configuration added

listener {
          address = "0.0.0.0:1514"
          labels   = { component = "loki.source.syslog", protocol = "tcp" }
        }
        forward_to = [loki.write.local_loki.receiver]
      }

README.md

@@ -1,3 +1,7 @@
 # edpbuilder stacks
 
-This repository contains the building blocks to instantiate Internal Developer Platforms.
+This repository contains the building blocks to instanciate Internal Developer Platform's.
+
+### Install edpbuilder
+
+To get started, you need to install [edpbuilder](https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW/edpbuilder).

template/edfbuilder.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/registry"
+    path: registry
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/ci-sizer.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ci-sizer-reg
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    name: in-cluster
-    namespace: argocd
-  source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ci-sizer"
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
-    targetRevision: HEAD
-  project: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

template/registry/core.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core"
+    path: stacks/core
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/docs.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: docs-reg
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    name: in-cluster
-    namespace: argocd
-  source:
-    path: argocd-stack
-    repoURL: "https://edp.buildth.ing/DevFW-CICD/website-and-documentation"
-    targetRevision: HEAD
-  project: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-  syncOptions:
-    - CreateNamespace=true

template/registry/local-backup.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: otc
+  name: local-backup
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc"
+    path: stacks/local-backup
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/monitoring.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: garm-reg
+  name: monitoring
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/garm"
+    path: stacks/monitoring
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/observability-client.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: observability-client
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    name: in-cluster
-    namespace: argocd
-  source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client"
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
-    targetRevision: HEAD
-  project: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

template/registry/observability.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: observability
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    name: in-cluster
-    namespace: argocd
-  source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability"
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
-    targetRevision: HEAD
-  project: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

template/registry/ref-implementation.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: coder-reg
+  name: ref-implementation
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/coder"
+    path: stacks/ref-implementation
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/second-cluster.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: forgejo
+  name: second-cluster
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo"
+    path: stacks/second-cluster
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/terralist.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: terralist-reg
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    name: in-cluster
-    namespace: argocd
-  source:
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/terralist"
-    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
-    targetRevision: HEAD
-  project: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

template/stacks/ci-sizer/gitlab-webhook.yaml

@@ -1,29 +0,0 @@
-# Optional: GitLab CI integration
-# Only hydrate this app for clusters that run GitLab Runner.
-# For Forgejo/GitHub-only deployments, omit this app from stacks-instances.
-# See: ci-sizer/docs/deployment-modes.md
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: gitlab-sizer-webhook
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: ci-sizer
-  source:
-    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-    targetRevision: HEAD
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ci-sizer/gitlab-webhook"

template/stacks/ci-sizer/gitlab-webhook/certificates.yaml

@@ -1,27 +0,0 @@
-# Self-signed Issuer for webhook TLS.
-# For production, replace with a ClusterIssuer backed by a real CA.
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: selfsigned-issuer
-spec:
-  selfSigned: {}
----
-# cert-manager Certificate for the webhook TLS.
-# The resulting Secret (gitlab-sizer-webhook-tls) is mounted into the webhook pod.
-# cert-manager also injects the CA into the MutatingWebhookConfiguration via the
-# cert-manager.io/inject-ca-from annotation.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gitlab-sizer-webhook-cert
-spec:
-  secretName: gitlab-sizer-webhook-tls
-  issuerRef:
-    name: selfsigned-issuer
-    kind: Issuer
-  dnsNames:
-    - gitlab-sizer-webhook.ci-sizer.svc
-    - gitlab-sizer-webhook.ci-sizer.svc.cluster.local
-  duration: 8760h
-  renewBefore: 720h

template/stacks/ci-sizer/gitlab-webhook/deployment.yaml

@@ -1,141 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: gitlab-sizer-webhook
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: gitlab-sizer-webhook
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: gitlab-sizer-webhook
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: gitlab-sizer-webhook
-subjects:
-  - kind: ServiceAccount
-    name: gitlab-sizer-webhook
-    namespace: ci-sizer
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gitlab-sizer-webhook
-  labels:
-    app: gitlab-sizer-webhook
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: gitlab-sizer-webhook
-  template:
-    metadata:
-      labels:
-        app: gitlab-sizer-webhook
-    spec:
-      serviceAccountName: gitlab-sizer-webhook
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-        runAsGroup: 65534
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: webhook
-          image: edp.buildth.ing/devfw-cicd/gitlab-webhook-edge-connect:latest
-          imagePullPolicy: Always
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          ports:
-            - containerPort: 8443
-              protocol: TCP
-          args:
-            - --listen-addr=:8443
-            - --tls-cert-file=/etc/webhook/tls/tls.crt
-            - --tls-key-file=/etc/webhook/tls/tls.key
-            - --sizer-url=http://sizer-receiver.ci-sizer.svc:8080
-            - --sizer-sidecar-image=edp.buildth.ing/devfw-cicd/ci-sizer-collector:latest
-          env:
-            - name: WEBHOOK_SIZER_READ_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: gitlab-sizer-webhook-tokens
-                  key: sizer-read-token
-            - name: WEBHOOK_SIZER_PUSH_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: gitlab-sizer-webhook-tokens
-                  key: sizer-push-token
-            - name: HTTP_PROXY
-              valueFrom:
-                configMapKeyRef:
-                  name: gitlab-sizer-webhook-config
-                  key: HTTP_PROXY
-                  optional: true
-            - name: HTTPS_PROXY
-              valueFrom:
-                configMapKeyRef:
-                  name: gitlab-sizer-webhook-config
-                  key: HTTPS_PROXY
-                  optional: true
-            - name: NO_PROXY
-              valueFrom:
-                configMapKeyRef:
-                  name: gitlab-sizer-webhook-config
-                  key: NO_PROXY
-                  optional: true
-          volumeMounts:
-            - name: webhook-tls
-              mountPath: /etc/webhook/tls
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8443
-              scheme: HTTPS
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: 8443
-              scheme: HTTPS
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-      volumes:
-        - name: webhook-tls
-          secret:
-            secretName: gitlab-sizer-webhook-tls
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitlab-sizer-webhook
-  labels:
-    app: gitlab-sizer-webhook
-spec:
-  selector:
-    app: gitlab-sizer-webhook
-  ports:
-    - port: 443
-      targetPort: 8443
-      protocol: TCP

template/stacks/ci-sizer/gitlab-webhook/webhook-config.yaml

@@ -1,30 +0,0 @@
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  name: gitlab-sizer-webhook
-  annotations:
-    cert-manager.io/inject-ca-from: ci-sizer/gitlab-sizer-webhook-cert
-webhooks:
-  - name: gitlab-sizer-webhook.ci-sizer.svc
-    admissionReviewVersions: ["v1"]
-    sideEffects: NoneOnDryRun
-    failurePolicy: Ignore
-    timeoutSeconds: 5
-    reinvocationPolicy: Never
-    clientConfig:
-      service:
-        name: gitlab-sizer-webhook
-        namespace: ci-sizer
-        path: /mutate
-    rules:
-      - apiGroups: [""]
-        apiVersions: ["v1"]
-        operations: ["CREATE"]
-        resources: ["pods"]
-    namespaceSelector:
-      matchLabels:
-        ci-sizer.devfw.io/watch: "true"
-    objectSelector:
-      matchExpressions:
-        - key: job.runner.gitlab.com/pod
-          operator: Exists

template/stacks/ci-sizer/sizer-receiver.yaml

@@ -1,29 +0,0 @@
-# Required: CI Sizer receiver
-# Always deploy this — it stores metrics and computes sizing recommendations.
-# Works standalone or with GARM (Forgejo/GitHub) and/or GitLab webhook.
-# See: ci-sizer/docs/deployment-modes.md
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: sizer-receiver
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: ci-sizer
-  source:
-    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-    targetRevision: HEAD
-    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ci-sizer/sizer-receiver"

template/stacks/ci-sizer/sizer-receiver/deployment.yaml

@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sizer-receiver
-  labels:
-    app: sizer-receiver
-spec:
-  strategy:
-    type: Recreate
-  replicas: 1
-  selector:
-    matchLabels:
-      app: sizer-receiver
-  template:
-    metadata:
-      labels:
-        app: sizer-receiver
-    spec:
-      securityContext:
-        fsGroup: 65534
-      containers:
-        - name: receiver
-          image: edp.buildth.ing/devfw-cicd/ci-sizer-receiver:latest
-          imagePullPolicy: Always
-          args:
-            - --db=/data/metrics.db
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: RECEIVER_READ_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: sizer-tokens
-                  key: read-token
-            - name: RECEIVER_HMAC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: sizer-tokens
-                  key: hmac-key
-{{{- if index .Env "DOMAIN_GITEA" }}}
-            - name: GARM_URL
-              value: "http://garm.garm.svc:80"
-            - name: GARM_USER
-              value: "admin"
-            - name: GARM_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: garm-fixed-credentials
-                  key: admin_password
-            {{{- end }}}
-            - name: RECEIVER_OIDC_ISSUER
-              value: "https://dex.{{{ .Env.DOMAIN }}}"
-            - name: RECEIVER_OIDC_CLIENT_ID
-              value: "ci-sizer"
-            - name: RECEIVER_OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: sizer-oidc-client
-                  key: client-secret
-            - name: RECEIVER_OIDC_REDIRECT_URI
-              value: "https://sizer.{{{ .Env.DOMAIN }}}/ui/callback"
-            - name: RECEIVER_SESSION_TTL
-              value: "12h"
-            - name: RECEIVER_ALLOWED_ORG
-              value: "{{{ getenv "SIZER_ALLOWED_ORG" "DevFW-CICD" }}}"
-            - name: RECEIVER_CPU_SIZING_MODE
-              value: "observe"
-            - name: RECEIVER_MEMORY_QOS
-              value: "guaranteed"
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 2
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: sizer-receiver-data
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sizer-receiver
-  labels:
-    app: sizer-receiver
-spec:
-  selector:
-    app: sizer-receiver
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-      protocol: TCP
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sizer-receiver-data
-  labels:
-    app: sizer-receiver
-  annotations:
-    everest.io/disk-volume-type: GPSSD
-spec:
-  storageClassName: csi-disk
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

template/stacks/ci-sizer/sizer-receiver/ingress.yaml

@@ -1,40 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    cert-manager.io/cluster-issuer: main
-{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
-    dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: sizer.{{{ .Env.DOMAIN }}}
-    dns.gardener.cloud/ttl: "600"
-{{{ end }}}
-  name: sizer-receiver
-  namespace: ci-sizer
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: sizer.{{{ .Env.DOMAIN }}}
-      http:
-        paths:
-          - backend:
-              service:
-                name: sizer-receiver
-                port:
-                  number: 8080
-            path: /
-            pathType: Prefix
-    - host: ci-sizer.{{{ .Env.DOMAIN }}}
-      http:
-        paths:
-          - backend:
-              service:
-                name: sizer-receiver
-                port:
-                  number: 8080
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - sizer.{{{ .Env.DOMAIN }}}
-      secretName: sizer-receiver-tls

template/stacks/coder/coder.yaml

@@ -1,32 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: coder
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: coder
-  sources:
-    - repoURL: https://helm.coder.com/v2
-      chart: coder
-      targetRevision: 2.28.3
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/coder/coder/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/coder/coder/manifests"

template/stacks/coder/coder/manifests/postgres.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: coder-db
-  namespace: coder
-spec:
-  instances: 1
-  primaryUpdateStrategy: unsupervised
-  resources:
-    requests:
-      memory: "1Gi"
-      cpu: "1"
-    limits:
-      memory: "1Gi"
-      cpu: "1"
-  managed:
-    roles:
-      - name: coder
-        createdb: true
-        login: true
-        passwordSecret:
-          name: coder-db-user
-  storage:
-    size: 10Gi
-    storageClass: csi-disk
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: coder
-  namespace: coder
-spec:
-  cluster:
-    name: coder-db
-  name: coder
-  owner: coder
----

template/stacks/coder/coder/values.yaml

@@ -1,61 +0,0 @@
-coder:
-  # You can specify any environment variables you'd like to pass to Coder
-  # here. Coder consumes environment variables listed in
-  # `coder server --help`, and these environment variables are also passed
-  # to the workspace provisioner (so you can consume them in your Terraform
-  # templates for auth keys etc.).
-  #
-  # Please keep in mind that you should not set `CODER_HTTP_ADDRESS`,
-  # `CODER_TLS_ENABLE`, `CODER_TLS_CERT_FILE` or `CODER_TLS_KEY_FILE` as
-  # they are already set by the Helm chart and will cause conflicts.
-  env:
-    - name: CODER_ACCESS_URL
-      value: https://coder.{{{ .Env.DOMAIN_GITEA }}}
-    - name: CODER_PG_CONNECTION_URL
-      valueFrom:
-        secretKeyRef:
-          # You'll need to create a secret called coder-db-url with your
-          # Postgres connection URL like:
-          # postgres://coder:password@postgres:5432/coder?sslmode=disable
-          name: coder-db-user
-          key: url
-    # For production deployments, we recommend configuring your own GitHub
-    # OAuth2 provider and disabling the default one.
-    - name: CODER_OAUTH2_GITHUB_DEFAULT_PROVIDER_ENABLE
-      value: "false"
-    - name: EDGE_CONNECT_ENDPOINT
-      valueFrom:
-        secretKeyRef:
-          name: edge-credential
-          key: endpoint
-    - name: EDGE_CONNECT_USERNAME
-      valueFrom:
-        secretKeyRef:
-          name: edge-credential
-          key: username
-    - name: EDGE_CONNECT_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: edge-credential
-          key: password
-
-    # (Optional) For production deployments the access URL should be set.
-    # If you're just trying Coder, access the dashboard via the service IP.
-    # - name: CODER_ACCESS_URL
-    #   value: "https://coder.example.com"
-
-  #tls:
-  #  secretNames:
-  #    - my-tls-secret-name
-  service:
-    type: ClusterIP
-
-  ingress:
-    enable: true
-    className: nginx
-    host: coder.{{{ .Env.DOMAIN_GITEA }}}
-    annotations:
-      cert-manager.io/cluster-issuer: main
-    tls:
-      enable: true
-      secretName: coder-tls-secret

template/stacks/core/argocd.yaml

@@ -12,24 +12,19 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-    retry:
-      limit: -1
   destination:
     name: in-cluster
     namespace: argocd
   sources:
-    - repoURL: https://github.com/argoproj/argo-helm.git
+    - repoURL: https://github.com/argoproj/argo-helm
       path: charts/argo-cd
       # TODO: RIRE Can be updated when https://github.com/argoproj/argo-cd/issues/20790 is fixed and merged
       # As logout make problems, it is suggested to switch from path based routing to an own argocd domain,
       # similar to the CNOE amazon reference implementation and in our case, Forgejo
-      targetRevision: argo-cd-9.4.6
+      targetRevision: argo-cd-7.7.5
       helm:
         valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/values.yaml
+          - $values/stacks/core/argocd/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
       targetRevision: HEAD
       ref: values
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/manifests"

template/stacks/core/argocd/values.yaml

@@ -1,20 +1,11 @@
 global:
-  domain: {{{ .Env.DOMAIN_ARGOCD }}}
+  domain: {{{ .Env.DOMAIN }}}
 
 configs:
   params:
     server.insecure: true
+    server.basehref: /argocd
   cm:
-    oidc.config: |
-      name: FORGEJO
-      issuer: https://{{{ .Env.DOMAIN_DEX }}}
-      clientID: controller-argocd-dex
-      clientSecret: $dex-argo-client:clientSecret
-      requestedScopes:
-      - openid
-      - profile
-      - email
-      - groups
     application.resourceTrackingMethod: annotation
     timeout.reconciliation: 60s
     resource.exclusions: |
@@ -28,9 +19,9 @@ configs:
         - CiliumIdentity
         clusters:
         - "*"
-    url: https://{{{ .Env.DOMAIN_ARGOCD }}}
+    accounts.provider-argocd: apiKey
   rbac:
-    policy.csv: 'g, DevFW, role:admin'
+    policy.csv: 'g, provider-argocd, role:admin'
 
   tls:
     certificates:

template/stacks/core/cloudnative-pg.yaml

@@ -1,30 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cloudnative-pg
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: cloudnative-pg
-  sources:
-    - repoURL: https://cloudnative-pg.github.io/charts
-      chart: cloudnative-pg
-      targetRevision: 0.26.1
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/cloudnative-pg/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values

template/stacks/core/cloudnative-pg/values.yaml

@@ -1 +0,0 @@
-# No need for values here.

template/stacks/core/crossplane-compositions.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: crossplane-compositions
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: crossplane-system
+  source:
+    path: stacks/core/crossplane-compositions
+    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    targetRevision: HEAD
+    directory:
+      recurse: true

template/stacks/core/crossplane-compositions/edfbuilder/definition.yaml

@@ -0,0 +1,30 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: CompositeResourceDefinition
+metadata:
+  name: edfbuilders.edfbuilder.crossplane.io
+spec:
+  connectionSecretKeys:
+    - kubeconfig
+  group: edfbuilder.crossplane.io
+  names:
+    kind: EDFBuilder
+    listKind: EDFBuilderList
+    plural: edfbuilders
+    singular: edfbuilders
+  versions:
+    - name: v1alpha1
+      served: true
+      referenceable: true
+      schema:
+        openAPIV3Schema:
+          description: A EDFBuilder is a composite resource that represents a K8S Cluster with edfbuilder Installed
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                repoURL:
+                  type: string
+                  description: URL to ArgoCD stack of stacks repo
+              required:
+                - repoURL

template/stacks/core/crossplane-providers.yaml

@@ -0,0 +1,23 @@
+{{{ if eq .Env.CLUSTER_TYPE "kind" }}}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: crossplane-providers
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: crossplane-system
+  source:
+    path: stacks/core/crossplane-providers
+    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    targetRevision: HEAD
+{{{ end }}}

template/stacks/core/crossplane-providers/function-patch-and-transform.yaml

@@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Function
+metadata:
+  name: crossplane-contrib-function-patch-and-transform
+spec:
+  package: xpkg.upbound.io/crossplane-contrib/function-patch-and-transform:v0.7.0
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-argocd-config.yaml

@@ -0,0 +1,14 @@
+apiVersion: argocd.crossplane.io/v1alpha1
+kind: ProviderConfig
+metadata:
+  name: argocd-provider
+spec:
+  serverAddr: argocd-server.argocd.svc.cluster.local:80
+  insecure: true
+  plainText: true
+  credentials:
+    source: Secret
+    secretRef:
+      namespace: crossplane-system
+      name: argocd-credentials
+      key: authToken

template/stacks/core/crossplane-providers/provider-argocd.yaml

@@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-argocd
+spec:
+  package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.9.1
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-kind-config.yaml

@@ -0,0 +1,14 @@
+apiVersion: kind.crossplane.io/v1alpha1
+kind: ProviderConfig
+metadata:
+  name: kind-provider
+spec:
+  credentials:
+    source: Secret
+    secretRef:
+      namespace: crossplane-system
+      name: kind-credentials
+      key: credentials
+  endpoint:
+    # the url is managed by crossplane-edfbuilder
+    url: https://DOCKER_HOST:SERVER_PORT/api/v1/kindserver

template/stacks/core/crossplane-providers/provider-kind.yaml

@@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-kind
+spec:
+  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-kind:v0.1.0
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-shell.yaml

@@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-shell
+spec:
+  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-shell:v0.1.1
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1

template/stacks/core/crossplane.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: crossplane
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: crossplane-system
+  source:
+    chart: crossplane
+    repoURL: https://charts.crossplane.io/stable
+    targetRevision: 1.18.0
+    helm:
+      releaseName: crossplane

template/stacks/core/dex/values.yaml

@@ -1,86 +0,0 @@
-ingress:
-  enabled: true
-  className: nginx
-  annotations:
-    cert-manager.io/cluster-issuer: main
-  hosts:
-    - host: {{{ .Env.DOMAIN_DEX }}}
-      paths:
-        - path: /
-          pathType: Prefix
-  tls:
-    - hosts:
-        - {{{ .Env.DOMAIN_DEX }}}
-      secretName: dex-cert
-
-envVars:
-  - name: FORGEJO_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: dex-forgejo-client
-        key: clientSecret
-  - name: FORGEJO_CLIENT_ID
-    valueFrom:
-      secretKeyRef:
-        name: dex-forgejo-client
-        key: clientID
-  - name: OIDC_DEX_GRAFANA_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: dex-grafana-client
-        key: clientSecret
-  - name: OIDC_DEX_ARGO_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: dex-argo-client
-        key: clientSecret
-  - name: FORGEJO_RUNNER_SIZER_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: dex-sizer-client
-        key: clientSecret
-  - name: LOG_LEVEL
-    value: debug
-
-config:
-  # Set it to a valid URL
-  issuer: https://{{{ .Env.DOMAIN_DEX }}}
-
-  # See https://dexidp.io/docs/storage/ for more options
-  storage:
-    type: memory
-
-  oauth2:
-    skipApprovalScreen: true
-    alwaysShowLoginScreen: false
-
-  connectors:
-    - type: gitea
-      id: gitea
-      name: Forgejo
-      config:
-        clientID: "$FORGEJO_CLIENT_ID"
-        clientSecret: "$FORGEJO_CLIENT_SECRET"
-        redirectURI: https://{{{ .Env.DOMAIN_DEX }}}/callback
-        baseURL: https://edp.buildth.ing
-        # loadAllGroups: true
-        orgs:
-          - name: DevFW
-  enablePasswordDB: false
-
-  staticClients:
-    - id: controller-argocd-dex
-      name: ArgoCD Client
-      redirectURIs:
-        - "https://{{{ .Env.DOMAIN_ARGOCD }}}/auth/callback"
-      secretEnv: "OIDC_DEX_ARGO_CLIENT_SECRET"
-    - id: grafana
-      redirectURIs:
-        - "https://{{{ .Env.DOMAIN_GRAFANA }}}/login/generic_oauth"
-      name: "Grafana"
-      secretEnv: "OIDC_DEX_GRAFANA_CLIENT_SECRET"
-    - id: ci-sizer
-      name: "CI Sizer"
-      redirectURIs:
-        - "https://sizer.{{{ .Env.DOMAIN }}}/ui/callback"
-      secretEnv: "FORGEJO_RUNNER_SIZER_CLIENT_SECRET"

template/stacks/core/forgejo-runner.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo-runner
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    server: "https://kubernetes.default.svc"
+  source:
+    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    targetRevision: HEAD
+    path: "stacks/core/forgejo-runner"

template/stacks/core/forgejo-runner/dind-docker.yaml

@@ -7,7 +7,7 @@ metadata:
   namespace: gitea
 spec:
   # Two replicas means that if one is busy, the other can pick up jobs.
-  replicas: 3
+  replicas: 1
   selector:
     matchLabels:
       app: forgejo-runner
@@ -28,18 +28,19 @@ spec:
       # https://forgejo.org/docs/v1.21/admin/actions/#offline-registration
       initContainers:
         - name: runner-register
-          image: code.forgejo.org/forgejo/runner:12.6.4
+          image: code.forgejo.org/forgejo/runner:6.0.1
-          command:
+          command: 
-          - "sh"
+            - "forgejo-runner"
-          - "-c"
+            - "register"
-          - |
+            - "--no-interactive"
-            forgejo-runner \
+            - "--token"
-              register \
+            - $(RUNNER_SECRET)
-              --no-interactive \
+            - "--name"
-              --token ${RUNNER_SECRET} \
+            - $(RUNNER_NAME)
-              --name ${RUNNER_NAME} \
+            - "--instance"
-              --instance ${FORGEJO_INSTANCE_URL} \
+            - $(FORGEJO_INSTANCE_URL)
-              --labels docker:docker://node:24-bookworm,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-24.04,ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04
+            - "--labels"
+            - "docker:docker://node:20-bookworm,ubuntu-22.04:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04,ubuntu-latest:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04"
           env:
             - name: RUNNER_NAME
               valueFrom:
@@ -57,8 +58,8 @@ spec:
               mountPath: /data
       containers:
       - name: runner
-        image: code.forgejo.org/forgejo/runner:12.6.4
+        image: code.forgejo.org/forgejo/runner:6.0.1
-        command:
+        command: 
           - "sh"
           - "-c"
           - |
@@ -93,7 +94,7 @@ spec:
         - name: runner-data
           mountPath: /data
       - name: daemon
-        image: docker:28.0.4-dind
+        image: docker:27.4.1-dind
         env:
         - name: DOCKER_TLS_CERTDIR
           value: /certs

template/stacks/core/forgejo.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: dex
+  name: forgejo
   namespace: argocd
   labels:
     env: dev
@@ -12,18 +12,16 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-    retry:
-      limit: -1
   destination:
     name: in-cluster
-    namespace: dex
+    namespace: gitea
   sources:
-    - repoURL: https://charts.dexidp.io
+    - repoURL: https://code.forgejo.org/forgejo-helm/forgejo-helm.git
-      chart: dex
+      path: .
-      targetRevision: 0.23.0
+      targetRevision: v10.1.1
       helm:
         valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/dex/values.yaml
+          - $values/stacks/core/forgejo/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
       targetRevision: HEAD
       ref: values

template/stacks/core/forgejo/values.yaml

@@ -0,0 +1,56 @@
+redis-cluster:
+  enabled: false
+postgresql:
+  enabled: false
+postgresql-ha:
+  enabled: false
+
+persistence:
+  enabled: true
+  size: 5Gi
+
+test:
+  enabled: false
+
+gitea:
+  admin:
+    existingSecret: gitea-credential
+  config:
+    database:
+      DB_TYPE: sqlite3
+    session:
+      PROVIDER: memory
+    cache:
+      ADAPTER: memory
+    queue:
+      TYPE: level
+    server:
+      DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
+      ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
+
+service:
+  ssh:
+    type: NodePort
+    nodePort: 32222
+    externalTrafficPolicy: Local
+
+image:
+  pullPolicy: "IfNotPresent"
+  # Overrides the image tag whose default is the chart appVersion.
+  #tag: "8.0.3"
+  # Adds -rootless suffix to image name
+  rootless: true
+
+forgejo:
+  runner:
+    enabled: true
+    image:
+      tag: latest
+    # replicas: 3
+    config:
+      runner:
+        labels:
+          - docker:docker://node:16-bullseye
+          - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+          - ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+          - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04

template/stacks/core/ingress-apps.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-apps
+  namespace: argocd
+  labels:
+    example: ref-implementation
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    server: "https://kubernetes.default.svc"
+  source:
+    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    targetRevision: HEAD
+    path: "stacks/core/ingress-apps"
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

template/stacks/core/ingress-apps/alloy.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: alloy
+  namespace: monitoring
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: {{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: alloy
+            port:
+              number: 12345
+        path: /alloy
+        pathType: Prefix

template/stacks/core/ingress-apps/argo-workflows-ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  name: argo-workflows-ingress
+  namespace: argo
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: localhost
+    http:
+      paths:
+      - backend:
+          service:
+            name: argo-server
+            port:
+              name: web
+        path: /argo-workflows(/|$)(.*)
+        pathType: ImplementationSpecific
+  - host: {{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: argo-server
+            port:
+              name: web
+        path: /argo-workflows(/|$)(.*)
+        pathType: ImplementationSpecific

template/stacks/core/ingress-apps/argocd-server.yaml

@@ -4,10 +4,11 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    cert-manager.io/cluster-issuer: main
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/use-regex: "true"
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
     dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_ARGOCD }}}
+    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN }}}
     dns.gardener.cloud/ttl: "600"
 {{{ end }}}
   name: argocd-server
@@ -15,7 +16,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: {{{ .Env.DOMAIN_ARGOCD }}}
+  - host: {{{ .Env.DOMAIN }}}
     http:
       paths:
       - backend:
@@ -23,9 +24,9 @@ spec:
             name: argocd-server
             port:
               number: 80
-        path: /
+        path: /argocd(/|$)(.*)
-        pathType: Prefix
+        pathType: ImplementationSpecific
   tls:
   - hosts:
-    - {{{ .Env.DOMAIN_ARGOCD }}}
+    - {{{ .Env.DOMAIN }}}
     secretName: argocd-net-tls

template/stacks/core/ingress-apps/backstage.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: backstage
+  namespace: backstage
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: localhost
+    http:
+      paths:
+      - backend:
+          service:
+            name: backstage
+            port:
+              name: http
+        path: /
+        pathType: Prefix
+  - host: {{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: backstage
+            port:
+              name: http
+        path: /
+        pathType: Prefix

template/stacks/core/ingress-apps/fibonacci-service.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: fibonacci-service
+  namespace: fibonacci-app
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: {{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: fibonacci-service
+            port:
+              number: 9090
+        path: /fibonacci
+        pathType: Prefix

template/stacks/core/ingress-apps/forgejo.yaml

@@ -3,14 +3,13 @@ kind: Ingress
 metadata:
   annotations:
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: 5120m
+    nginx.ingress.kubernetes.io/proxy-body-size: 512m
-    cert-manager.io/cluster-issuer: main
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
     dns.gardener.cloud/class: garden
     dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_GITEA }}}
     dns.gardener.cloud/ttl: "600"
 {{{ end }}}
-  name: forgejo-server
+  name: forgejo
   namespace: gitea
 spec:
   ingressClassName: nginx
@@ -20,7 +19,7 @@ spec:
       paths:
       - backend:
           service:
-            name: forgejo-server-http
+            name: forgejo-http
             port:
               number: 3000
         path: /

template/stacks/core/ingress-apps/keycloak-ingress-localhost.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak-ingress-localhost
+  namespace: keycloak
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: localhost
+    http:
+      paths:
+      - backend:
+          service:
+            name: keycloak
+            port:
+              name: http
+        path: /keycloak
+        pathType: ImplementationSpecific
+  - host: {{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: keycloak
+            port:
+              name: http
+        path: /keycloak
+        pathType: ImplementationSpecific

template/stacks/core/ingress-apps/kube-prometheus-stack-grafana.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kube-prometheus-stack-grafana
+  namespace: monitoring
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: {{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: kube-prometheus-stack-grafana
+            port:
+              number: 80
+        path: /grafana
+        pathType: Prefix

template/stacks/core/ingress-apps/minio-console.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio-console
+  namespace: minio-backup
+{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
+  annotations:
+    dns.gardener.cloud/class: garden
+    dns.gardener.cloud/dnsnames: minio-backup.{{{ .Env.DOMAIN }}}
+    dns.gardener.cloud/ttl: "600"
+{{{ end }}}
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: minio-backup.{{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: minio-console
+            port:
+              number: 9001
+        path: /
+        pathType: Prefix

template/stacks/core/ingress-apps/openbao.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: openbao
+  namespace: openbao
+{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
+  annotations:
+    dns.gardener.cloud/class: garden
+    dns.gardener.cloud/dnsnames: openbao.{{{ .Env.DOMAIN }}}
+    dns.gardener.cloud/ttl: "600"
+{{{ end }}}
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: openbao.{{{ .Env.DOMAIN }}}
+    http:
+      paths:
+      - backend:
+          service:
+            name: openbao
+            port:
+              number: 8200
+        path: /
+        pathType: Prefix

template/stacks/core/ingress-nginx.yaml

@@ -12,18 +12,16 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-    retry:
-      limit: -1
   destination:
     name: in-cluster
     namespace: ingress-nginx
   sources:
-    - repoURL: https://github.com/kubernetes/ingress-nginx.git
+    - repoURL: https://github.com/kubernetes/ingress-nginx
       path: charts/ingress-nginx
-      targetRevision: helm-chart-4.12.1
+      targetRevision: helm-chart-4.11.3
       helm:
         valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/ingress-nginx/values.yaml
+          - $values/stacks/core/ingress-nginx/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
       targetRevision: HEAD
       ref: values

template/stacks/core/ingress-nginx/values.yaml

@@ -0,0 +1,49 @@
+controller:
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  ingressClassResource:
+    name: nginx
+
+  # added for idpbuilder
+  allowSnippetAnnotations: true
+
+  # added for idpbuilder
+  config:
+    proxy-buffer-size: 32k
+    use-forwarded-headers: "true"
+
+  # monitoring nginx
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels: 
+        release: "ingress-nginx"  
+      enabled: true
+
+{{{ if eq .Env.CLUSTER_TYPE "kind" }}}
+  hostPort:
+    enabled: true
+  terminationGracePeriodSeconds: 0
+  service:
+    type: NodePort
+
+  nodeSelector:
+    ingress-ready: "true"
+  tolerations:
+    - key: "node-role.kubernetes.io/master"
+      operator: "Equal"
+      effect: "NoSchedule"
+    - key: "node-role.kubernetes.io/control-plane"
+      operator: "Equal"
+      effect: "NoSchedule"
+
+  publishService:
+    enabled: false
+  extraArgs:
+    publish-status-address: localhost
+    # added for idpbuilder
+    enable-ssl-passthrough: ""
+{{{ end }}}

template/stacks/forgejo/forgejo-server.yaml

@@ -1,32 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: forgejo-server
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: gitea
-  sources:
-    - repoURL: https://code.forgejo.org/forgejo-helm/forgejo-helm.git
-      path: .
-      targetRevision: v16.2.0
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/manifests"

template/stacks/forgejo/forgejo-server/manifests/forgejo-s3-backup-cronjob.yaml

@@ -1,91 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: forgejo-s3-backup
-  namespace: gitea
-spec:
-  schedule: "0 1 * * *"
-  concurrencyPolicy: "Forbid"
-  successfulJobsHistoryLimit: 5
-  failedJobsHistoryLimit: 5
-  startingDeadlineSeconds: 600 # 10 minutes
-  jobTemplate:
-    spec:
-      # 60 min until backup - 10 min start - (backoffLimit * activeDeadlineSeconds) - some time sync buffer
-      activeDeadlineSeconds: 1350
-      backoffLimit: 2
-      ttlSecondsAfterFinished: 259200 #
-      template:
-        spec:
-          containers:
-            - name: rclone
-              image: rclone/rclone:1.70
-              imagePullPolicy: IfNotPresent
-              env:
-                - name: SOURCE_BUCKET
-                  valueFrom:
-                    secretKeyRef:
-                      name: forgejo-cloud-credentials
-                      key: bucket-name
-                - name: AWS_ACCESS_KEY_ID
-                  valueFrom:
-                    secretKeyRef:
-                      name: forgejo-cloud-credentials
-                      key: access-key
-                - name: AWS_SECRET_ACCESS_KEY
-                  valueFrom:
-                    secretKeyRef:
-                      name: forgejo-cloud-credentials
-                      key: secret-key
-              volumeMounts:
-                - name: rclone-config
-                  mountPath: /config/rclone
-                  readOnly: true
-                - name: backup-dir
-                  mountPath: /backup
-                  readOnly: false
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  rclone sync source:/${SOURCE_BUCKET} /backup -v --ignore-checksum
-          restartPolicy: OnFailure
-          volumes:
-            - name: rclone-config
-              secret:
-                secretName: forgejo-s3-backup
-            - name: backup-dir
-              persistentVolumeClaim:
-                claimName: s3-backup
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: s3-backup
-  namespace: gitea
-  annotations:
-    everest.io/disk-volume-type: GPSSD
-    everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
-spec:
-  storageClassName: csi-disk
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 500Gi
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: forgejo-s3-backup
-  namespace: gitea
-type: Opaque
-stringData:
-  rclone.conf: |
-    [source]
-    type = s3
-    provider = HuaweiOBS
-    env_auth = true
-    endpoint = obs.eu-de.otc.t-systems.com
-    region = eu-de
-    acl = private

template/stacks/forgejo/forgejo-server/values.yaml

@@ -1,183 +0,0 @@
-
-# We use recreate to make sure only one instance with one version is running, because Forgejo might break or data gets inconsistant.
-strategy:
-  type: Recreate
-
-redis-cluster:
-  enabled: false
-
-redis:
-  enabled: false
-
-postgresql:
-  enabled: false
-
-postgresql-ha:
-  enabled: false
-
-persistence:
-  enabled: true
-  size: 200Gi
-  storageClass: csi-disk
-  annotations:
-    everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
-    everest.io/disk-volume-type: GPSSD
-
-test:
-  enabled: false
-
-deployment:
-  env:
-    - name: SSL_CERT_DIR
-      value: /etc/ssl/forgejo
-
-extraVolumeMounts:
-  - mountPath: /etc/ssl/forgejo
-    name: custom-database-certs-volume
-    readOnly: true
-
-extraVolumes:
-  - name: custom-database-certs-volume
-    secret:
-      secretName: custom-database-certs
-
-gitea:
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-  additionalConfigFromEnvs:
-    - name: FORGEJO__storage__MINIO_ACCESS_KEY_ID
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-cloud-credentials
-          key: access-key
-    - name: FORGEJO__storage__MINIO_SECRET_ACCESS_KEY
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-cloud-credentials
-          key: secret-key
-    - name: FORGEJO__queue__CONN_STR
-      valueFrom:
-        secretKeyRef:
-          name: redis-forgejo-cloud-credentials
-          key: connection-string
-    - name: FORGEJO__session__PROVIDER_CONFIG
-      valueFrom:
-        secretKeyRef:
-          name: redis-forgejo-cloud-credentials
-          key: connection-string
-    - name: FORGEJO__cache__HOST
-      valueFrom:
-        secretKeyRef:
-          name: redis-forgejo-cloud-credentials
-          key: connection-string
-    - name: FORGEJO__database__HOST
-      valueFrom:
-        secretKeyRef:
-          name: postgres-forgejo-cloud-credentials
-          key: host_port
-    - name: FORGEJO__database__NAME
-      valueFrom:
-        secretKeyRef:
-          name: postgres-forgejo-cloud-credentials
-          key: database
-    - name: FORGEJO__database__USER
-      valueFrom:
-        secretKeyRef:
-          name: postgres-forgejo-cloud-credentials
-          key: username
-    - name: FORGEJO__database__PASSWD
-      valueFrom:
-        secretKeyRef:
-          name: postgres-forgejo-cloud-credentials
-          key: password
-    # Either 'elasticsearch' or 'bleve' (go in memory search engine)
-    - name: FORGEJO__indexer__ISSUE_INDEXER_TYPE
-      valueFrom:
-        secretKeyRef:
-          name: elasticsearch-cloud-credentials
-          key: type
-    - name: FORGEJO__indexer__ISSUE_INDEXER_CONN_STR
-      valueFrom:
-        secretKeyRef:
-          name: elasticsearch-cloud-credentials
-          key: connection-string
-    - name: FORGEJO__indexer__ISSUE_INDEXER_ENABLED
-      valueFrom:
-        secretKeyRef:
-          name: elasticsearch-cloud-credentials
-          key: enabled
-    - name: FORGEJO__mailer__PASSWD
-      valueFrom:
-        secretKeyRef:
-          name: email-user-credentials
-          key: connection-string
-
-  admin:
-    existingSecret: gitea-credential
-
-  config:
-    APP_NAME: 'EDP'
-    APP_SLOGAN: 'Build your thing in minutes'
-    storage:
-      MINIO_ENDPOINT: obs.eu-de.otc.t-systems.com:443
-      STORAGE_TYPE: minio
-      MINIO_LOCATION: eu-de
-      MINIO_BUCKET: "{{{ getenv "FORGEJO_BUCKET_NAME" }}}"
-      MINIO_USE_SSL: true
-
-    queue:
-      TYPE: redis
-
-    session:
-      PROVIDER: redis
-
-    cache:
-      ENABLED: true
-      ADAPTER: redis
-
-    security:
-      GLOBAL_TWO_FACTOR_REQUIREMENT: admin
-
-    service:
-      DISABLE_REGISTRATION: true
-      ENABLE_NOTIFY_MAIL: true
-
-    other:
-      SHOW_FOOTER_VERSION: false
-      SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
-
-    database:
-      DB_TYPE: postgres
-      SSL_MODE: verify-ca
-
-    server:
-      DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
-      ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
-
-    mailer:
-      ENABLED: true
-      USER: ipcei-cis-devfw@mms-support.de
-      PROTOCOL: smtps
-      FROM: '"IPCEI CIS DevFW" <ipcei-cis-devfw@mms-support.de>'
-      SMTP_ADDR: mail.mms-support.de
-      SMTP_PORT: 465
-
-service:
-  ssh:
-    type: LoadBalancer
-    nodePort: 32222
-    externalTrafficPolicy: Cluster
-    annotations:
-      kubernetes.io/elb.id: {{{ .Env.LOADBALANCER_ID }}}
-
-image:
-  pullPolicy: "IfNotPresent"
-  # Overrides the image tag whose default is the chart appVersion.
-  #tag: "8.0.3"
-  # Adds -rootless suffix to image name
-  # rootless: true
-  fullOverride: {{{ getenv "CLIENT_REPO_DOMAIN" }}}/devfw-cicd/edp-forgejo:{{{ .Env.FORGEJO_IMAGE_TAG }}}
-
-forgejo: {}

template/stacks/garm/garm.yaml

@@ -1,33 +0,0 @@
-# Default: Forgejo/GitHub Actions runner manager
-# Deploys GARM with the ci-sizer provider for automatic sizing + collector injection.
-# For GitLab-only deployments, omit this and use gitlab-webhook instead.
-# See: ci-sizer/docs/deployment-modes.md
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: garm
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: garm
-  sources:
-    - repoURL: https://edp.buildth.ing/DevFW-CICD/garm-helm
-      path: charts/garm
-      targetRevision: v0.0.16
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/garm/garm/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values

template/stacks/garm/garm/values.yaml

@@ -1,45 +0,0 @@
-ingress:
-  enabled: true
-  className: nginx
-  annotations:
-    cert-manager.io/cluster-issuer: main
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-  hosts:
-    - host: garm.{{{ .Env.DOMAIN_GITEA }}}
-      paths:
-        - path: /
-          pathType: Prefix
-  tls:
-    - secretName: garm-net-tls
-      hosts:
-        - garm.{{{ .Env.DOMAIN_GITEA }}}
-
-# Credentials and Secrets
-credentials:
-  edgeConnect:
-    existingSecretName: "edge-credential"
-  gitea:
-    url: "https://{{{ .Env.DOMAIN_GITEA }}}"  # Required
-  db:
-    existingSecretName: garm-fixed-credentials
-
-image:
-  repository: {{{ .Env.CLIENT_REPO_DOMAIN }}}/devfw-cicd/garm-forgejo
-  tag: v0.1.7-forgejo-23
-
-providerConfig:
-  edgeConnect:
-    organization: edp2
-    region: EU
-    edgeConnectUrl: "https://hub.apps.edge.platform.mg3.mdb.osc.live"
-    cloudlet:
-      name: Hamburg
-      organization: TelekomOP
-  edgeConnectK8s:
-    sizer:
-      sidecarImage: edp.buildth.ing/devfw-cicd/ci-sizer-collector:0.0.4
-
-garm:
-  logging:
-    logLevel: info

template/stacks/local-backup/README.md

@@ -0,0 +1,126 @@
+# Local Backup with Velero and Minio
+
+This is example is adapted from the original icpbuilder stack.
+
+The two significant changes from the original were made:
+
+* disabled `hostPath` mount to persist backups within kind, since backups do not work sufficiently in this example due to PVC issues, see below.
+* renamed `minio` namespace to `minio-backup` so it does not collide with other minio examples.
+
+Within kind, it can only backup kubernetes objects. Data from PVC's is skipped, see below why.
+
+[Velero](https://velero.io/) requires some compatible storage providers as its backup target. This local installation uses [MinIO](https://min.io/) as an example.
+However, MinIO is not officially supported by Velero but works due to S3 compatibility.
+
+The current setup does NOT persist backups but stores them in MinIO's PVCs. Proper backups should configure external storage, see [Supported Providers](https://velero.io/docs/main/supported-providers/).
+
+## Installation
+
+The stack is installed as part of the `./example.sh` run.
+
+In order to persist a local backup you have to mount a local directory within `main.go`:
+
+```yaml
+nodes:
+  - role: control-plane
+    extraMounts:
+      - hostPath: /some/path/backup # replace with your own path
+        containerPath: /backup
+```
+
+Kind creates the directory on the host but you might have to adjust the permissions, otherwise the minio pod fails to start.
+
+## Using it
+
+After the installation velero and minio should be visible in ArgoCD.
+
+During the installation credentials for minio are generated and shared with velero. You can access them manually:
+
+```bash
+kubectl -n minio-backup get secret root-creds -o go-template='{{ range $key, $value := .data }}{{ printf "%s: %s\n" $key ($value | base64decode) }}{{ end }}'
+# example output
+# rootPassword: aKKZzLnyry6OYZts17vMTf32H5ghFL4WYgu6bHujm
+# rootUser: ge8019yksArb7BICt3MLY9
+```
+
+A bucket in minio was created and velero uses it for its backups by default, see helm `values.yaml` files.
+
+
+### Backup and Restore
+
+Backups and subsequent restores can be scheduled by either using the velero cli or by creating CRD objects.
+
+Check the `./demo` directory for equivalent CRD manifests.
+
+Create a backup of the backstage namespace, see `schedule` task for more permanent setups:
+
+```shell
+velero backup create backstage-backup --include-namespaces backstage
+```
+
+There are more options to create a fine granular backup and to set the backup storage.
+See velero's docs for details.
+
+Check the backup with:
+```shell
+velero backup get
+```
+
+To get more details on the backup you need to be able to connect to velero's backup storage, i.e. minio.
+Using `kubefwd` here helps a lot (this is not necessary for restore).
+
+```shell
+kubefwd services -n minio-backup
+```
+
+More details with `describe` and `logs`:
+
+```shell
+velero backup describe backstage-backup --details
+velero backup logs backstage-backup
+```
+
+Restore the backup into the original namespace, you might want to delete the existing namespace beforehand:
+
+```shell
+kubectl delete namespace backstage
+velero restore create --from-backup backstage-backup
+```
+
+When restoring, velero does not replace existing objects in the backup target.
+
+ArgoCD does pickup on the changes and also validates that the backup is in sync.
+
+
+## Issues with Persistent Volumes
+
+Velero has no issue to backup kubernetes objects like Deployments, ConfigMaps, etc. since they are just yaml/json definitions.
+Volumes containing data are, however, more complex. The preferred type of backup are kubernetes' VolumeSnapshots as they consistently store the state
+of a volume at a given point in time in an atomic action. Those snapshots live within the cluster and are subsequently downloaded into one of velero's
+storage backends for safekeeping.
+
+However, VolumeSnapshots are only possible on storage backends that support them via CSI drivers.
+Backends like `nfs` or `hostPath` do NOT support them. Here, velero uses an alternative method
+called [File System Backups](https://velero.io/docs/main/file-system-backup/).
+In essence, this a simple copy operation based on the file system. Even though
+this uses more sophisticated tooling under the hood, i.e. kopia, it is not
+possible to create a backup in an atomic transaction. Thus, the resulting backup
+might be inconsistent.
+
+Furthermore, for file system backups to work velero installs a node-agent as a
+DaemonSet on each Kubernetes node. The agent is aware of the node's internal
+storage and accesses the directories on the host directly to copy the files.
+This is not supported for hostPath volumes as they mount an arbitrary path
+on the host. In theory, a backup is possible but due extra config and security
+considerations intentionally skipped. Kind's local-path provider storage uses
+a hostPath and is thus not supported for any kind of backup.
+
+## TODOs
+
+* The MinIO -backup installation is only intended as an example and must either
+be configured properly or replaced.
+
+* The current example does not automatically schedule backups.
+
+* velero chart must be properly parameterized
+

template/stacks/local-backup/demo/backup.yaml

@@ -0,0 +1,9 @@
+# velero backup create backstage-backup --include-namespaces backstage
+apiVersion: velero.io/v1
+kind: Backup
+metadata:
+  name: backstage-backup
+  namespace: velero
+spec:
+  includedNamespaces:
+    - 'backstage'

template/stacks/local-backup/demo/restore.yaml

@@ -0,0 +1,10 @@
+# velero restore create --from-backup backstage-backup
+apiVersion: velero.io/v1
+kind: Restore
+metadata:
+  name: backstage-backup
+  namespace: velero
+spec:
+  backupName: backstage-backup
+  includedNamespaces:
+    - 'backstage'

template/stacks/local-backup/minio.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: minio
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  sources:
+    - repoURL: 'https://charts.min.io'
+      targetRevision: 5.0.15
+      helm:
+        releaseName: minio
+        valueFiles:
+          - $values/stacks/local-backup/minio/helm/values.yaml
+      chart: minio
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+      targetRevision: HEAD
+      path: "stacks/local-backup/minio/manifests"
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: minio-backup
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      selfHeal: true

template/stacks/local-backup/minio/helm/values.yaml

@@ -0,0 +1,17 @@
+replicas: 1
+mode: standalone
+
+resources:
+  requests:
+    memory: 128Mi
+
+persistence:
+  enabled: true
+  storageClass: standard
+  size: 512Mi
+  # volumeName: backup # re-enable this to mount a local host path, see minio-pv.yaml
+
+buckets:
+  - name: edfbuilder-backups
+
+existingSecret: root-creds

template/stacks/local-backup/minio/manifests/minio-pv.yaml

@@ -0,0 +1,13 @@
+# re-enable this config to mount a local host path, see `../helm/values.yaml`
+# apiVersion: v1
+# kind: PersistentVolume
+# metadata:
+#   name: backup
+# spec:
+#   storageClassName: standard
+#   accessModes:
+#     - ReadWriteOnce
+#   capacity:
+#     storage: 512Mi
+#   hostPath:
+#     path: /backup

template/stacks/local-backup/minio/manifests/secret-sync.yaml

@@ -0,0 +1,154 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secret-sync
+  namespace: minio-backup
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/sync-wave: "-20"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-sync
+  namespace: minio-backup
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/sync-wave: "-20"
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-sync
+  namespace: minio-backup
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/sync-wave: "-20"
+subjects:
+  - kind: ServiceAccount
+    name: secret-sync
+    namespace: minio-backup
+roleRef:
+  kind: Role
+  name: secret-sync
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-sync
+  namespace: velero
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/sync-wave: "-20"
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-sync
+  namespace: velero
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/sync-wave: "-20"
+subjects:
+  - kind: ServiceAccount
+    name: secret-sync
+    namespace: minio-backup
+roleRef:
+  kind: Role
+  name: secret-sync
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: secret-sync
+  namespace: minio-backup
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+spec:
+  template:
+    metadata:
+      generateName: secret-sync
+    spec:
+      serviceAccountName: secret-sync
+      restartPolicy: Never
+      containers:
+        - name: kubectl
+          image: docker.io/bitnami/kubectl
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              set -e
+              kubectl get secrets -n minio-backup root-creds -o json > /tmp/secret
+              ACCESS=$(jq -r '.data.rootUser | @base64d'  /tmp/secret)
+              SECRET=$(jq -r '.data.rootPassword | @base64d'  /tmp/secret)
+              
+              echo \
+              "apiVersion: v1
+              kind: Secret
+              metadata:
+                name: secret-key
+                namespace: velero
+              type: Opaque
+              stringData:
+                aws: |
+                  [default]
+                    aws_access_key_id=${ACCESS}
+                    aws_secret_access_key=${SECRET}
+              " > /tmp/secret.yaml
+              
+              kubectl apply -f /tmp/secret.yaml
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: minio-root-creds
+  namespace: minio-backup
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/sync-wave: "-10"
+spec:
+  template:
+    metadata:
+      generateName: minio-root-creds
+    spec:
+      serviceAccountName: secret-sync
+      restartPolicy: Never
+      containers:
+        - name: kubectl
+          image: docker.io/bitnami/kubectl
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              kubectl get secrets -n minio-backup root-creds
+              if [ $? -eq 0 ]; then
+                exit 0
+              fi
+              
+              set -e
+              
+              NAME=$(openssl rand -base64 24)
+              PASS=$(openssl rand -base64 36)
+              
+              echo \
+              "apiVersion: v1
+              kind: Secret
+              metadata:
+                name: root-creds
+                namespace: minio-backup
+              type: Opaque
+              stringData:
+                rootUser: "${NAME}"
+                rootPassword: "${PASS}"
+              " > /tmp/secret.yaml
+              
+              kubectl apply -f /tmp/secret.yaml

template/stacks/local-backup/velero.yaml

@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: velero
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  sources:
+    - repoURL: 'https://vmware-tanzu.github.io/helm-charts'
+      targetRevision: 8.0.0
+      helm:
+        releaseName: velero
+        valueFiles:
+          - $values/stacks/local-backup/velero/helm/values.yaml
+      chart: velero
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+      targetRevision: HEAD
+      ref: values
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: velero
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true

template/stacks/local-backup/velero/helm/values.yaml

@@ -0,0 +1,25 @@
+resources:
+  requests:
+    memory: 128Mi
+initContainers:
+  - name: velero-plugin-for-aws
+    image: velero/velero-plugin-for-aws:v1.11.0
+    imagePullPolicy: IfNotPresent
+    volumeMounts:
+      - mountPath: /target
+        name: plugins
+# snapshotsEnabled: false # create snapshot crd?
+# deployNodeAgent: true # install node agent as daemonset for file system backups?
+configuration:
+  # defaultVolumesToFsBackup: true # backup pod volumes via fsb without explicit annotation?
+  backupStorageLocation:
+    - name: default
+      provider: aws
+      bucket: edfbuilder-backups
+      credential:
+        name: secret-key # this key is created within the minio-backup/secret-sync and injected into the velero namespace
+        key: aws
+      config:
+        region: minio
+        s3Url: http://minio.minio-backup.svc.cluster.local:9000 # internal resolution, external access for velero cli via fwd
+        s3ForcePathStyle: "true"

template/stacks/monitoring/alloy.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: alloy
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: monitoring
+  sources:
+    - repoURL: https://github.com/grafana/alloy.git
+      path: operations/helm/charts/alloy   
+      targetRevision: HEAD      
+      helm:
+        valueFiles:
+          - $values/stacks/monitoring/alloy/values.yaml
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+      targetRevision: HEAD
+      ref: values

template/stacks/monitoring/alloy/values.yaml

@@ -0,0 +1,93 @@
+alloy:
+  extraPorts:
+    - name: "tcpsocket"
+      port: 1514
+      targetPort: 1514
+      protocol: "TCP"
+      appProtocol: "tcp"
+
+  uiPathPrefix: "/alloy"
+
+  create: false
+  name: alloy-config
+  key: config.alloy
+
+  configMap:
+    content: |-
+
+      logging {
+        level  = "info"
+        format = "logfmt"
+      }
+
+      loki.write "local_loki" {
+          endpoint {
+              url = "http://loki-loki-distributed-gateway/loki/api/v1/push"
+          }
+      }
+
+      discovery.kubernetes "pod" {
+        role = "pod"
+      }
+
+      discovery.kubernetes "nodes" {
+        role = "node"
+      }
+
+      discovery.kubernetes "services" {
+        role = "service"
+      }
+
+      discovery.kubernetes "endpoints" {
+        role = "endpoints"
+      }
+
+      discovery.kubernetes "endpointslices" {
+        role = "endpointslice"
+      }
+
+      discovery.kubernetes "ingresses" {
+        role = "ingress"
+      }
+
+      discovery.relabel "pod_logs" {
+        targets = discovery.kubernetes.pod.targets
+
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          action        = "replace"
+          target_label  = "namespace"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          action        = "replace"
+          target_label  = "pod"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          action        = "replace"
+          target_label  = "node"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          action        = "replace"
+          target_label  = "container"
+        }
+
+      }
+
+      loki.source.kubernetes "all_pod_logs" {
+        targets    = discovery.relabel.pod_logs.output
+        forward_to = [loki.write.local_loki.receiver]
+      }
+
+      loki.source.syslog "tcp_socket" {
+        listener {
+          address = "0.0.0.0:1514"
+          labels   = { component = "loki.source.syslog", protocol = "tcp" }
+        }
+        forward_to = [loki.write.local_loki.receiver]
+      }

template/stacks/monitoring/grafana-dashboards.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: grafana-dashboards
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    targetRevision: HEAD
+    path: "stacks/monitoring/kube-prometheus/dashboards"
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: monitoring
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      selfHeal: true
+    retry:
+      limit: -1

template/stacks/monitoring/kube-prometheus-sso.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kube-prometheus-sso
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    targetRevision: HEAD
+    path: "stacks/monitoring/kube-prometheus-sso"
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: monitoring
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      selfHeal: true
+    retry:
+      limit: -1
+      backoff:
+        duration: 15s
+        factor: 1
+        maxDuration: 15s

template/stacks/monitoring/kube-prometheus-sso/secret-grafana.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: auth-generic-oauth-secret
+  namespace: monitoring
+spec:
+  secretStoreRef:
+    name: keycloak
+    kind: ClusterSecretStore
+  refreshInterval: "0"
+  target:
+    name: auth-generic-oauth-secret
+    template:
+      engineVersion: v2
+      data:
+        client_secret: "{{.GRAFANA_CLIENT_SECRET}}"
+  data:
+    - secretKey: GRAFANA_CLIENT_SECRET
+      remoteRef:
+        key: keycloak-clients
+        property: GRAFANA_CLIENT_SECRET

template/stacks/monitoring/kube-prometheus.yaml

@@ -0,0 +1,36 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kube-prometheus-stack
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true  # do not copy metdata, since (because of its large size) it can lead to sync failure
+    retry:
+      limit: -1
+      backoff:
+        duration: 15s
+        factor: 1
+        maxDuration: 15s
+  destination:
+    name: in-cluster
+    namespace: monitoring
+  sources:
+    - repoURL: https://github.com/prometheus-community/helm-charts
+      path: charts/kube-prometheus-stack
+      targetRevision: HEAD
+      helm:
+        valueFiles:
+          - $values/stacks/monitoring/kube-prometheus/values.yaml
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+      targetRevision: HEAD
+      ref: values

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_apps.yaml

@@ -0,0 +1,268 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-dashboard-1
+  labels:
+    grafana_dashboard: "1"
+data:
+  k8s-dashboard-01.json: |
+    {
+        "annotations": {
+            "list": [
+                {
+                    "builtIn": 1,
+                    "datasource": {
+                        "type": "grafana",
+                        "uid": "-- Grafana --"
+                    },
+                    "enable": true,
+                    "hide": true,
+                    "iconColor": "rgba(0, 211, 255, 1)",
+                    "name": "Annotations & Alerts",
+                    "type": "dashboard"
+                }
+            ]
+        },
+        "editable": true,
+        "fiscalYearStartMonth": 0,
+        "graphTooltip": 0,
+        "id": 1,
+        "links": [
+        ],
+        "panels": [
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 0
+                },
+                "id": 5,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "expr": "{app=\"crossplane\"}",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: App crossplane",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 8
+                },
+                "id": 4,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "expr": "{app=\"argo-server\"}",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: App argo-server",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 16
+                },
+                "id": 3,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "expr": "{app=\"forgejo\"}",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: App forgejo",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 24
+                },
+                "id": 2,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "expr": "{app=\"backstage\"}",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: App backstage",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 32
+                },
+                "id": 1,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "expr": "{app=\"shoot-control-plane\"}",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: App shoot-control-plane",
+                "type": "logs"
+            }
+        ],
+        "preload": false,
+        "schemaVersion": 40,
+        "tags": [
+        ],
+        "templating": {
+            "list": [
+            ]
+        },
+        "time": {
+            "from": "now-6h",
+            "to": "now"
+        },
+        "timepicker": {
+        },
+        "timezone": "browser",
+        "title": "Loki Logs: Apps",
+        "uid": "ee4iuluru756of",
+        "version": 2,
+        "weekStart": ""
+    }

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_components.yaml

@@ -0,0 +1,845 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-dashboard-2
+  labels:
+    grafana_dashboard: "1"
+data:
+  k8s-dashboard-02.json: |
+    {
+        "annotations": {
+            "list": [
+                {
+                    "builtIn": 1,
+                    "datasource": {
+                        "type": "grafana",
+                        "uid": "-- Grafana --"
+                    },
+                    "enable": true,
+                    "hide": true,
+                    "iconColor": "rgba(0, 211, 255, 1)",
+                    "name": "Annotations & Alerts",
+                    "type": "dashboard"
+                }
+            ]
+        },
+        "editable": true,
+        "fiscalYearStartMonth": 0,
+        "graphTooltip": 0,
+        "id": 30,
+        "links": [
+        ],
+        "panels": [
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 0
+                },
+                "id": 19,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"server\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component server",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 8
+                },
+                "id": 17,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"repo-server\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component repo-server",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 16
+                },
+                "id": 16,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"redis\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component redis",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 24
+                },
+                "id": 15,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"query-frontend\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component query-frontend",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 32
+                },
+                "id": 14,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"querier\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component querier",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 40
+                },
+                "id": 13,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"prometheus-operator-webhook\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component prometheus-operator-webhook",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 48
+                },
+                "id": 12,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"prometheus-operator\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component prometheus-operator",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 56
+                },
+                "id": 11,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"metrics\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component metrics",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 64
+                },
+                "id": 10,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"kube-scheduler\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component kube-scheduler",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 72
+                },
+                "id": 9,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"kube-controller-manager\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component kube-controller-manager",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 80
+                },
+                "id": 8,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"kube-apiserver\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component kube-apiserver",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 88
+                },
+                "id": 7,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"ingester\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component ingester",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 96
+                },
+                "id": 6,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"gateway\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component gateway",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 104
+                },
+                "id": 5,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"etcd\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component etcd",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 112
+                },
+                "id": 4,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"distributor\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component distributor",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 120
+                },
+                "id": 3,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"controller\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component controller",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 128
+                },
+                "id": 2,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"cloud-infrastructure-controller\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component cloud-infrastructure-controller",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 136
+                },
+                "id": 1,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{component=\"applicationset-controller\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Component application-controller",
+                "type": "logs"
+            }
+        ],
+        "preload": false,
+        "schemaVersion": 40,
+        "tags": [
+        ],
+        "templating": {
+            "list": [
+            ]
+        },
+        "time": {
+            "from": "now-6h",
+            "to": "now"
+        },
+        "timepicker": {
+        },
+        "timezone": "browser",
+        "title": "Loki Logs: Components",
+        "uid": "ae4zuyp1kui9sc",
+        "version": 2,
+        "weekStart": ""
+    }

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_container.yaml

@@ -0,0 +1,537 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-dashboard-3
+  labels:
+    grafana_dashboard: "1"
+data:
+  k8s-dashboard-03.json: |
+    {
+        "annotations": {
+            "list": [
+                {
+                    "builtIn": 1,
+                    "datasource": {
+                        "type": "grafana",
+                        "uid": "-- Grafana --"
+                    },
+                    "enable": true,
+                    "hide": true,
+                    "iconColor": "rgba(0, 211, 255, 1)",
+                    "name": "Annotations & Alerts",
+                    "type": "dashboard"
+                }
+            ]
+        },
+        "editable": true,
+        "fiscalYearStartMonth": 0,
+        "graphTooltip": 0,
+        "id": 31,
+        "links": [
+        ],
+        "panels": [
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 0
+                },
+                "id": 11,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"repo-server\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container repo-server",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 8
+                },
+                "id": 10,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"alloy\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container alloy",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 16
+                },
+                "id": 9,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"prometheus\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container prometheus",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 24
+                },
+                "id": 8,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"postgres\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container postgres",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 32
+                },
+                "id": 7,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"kube-prometheus-stack\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container kube-prometheus-stack",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 40
+                },
+                "id": 6,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"keycloak\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container keycloak",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 48
+                },
+                "id": 5,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"grafana\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container grafana",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 56
+                },
+                "id": 4,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"forgejo\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container forgejo",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 64
+                },
+                "id": 3,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"crossplane\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container crossplane",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 72
+                },
+                "id": 2,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"backstage\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container backstage",
+                "type": "logs"
+            },
+            {
+                "datasource": {
+                    "type": "loki",
+                    "uid": "P8E80F9AEF21F6940"
+                },
+                "fieldConfig": {
+                    "defaults": {
+                    },
+                    "overrides": [
+                    ]
+                },
+                "gridPos": {
+                    "h": 8,
+                    "w": 24,
+                    "x": 0,
+                    "y": 80
+                },
+                "id": 1,
+                "options": {
+                    "dedupStrategy": "none",
+                    "enableLogDetails": true,
+                    "prettifyLogMessage": false,
+                    "showCommonLabels": false,
+                    "showLabels": false,
+                    "showTime": false,
+                    "sortOrder": "Descending",
+                    "wrapLogMessage": false
+                },
+                "pluginVersion": "11.3.1",
+                "targets": [
+                    {
+                        "datasource": {
+                            "type": "loki",
+                            "uid": "P8E80F9AEF21F6940"
+                        },
+                        "editorMode": "builder",
+                        "expr": "{container=\"argo-server\"} |= ``",
+                        "queryType": "range",
+                        "refId": "A"
+                    }
+                ],
+                "title": "Logs: Container argo-server",
+                "type": "logs"
+            }
+        ],
+        "preload": false,
+        "schemaVersion": 40,
+        "tags": [
+        ],
+        "templating": {
+            "list": [
+            ]
+        },
+        "time": {
+            "from": "now-6h",
+            "to": "now"
+        },
+        "timepicker": {
+        },
+        "timezone": "browser",
+        "title": "Loki Logs: Container",
+        "uid": "ee50bcaehmv40e",
+        "version": 2,
+        "weekStart": ""
+    }

template/stacks/monitoring/kube-prometheus/values.yaml

@@ -0,0 +1,71 @@
+grafana:
+  namespaceOverride: "monitoring"
+
+  admin:
+    existingSecret: "kube-prometheus-stack-grafana-admin-password"
+    userKey: admin-user
+    passwordKey: admin-password
+
+  defaultDashboardsTimezone: Europe/Berlin
+
+  additionalDataSources:
+    - name: Loki
+      type: loki
+      url: http://loki-loki-distributed-gateway.monitoring:80
+
+  # syncPolicy:
+  #   syncOptions:
+  #   - ServerSideApply=true
+
+  sidecar:
+    dashboards:
+      enabled: true
+      label: grafana_dashboard
+      folder: /tmp/dashboards
+      updateIntervalSeconds: 10
+      folderAnnotation: grafana_folder
+      provider:
+        allowUiUpdates: true
+        foldersFromFilesStructure: true
+
+  grafana.ini:
+    server:
+      domain: {{{ .Env.DOMAIN }}}
+      root_url: "%(protocol)s://%(domain)s/grafana"
+      serve_from_sub_path: true
+    auth:
+      disable_login: true
+      disable_login_form: true
+    auth.generic_oauth:
+      enabled: true
+      name: Keycloak-OAuth
+      allow_sign_up: true
+      use_refresh_token: true
+      client_id: grafana
+      client_secret: $__file{/etc/secrets/auth_generic_oauth/client_secret}
+      scopes: openid email profile offline_access roles
+      email_attribute_path: email
+      login_attribute_path: username
+      name_attribute_path: full_name
+      auth_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/auth
+      token_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/token
+      api_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/userinfo
+      redirect_uri: http://{{{ .Env.DOMAIN }}}/grafana/login/generic_oauth
+      role_attribute_path: "contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'editor') && 'Editor' || 'Viewer'"
+      
+  extraSecretMounts:
+    - name: auth-generic-oauth-secret-mount
+      secretName: auth-generic-oauth-secret
+      defaultMode: 0440
+      mountPath: /etc/secrets/auth_generic_oauth
+      readOnly: true
+
+  serviceMonitor:
+    # If true, a ServiceMonitor CRD is created for a prometheus operator https://github.com/coreos/prometheus-operator
+    enabled: true
+
+#monitoring nginx
+prometheus:
+  prometheusSpec:
+    podMonitorSelectorNilUsesHelmValues: false
+    serviceMonitorSelectorNilUsesHelmValues: false     

template/stacks/monitoring/loki.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: loki
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: monitoring
+  sources:
+    - repoURL: https://github.com/grafana/helm-charts
+      path:     charts/loki-distributed         
+      targetRevision: HEAD      
+      helm:
+        valueFiles:
+          - $values/stacks/monitoring/loki/values.yaml
+    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+      targetRevision: HEAD
+      ref: values
+
+    ## consider using the following version, if it works again
+    #- repoURL: https://github.com/grafana/loki
+    #  path: production/helm/loki        
+

template/stacks/monitoring/loki/values.yaml

@@ -0,0 +1,7 @@
+loki:
+  commonConfig:
+    replication_factor: 1
+  auth_enabled: false
+
+#  storageConfig:
+#    filesystem: null

template/stacks/observability-client/metrics-server.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: metrics-server
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: observability
-  sources:
-    - chart: metrics-server
-      repoURL: https://kubernetes-sigs.github.io/metrics-server/
-      targetRevision: 3.12.2
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/metrics-server/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values

template/stacks/observability-client/metrics-server/values.yaml

@@ -1,4 +0,0 @@
-metrics:
-  enabled: true
-serviceMonitor:
-  enabled: true

template/stacks/observability-client/vector.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: vector
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: observability
-  sources:
-    - chart: vector
-      repoURL: https://helm.vector.dev
-      targetRevision: 0.43.0
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vector/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values

template/stacks/observability-client/vector/values.yaml

@@ -1,68 +0,0 @@
-# -- Enable deployment of vector
-role: Agent
-dataDir: /vector-data-dir
-resources: {}
-args:
-  - -w
-  - --config-dir
-  - /etc/vector/
-env:
-  - name: VECTOR_USER
-    valueFrom:
-      secretKeyRef:
-        name: simple-user-secret
-        key: username
-  - name: VECTOR_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: simple-user-secret
-        key: password
-containerPorts:
-  - name: prom-exporter
-    containerPort: 9090
-    protocol: TCP
-service:
-  enabled: false
-customConfig:
-  data_dir: /vector-data-dir
-  api:
-    enabled: false
-    address: 0.0.0.0:8686
-    playground: true
-  sources:
-    k8s:
-      type: kubernetes_logs
-    internal_metrics:
-      type: internal_metrics
-  transforms:
-    parser:
-      type: remap
-      inputs: [k8s]
-      source: |
-        ._msg = parse_json(.message) ?? .message
-        del(.message)
-        # Add the cluster environment to the log event
-        .cluster_environment = "{{{ .Env.CLUSTER_ENVIRONMENT }}}"
-  sinks:
-    vlogs:
-      type: elasticsearch
-      inputs: [parser]
-      endpoints: 
-        - https://{{{ .Env.DOMAIN_O12Y }}}/insert/elasticsearch/
-      auth:
-        strategy: basic
-        user: ${VECTOR_USER}
-        password: ${VECTOR_PASSWORD}
-      mode: bulk
-      api_version: v8
-      compression: gzip
-      healthcheck:
-        enabled: false
-      request:
-        headers:
-          AccountID: "0"
-          ProjectID: "0"
-      query:
-        _msg_field: _msg
-        _time_field: _time
-        _stream_fields: cluster_environment,kubernetes.container_name,kubernetes.namespace

template/stacks/observability-client/vm-client-stack.yaml

@@ -1,30 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: vm-client
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: observability
-  sources:
-    - chart: victoria-metrics-k8s-stack
-      repoURL: https://victoriametrics.github.io/helm-charts/
-      targetRevision: 0.48.1
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/manifests"

template/stacks/observability/grafana-operator.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: grafana-operator
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
-  destination:
-    name: in-cluster
-    namespace: observability
-  sources:
-    - chart: grafana-operator
-      repoURL: ghcr.io/grafana/helm-charts
-      targetRevision: v5.18.0
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/grafana-operator/manifests"

template/stacks/observability/grafana-operator/manifests/argocd.yaml

@@ -1,9 +0,0 @@
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: argocd
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  url: "https://raw.githubusercontent.com/argoproj/argo-cd/refs/heads/master/examples/dashboard.json"

template/stacks/observability/grafana-operator/manifests/grafana.yaml

@@ -1,75 +0,0 @@
-apiVersion: grafana.integreatly.org/v1beta1
-kind: Grafana
-metadata:
-  name: grafana
-  labels:
-    dashboards: "grafana"
-spec:
-  persistentVolumeClaim:
-    metadata:
-      annotations:
-        everest.io/disk-volume-type: GPSSD
-        everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
-    spec:
-      storageClassName: csi-disk
-      accessModes:
-        - ReadWriteOnce
-      resources:
-        requests:
-          storage: 10Gi
-  deployment:
-    spec:
-      template:
-        spec:
-          containers:
-            - name: grafana
-              env:
-                - name: OAUTH_CLIENT_SECRET
-                  valueFrom:
-                    secretKeyRef:
-                      key: clientSecret
-                      name: dex-grafana-client
-  config:
-    log.console:
-      level: debug
-    server:
-      root_url: "https://{{{ .Env.DOMAIN_GRAFANA }}}"
-    auth:
-      disable_login: "true"
-      disable_login_form: "true"
-    auth.generic_oauth:
-      enabled: "true"
-      name: Forgejo
-      allow_sign_up: "true"
-      use_refresh_token: "true"
-      client_id: grafana
-      client_secret: $__env{OAUTH_CLIENT_SECRET}
-      scopes: openid email profile offline_access groups
-      auth_url: https://{{{ .Env.DOMAIN_DEX }}}/auth
-      token_url: https://{{{ .Env.DOMAIN_DEX }}}/token
-      api_url: https://{{{ .Env.DOMAIN_DEX }}}/userinfo
-      redirect_uri: https://{{{ .Env.DOMAIN_GRAFANA }}}/login/generic_oauth
-      role_attribute_path: "contains(groups[*], 'DevFW') && 'GrafanaAdmin' || 'None'"
-      allow_assign_grafana_admin: "true"
-  ingress:
-    metadata:
-      annotations:
-        cert-manager.io/cluster-issuer: main
-        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    spec:
-      ingressClassName: nginx
-      rules:
-      - host: {{{ .Env.DOMAIN_GRAFANA }}}
-        http:
-          paths:
-          - backend:
-              service:
-                name: grafana-service
-                port:
-                  number: 3000
-            path: /
-            pathType: Prefix
-      tls:
-      - hosts:
-        - {{{ .Env.DOMAIN_GRAFANA }}}
-        secretName: grafana-net-tls

template/stacks/observability/grafana-operator/manifests/ingress-nginx.yaml

@@ -1,9 +0,0 @@
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: ingress-nginx 
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  url: "https://raw.githubusercontent.com/adinhodovic/ingress-nginx-mixin/refs/heads/main/dashboards_out/ingress-nginx-overview.json"

template/stacks/observability/grafana-operator/manifests/victoria-logs.yaml

@@ -1,9 +0,0 @@
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: victoria-logs
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  url: "https://raw.githubusercontent.com/VictoriaMetrics/VictoriaMetrics/refs/heads/master/dashboards/vm/victorialogs.json"

template/stacks/observability/victoria-k8s-stack.yaml

@@ -1,31 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: o12y
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
-  destination:
-    name: in-cluster
-    namespace: observability
-  sources:
-    - chart: victoria-metrics-k8s-stack
-      repoURL: https://victoriametrics.github.io/helm-charts/
-      targetRevision: 0.48.1
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/manifests"

template/stacks/observability/victoria-k8s-stack/manifests/alerts.yaml

@@ -1,40 +0,0 @@
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMRule
-metadata:
-  name: forgejo-alerts
-  namespace: observability
-spec:
-  groups:
-    - name: forgejo
-      rules:
-        - alert: forgejo down
-          expr: sum by(cluster_environment) (up{pod=~"forgejo-server-.*"}) < 1
-          for: 30s
-          labels:
-            severity: critical
-            job:  "{{ $labels.job }}"
-          annotations:
-            value: "{{ $value }}"
-            description: 'forgejo is down in cluster environment {{ $labels.cluster_environment }}'
-    - name: forgejo-backup
-      rules:
-        - alert: forgejo s3 backup job failed
-          expr: max by(cluster_environment) (kube_job_status_failed{job_name=~"forgejo-s3-backup-.*"}) != 0
-          for: 30s
-          labels:
-            severity: critical
-            job:  "{{ $labels.job }}"
-          annotations:
-            value: "{{ $value }}"
-            description: 'forgejo s3 backup job failed in cluster environment {{ $labels.cluster_environment }}'
-    - name: disk-consumption-high
-      rules:
-        - alert: disk consumption high
-          expr: 1-(kubelet_volume_stats_available_bytes / kubelet_volume_stats_capacity_bytes) > 0.6
-          for: 30s
-          labels:
-            severity: major
-            job:  "{{ $labels.job }}"
-          annotations:
-            value: "{{ $value }}"
-            description: 'disk consumption of pvc {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is high in cluster environment {{ $labels.cluster_environment }}'

template/stacks/observability/victoria-k8s-stack/manifests/vlogs.yaml

@@ -1,26 +0,0 @@
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VLogs
-metadata:
-  name: victorialogs
-  namespace: observability
-spec:
-  retentionPeriod: "12"
-  removePvcAfterDelete: true
-  storageMetadata:
-    annotations:
-      everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
-      everest.io/disk-volume-type: GPSSD
-  storage:
-    storageClassName: csi-disk
-    accessModes:
-      - ReadWriteOnce
-    resources:
-      requests:
-        storage: 50Gi
-  resources:
-    requests:
-      memory: 500Mi
-      cpu: 500m
-    limits:
-      memory: 10Gi
-      cpu: 2

template/stacks/observability/victoria-k8s-stack/manifests/vmauth.yaml

@@ -1,17 +0,0 @@
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMUser
-metadata:
-  name: simple-user
-  namespace: observability
-spec:
-  username: simple-user
-  passwordRef:
-    key: password
-    name: simple-user-secret
-  targetRefs:
-    - static:
-        url: http://vmsingle-o12y:8429
-      paths: ["/api/v1/write"]
-    - static:
-        url: http://vlogs-victorialogs:9428
-      paths: ["/insert/elasticsearch/.*"]

template/stacks/otc/cert-manager/manifests/clusterissuer.yaml

@@ -1,14 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: main
-spec:
-  acme:
-    email: admin@think-ahead.tech
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: cluster-issuer-account-key
-    solvers:
-    - http01:
-        ingress:
-          ingressClassName: nginx

template/stacks/otc/cert-manager/values.yaml

@@ -1,4 +0,0 @@
-crds:
-  enabled: true
-
-replicaCount: 1

template/stacks/otc/cert-manger.yaml

@@ -1,32 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cert-manager
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: -1
-  destination:
-    name: in-cluster
-    namespace: cert-manager
-  sources:
-    - chart: cert-manager
-      repoURL: https://charts.jetstack.io
-      targetRevision: v1.17.2
-      helm:
-        valueFiles:
-          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/values.yaml
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      ref: values
-    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
-      targetRevision: HEAD
-      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/manifests"