feat(observability-client): user and password for vector referenced from a secret

Refs: DevFW/infra-deploy#36

README.md

@@ -1,6 +1,6 @@
 # edpbuilder stacks
 
-This repository contains the building blocks to instanciate Internal Developer Platform's.
+This repository contains the building blocks to instantiate Internal Developer Platforms.
 
 ### Install edpbuilder
 

template/edfbuilder.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: registry
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/registry"
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/core.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/core
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core"
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/forgejo.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: second-cluster
+  name: forgejo
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/second-cluster
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo"
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/local-backup.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/local-backup
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/local-backup"
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/observability-client.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: observability-client
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    name: in-cluster
+    namespace: argocd
+  source:
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    targetRevision: HEAD
+  project: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

template/registry/observability.yaml

@@ -1,23 +1,24 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: create-new-cluster-guestbook
+  name: observability
   namespace: argocd
   labels:
     env: dev
   finalizers:
     - resources-finalizer.argocd.argoproj.io
 spec:
+  destination:
+    name: in-cluster
+    namespace: argocd
+  source:
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability"
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
+    targetRevision: HEAD
   project: default
   syncPolicy:
     automated:
+      prune: true
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: crossplane-system
-  source:
-    path: stacks/second-cluster/create-new-cluster-guestbook
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD

template/registry/otc.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: monitoring
+  name: otc
   namespace: argocd
   labels:
     env: dev
@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/monitoring
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc"
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/registry/ref-implementation.yaml

@@ -12,8 +12,8 @@ spec:
     name: in-cluster
     namespace: argocd
   source:
-    path: stacks/ref-implementation
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation"
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: "https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}"
     targetRevision: HEAD
   project: default
   syncPolicy:

template/stacks/core/argocd.yaml

@@ -12,6 +12,8 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+    retry:
+      limit: -1
   destination:
     name: in-cluster
     namespace: argocd
@@ -24,7 +26,10 @@ spec:
       targetRevision: argo-cd-7.8.14-depends
       helm:
         valueFiles:
-          - $values/stacks/core/argocd/values.yaml
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/core/argocd/manifests"

template/stacks/core/argocd/manifests/argocd-server-ingress.yaml

@@ -4,9 +4,10 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: main
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
     dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN }}}
+    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_ARGOCD }}}
     dns.gardener.cloud/ttl: "600"
 {{{ end }}}
   name: argocd-server
@@ -14,7 +15,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: {{{ .Env.DOMAIN }}}
+  - host: {{{ .Env.DOMAIN_ARGOCD }}}
     http:
       paths:
       - backend:
@@ -22,9 +23,9 @@ spec:
             name: argocd-server
             port:
               number: 80
-        path: /argocd
+        path: /
         pathType: Prefix
   tls:
   - hosts:
-    - {{{ .Env.DOMAIN }}}
+    - {{{ .Env.DOMAIN_ARGOCD }}}
     secretName: argocd-net-tls

template/stacks/core/argocd/values.yaml

@@ -1,11 +1,9 @@
 global:
-  domain: {{{ .Env.DOMAIN }}}
+  domain: {{{ .Env.DOMAIN_ARGOCD }}}
 
 configs:
   params:
     server.insecure: true
-    server.basehref: /argocd
-    server.rootpath: /argocd
   cm:
     application.resourceTrackingMethod: annotation
     timeout.reconciliation: 60s
@@ -21,7 +19,7 @@ configs:
         clusters:
         - "*"
     accounts.provider-argocd: apiKey
-    url: https://{{{ .Env.DOMAIN }}}/argocd
+    url: https://{{{ .Env.DOMAIN_ARGOCD }}}
   rbac:
     policy.csv: 'g, provider-argocd, role:admin'
 

template/stacks/core/crossplane-compositions.yaml

@@ -1,23 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: crossplane-compositions
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: crossplane-system
-  source:
-    path: stacks/core/crossplane-compositions
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    directory:
-      recurse: true

template/stacks/core/crossplane-compositions/edfbuilder/definition.yaml

@@ -1,30 +0,0 @@
-apiVersion: apiextensions.crossplane.io/v1
-kind: CompositeResourceDefinition
-metadata:
-  name: edfbuilders.edfbuilder.crossplane.io
-spec:
-  connectionSecretKeys:
-    - kubeconfig
-  group: edfbuilder.crossplane.io
-  names:
-    kind: EDFBuilder
-    listKind: EDFBuilderList
-    plural: edfbuilders
-    singular: edfbuilders
-  versions:
-    - name: v1alpha1
-      served: true
-      referenceable: true
-      schema:
-        openAPIV3Schema:
-          description: A EDFBuilder is a composite resource that represents a K8S Cluster with edfbuilder Installed
-          type: object
-          properties:
-            spec:
-              type: object
-              properties:
-                repoURL:
-                  type: string
-                  description: URL to ArgoCD stack of stacks repo
-              required:
-                - repoURL

template/stacks/core/crossplane-providers.yaml

@@ -1,23 +0,0 @@
-{{{ if eq .Env.CLUSTER_TYPE "kind" }}}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: crossplane-providers
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: crossplane-system
-  source:
-    path: stacks/core/crossplane-providers
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-{{{ end }}}

template/stacks/core/crossplane-providers/function-patch-and-transform.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Function
-metadata:
-  name: crossplane-contrib-function-patch-and-transform
-spec:
-  package: xpkg.upbound.io/crossplane-contrib/function-patch-and-transform:v0.7.0
-  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
-  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
-  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-argocd-config.yaml

@@ -1,14 +0,0 @@
-apiVersion: argocd.crossplane.io/v1alpha1
-kind: ProviderConfig
-metadata:
-  name: argocd-provider
-spec:
-  serverAddr: argocd-server.argocd.svc.cluster.local:80
-  insecure: true
-  plainText: true
-  credentials:
-    source: Secret
-    secretRef:
-      namespace: crossplane-system
-      name: argocd-credentials
-      key: authToken

template/stacks/core/crossplane-providers/provider-argocd.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Provider
-metadata:
-  name: provider-argocd
-spec:
-  package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.0
-  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
-  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
-  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-kind-config.yaml

@@ -1,14 +0,0 @@
-apiVersion: kind.crossplane.io/v1alpha1
-kind: ProviderConfig
-metadata:
-  name: kind-provider
-spec:
-  credentials:
-    source: Secret
-    secretRef:
-      namespace: crossplane-system
-      name: kind-credentials
-      key: credentials
-  endpoint:
-    # the url is managed by crossplane-edfbuilder
-    url: https://DOCKER_HOST:SERVER_PORT/api/v1/kindserver

template/stacks/core/crossplane-providers/provider-kind.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Provider
-metadata:
-  name: provider-kind
-spec:
-  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-kind:v0.1.1
-  packagePullPolicy: IfNotPresent
-  revisionActivationPolicy: Automatic
-  revisionHistoryLimit: 1

template/stacks/core/crossplane-providers/provider-shell.yaml

@@ -1,9 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Provider
-metadata:
-  name: provider-shell
-spec:
-  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-shell:v0.1.5
-  packagePullPolicy: IfNotPresent
-  revisionActivationPolicy: Automatic
-  revisionHistoryLimit: 1

template/stacks/core/crossplane.yaml

@@ -1,23 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: crossplane
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: crossplane-system
-  source:
-    chart: crossplane
-    repoURL: https://charts.crossplane.io/stable
-    targetRevision: 1.18.0
-    helm:
-      releaseName: crossplane

template/stacks/core/forgejo-runner.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: forgejo-runner
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    server: "https://kubernetes.default.svc"
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/core/forgejo-runner"

template/stacks/core/forgejo.yaml

@@ -1,27 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: forgejo
-  namespace: argocd
-  labels:
-    env: dev
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: gitea
-  sources:
-    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/forgejo-helm.git
-      path: .
-      targetRevision: v11.0.5-depends
-      helm:
-        valueFiles:
-          - $values/stacks/core/forgejo/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values

template/stacks/core/forgejo/values.yaml

@@ -1,62 +0,0 @@
-redis-cluster:
-  enabled: false
-postgresql:
-  enabled: false
-postgresql-ha:
-  enabled: false
-
-persistence:
-  enabled: true
-  size: 5Gi
-
-test:
-  enabled: false
-
-gitea:
-  admin:
-    existingSecret: gitea-credential
-  config:
-    database:
-      DB_TYPE: sqlite3
-    session:
-      PROVIDER: memory
-    cache:
-      ADAPTER: memory
-    queue:
-      TYPE: level
-    server:
-      DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
-      ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
-    mailer:
-      ENABLED: true
-      FROM: forgejo@{{{ .Env.DOMAIN_GITEA }}}
-      PROTOCOL: smtp
-      SMTP_ADDR: mailhog.mailhog.svc.cluster.local
-      SMTP_PORT: 1025
-
-service:
-  ssh:
-    type: NodePort
-    nodePort: 32222
-    externalTrafficPolicy: Local
-
-image:
-  pullPolicy: "IfNotPresent"
-  # Overrides the image tag whose default is the chart appVersion.
-  #tag: "8.0.3"
-  # Adds -rootless suffix to image name
-  rootless: true
-
-forgejo:
-  runner:
-    enabled: true
-    image:
-      tag: latest
-    # replicas: 3
-    config:
-      runner:
-        labels:
-          - docker:docker://node:16-bullseye
-          - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
-          - ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04
-          - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04

template/stacks/core/ingress-apps.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ingress-apps
-  namespace: argocd
-  labels:
-    example: ref-implementation
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    server: "https://kubernetes.default.svc"
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/core/ingress-apps"
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

template/stacks/core/ingress-apps/alloy.yaml

@@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: alloy
-  namespace: monitoring
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: alloy
-            port:
-              number: 12345
-        path: /alloy
-        pathType: Prefix

template/stacks/core/ingress-apps/argo-workflows-ingress.yaml

@@ -1,31 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
-    nginx.ingress.kubernetes.io/use-regex: "true"
-  name: argo-workflows-ingress
-  namespace: argo
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: localhost
-    http:
-      paths:
-      - backend:
-          service:
-            name: argo-server
-            port:
-              name: web
-        path: /argo-workflows(/|$)(.*)
-        pathType: ImplementationSpecific
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: argo-server
-            port:
-              name: web
-        path: /argo-workflows(/|$)(.*)
-        pathType: ImplementationSpecific

template/stacks/core/ingress-apps/backstage.yaml

@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: backstage
-  namespace: backstage
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: localhost
-    http:
-      paths:
-      - backend:
-          service:
-            name: backstage
-            port:
-              name: http
-        path: /
-        pathType: Prefix
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: backstage
-            port:
-              name: http
-        path: /
-        pathType: Prefix

template/stacks/core/ingress-apps/fibonacci-service.yaml

@@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fibonacci-service
-  namespace: fibonacci-app
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: fibonacci-service
-            port:
-              number: 9090
-        path: /fibonacci
-        pathType: Prefix

template/stacks/core/ingress-apps/keycloak-ingress-localhost.yaml

@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: keycloak-ingress-localhost
-  namespace: keycloak
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: localhost
-    http:
-      paths:
-      - backend:
-          service:
-            name: keycloak
-            port:
-              name: http
-        path: /keycloak
-        pathType: ImplementationSpecific
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: keycloak
-            port:
-              name: http
-        path: /keycloak
-        pathType: ImplementationSpecific

template/stacks/core/ingress-apps/kube-prometheus-stack-grafana.yaml

@@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kube-prometheus-stack-grafana
-  namespace: monitoring
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: kube-prometheus-stack-grafana
-            port:
-              number: 80
-        path: /grafana
-        pathType: Prefix

template/stacks/core/ingress-apps/mailhog.yaml

@@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mailhog
-  namespace: mailhog
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: mailhog
-            port:
-              number: 8025
-        path: /mailhog
-        pathType: Prefix

template/stacks/core/ingress-apps/minio-console.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: minio-console
-  namespace: minio-backup
-{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
-  annotations:
-    dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: minio-backup.{{{ .Env.DOMAIN }}}
-    dns.gardener.cloud/ttl: "600"
-{{{ end }}}
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: minio-backup.{{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: minio-console
-            port:
-              number: 9001
-        path: /
-        pathType: Prefix

template/stacks/core/ingress-apps/openbao.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: openbao
-  namespace: openbao
-{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
-  annotations:
-    dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: openbao.{{{ .Env.DOMAIN }}}
-    dns.gardener.cloud/ttl: "600"
-{{{ end }}}
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: openbao.{{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: openbao
-            port:
-              number: 8200
-        path: /
-        pathType: Prefix

template/stacks/core/ingress-nginx/values.yaml

@@ -1,49 +0,0 @@
-controller:
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-
-  ingressClassResource:
-    name: nginx
-
-  # added for idpbuilder
-  allowSnippetAnnotations: true
-
-  # added for idpbuilder
-  config:
-    proxy-buffer-size: 32k
-    use-forwarded-headers: "true"
-
-  # monitoring nginx
-  metrics:
-    enabled: true
-    serviceMonitor:
-      additionalLabels: 
-        release: "ingress-nginx"  
-      enabled: true
-
-{{{ if eq .Env.CLUSTER_TYPE "kind" }}}
-  hostPort:
-    enabled: true
-  terminationGracePeriodSeconds: 0
-  service:
-    type: NodePort
-
-  nodeSelector:
-    ingress-ready: "true"
-  tolerations:
-    - key: "node-role.kubernetes.io/master"
-      operator: "Equal"
-      effect: "NoSchedule"
-    - key: "node-role.kubernetes.io/control-plane"
-      operator: "Equal"
-      effect: "NoSchedule"
-
-  publishService:
-    enabled: false
-  extraArgs:
-    publish-status-address: localhost
-    # added for idpbuilder
-    enable-ssl-passthrough: ""
-{{{ end }}}

template/stacks/forgejo/forgejo-runner.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: fibonacci-app
+  name: forgejo-runner
   namespace: argocd
   labels:
     env: dev
@@ -9,17 +9,16 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: default
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/ref-implementation/fibonacci-app"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: fibonacci-app
   syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
     automated:
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
     retry:
       limit: -1
+  destination:
+    server: "https://kubernetes.default.svc"
+  source:
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    targetRevision: HEAD
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-runner"

template/stacks/forgejo/forgejo-runner/dind-docker.yaml

@@ -30,17 +30,16 @@ spec:
         - name: runner-register
           image: code.forgejo.org/forgejo/runner:6.3.1
           command:
-            - "forgejo-runner"
+          - "sh"
-            - "register"
+          - "-c"
-            - "--no-interactive"
+          - |
-            - "--token"
+            forgejo-runner \
-            - $(RUNNER_SECRET)
+              register \
-            - "--name"
+              --no-interactive \
-            - $(RUNNER_NAME)
+              --token ${RUNNER_SECRET} \
-            - "--instance"
+              --name ${RUNNER_NAME} \
-            - $(FORGEJO_INSTANCE_URL)
+              --instance ${FORGEJO_INSTANCE_URL} \
-            - "--labels"
+              --labels docker:docker://node:20-bookworm,ubuntu-22.04:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04,ubuntu-latest:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04
-            - "docker:docker://node:20-bookworm,ubuntu-22.04:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04,ubuntu-latest:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04"
           env:
             - name: RUNNER_NAME
               valueFrom:

template/stacks/forgejo/forgejo-server.yaml

@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo-server
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: gitea
+  sources:
+    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/forgejo-helm.git
+      path: .
+      # first check out the desired version (example v9.0.0): https://code.forgejo.org/forgejo-helm/forgejo-helm/src/tag/v9.0.0/Chart.yaml
+      # (note that the chart version is not the same as the forgejo application version, which is specified in the above Chart.yaml file)
+      # then use the devops pipeline and select development, forgejo and the desired version (example v9.0.0):
+      # https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/devops-pipelines/actions?workflow=update-helm-depends.yaml&actor=0&status=0
+      # finally update the desired version here and include "-depends", it is created by the devops pipeline. 
+      # why do we have an added "-depends" tag? it resolves rate limitings when downloading helm OCI dependencies
+      targetRevision: v9.0.0-depends
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/manifests"

template/stacks/forgejo/forgejo-server/manifests/forgejo-ingress.yaml

@@ -4,12 +4,13 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
     nginx.ingress.kubernetes.io/proxy-body-size: 512m
+    cert-manager.io/cluster-issuer: main
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
     dns.gardener.cloud/class: garden
     dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_GITEA }}}
     dns.gardener.cloud/ttl: "600"
 {{{ end }}}
-  name: forgejo
+  name: forgejo-server
   namespace: gitea
 spec:
   ingressClassName: nginx
@@ -19,7 +20,7 @@ spec:
       paths:
       - backend:
           service:
-            name: forgejo-http
+            name: forgejo-server-http
             port:
               number: 3000
         path: /

template/stacks/forgejo/forgejo-server/values.yaml

@@ -0,0 +1,175 @@
+# We use recreate to make sure only one instance with one version is running, because Forgejo might break or data gets inconsistant. 
+strategy:
+  type: Recreate
+
+redis-cluster:
+  enabled: false
+
+redis:
+  enabled: false
+
+postgresql:
+  enabled: false
+
+postgresql-ha:
+  enabled: false
+
+persistence:
+  enabled: true
+  size: 200Gi
+  annotations:
+    everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
+
+test:
+  enabled: false
+
+deployment:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/ssl/forgejo
+
+extraVolumeMounts:
+  - mountPath: /etc/ssl/forgejo
+    name: custom-database-certs-volume
+    readOnly: true
+
+extraVolumes:
+  - name: custom-database-certs-volume
+    secret:
+      secretName: custom-database-certs
+
+gitea:
+  additionalConfigFromEnvs:
+    - name: FORGEJO__storage__MINIO_ACCESS_KEY_ID
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-cloud-credentials
+          key: access-key
+    - name: FORGEJO__storage__MINIO_SECRET_ACCESS_KEY
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-cloud-credentials
+          key: secret-key
+    - name: FORGEJO__queue__CONN_STR
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__session__PROVIDER_CONFIG
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__cache__HOST
+      valueFrom:
+        secretKeyRef:
+          name: redis-forgejo-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__database__HOST
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: host_port
+    - name: FORGEJO__database__NAME
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: database
+    - name: FORGEJO__database__USER
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: username
+    - name: FORGEJO__database__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: postgres-forgejo-cloud-credentials
+          key: password
+    - name: FORGEJO__indexer__ISSUE_INDEXER_CONN_STR
+      valueFrom:
+        secretKeyRef:
+          name: elasticsearch-cloud-credentials
+          key: connection-string
+    - name: FORGEJO__mailer__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: email-user-credentials
+          key: connection-string
+
+  admin:
+    existingSecret: gitea-credential
+
+  config:
+    indexer:
+      ISSUE_INDEXER_ENABLED: true
+      ISSUE_INDEXER_TYPE: elasticsearch
+      # TODO next
+      REPO_INDEXER_ENABLED: false
+      # REPO_INDEXER_TYPE: meilisearch # not yet working
+
+    storage:
+      MINIO_ENDPOINT: obs.eu-de.otc.t-systems.com:443
+      STORAGE_TYPE: minio
+      MINIO_LOCATION: eu-de
+      MINIO_BUCKET: edp-forgejo-{{{ .Env.CLUSTER_ENVIRONMENT }}}
+      MINIO_USE_SSL: true
+
+    queue:
+      TYPE: redis
+
+    session:
+      PROVIDER: redis
+
+    cache:
+      ENABLED: true
+      ADAPTER: redis
+
+    service:
+      DISABLE_REGISTRATION: true
+
+    other:
+      SHOW_FOOTER_VERSION: false
+      SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
+
+    database:
+      DB_TYPE: postgres
+      SSL_MODE: verify-ca
+
+    server:
+      DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
+      ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
+
+    mailer:
+      ENABLED: true
+      USER: ipcei-cis-devfw@mms-support.de
+      PROTOCOL: smtps
+      FROM: '"IPCEI CIS DevFW" <ipcei-cis-devfw@mms-support.de>'
+      SMTP_ADDR: mail.mms-support.de
+      SMTP_PORT: 465
+
+service:
+  ssh:
+    type: NodePort
+    nodePort: 32222
+    externalTrafficPolicy: Local
+
+image:
+  pullPolicy: "IfNotPresent"
+  # Overrides the image tag whose default is the chart appVersion.
+  #tag: "8.0.3"
+  # Adds -rootless suffix to image name
+  rootless: true
+
+forgejo:
+  runner:
+    enabled: true
+    image:
+      tag: latest
+    # replicas: 3
+    config:
+      runner:
+        labels:
+          - docker:docker://node:16-bullseye
+          - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+          - ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+          - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04

template/stacks/local-backup/minio.yaml

@@ -10,19 +10,19 @@ metadata:
 spec:
   project: default
   sources:
-    - repoURL: 'https://charts.min.io'
+    - repoURL: "https://charts.min.io"
       targetRevision: 5.0.15
       helm:
         releaseName: minio
         valueFiles:
-          - $values/stacks/local-backup/minio/helm/values.yaml
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/local-backup/minio/helm/values.yaml
       chart: minio
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
-      path: "stacks/local-backup/minio/manifests"
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/local-backup/minio/manifests"
   destination:
     server: "https://kubernetes.default.svc"
     namespace: minio-backup

template/stacks/local-backup/velero.yaml

@@ -10,14 +10,14 @@ metadata:
 spec:
   project: default
   sources:
-    - repoURL: 'https://vmware-tanzu.github.io/helm-charts'
+    - repoURL: "https://vmware-tanzu.github.io/helm-charts"
       targetRevision: 8.0.0
       helm:
         releaseName: velero
         valueFiles:
-          - $values/stacks/local-backup/velero/helm/values.yaml
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/local-backup/velero/helm/values.yaml
       chart: velero
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values
   destination:

template/stacks/monitoring/alloy.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: alloy
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: monitoring
-  sources:
-    - repoURL: https://github.com/grafana/alloy.git
-      path: operations/helm/charts/alloy   
-      targetRevision: HEAD      
-      helm:
-        valueFiles:
-          - $values/stacks/monitoring/alloy/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values

template/stacks/monitoring/alloy/values.yaml

@@ -1,78 +0,0 @@
-alloy:
-  create: false
-  name: alloy-config
-  key: config.alloy
-
-  uiPathPrefix: "/alloy"
-
-  configMap:
-    content: |-
-
-      logging {
-        level  = "info"
-        format = "logfmt"
-      }
-
-      loki.write "local_loki" {
-          endpoint {
-              url = "http://loki-loki-distributed-gateway/loki/api/v1/push"
-          }
-      }
-
-      discovery.kubernetes "pod" {
-        role = "pod"
-      }
-
-      discovery.kubernetes "nodes" {
-        role = "node"
-      }
-
-      discovery.kubernetes "services" {
-        role = "service"
-      }
-
-      discovery.kubernetes "endpoints" {
-        role = "endpoints"
-      }
-
-      discovery.kubernetes "endpointslices" {
-        role = "endpointslice"
-      }
-
-      discovery.kubernetes "ingresses" {
-        role = "ingress"
-      }
-
-      discovery.relabel "pod_logs" {
-        targets = discovery.kubernetes.pod.targets
-
-        rule {
-          source_labels = ["__meta_kubernetes_namespace"]
-          action        = "replace"
-          target_label  = "namespace"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_pod_name"]
-          action        = "replace"
-          target_label  = "pod"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_pod_node_name"]
-          action        = "replace"
-          target_label  = "node"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_pod_container_name"]
-          action        = "replace"
-          target_label  = "container"
-        }
-
-      }
-
-      loki.source.kubernetes "all_pod_logs" {
-        targets    = discovery.relabel.pod_logs.output
-        forward_to = [loki.write.local_loki.receiver]
-      }

template/stacks/monitoring/kube-prometheus-sso.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kube-prometheus-sso
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/monitoring/kube-prometheus-sso"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: monitoring
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      selfHeal: true
-    retry:
-      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s

template/stacks/monitoring/kube-prometheus-sso/secret-grafana.yaml

@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: auth-generic-oauth-secret
-  namespace: monitoring
-spec:
-  secretStoreRef:
-    name: keycloak
-    kind: ClusterSecretStore
-  refreshInterval: "0"
-  target:
-    name: auth-generic-oauth-secret
-    template:
-      engineVersion: v2
-      data:
-        client_secret: "{{.GRAFANA_CLIENT_SECRET}}"
-  data:
-    - secretKey: GRAFANA_CLIENT_SECRET
-      remoteRef:
-        key: keycloak-clients
-        property: GRAFANA_CLIENT_SECRET

template/stacks/monitoring/kube-prometheus.yaml

@@ -1,36 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kube-prometheus-stack
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true  # do not copy metdata, since (because of its large size) it can lead to sync failure
-    retry:
-      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s
-  destination:
-    name: in-cluster
-    namespace: monitoring
-  sources:
-    - repoURL: https://github.com/prometheus-community/helm-charts
-      path: charts/kube-prometheus-stack
-      targetRevision: HEAD
-      helm:
-        valueFiles:
-          - $values/stacks/monitoring/kube-prometheus/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_apps.yaml

@@ -1,268 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-dashboard-1
-  labels:
-    grafana_dashboard: "1"
-data:
-  k8s-dashboard-01.json: |
-    {
-        "annotations": {
-            "list": [
-                {
-                    "builtIn": 1,
-                    "datasource": {
-                        "type": "grafana",
-                        "uid": "-- Grafana --"
-                    },
-                    "enable": true,
-                    "hide": true,
-                    "iconColor": "rgba(0, 211, 255, 1)",
-                    "name": "Annotations & Alerts",
-                    "type": "dashboard"
-                }
-            ]
-        },
-        "editable": true,
-        "fiscalYearStartMonth": 0,
-        "graphTooltip": 0,
-        "id": 1,
-        "links": [
-        ],
-        "panels": [
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 0
-                },
-                "id": 5,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"crossplane\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App crossplane",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 8
-                },
-                "id": 4,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"argo-server\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App argo-server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 16
-                },
-                "id": 3,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"forgejo\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App forgejo",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 24
-                },
-                "id": 2,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"backstage\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App backstage",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 32
-                },
-                "id": 1,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "expr": "{app=\"shoot-control-plane\"}",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: App shoot-control-plane",
-                "type": "logs"
-            }
-        ],
-        "preload": false,
-        "schemaVersion": 40,
-        "tags": [
-        ],
-        "templating": {
-            "list": [
-            ]
-        },
-        "time": {
-            "from": "now-6h",
-            "to": "now"
-        },
-        "timepicker": {
-        },
-        "timezone": "browser",
-        "title": "Loki Logs: Apps",
-        "uid": "ee4iuluru756of",
-        "version": 2,
-        "weekStart": ""
-    }

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_components.yaml

@@ -1,845 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-dashboard-2
-  labels:
-    grafana_dashboard: "1"
-data:
-  k8s-dashboard-02.json: |
-    {
-        "annotations": {
-            "list": [
-                {
-                    "builtIn": 1,
-                    "datasource": {
-                        "type": "grafana",
-                        "uid": "-- Grafana --"
-                    },
-                    "enable": true,
-                    "hide": true,
-                    "iconColor": "rgba(0, 211, 255, 1)",
-                    "name": "Annotations & Alerts",
-                    "type": "dashboard"
-                }
-            ]
-        },
-        "editable": true,
-        "fiscalYearStartMonth": 0,
-        "graphTooltip": 0,
-        "id": 30,
-        "links": [
-        ],
-        "panels": [
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 0
-                },
-                "id": 19,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 8
-                },
-                "id": 17,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"repo-server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component repo-server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 16
-                },
-                "id": 16,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"redis\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component redis",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 24
-                },
-                "id": 15,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"query-frontend\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component query-frontend",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 32
-                },
-                "id": 14,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"querier\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component querier",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 40
-                },
-                "id": 13,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"prometheus-operator-webhook\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component prometheus-operator-webhook",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 48
-                },
-                "id": 12,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"prometheus-operator\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component prometheus-operator",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 56
-                },
-                "id": 11,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"metrics\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component metrics",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 64
-                },
-                "id": 10,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"kube-scheduler\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component kube-scheduler",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 72
-                },
-                "id": 9,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"kube-controller-manager\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component kube-controller-manager",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 80
-                },
-                "id": 8,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"kube-apiserver\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component kube-apiserver",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 88
-                },
-                "id": 7,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"ingester\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component ingester",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 96
-                },
-                "id": 6,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"gateway\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component gateway",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 104
-                },
-                "id": 5,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"etcd\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component etcd",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 112
-                },
-                "id": 4,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"distributor\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component distributor",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 120
-                },
-                "id": 3,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"controller\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component controller",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 128
-                },
-                "id": 2,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"cloud-infrastructure-controller\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component cloud-infrastructure-controller",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 136
-                },
-                "id": 1,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{component=\"applicationset-controller\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Component application-controller",
-                "type": "logs"
-            }
-        ],
-        "preload": false,
-        "schemaVersion": 40,
-        "tags": [
-        ],
-        "templating": {
-            "list": [
-            ]
-        },
-        "time": {
-            "from": "now-6h",
-            "to": "now"
-        },
-        "timepicker": {
-        },
-        "timezone": "browser",
-        "title": "Loki Logs: Components",
-        "uid": "ae4zuyp1kui9sc",
-        "version": 2,
-        "weekStart": ""
-    }

template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_container.yaml

@@ -1,537 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-dashboard-3
-  labels:
-    grafana_dashboard: "1"
-data:
-  k8s-dashboard-03.json: |
-    {
-        "annotations": {
-            "list": [
-                {
-                    "builtIn": 1,
-                    "datasource": {
-                        "type": "grafana",
-                        "uid": "-- Grafana --"
-                    },
-                    "enable": true,
-                    "hide": true,
-                    "iconColor": "rgba(0, 211, 255, 1)",
-                    "name": "Annotations & Alerts",
-                    "type": "dashboard"
-                }
-            ]
-        },
-        "editable": true,
-        "fiscalYearStartMonth": 0,
-        "graphTooltip": 0,
-        "id": 31,
-        "links": [
-        ],
-        "panels": [
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 0
-                },
-                "id": 11,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"repo-server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container repo-server",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 8
-                },
-                "id": 10,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"alloy\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container alloy",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 16
-                },
-                "id": 9,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"prometheus\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container prometheus",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 24
-                },
-                "id": 8,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"postgres\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container postgres",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 32
-                },
-                "id": 7,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"kube-prometheus-stack\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container kube-prometheus-stack",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 40
-                },
-                "id": 6,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"keycloak\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container keycloak",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 48
-                },
-                "id": 5,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"grafana\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container grafana",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 56
-                },
-                "id": 4,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"forgejo\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container forgejo",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 64
-                },
-                "id": 3,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"crossplane\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container crossplane",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 72
-                },
-                "id": 2,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"backstage\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container backstage",
-                "type": "logs"
-            },
-            {
-                "datasource": {
-                    "type": "loki",
-                    "uid": "P8E80F9AEF21F6940"
-                },
-                "fieldConfig": {
-                    "defaults": {
-                    },
-                    "overrides": [
-                    ]
-                },
-                "gridPos": {
-                    "h": 8,
-                    "w": 24,
-                    "x": 0,
-                    "y": 80
-                },
-                "id": 1,
-                "options": {
-                    "dedupStrategy": "none",
-                    "enableLogDetails": true,
-                    "prettifyLogMessage": false,
-                    "showCommonLabels": false,
-                    "showLabels": false,
-                    "showTime": false,
-                    "sortOrder": "Descending",
-                    "wrapLogMessage": false
-                },
-                "pluginVersion": "11.3.1",
-                "targets": [
-                    {
-                        "datasource": {
-                            "type": "loki",
-                            "uid": "P8E80F9AEF21F6940"
-                        },
-                        "editorMode": "builder",
-                        "expr": "{container=\"argo-server\"} |= ``",
-                        "queryType": "range",
-                        "refId": "A"
-                    }
-                ],
-                "title": "Logs: Container argo-server",
-                "type": "logs"
-            }
-        ],
-        "preload": false,
-        "schemaVersion": 40,
-        "tags": [
-        ],
-        "templating": {
-            "list": [
-            ]
-        },
-        "time": {
-            "from": "now-6h",
-            "to": "now"
-        },
-        "timepicker": {
-        },
-        "timezone": "browser",
-        "title": "Loki Logs: Container",
-        "uid": "ee50bcaehmv40e",
-        "version": 2,
-        "weekStart": ""
-    }

template/stacks/monitoring/kube-prometheus/values.yaml

@@ -1,71 +0,0 @@
-grafana:
-  namespaceOverride: "monitoring"
-
-  admin:
-    existingSecret: "kube-prometheus-stack-grafana-admin-password"
-    userKey: admin-user
-    passwordKey: admin-password
-
-  defaultDashboardsTimezone: Europe/Berlin
-
-  additionalDataSources:
-    - name: Loki
-      type: loki
-      url: http://loki-loki-distributed-gateway.monitoring:80
-
-  # syncPolicy:
-  #   syncOptions:
-  #   - ServerSideApply=true
-
-  sidecar:
-    dashboards:
-      enabled: true
-      label: grafana_dashboard
-      folder: /tmp/dashboards
-      updateIntervalSeconds: 10
-      folderAnnotation: grafana_folder
-      provider:
-        allowUiUpdates: true
-        foldersFromFilesStructure: true
-
-  grafana.ini:
-    server:
-      domain: {{{ .Env.DOMAIN }}}
-      root_url: "%(protocol)s://%(domain)s/grafana"
-      serve_from_sub_path: true
-    auth:
-      disable_login: true
-      disable_login_form: true
-    auth.generic_oauth:
-      enabled: true
-      name: Keycloak-OAuth
-      allow_sign_up: true
-      use_refresh_token: true
-      client_id: grafana
-      client_secret: $__file{/etc/secrets/auth_generic_oauth/client_secret}
-      scopes: openid email profile offline_access roles
-      email_attribute_path: email
-      login_attribute_path: username
-      name_attribute_path: full_name
-      auth_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/auth
-      token_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/token
-      api_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/userinfo
-      redirect_uri: http://{{{ .Env.DOMAIN }}}/grafana/login/generic_oauth
-      role_attribute_path: "contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'editor') && 'Editor' || 'Viewer'"
-      
-  extraSecretMounts:
-    - name: auth-generic-oauth-secret-mount
-      secretName: auth-generic-oauth-secret
-      defaultMode: 0440
-      mountPath: /etc/secrets/auth_generic_oauth
-      readOnly: true
-
-  serviceMonitor:
-    # If true, a ServiceMonitor CRD is created for a prometheus operator https://github.com/coreos/prometheus-operator
-    enabled: true
-
-#monitoring nginx
-prometheus:
-  prometheusSpec:
-    podMonitorSelectorNilUsesHelmValues: false
-    serviceMonitorSelectorNilUsesHelmValues: false     

template/stacks/monitoring/loki.yaml

@@ -1,34 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: loki
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  syncPolicy:
-    automated:
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  destination:
-    name: in-cluster
-    namespace: monitoring
-  sources:
-    - repoURL: https://github.com/grafana/helm-charts
-      path:     charts/loki-distributed         
-      targetRevision: HEAD      
-      helm:
-        valueFiles:
-          - $values/stacks/monitoring/loki/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-      targetRevision: HEAD
-      ref: values
-
-    ## consider using the following version, if it works again
-    #- repoURL: https://github.com/grafana/loki
-    #  path: production/helm/loki        
-

template/stacks/monitoring/loki/values.yaml

@@ -1,7 +0,0 @@
-loki:
-  commonConfig:
-    replication_factor: 1
-  auth_enabled: false
-
-#  storageConfig:
-#    filesystem: null

template/stacks/observability-client/metrics-server.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: metrics-server
+      repoURL: https://kubernetes-sigs.github.io/metrics-server/
+      targetRevision: 3.12.2
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/metrics-server/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values

template/stacks/observability-client/metrics-server/values.yaml

@@ -0,0 +1,4 @@
+metrics:
+  enabled: true
+serviceMonitor:
+  enabled: true

template/stacks/observability-client/vector.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vector
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: vector
+      repoURL: https://helm.vector.dev
+      targetRevision: 0.43.0
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vector/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values

template/stacks/observability-client/vector/values.yaml

@@ -0,0 +1,68 @@
+# -- Enable deployment of vector
+role: Agent
+dataDir: /vector-data-dir
+resources: {}
+args:
+  - -w
+  - --config-dir
+  - /etc/vector/
+env:
+  - name: VECTOR_USER
+    valueFrom:
+      secretKeyRef:
+        name: simple-user-secret
+        key: username
+  - name: VECTOR_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: simple-user-secret
+        key: password
+containerPorts:
+  - name: prom-exporter
+    containerPort: 9090
+    protocol: TCP
+service:
+  enabled: false
+customConfig:
+  data_dir: /vector-data-dir
+  api:
+    enabled: false
+    address: 0.0.0.0:8686
+    playground: true
+  sources:
+    k8s:
+      type: kubernetes_logs
+    internal_metrics:
+      type: internal_metrics
+  transforms:
+    parser:
+      type: remap
+      inputs: [k8s]
+      source: |
+        ._msg = parse_json(.message) ?? .message
+        del(.message)
+        # Add the cluster environment to the log event
+        .cluster_environment = "{{{ .Env.CLUSTER_ENVIRONMENT }}}"
+  sinks:
+    vlogs:
+      type: elasticsearch
+      inputs: [parser]
+      endpoints: 
+        - https://{{{ .Env.DOMAIN_O12Y }}}/insert/elasticsearch/
+      auth:
+        strategy: basic
+        user: ${VECTOR_USER}
+        password: ${VECTOR_PASSWORD}
+      mode: bulk
+      api_version: v8
+      compression: gzip
+      healthcheck:
+        enabled: false
+      request:
+        headers:
+          AccountID: "0"
+          ProjectID: "0"
+      query:
+        _msg_field: _msg
+        _time_field: _time
+        _stream_fields: cluster_environment,kubernetes.container_name,kubernetes.namespace

template/stacks/observability-client/vm-client-stack.yaml

@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vm-client
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: victoria-metrics-k8s-stack
+      repoURL: https://victoriametrics.github.io/helm-charts/
+      targetRevision: 0.48.1
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability-client/vm-client-stack/manifests"

template/stacks/observability-client/vm-client-stack/manifests/simple-user-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: simple-user-secret
+  namespace: observability
+type: Opaque
+stringData:
+  username: simple-user
+  password: simple-password

template/stacks/observability/grafana-operator.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: grafana-operator
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: grafana-operator
+      repoURL: ghcr.io/grafana/helm-charts
+      targetRevision: v5.18.0
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/grafana-operator/manifests"

template/stacks/observability/grafana-operator/manifests/argocd.yaml

@@ -0,0 +1,9 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: argocd
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  url: "https://raw.githubusercontent.com/argoproj/argo-cd/refs/heads/master/examples/dashboard.json"

template/stacks/observability/grafana-operator/manifests/grafana.yaml

@@ -0,0 +1,36 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: Grafana
+metadata:
+  name: grafana
+  labels:
+    dashboards: "grafana"
+spec:
+  persistentVolumeClaim:
+    spec:
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+  ingress:
+    metadata:
+      annotations:
+        cert-manager.io/cluster-issuer: main
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    spec:
+      ingressClassName: nginx
+      rules:
+      - host: grafana.{{{ .Env.DOMAIN }}}
+        http:
+          paths:
+          - backend:
+              service:
+                name: grafana-service
+                port:
+                  number: 3000
+            path: /
+            pathType: Prefix
+      tls:
+      - hosts:
+        - grafana.{{{ .Env.DOMAIN }}}
+        secretName: grafana-net-tls

template/stacks/observability/grafana-operator/manifests/ingress-nginx.yaml

@@ -0,0 +1,9 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: ingress-nginx 
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  url: "https://raw.githubusercontent.com/adinhodovic/ingress-nginx-mixin/refs/heads/main/dashboards_out/ingress-nginx-overview.json"

template/stacks/observability/grafana-operator/manifests/victoria-logs.yaml

@@ -0,0 +1,9 @@
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: victoria-logs
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  url: "https://raw.githubusercontent.com/VictoriaMetrics/VictoriaMetrics/refs/heads/master/dashboards/vm/victorialogs.json"

template/stacks/observability/victoria-k8s-stack.yaml

@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: o12y
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+  destination:
+    name: in-cluster
+    namespace: observability
+  sources:
+    - chart: victoria-metrics-k8s-stack
+      repoURL: https://victoriametrics.github.io/helm-charts/
+      targetRevision: 0.48.1
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/observability/victoria-k8s-stack/manifests"

template/stacks/observability/victoria-k8s-stack/manifests/vlogs.yaml

@@ -0,0 +1,24 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VLogs
+metadata:
+  name: victorialogs
+  namespace: observability
+spec:
+  retentionPeriod: "12"
+  removePvcAfterDelete: true
+  storageMetadata:
+    annotations:
+      everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
+  storage:
+    accessModes:
+      - ReadWriteOnce
+    resources:
+      requests:
+        storage: 50Gi
+  resources:
+    requests:
+      memory: 500Mi
+      cpu: 500m
+    limits:
+      memory: 10Gi
+      cpu: 2

template/stacks/observability/victoria-k8s-stack/manifests/vmauth.yaml

@@ -0,0 +1,15 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  name: simple-user
+  namespace: observability
+spec:
+  username: simple-user
+  password: simple-password
+  targetRefs:
+    - static:
+        url: http://vmsingle-o12y:8429
+      paths: ["/api/v1/write"]
+    - static:
+        url: http://vlogs-victorialogs:9428
+      paths: ["/insert/elasticsearch/.*"]

template/stacks/otc/cert-manager/manifests/clusterissuer.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: main
+spec:
+  acme:
+    email: admin@think-ahead.tech
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: cluster-issuer-account-key
+    solvers:
+    - http01:
+        ingress:
+          ingressClassName: nginx

template/stacks/otc/cert-manager/values.yaml

@@ -0,0 +1,4 @@
+crds:
+  enabled: true
+
+replicaCount: 1

template/stacks/otc/cert-manger.yaml

@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: -1
+  destination:
+    name: in-cluster
+    namespace: cert-manager
+  sources:
+    - chart: cert-manager
+      repoURL: https://charts.jetstack.io
+      targetRevision: v1.17.2
+      helm:
+        valueFiles:
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/values.yaml
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/cert-manager/manifests"

template/stacks/otc/ingress-nginx.yaml

@@ -12,6 +12,8 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+    retry:
+      limit: -1
   destination:
     name: in-cluster
     namespace: ingress-nginx
@@ -21,7 +23,7 @@ spec:
       targetRevision: helm-chart-4.12.1-depends
       helm:
         valueFiles:
-          - $values/stacks/core/ingress-nginx/values.yaml
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/ingress-nginx/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values

template/stacks/otc/ingress-nginx/values.yaml

@@ -0,0 +1,31 @@
+controller:
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  service:
+    annotations:
+      kubernetes.io/elb.class: union
+      kubernetes.io/elb.port: '80'
+      kubernetes.io/elb.id: {{{ .Env.LOADBALANCER_ID }}}
+      kubernetes.io/elb.ip: {{{ .Env.LOADBALANCER_IP }}}
+
+  ingressClassResource:
+    name: nginx
+
+  # added for idpbuilder
+  allowSnippetAnnotations: true
+
+  # added for idpbuilder
+  config:
+    proxy-buffer-size: 32k
+    use-forwarded-headers: "true"
+
+  # monitoring nginx
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels: 
+        release: "ingress-nginx"  
+      enabled: true

template/stacks/otc/storageclass.yaml

@@ -1,25 +1,25 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: grafana-dashboards
+  name: storageclass
   namespace: argocd
   labels:
-    env: dev
+    example: otc
   finalizers:
     - resources-finalizer.argocd.argoproj.io
 spec:
-  project: default
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/monitoring/kube-prometheus/dashboards"
   destination:
+    namespace: default
     server: "https://kubernetes.default.svc"
-    namespace: monitoring
+  source:
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+    targetRevision: HEAD
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/otc/storageclass"
+  project: default
   syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
     automated:
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
     retry:
       limit: -1

template/stacks/otc/storageclass/storageclass.yaml

@@ -0,0 +1,18 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations:
+    storageclass.beta.kubernetes.io/is-default-class: "true"
+  labels:
+    kubernetes.io/cluster-service: "true"
+  name: default
+parameters:
+  kubernetes.io/description: ""
+  kubernetes.io/hw:passthrough: "true"
+  kubernetes.io/storagetype: BS
+  kubernetes.io/volumetype: SATA
+  kubernetes.io/zone: eu-de-02
+provisioner: flexvolume-huawei.com/fuxivol
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+allowVolumeExpansion: true

template/stacks/ref-implementation/argo-workflows.yaml

@@ -10,9 +10,9 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
     targetRevision: HEAD
-    path: "stacks/ref-implementation/argo-workflows/manifests/dev"
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/argo-workflows/manifests/dev"
   destination:
     server: "https://kubernetes.default.svc"
     namespace: argo

template/stacks/ref-implementation/backstage-templates.yaml

@@ -10,11 +10,11 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
     targetRevision: HEAD
-    path: "stacks/ref-implementation/backstage-templates/entities"
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/backstage-templates/entities"
     directory:
-      exclude: 'catalog-info.yaml'
+      exclude: "catalog-info.yaml"
   destination:
     server: "https://kubernetes.default.svc"
     namespace: backstage

template/stacks/ref-implementation/backstage.yaml

@@ -10,9 +10,9 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
     targetRevision: HEAD
-    path: "stacks/ref-implementation/backstage/manifests"
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/backstage/manifests"
   destination:
     server: "https://kubernetes.default.svc"
     namespace: backstage

template/stacks/ref-implementation/backstage/manifests/install.yaml

@@ -167,7 +167,7 @@ data:
       locations:
         # Examples from a public GitHub repository.
         - type: url
-          target: https://{{{ .Env.DOMAIN_GITEA }}}:443/giteaAdmin/edfbuilder/raw/branch/main/stacks/ref-implementation/backstage-templates/entities/catalog-info.yaml
+          target: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}:443/{{{ .Env.CLIENT_REPO_ORG_NAME }}}/raw/branch/main/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/backstage-templates/entities/catalog-info.yaml
           rules:
             - allow: [Component, System, API, Resource, Location, Template, User, Group]
     kubernetes:
@@ -264,7 +264,8 @@ spec:
                 name: gitea-credentials
             - secretRef:
                 name: argocd-credentials
-          image: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/backstage-edp:development
+          image: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/backstage-edp:1.1.0
+          imagePullPolicy: Always
           name: backstage
           ports:
             - containerPort: 7007

template/stacks/ref-implementation/external-secrets.yaml

@@ -12,9 +12,9 @@ spec:
     namespace: external-secrets
     server: "https://kubernetes.default.svc"
   source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
     targetRevision: HEAD
-    path: "stacks/ref-implementation/external-secrets/manifests"
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/external-secrets/manifests"
   project: default
   syncPolicy:
     automated:

template/stacks/ref-implementation/fibonacci-app/deployment.yaml

@@ -1,20 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: fibonacci-deployment
-  namespace: fibonacci-app  
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: fibonacci-go
-  template:
-    metadata:
-      labels:
-        app: fibonacci-go
-    spec:
-      containers:
-      - name: fibonacci-go
-        image: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/christopher.hase/fibonacci_http_go:1.0.0
-        ports:
-        - containerPort: 9090

template/stacks/ref-implementation/fibonacci-app/service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: fibonacci-service
-  namespace: fibonacci-app
-spec:
-  selector:
-    app: fibonacci-go
-  ports:
-    - protocol: TCP
-      port: 9090
-      targetPort: 9090
-  type: ClusterIP

template/stacks/ref-implementation/keycloak.yaml

@@ -12,9 +12,9 @@ spec:
     namespace: keycloak
     server: "https://kubernetes.default.svc"
   source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
     targetRevision: HEAD
-    path: "stacks/ref-implementation/keycloak/manifests"
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/keycloak/manifests"
   project: default
   syncPolicy:
     automated:

template/stacks/ref-implementation/keycloak/manifests/keycloak-config.yaml

@@ -219,6 +219,64 @@ data:
       ]
     }
 
+  argocd-client-payload.json: |
+    {
+      "protocol": "openid-connect",
+      "clientId": "argocd",
+      "name": "ArgoCD Client",
+      "description": "Used for ArgoCD SSO",
+      "publicClient": false,
+      "authorizationServicesEnabled": false,
+      "serviceAccountsEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": true,
+      "standardFlowEnabled": true,
+      "frontchannelLogout": true,
+      "attributes": {
+        "saml_idp_initiated_sso_url_name": "",
+        "oauth2.device.authorization.grant.enabled": false,
+        "oidc.ciba.grant.enabled": false
+      },
+      "alwaysDisplayInConsole": false,
+      "rootUrl": "",
+      "baseUrl": "",
+      "redirectUris": [
+        "https://{{{ .Env.DOMAIN }}}/*"
+      ],
+      "webOrigins": [
+        "/*"
+      ]
+    }      
+
+  forgejo-client-payload.json: |
+    {
+      "protocol": "openid-connect",
+      "clientId": "forgejo",
+      "name": "Forgejo Client",
+      "description": "Used for Forgejo SSO",
+      "publicClient": false,
+      "authorizationServicesEnabled": false,
+      "serviceAccountsEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": true,
+      "standardFlowEnabled": true,
+      "frontchannelLogout": true,
+      "attributes": {
+        "saml_idp_initiated_sso_url_name": "",
+        "oauth2.device.authorization.grant.enabled": false,
+        "oidc.ciba.grant.enabled": false
+      },
+      "alwaysDisplayInConsole": false,
+      "rootUrl": "",
+      "baseUrl": "",
+      "redirectUris": [
+        "https://{{{ .Env.DOMAIN_GITEA }}}/*"
+      ],
+      "webOrigins": [
+        "/*"
+      ]
+    }      
+
 ---
 apiVersion: batch/v1
 kind: Job
@@ -315,7 +373,7 @@ spec:
                 ${KEYCLOAK_URL}/admin/realms/cnoe/groups
               
               # Create scope mapper
-                echo 'adding group claim to tokens'
+              echo 'adding group claim to tokens'
               CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
               
               curl -sS -H "Content-Type: application/json" \
@@ -355,8 +413,8 @@ spec:
               echo "creating Argo Workflows client"
               curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                  -X POST --data @/var/config/argo-client-payload.json \
+                -X POST --data @/var/config/argo-client-payload.json \
-                  ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
               
               CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
@@ -370,21 +428,26 @@ spec:
                 -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
               
               ARGO_WORKFLOWS_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
-              -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-              -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
 
               echo "creating Grafana client"
               curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                 -X POST --data @/var/config/grafana-client-payload.json \
-                  ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
               
               CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                 -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "grafana") | .id')
               
-              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
-              curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
               
               GRAFANA_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
@@ -394,19 +457,68 @@ spec:
               curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                 -X POST --data @/var/config/backstage-client-payload.json \
-                  ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
               
               CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                 -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "backstage") | .id')
               
-              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
-              curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
               
               BACKSTAGE_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
                 -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                 -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
 
+              echo "creating ArgoCD client"
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/argocd-client-payload.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+              
+              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "argocd") | .id')
+              
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
+              
+              ARGOCD_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')  
+              
+              echo "creating Forgejo client"
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X POST --data @/var/config/forgejo-client-payload.json \
+                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+              
+              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "forgejo") | .id')
+              
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
+              
+              FORGEJO_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')  
+
               ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{.data.password | base64decode }}')
               
               ARGOCD_SESSION_TOKEN=$(curl -sS https://{{{ .Env.DOMAIN }}}/argocd/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token)
@@ -426,7 +538,10 @@ spec:
                 BACKSTAGE_CLIENT_ID: backstage
                 GRAFANA_CLIENT_SECRET: ${GRAFANA_CLIENT_SECRET}
                 GRAFANA_CLIENT_ID: grafana
+                ARGOCD_CLIENT_SECRET: ${ARGOCD_CLIENT_SECRET}
+                ARGOCD_CLIENT_ID: argocd
+                FORGEJO_CLIENT_SECRET: ${FORGEJO_CLIENT_SECRET}
+                FORGEJO_CLIENT_ID: forgejo
               " > /tmp/secret.yaml
               
               ./kubectl apply -f /tmp/secret.yaml
-              

template/stacks/ref-implementation/mailhog.yaml

@@ -10,9 +10,9 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
     targetRevision: HEAD
-    path: "stacks/ref-implementation/mailhog"
+    path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/mailhog"
   destination:
     server: "https://kubernetes.default.svc"
     namespace: mailhog

template/stacks/ref-implementation/openbao.yaml

@@ -11,7 +11,7 @@ spec:
   project: default
   syncPolicy:
     automated:
-     selfHeal: false
+      selfHeal: false
     syncOptions:
       - CreateNamespace=true
   destination:
@@ -23,12 +23,15 @@ spec:
       targetRevision: HEAD
       helm:
         valueFiles:
-          - $values/stacks/ref-implementation/openbao/values.yaml
+          - $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/openbao/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
       targetRevision: HEAD
       ref: values
+    - repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
+      targetRevision: HEAD
+      path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/ref-implementation/openbao/manifests"
   ignoreDifferences:
-  - group: admissionregistration.k8s.io
+    - group: admissionregistration.k8s.io
-    kind: MutatingWebhookConfiguration
+      kind: MutatingWebhookConfiguration
-    jqPathExpressions:
+      jqPathExpressions:
-    - .webhooks[]?.clientConfig.caBundle
+        - .webhooks[]?.clientConfig.caBundle

template/stacks/ref-implementation/openbao/manifests/role.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vault-token-role
+  namespace: openbao
+rules:
+  - apiGroups: [""] # "" indicates the core API group
+    resources: ["secrets"]
+    verbs: ["create"]

template/stacks/ref-implementation/openbao/manifests/rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vault-token-rolebinding
+  namespace: openbao
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vault-token-role
+subjects:
+  - kind: ServiceAccount
+    name: openbao
+    namespace: openbao

template/stacks/ref-implementation/openbao/values.yaml

@@ -3,6 +3,8 @@ server:
     - sh
     - -c
     - |
+      echo --- unseal workaround
+
       sleep 10
       bao operator init >> /tmp/init.txt
       cat /tmp/init.txt | grep "Key " | awk '{print $NF}' | xargs -I{} bao operator unseal {}
@@ -13,5 +15,20 @@ server:
       echo $(grep "Unseal Key 4:" /tmp/init.txt | awk '{print $NF}')| cat > /openbao/data/unseal_key4.txt
       echo $(grep "Unseal Key 5:" /tmp/init.txt | awk '{print $NF}')| cat > /openbao/data/unseal_key5.txt
       rm /tmp/init.txt
+      
+
+      echo --- provide OpenBAO secret to ESO
+
+      if [[ "$(uname -m)" == "x86_64" ]]; then
+        wget "https://dl.k8s.io/release/$(wget https://dl.k8s.io/release/stable.txt -q -O -)/bin/linux/amd64/kubectl" -O /tmp/kubectl_eso
+      else
+        wget "https://dl.k8s.io/release/$(wget https://dl.k8s.io/release/stable.txt -q -O -)/bin/linux/arm64/kubectl" -O /tmp/kubectl_eso
+      fi
+      chmod +x /tmp/kubectl_eso
+
+      /tmp/kubectl_eso create secret generic vault-token --from-literal=token="$(cat /openbao/data/initial_token.txt)" -n openbao
+
+      rm /tmp/kubectl_eso
+
 ui:
   enabled: true

template/stacks/second-cluster/create-new-cluster-guestbook/argocluster.yaml

@@ -1,16 +0,0 @@
-apiVersion: cluster.argocd.crossplane.io/v1alpha1
-kind: Cluster
-metadata:
-  name: argo-app-test
-  labels:
-    purpose: dev
-spec:
-  forProvider:
-    config:
-      kubeconfigSecretRef:
-        key: kubeconfig
-        namespace: crossplane-system
-        name: argo-app-test-kubeconf
-    name: argo-app-test-cluster
-  providerConfigRef:
-    name: argocd-provider

template/stacks/second-cluster/create-new-cluster-guestbook/guestbook.yaml

@@ -1,26 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argo-second-cluster-demo
-  namespace: argocd
-spec:
-  destination:
-    namespace: guestbook
-    name: argo-app-test-cluster
-  project: default
-  source:
-    path: guestbook
-    repoURL: https://github.com/argoproj/argocd-example-apps.git
-    targetRevision: HEAD
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
-    retry:
-      limit: -1
-      backoff:
-        duration: 5s 
-        factor: 2 
-        maxDuration: 1m

template/stacks/second-cluster/create-new-cluster-guestbook/kindcluster.yaml

@@ -1,26 +0,0 @@
-apiVersion: container.kind.crossplane.io/v1alpha1
-kind: KindCluster
-metadata:
-  name: argo-app-test
-spec:
-  forProvider:
-    kindConfig: |
-      kind: Cluster
-      apiVersion: kind.x-k8s.io/v1alpha4
-      nodes:
-      - role: control-plane
-        kubeadmConfigPatches:
-        - |
-          kind: InitConfiguration
-          nodeRegistration:
-            kubeletExtraArgs:
-              node-labels: "ingress-ready=true"
-      # TODO: RIRE used maybe for velero backup
-      #  extraMounts:
-      #    - hostPath: /tmp/backup # replace with your own path
-      #      containerPath: /backup
-  providerConfigRef:
-    name: kind-provider
-  writeConnectionSecretToRef:
-    namespace: crossplane-system
-    name: argo-app-test-kubeconf