"
-data:
-  k8s-dashboard-03.json: |
-    {
-        "annotations": {
-            "list": [
-                {
-                    "builtIn": 1,
-                    "datasource": {
-                        "type": "grafana",
-                        "uid": "-- Grafana --"
-                    },
-                    "enable": true,
-                    "hide": true,
-                    "iconColor": "rgba(0, 211, 255, 1)",
-                    "name": "Annotations & Alerts",
-                    "type": "dashboard"
-                }
-            ]
-        },
-        "editable": true,
-        "fiscalYearStartMonth": 0,
-        "graphTooltip": 0,
-        "id": 31,
-        "links": [
-        ],
-        "panels": [
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 0
-                },
-                "id": 11,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"repo-server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container repo-server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 8
-                },
-                "id": 10,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"promtail\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container promtail",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 16
-                },
-                "id": 9,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"prometheus\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container prometheus",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 24
-                },
-                "id": 8,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"postgres\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container postgres",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 32
-                },
-                "id": 7,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"kube-prometheus-stack\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container kube-prometheus-stack",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 40
-                },
-                "id": 6,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"keycloak\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container keycloak",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 48
-                },
-                "id": 5,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"grafana\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container grafana",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 56
-                },
-                "id": 4,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"forgejo\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container forgejo",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 64
-                },
-                "id": 3,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"crossplane\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container crossplane",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 72
-                },
-                "id": 2,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"backstage\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container backstage",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 80
-                },
-                "id": 1,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"argo-server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container argo-server",
-                "type": "logs"
-            }
-        ],
-        "preload": false,
-        "schemaVersion": 40,
-        "tags": [
-        ],
-        "templating": {
-            "list": [
-            ]
-        },
-        "time": {
-            "from": "now-6h",
-            "to": "now"
-        },
-        "timepicker": {
-        },
-        "timezone": "browser",
-        "title": "Loki Logs: Container",
-        "uid": "ee50bcaehmv40e",
-        "version": 2,
-        "weekStart": ""
-    }

template/stacks/monitoring/kube-prometheus/values.yaml

@@ -1,45 +0,0 @@
-grafana:
-  namespaceOverride: "monitoring"
-
-  admin:
-    existingSecret: "kube-prometheus-stack-grafana-admin-password"
-    userKey: admin-user
-    passwordKey: admin-password
-
-  defaultDashboardsTimezone: Europe/Berlin
-
-  additionalDataSources:
-    - name: Loki
-      type: loki
-      url: http://loki-loki-distributed-gateway.monitoring:80
-
-  # syncPolicy:
-  #   syncOptions:
-  #   - ServerSideApply=true
-
-  sidecar:
-    dashboards:
-      enabled: true
-      label: grafana_dashboard
-      folder: /tmp/dashboards
-      updateIntervalSeconds: 10
-      folderAnnotation: grafana_folder
-      provider:
-        allowUiUpdates: true
-        foldersFromFilesStructure: true
-
-  grafana.ini:
-    server:
-      domain: {{{ .Env.DOMAIN }}}
-      root_url: "%(protocol)s://%(domain)s/grafana"
-      serve_from_sub_path: true
-      
-  serviceMonitor:
-    # If true, a ServiceMonitor CRD is created for a prometheus operator https://github.com/coreos/prometheus-operator
-    enabled: true
-
-#monitoring nginx
-prometheus:
-  prometheusSpec:
-    podMonitorSelectorNilUsesHelmValues: false
-    serviceMonitorSelectorNilUsesHelmValues: false     

template/stacks/monitoring/loki.yaml

@@ -1,34 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: loki
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: monitoring
-  sources:
-    - repoURL: https://github.com/grafana/helm-charts
-      path:     charts/loki-distributed         
-      targetRevision: HEAD      
-      helm:
-        valueFiles:
-          - $values/stacks/monitoring/loki/values.yaml
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values
-
-    ## consider using the following version, if it works again
-    #- repoURL: https://github.com/grafana/loki
-    #  path: production/helm/loki        
-

template/stacks/monitoring/loki/values.yaml

@@ -1,7 +0,0 @@
-loki:
-  commonConfig:
-    replication_factor: 1
-  auth_enabled: false
-
-#  storageConfig:
-#    filesystem: null

template/stacks/monitoring/promtail.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: promtail
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: monitoring
-  sources:
-    - repoURL: https://github.com/grafana/helm-charts
-      path:     charts/promtail   
-      targetRevision: HEAD      
-      helm:
-        valueFiles:
-          - $values/stacks/monitoring/promtail/values.yaml
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values

template/stacks/monitoring/promtail/values.yaml

@@ -1,45 +0,0 @@
-# -- Overrides the chart's name
-nameOverride: null
-
-# -- Overrides the chart's computed fullname
-fullnameOverride: null
-
-global:
-  # -- Allow parent charts to override registry hostname
-  imageRegistry: ""
-  # -- Allow parent charts to override registry credentials
-  imagePullSecrets: []
-
-daemonset:
-  # -- Deploys Promtail as a DaemonSet
-  enabled: true
-  autoscaling:
-    # -- Creates a VerticalPodAutoscaler for the daemonset
-    enabled: false
-
-deployment:
-  # -- Deploys Promtail as a Deployment
-  enabled: false    
-
-config:
-  enabled: true
-  logLevel: info
-  logFormat: logfmt
-  serverPort: 3101
-  clients:
-    - url: http://loki-loki-distributed-gateway/loki/api/v1/push
-  scrape_configs:
-  - job_name: authlog
-    static_configs:
-    - targets:
-        - authlog
-      labels:
-        job: authlog
-        __path__: /logs/auth.log
-  - job_name: syslog
-    static_configs:
-    - targets:
-        - syslog
-      labels:
-        job: syslog
-        __path__: /logs/syslog    

template/stacks/observability-client/metrics-server.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: metrics-server
+      repoURL: https://kubernetes-sigs.github.io/metrics-server/
+      targetRevision: 3.12.2
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/metrics-server/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values

template/stacks/observability-client/metrics-server/values.yaml

@@ -0,0 +1,4 @@
+metrics:
+  enabled: true
+serviceMonitor:
+  enabled: true

template/stacks/observability-client/vector.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vector
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: vector
+      repoURL: https://helm.vector.dev
+      targetRevision: 0.43.0
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vector/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values

template/stacks/observability-client/vector/values.yaml

@@ -0,0 +1,68 @@
+# -- Enable deployment of vector
+role: Agent
+dataDir: /vector-data-dir
+resources: {}
+args:
+  - -w
+  - --config-dir
+  - /etc/vector/
+env:
+  - name: VECTOR_USER
+    valueFrom:
+      secretKeyRef:
+        name: simple-user-secret
+        key: username
+  - name: VECTOR_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: simple-user-secret
+        key: password
+containerPorts:
+  - name: prom-exporter
+    containerPort: 9090
+    protocol: TCP
+service:
+  enabled: false
+customConfig:
+  data_dir: /vector-data-dir
+  api:
+    enabled: false
+    address: 0.0.0.0:8686
+    playground: true
+  sources:
+    k8s:
+      type: kubernetes_logs
+    internal_metrics:
+      type: internal_metrics
+  transforms:
+    parser:
+      type: remap
+      inputs: [k8s]
+      source: |
+        ._msg = parse_json(.message) ?? .message
+        del(.message)
+        # Add the cluster environment to the log event
+        .cluster_environment = "{{{ .Env.CLUSTER_ENVIRONMENT }}}"
+  sinks:
+    vlogs:
+      type: elasticsearch
+      inputs: [parser]
+      endpoints: 
+        - https://{{{ .Env.DOMAIN_O12Y }}}/insert/elasticsearch/
+      auth:
+        strategy: basic
+        user: ${VECTOR_USER}
+        password: ${VECTOR_PASSWORD}
+      mode: bulk
+      api_version: v8
+      compression: gzip
+      healthcheck:
+        enabled: false
+      request:
+        headers:
+          AccountID: "0"
+          ProjectID: "0"
+      query:
+        _msg_field: _msg
+        _time_field: _time
+        _stream_fields: cluster_environment,kubernetes.container_name,kubernetes.namespace

template/stacks/observability-client/vm-client-stack.yaml

@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vm-client
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: victoria-metrics-k8s-stack
+      repoURL: https://victoriametrics.github.io/helm-charts/
+      targetRevision: 0.48.1
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/manifests"

template/stacks/observability/grafana-operator.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: grafana-operator
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: grafana-operator
+      repoURL: ghcr.io/grafana/helm-charts
+      targetRevision: v5.18.0
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/grafana-operator/manifests"

template/stacks/observability/grafana-operator/manifests/argocd.yaml

@@ -0,0 +1,9 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: argocd
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  url: "https://raw.githubusercontent.com/argoproj/argo-cd/refs/heads/master/examples/dashboard.json"

template/stacks/observability/grafana-operator/manifests/grafana.yaml

@@ -0,0 +1,75 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: Grafana
+metadata:
+  name: grafana
+  labels:
+    dashboards: "grafana"
+spec:
+  persistentVolumeClaim:
+    metadata:
+      annotations:
+        everest.io/disk-volume-type: GPSSD
+        everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
+    spec:
+      storageClassName: csi-disk
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+  deployment:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: grafana
+              env:
+                - name: OAUTH_CLIENT_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                      key: clientSecret
+                      name: dex-grafana-client
+  config:
+    log.console:
+      level: debug
+    server:
+      root_url: "https://{{{ .Env.DOMAIN_GRAFANA }}}"
+    auth:
+      disable_login: "true"
+      disable_login_form: "true"
+    auth.generic_oauth:
+      enabled: "true"
+      name: Forgejo
+      allow_sign_up: "true"
+      use_refresh_token: "true"
+      client_id: grafana
+      client_secret: $__env{OAUTH_CLIENT_SECRET}
+      scopes: openid email profile offline_access groups
+      auth_url: https://{{{ .Env.DOMAIN_DEX }}}/auth
+      token_url: https://{{{ .Env.DOMAIN_DEX }}}/token
+      api_url: https://{{{ .Env.DOMAIN_DEX }}}/userinfo
+      redirect_uri: https://{{{ .Env.DOMAIN_GRAFANA }}}/login/generic_oauth
+      role_attribute_path: "contains(groups[*], 'DevFW') && 'GrafanaAdmin' || 'None'"
+      allow_assign_grafana_admin: "true"
+  ingress:
+    metadata:
+      annotations:
+        cert-manager.io/cluster-issuer: main
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    spec:
+      ingressClassName: nginx
+      rules:
+      - host: {{{ .Env.DOMAIN_GRAFANA }}}
+        http:
+          paths:
+          - backend:
+              service:
+                name: grafana-service
+                port:
+                  number: 3000
+            path: /
+            pathType: Prefix
+      tls:
+      - hosts:
+        - {{{ .Env.DOMAIN_GRAFANA }}}
+        secretName: grafana-net-tls

template/stacks/observability/grafana-operator/manifests/ingress-nginx.yaml

@@ -0,0 +1,9 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: ingress-nginx 
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  url: "https://raw.githubusercontent.com/adinhodovic/ingress-nginx-mixin/refs/heads/main/dashboards_out/ingress-nginx-overview.json"

template/stacks/observability/grafana-operator/manifests/victoria-logs.yaml

@@ -0,0 +1,9 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: victoria-logs
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  url: "https://raw.githubusercontent.com/VictoriaMetrics/VictoriaMetrics/refs/heads/master/dashboards/vm/victorialogs.json"

template/stacks/observability/victoria-k8s-stack.yaml

@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: o12y
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: victoria-metrics-k8s-stack
+      repoURL: https://victoriametrics.github.io/helm-charts/
+      targetRevision: 0.48.1
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/manifests"

template/stacks/observability/victoria-k8s-stack/manifests/alerts.yaml

@@ -0,0 +1,40 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMRule
+metadata:
+  name: forgejo-alerts
+  namespace: observability
+spec:
+  groups:
+    - name: forgejo
+      rules:
+        - alert: forgejo down
+          expr: sum by(cluster_environment) (up{pod=~"forgejo-server-.*"}) < 1
+          for: 30s
+          labels:
+            severity: critical
+            job:  "{{ $labels.job }}"
+          annotations:
+            value: "{{ $value }}"
+            description: 'forgejo is down in cluster environment {{ $labels.cluster_environment }}'
+    - name: forgejo-backup
+      rules:
+        - alert: forgejo s3 backup job failed
+          expr: max by(cluster_environment) (kube_job_status_failed{job_name=~"forgejo-s3-backup-.*"}) != 0
+          for: 30s
+          labels:
+            severity: critical
+            job:  "{{ $labels.job }}"
+          annotations:
+            value: "{{ $value }}"
+            description: 'forgejo s3 backup job failed in cluster environment {{ $labels.cluster_environment }}'
+    - name: disk-consumption-high
+      rules:
+        - alert: disk consumption high
+          expr: 1-(kubelet_volume_stats_available_bytes / kubelet_volume_stats_capacity_bytes) > 0.6
+          for: 30s
+          labels:
+            severity: major
+            job:  "{{ $labels.job }}"
+          annotations:
+            value: "{{ $value }}"
+            description: 'disk consumption of pvc {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is high in cluster environment {{ $labels.cluster_environment }}'

template/stacks/observability/victoria-k8s-stack/manifests/vlogs.yaml

@@ -0,0 +1,26 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VLogs
+metadata:
+  name: victorialogs
+  namespace: observability
+spec:
+  retentionPeriod: "12"
+  removePvcAfterDelete: true
+  storageMetadata:
+    annotations:
+      everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
+      everest.io/disk-volume-type: GPSSD
+  storage:
+    storageClassName: csi-disk
+    accessModes:
+      - ReadWriteOnce
+    resources:
+      requests:
+        storage: 50Gi
+  resources:
+    requests:
+      memory: 500Mi
+      cpu: 500m
+    limits:
+      memory: 10Gi
+      cpu: 2

template/stacks/observability/victoria-k8s-stack/manifests/vmauth.yaml

@@ -0,0 +1,17 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  name: simple-user
+  namespace: observability
+spec:
+  username: simple-user
+  passwordRef:
+    key: password
+    name: simple-user-secret
+  targetRefs:
+    - static:
+        url: http://vmsingle-o12y:8429
+      paths: ["/api/v1/write"]
+    - static:
+        url: http://vlogs-victorialogs:9428
+      paths: ["/insert/elasticsearch/.*"]

template/stacks/otc/cert-manager/manifests/clusterissuer.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: main
+spec:
+  acme:
+    email: admin@think-ahead.tech
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: cluster-issuer-account-key
+    solvers:
+    - http01:
+        ingress:
+          ingressClassName: nginx

template/stacks/otc/cert-manager/values.yaml

@@ -0,0 +1,4 @@
+crds:
+  enabled: true
+
+replicaCount: 1

template/stacks/otc/cert-manger.yaml

@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: cert-manager
+  sources:
+    - chart: cert-manager
+      repoURL: https://charts.jetstack.io
+      targetRevision: v1.17.2
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/manifests"

template/stacks/otc/ingress-nginx.yaml

@@ -12,16 +12,18 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+    retry:
+      limit: -1
   destination:
     name: in-cluster
     namespace: ingress-nginx
   sources:
-    - repoURL: https://github.com/kubernetes/ingress-nginx
+    - repoURL: https://github.com/kubernetes/ingress-nginx.git
       path: charts/ingress-nginx
-      targetRevision: helm-chart-4.11.3
+      targetRevision: helm-chart-4.12.1
       helm:
         valueFiles:
-          - $values/stacks/core/ingress-nginx/values.yaml
-    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/ingress-nginx/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values

template/stacks/otc/ingress-nginx/values.yaml

@@ -0,0 +1,31 @@
+controller:
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  service:
+    annotations:
+      kubernetes.io/elb.class: union
+      kubernetes.io/elb.port: '80'
+      kubernetes.io/elb.id: {{{ .Env.LOADBALANCER_ID }}}
+      kubernetes.io/elb.ip: {{{ .Env.LOADBALANCER_IP }}}
+
+  ingressClassResource:
+    name: nginx
+
+  # added for idpbuilder
+  allowSnippetAnnotations: true
+
+  # added for idpbuilder
+  config:
+    proxy-buffer-size: 32k
+    use-forwarded-headers: "true"
+
+  # monitoring nginx
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels: 
+        release: "ingress-nginx"  
+      enabled: true

template/stacks/otc/storageclass.yaml

@@ -1,25 +1,25 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: fibonacci-app
+  name: storageclass
   namespace: argocd
   labels:
-    env: dev
+    example: otc
   finalizers:
     - resources-finalizer.argocd.argoproj.io
 spec:
-  project: default
-  source:
-    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/ref-implementation/fibonacci-app"
   destination:
+    namespace: default
     server: "https://kubernetes.default.svc"
-    namespace: fibonacci-app
+  source:
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    targetRevision: HEAD
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/storageclass"
+  project: default
   syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
     automated:
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
     retry:
       limit: -1

template/stacks/otc/storageclass/storageclass.yaml

@@ -0,0 +1,18 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations:
+    storageclass.beta.kubernetes.io/is-default-class: "true"
+  labels:
+    kubernetes.io/cluster-service: "true"
+  name: default
+parameters:
+  kubernetes.io/description: ""
+  kubernetes.io/hw:passthrough: "true"
+  kubernetes.io/storagetype: BS
+  kubernetes.io/volumetype: SATA
+  kubernetes.io/zone: eu-de-02
+provisioner: flexvolume-huawei.com/fuxivol
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+allowVolumeExpansion: true

template/stacks/ref-implementation/README.md

@@ -1,146 +0,0 @@
-# Reference implementation 
-
-This example creates a local version of the CNOE reference implementation.
-
-## Prerequisites
-
-Ensure you have the following tools installed on your computer.
-
-**Required**
-
-- [idpbuilder](https://github.com/cnoe-io/idpbuilder/releases/latest): version `0.3.0` or later
-- [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl): version `1.27` or later
-- Your computer should have at least 6 GB RAM allocated to Docker. If you are on Docker Desktop, see [this guide](https://docs.docker.com/desktop/settings/mac/).
-
-**Optional**
-
-- AWS credentials: Access Key and secret Key. If you want to create AWS resources in one of examples below.
-
-## Installation
-
-**_NOTE:_**
-- If you'd like to run this in your web browser through Codespaces, please follow [the instructions here](./codespaces.md) to install instead. 
-
-- _This example assumes that you run the reference implementation with the default port configguration of 8443 for the idpBuilder.
-If you happen to configure a different host or port for the idpBuilder, the manifests in the reference example need to be updated
-and be configured with the new host and port. you can use the [replace.sh](replace.sh) to change the port as desired prior to applying the manifest as instructed in the command above._
-
-```bash
-idpbuilder create --use-path-routing \
-  --package https://github.com/cnoe-io/stacks//ref-implementation
-```
-
-This will take ~6 minutes for everything to come up. To track the progress, you can go to the [ArgoCD UI](https://{{{ .Env.DOMAIN }}}:8443/argocd/applications).
-
-### What was installed?
-
-1. **Argo Workflows** to enable workflow orchestrations.
-1. **Backstage** as the UI for software catalog and templating. Source is available [here](https://github.com/cnoe-io/backstage-app).
-1. **External Secrets** to generate secrets and coordinate secrets between applications.
-1. **Keycloak** as the identity provider for applications.
-1. **Spark Operator** to demonstrate an example Spark workload through Backstage.
-
-If you don't want to install a package above, you can remove the ArgoCD Application file corresponding to the package you want to remove.
-For example, if you want to remove Spark Operator, you can delete [this file](./spark-operator.yaml).
-
-The only package that cannot be removed this way is Keycloak because other packages rely on it. 
-
-
-#### Accessing UIs
-- Argo CD: https://{{{ .Env.DOMAIN }}}:8443/argocd
-- Argo Workflows: https://{{{ .Env.DOMAIN }}}:8443/argo-workflows
-- Backstage: https://{{{ .Env.DOMAIN }}}:8443/
-- Gitea: https://{{{ .Env.DOMAIN }}}:8443/gitea
-- Keycloak: https://{{{ .Env.DOMAIN }}}:8443/keycloak/admin/master/console/
-
-# Using it
-
-For this example, we will walk through a few demonstrations. Once applications are ready, go to the [backstage URL](https://{{{ .Env.DOMAIN }}}:8443).
-
-Click on the Sign-In button, you will be asked to log into the Keycloak instance. There are two users set up in this 
-configuration, and their password can be retrieved with the following command:
-
-```bash
-idpbuilder get secrets
-```
-
-Use the username **`user1`** and the password value given by `USER_PASSWORD` field to login to the backstage instance.
-`user1` is an admin user who has access to everything in the cluster, while `user2` is a regular user with limited access.
-Both users use the same password retrieved above.
-
-If you want to create a new user or change existing users:
-
-1. Go to the [Keycloak UI](https://{{{ .Env.DOMAIN }}}:8443/keycloak/admin/master/console/). 
-Login with the username `cnoe-admin`. Password is the `KEYCLOAK_ADMIN_PASSWORD` field from the command above. 
-2. Select `cnoe` from the realms drop down menu.
-3. Select users tab.
-
-
-## Basic Deployment
-
-Let's start by deploying a simple application to the cluster through Backstage.
-
-Click on the `Create...` button on the left, then select the `Create a Basic Deployment` template.
-
-![img.png](images/backstage-templates.png)
-
-
-In the next screen, type `demo` for the name field, then click Review, then Create. 
-Once steps run, click the Open In Catalog button to go to the entity page. 
-
-![img.png](images/basic-template-flow.png)
-
-In the demo entity page, you will notice a ArgoCD overview card associated with this entity. 
-You can click on the ArgoCD Application name to see more details.
-
-![img.png](images/demo-entity.png)
-
-### What just happened?
-
-1. Backstage created [a git repository](https://{{{ .Env.DOMAIN }}}:8443/gitea/giteaAdmin/demo), then pushed templated contents to it.
-2. Backstage created [an ArgoCD Application](https://{{{ .Env.DOMAIN }}}:8443/argocd/applications/argocd/demo?) and pointed it to the git repository.
-3. Backstage registered the application as [a component](https://{{{ .Env.DOMAIN }}}:8443/gitea/giteaAdmin/demo/src/branch/main/catalog-info.yaml) in Backstage.
-4. ArgoCD deployed the manifests stored in the repo to the cluster.
-5. Backstage retrieved application health from ArgoCD API, then displayed it.
-
-![image.png](images/basic-deployment.png)
-
-
-## Argo Workflows and Spark Operator
-
-In this example, we will deploy a simple Apache Spark job through Argo Workflows.
-
-Click on the `Create...` button on the left, then select the `Basic Argo Workflow with a Spark Job` template.
-
-![img.png](images/backstage-templates-spark.png)
-
-Type `demo2` for the name field, then click create. You will notice that the Backstage templating steps are very similar to the basic example above.
-Click on the Open In Catalog button to go to the entity page.
-
-![img.png](images/demo2-entity.png)
-
-Deployment processes are the same as the first example. Instead of deploying a pod, we deployed a workflow to create a Spark job.
-
-In the entity page, there is a card for Argo Workflows, and it should say running or succeeded. 
-You can click the name in the card to go to the Argo Workflows UI to view more details about this workflow run. 
-When prompted to log in, click the login button under single sign on. Argo Workflows is configured to use SSO with Keycloak allowing you to login with the same credentials as Backstage login.
-
-Note that Argo Workflows are not usually deployed this way. This is just an example to show you how you can integrate workflows, backstage, and spark.
-
-Back in the entity page, you can view more details about Spark jobs by navigating to the Spark tab.
-
-## Application with cloud resources.
-
-To deploy cloud resources, you can follow any of the instructions below:
-
-- [Cloud resource deployments via Crossplane](../crossplane-integrations/)
-- [Cloud resource deployments via Terraform](../terraform-integrations/)
-
-## Notes
-
-- In these examples, we have used the pattern of creating a new repository for every app, then having ArgoCD deploy it.
-This is done for convenience and demonstration purposes only. There are alternative actions that you can use. 
-For example, you can create a PR to an existing repository, create a repository but not deploy them yet, etc.
-
-- If Backstage's pipelining and templating mechanisms is too simple, you can use more advanced workflow engines like Tekton or Argo Workflows. 
-  You can invoke them in Backstage templates, then track progress similar to how it was described above.