the existing infrastructure

2026-11-02 09:55:40 +00:00
commit aef641e978
55 changed files with 618 additions and 0 deletions
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: shop-admin
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.example.com/shop/admin.git
+    targetRevision: v1.4.0
+    path: deploy
+  destination:
+    namespace: shop
+    server: https://kubernetes.default.svc
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,7 @@
+name: shop-admin
+owner: bob
+repoURL: https://git.example.com/shop/admin.git
+path: deploy
+revision: v1.4.0
+namespace: shop
+autoSync: false
@@ -0,0 +1,5 @@
+# An Application on a tag of a team's repository, synced by hand.
+kind: create
+params: { name: shop-admin }
+owner: bob
+values: { repoURL: "https://git.example.com/shop/admin.git", path: deploy, revision: v1.4.0, namespace: shop, autoSync: false }
@@ -0,0 +1,7 @@
+# Deleting an Application removes its directory; its finalizer deletes what it deployed.
+kind: delete
+key: shop-web
+deleted:
+  - apps/shop-web/kustomization.yaml
+  - apps/shop-web/manifests.yaml
+  - apps/shop-web/quai.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: checkout
+  namespace: shop
+data:
+  provider: example-pay
+  timeout: 30s
@@ -0,0 +1,6 @@
+name: checkout
+namespace: shop
+owner: alice
+data:
+  provider: example-pay
+  timeout: 30s
@@ -0,0 +1,5 @@
+# A ConfigMap from the raw component.
+kind: create
+params: { namespace: shop, name: checkout }
+owner: alice
+values: { data: { provider: example-pay, timeout: 30s } }
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,15 @@
+apiVersion: database.example.org/v1alpha1
+kind: PostgreSQLInstance
+metadata:
+  name: payments
+  namespace: shop
+spec:
+  parameters:
+    highAvailability: false
+    storageGB: 20
+    version: "17"
+  compositionSelector:
+    matchLabels:
+      provider: example
+  writeConnectionSecretToRef:
+    name: payments-connection
@@ -0,0 +1,5 @@
+name: payments
+namespace: shop
+owner: carol
+version: "17"
+storageGB: 20
@@ -0,0 +1,5 @@
+# A claim of the platform's PostgreSQL API: high availability is off unless the form turns it on.
+kind: create
+params: { namespace: shop, name: payments }
+owner: carol
+values: { version: "17", storageGB: 20 }
@@ -0,0 +1,15 @@
+apiVersion: database.example.org/v1alpha1
+kind: PostgreSQLInstance
+metadata:
+  name: orders
+  namespace: shop
+spec:
+  parameters:
+    highAvailability: true
+    storageGB: 100 # about a year of orders
+    version: "17"
+  compositionSelector:
+    matchLabels:
+      provider: example
+  writeConnectionSecretToRef:
+    name: orders-connection
@@ -0,0 +1,6 @@
+name: orders
+namespace: shop
+owner: alice
+version: "17"
+storageGB: 100
+highAvailability: true
@@ -0,0 +1,4 @@
+# More storage for orders: one parameter of the claim changes, its comment stays.
+kind: update
+key: shop/orders
+values: { name: orders, namespace: shop, owner: alice, version: "17", storageGB: 100, highAvailability: true }
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: web
+  labels:
+    team: web
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: quota
+  namespace: web
+spec:
+  hard:
+    requests.cpu: "4"
+    requests.memory: 8Gi
@@ -0,0 +1,5 @@
+name: web
+owner: bob
+team: web
+cpu: "4"
+memory: 8Gi
@@ -0,0 +1,5 @@
+# A new team namespace: the record, the namespace and its quota, and a kustomization that lists them.
+kind: create
+params: { name: web }
+owner: bob
+values: { team: web, cpu: "4", memory: 8Gi }
@@ -0,0 +1,17 @@
+# The shop team: storefront, orders and payments.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: shop
+  labels:
+    team: shop
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: quota
+  namespace: shop
+spec:
+  hard:
+    requests.cpu: "12" # raised for the sales, see PLAT-142
+    requests.memory: 16Gi
@@ -0,0 +1,5 @@
+name: shop
+owner: alice
+team: shop
+cpu: "12"
+memory: 16Gi
@@ -0,0 +1,5 @@
+# More CPU for shop: the record and the quota change in place, the comments stay; the
+# kustomization and the README are left alone.
+kind: update
+key: shop
+values: { name: shop, owner: alice, team: shop, cpu: "12", memory: 16Gi }
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: web-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./policies/web
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: platform
+  targetNamespace: web
@@ -0,0 +1,4 @@
+name: web-policies
+owner: bob
+path: ./policies/web
+targetNamespace: web
@@ -0,0 +1,5 @@
+# A Flux Kustomization of the platform source, every ten minutes unless the form says otherwise.
+kind: create
+params: { name: web-policies }
+owner: bob
+values: { path: ./policies/web, targetNamespace: web }
@@ -0,0 +1,29 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: app
+  title: Application
+  description: An Argo CD Application that deploys a directory of a team's repository.
+  icon: rocket
+  category: Delivery
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "apps/{name}" }
+  params:
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,40}" }
+  schema: schemas/app.schema.json
+  generate:
+    kind: component
+    component: argocd.application
+    with:
+      name: ${{ params.name }}
+      repoURL: ${{ inputs.repoURL }}
+      path: ${{ inputs.path }}
+      targetRevision: ${{ inputs.?revision }}
+      destinationNamespace: ${{ inputs.namespace }}
+      automated: ${{ inputs.?autoSync.orValue(true) }}
+      syncOptions: [CreateNamespace=true]
+      cascadeDelete: true
+  ownership: { field: owner }
+  paramFields: { name: name }
+  deletion: allowed
@@ -0,0 +1,27 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: config
+  title: Configuration
+  description: Settings for an application, as a ConfigMap in its namespace.
+  icon: settings
+  category: Kubernetes
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "configs/{namespace}/{name}" }
+  params:
+    - { name: namespace, title: Namespace, type: enum, discover: true }
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,30}" }
+  schema: schemas/config.schema.json
+  generate:
+    kind: component
+    component: raw
+    with:
+      manifests:
+        - apiVersion: v1
+          kind: ConfigMap
+          metadata: { name: "${{ params.name }}", namespace: "${{ params.namespace }}" }
+          data: ${{ inputs.data }}
+  ownership: { field: owner }
+  paramFields: { name: name, namespace: namespace }
+  deletion: allowed
@@ -0,0 +1,37 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: database
+  title: PostgreSQL database
+  description: A managed PostgreSQL instance, claimed from the platform's Crossplane API.
+  icon: database
+  category: Data
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "databases/{namespace}/{name}" }
+  params:
+    - { name: namespace, title: Namespace, type: enum, discover: true }
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,30}" }
+  schema: schemas/database.schema.json
+  generate:
+    kind: component
+    component: crossplane.claim
+    with:
+      apiVersion: database.example.org/v1alpha1
+      kind: PostgreSQLInstance
+      name: ${{ params.name }}
+      namespace: ${{ params.namespace }}
+      spec:
+        parameters:
+          version: ${{ inputs.version }}
+          storageGB: ${{ inputs.storageGB }}
+          highAvailability: ${{ inputs.?highAvailability.orValue(false) }}
+        compositionSelector: { matchLabels: { provider: example } }
+        writeConnectionSecretToRef: { name: "${{ params.name }}-connection" }
+  ownership: { field: owner }
+  paramFields: { name: name, namespace: namespace }
+  deletion: approval
+  ui:
+    order: [version, storageGB, highAvailability]
+    fields:
+      version: { immutable: true }
@@ -0,0 +1,31 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: namespace
+  title: Team namespace
+  description: A team's namespace with a quota of CPU and memory requests.
+  icon: box
+  category: Kubernetes
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "namespaces/{name}" }
+  params:
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,30}" }
+  schema: schemas/namespace.schema.json
+  generate:
+    kind: component
+    component: k8s.namespace
+    with:
+      name: ${{ params.name }}
+      labels: { team: "${{ inputs.team }}" }
+      quota:
+        requests.cpu: ${{ inputs.?cpu }}
+        requests.memory: ${{ inputs.?memory }}
+  ownership: { field: owner }
+  paramFields: { name: name }
+  deletion: approval
+  approval:
+    rules:
+      - name: quota
+        when: inputs.?cpu != previous.?cpu || inputs.?memory != previous.?memory
+        approvers: [group:platform-admins]
@@ -0,0 +1,26 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: sync
+  title: Flux sync
+  description: A Flux Kustomization that applies a directory of the platform repository to a namespace.
+  icon: refresh
+  category: Delivery
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "flux/{name}" }
+  params:
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,40}" }
+  schema: schemas/sync.schema.json
+  generate:
+    kind: component
+    component: flux.kustomization
+    with:
+      name: ${{ params.name }}
+      source: platform
+      path: ${{ inputs.path }}
+      interval: ${{ inputs.?interval }}
+      targetNamespace: ${{ inputs.targetNamespace }}
+  ownership: { field: owner }
+  paramFields: { name: name }
+  deletion: approval
@@ -0,0 +1,25 @@
+# Kubernetes example repository
+
+A GitOps repository for a Kubernetes platform, reconciled by Argo CD or Flux, with Quai
+definitions added: a type for each built-in component of the `component` generator
+(docs/design/02-resource-types-and-generators.md). The backend's tests lint it, run its golden
+examples, and check its manifests against a Kubernetes API server in server-side dry runs.
+
+Each resource is a directory (the `dir` locator) that holds:
+
+- `quai.yaml`, the record of the form's values, which Quai reads back;
+- `manifests.yaml`, the manifests the component renders, one YAML document each;
+- `kustomization.yaml`, which lists the manifests (not the record) for Argo CD, Flux or
+  `kubectl apply -k`.
+
+The types:
+
+| Type | Component | Directory | Renders |
+| --- | --- | --- | --- |
+| `namespace` | `k8s.namespace` | `namespaces/<name>/` | a team's `Namespace` and its `ResourceQuota` |
+| `config` | `raw` | `configs/<namespace>/<name>/` | a `ConfigMap` |
+| `database` | `crossplane.claim` | `databases/<namespace>/<name>/` | a `PostgreSQLInstance` claim of the XRD in `platform/xrds/` |
+| `app` | `argocd.application` | `apps/<name>/` | an Argo CD `Application` deploying a path of a team's repository |
+| `sync` | `flux.kustomization` | `flux/<name>/` | a Flux `Kustomization` applying a path of the `platform` source |
+
+`schemas/` holds the forms' JSON Schemas and `.quai/tests/<type>/` the golden examples.
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: shop-web
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.example.com/shop/web.git
+    targetRevision: HEAD
+    path: deploy/prod
+  destination:
+    namespace: shop
+    server: https://kubernetes.default.svc
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,5 @@
+name: shop-web
+owner: alice
+repoURL: https://git.example.com/shop/web.git
+path: deploy/prod
+namespace: shop
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: storefront
+  namespace: shop
+data:
+  currency: CHF
+  language: fr
@@ -0,0 +1,6 @@
+name: storefront
+namespace: shop
+owner: alice
+data:
+  currency: CHF
+  language: fr
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,15 @@
+apiVersion: database.example.org/v1alpha1
+kind: PostgreSQLInstance
+metadata:
+  name: orders
+  namespace: shop
+spec:
+  parameters:
+    highAvailability: false
+    storageGB: 50 # about a year of orders
+    version: "17"
+  compositionSelector:
+    matchLabels:
+      provider: example
+  writeConnectionSecretToRef:
+    name: orders-connection
@@ -0,0 +1,5 @@
+name: orders
+namespace: shop
+owner: alice
+version: "17"
+storageGB: 50
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: shop-policies
+  namespace: flux-system
+spec:
+  interval: 1h
+  path: ./policies/shop
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: platform
+  targetNamespace: shop
@@ -0,0 +1,5 @@
+name: shop-policies
+owner: alice
+path: ./policies/shop
+targetNamespace: shop
+interval: 1h
@@ -0,0 +1 @@
+The shop team's namespace. Its quota is reviewed by the platform team.
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,17 @@
+# The shop team: storefront, orders and payments.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: shop
+  labels:
+    team: shop
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: quota
+  namespace: shop
+spec:
+  hard:
+    requests.cpu: "8" # raised for the sales, see PLAT-142
+    requests.memory: 16Gi
@@ -0,0 +1,5 @@
+name: shop
+owner: alice
+team: shop
+cpu: "8"
+memory: 16Gi
@@ -0,0 +1,41 @@
+# The platform team's PostgreSQL API: claims of kind PostgreSQLInstance, composed by the
+# compositions labelled with a provider.
+apiVersion: apiextensions.crossplane.io/v1
+kind: CompositeResourceDefinition
+metadata:
+  name: xpostgresqlinstances.database.example.org
+spec:
+  group: database.example.org
+  names:
+    kind: XPostgreSQLInstance
+    plural: xpostgresqlinstances
+  claimNames:
+    kind: PostgreSQLInstance
+    plural: postgresqlinstances
+  connectionSecretKeys: [username, password, endpoint, port]
+  versions:
+    - name: v1alpha1
+      served: true
+      referenceable: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              required: [parameters]
+              properties:
+                parameters:
+                  type: object
+                  required: [version, storageGB]
+                  properties:
+                    version:
+                      type: string
+                      enum: ["16", "17"]
+                    storageGB:
+                      type: integer
+                      minimum: 20
+                      maximum: 1024
+                    highAvailability:
+                      type: boolean
+                      default: false
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Application",
+  "type": "object",
+  "required": ["repoURL", "path", "namespace"],
+  "additionalProperties": false,
+  "properties": {
+    "name": { "type": "string", "title": "Name", "readOnly": true },
+    "owner": { "type": "string", "title": "Owner" },
+    "repoURL": { "type": "string", "title": "Repository", "description": "The Git repository of the application's manifests.", "pattern": "^https://" },
+    "path": { "type": "string", "title": "Path", "description": "The directory of the manifests in that repository.", "minLength": 1 },
+    "revision": { "type": "string", "title": "Revision", "description": "A branch, a tag or a commit; HEAD when empty." },
+    "namespace": { "type": "string", "title": "Namespace", "description": "The namespace it deploys to.", "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" },
+    "autoSync": { "type": "boolean", "title": "Sync automatically", "default": true }
+  }
+}
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Configuration",
+  "type": "object",
+  "required": ["data"],
+  "additionalProperties": false,
+  "properties": {
+    "name": { "type": "string", "title": "Name", "readOnly": true },
+    "namespace": { "type": "string", "title": "Namespace", "readOnly": true },
+    "owner": { "type": "string", "title": "Owner" },
+    "data": {
+      "type": "object",
+      "title": "Settings",
+      "minProperties": 1,
+      "propertyNames": { "pattern": "^[A-Za-z0-9._-]+$" },
+      "additionalProperties": { "type": "string" }
+    }
+  }
+}
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "PostgreSQL database",
+  "type": "object",
+  "required": ["version", "storageGB"],
+  "additionalProperties": false,
+  "properties": {
+    "name": { "type": "string", "title": "Name", "readOnly": true },
+    "namespace": { "type": "string", "title": "Namespace", "readOnly": true },
+    "owner": { "type": "string", "title": "Owner" },
+    "version": { "type": "string", "title": "PostgreSQL version", "enum": ["16", "17"] },
+    "storageGB": { "type": "integer", "title": "Storage (GB)", "minimum": 20, "maximum": 1024 },
+    "highAvailability": { "type": "boolean", "title": "High availability", "default": false }
+  }
+}
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Team namespace",
+  "type": "object",
+  "required": ["team"],
+  "additionalProperties": false,
+  "properties": {
+    "name": { "type": "string", "title": "Name", "readOnly": true },
+    "owner": { "type": "string", "title": "Owner" },
+    "team": { "type": "string", "title": "Team", "pattern": "^[a-z][a-z0-9-]*$" },
+    "cpu": { "type": "string", "title": "CPU requests", "description": "The namespace's quota of CPU requests, such as 8 or 500m.", "pattern": "^[0-9]+m?$" },
+    "memory": { "type": "string", "title": "Memory requests", "description": "The namespace's quota of memory requests, such as 16Gi.", "pattern": "^[0-9]+(Mi|Gi)$" }
+  }
+}
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Flux sync",
+  "type": "object",
+  "required": ["path", "targetNamespace"],
+  "additionalProperties": false,
+  "properties": {
+    "name": { "type": "string", "title": "Name", "readOnly": true },
+    "owner": { "type": "string", "title": "Owner" },
+    "path": { "type": "string", "title": "Path", "description": "The directory of the platform repository that Flux applies.", "pattern": "^\\./" },
+    "targetNamespace": { "type": "string", "title": "Namespace", "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" },
+    "interval": { "type": "string", "title": "Interval", "enum": ["1m", "10m", "1h"] }
+  }
+}
				`@@ -0,0 +1 @@`
				`The shop team's namespace. Its quota is reviewed by the platform team.`