the existing infrastructure

2026-11-02 09:55:40 +00:00
commit aef641e978
55 changed files with 618 additions and 0 deletions
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: shop-admin
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.example.com/shop/admin.git
+    targetRevision: v1.4.0
+    path: deploy
+  destination:
+    namespace: shop
+    server: https://kubernetes.default.svc
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,7 @@
+name: shop-admin
+owner: bob
+repoURL: https://git.example.com/shop/admin.git
+path: deploy
+revision: v1.4.0
+namespace: shop
+autoSync: false
@@ -0,0 +1,5 @@
+# An Application on a tag of a team's repository, synced by hand.
+kind: create
+params: { name: shop-admin }
+owner: bob
+values: { repoURL: "https://git.example.com/shop/admin.git", path: deploy, revision: v1.4.0, namespace: shop, autoSync: false }
@@ -0,0 +1,7 @@
+# Deleting an Application removes its directory; its finalizer deletes what it deployed.
+kind: delete
+key: shop-web
+deleted:
+  - apps/shop-web/kustomization.yaml
+  - apps/shop-web/manifests.yaml
+  - apps/shop-web/quai.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: checkout
+  namespace: shop
+data:
+  provider: example-pay
+  timeout: 30s
@@ -0,0 +1,6 @@
+name: checkout
+namespace: shop
+owner: alice
+data:
+  provider: example-pay
+  timeout: 30s
@@ -0,0 +1,5 @@
+# A ConfigMap from the raw component.
+kind: create
+params: { namespace: shop, name: checkout }
+owner: alice
+values: { data: { provider: example-pay, timeout: 30s } }
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,15 @@
+apiVersion: database.example.org/v1alpha1
+kind: PostgreSQLInstance
+metadata:
+  name: payments
+  namespace: shop
+spec:
+  parameters:
+    highAvailability: false
+    storageGB: 20
+    version: "17"
+  compositionSelector:
+    matchLabels:
+      provider: example
+  writeConnectionSecretToRef:
+    name: payments-connection
@@ -0,0 +1,5 @@
+name: payments
+namespace: shop
+owner: carol
+version: "17"
+storageGB: 20
@@ -0,0 +1,5 @@
+# A claim of the platform's PostgreSQL API: high availability is off unless the form turns it on.
+kind: create
+params: { namespace: shop, name: payments }
+owner: carol
+values: { version: "17", storageGB: 20 }
@@ -0,0 +1,15 @@
+apiVersion: database.example.org/v1alpha1
+kind: PostgreSQLInstance
+metadata:
+  name: orders
+  namespace: shop
+spec:
+  parameters:
+    highAvailability: true
+    storageGB: 100 # about a year of orders
+    version: "17"
+  compositionSelector:
+    matchLabels:
+      provider: example
+  writeConnectionSecretToRef:
+    name: orders-connection
@@ -0,0 +1,6 @@
+name: orders
+namespace: shop
+owner: alice
+version: "17"
+storageGB: 100
+highAvailability: true
@@ -0,0 +1,4 @@
+# More storage for orders: one parameter of the claim changes, its comment stays.
+kind: update
+key: shop/orders
+values: { name: orders, namespace: shop, owner: alice, version: "17", storageGB: 100, highAvailability: true }
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: web
+  labels:
+    team: web
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: quota
+  namespace: web
+spec:
+  hard:
+    requests.cpu: "4"
+    requests.memory: 8Gi
@@ -0,0 +1,5 @@
+name: web
+owner: bob
+team: web
+cpu: "4"
+memory: 8Gi
@@ -0,0 +1,5 @@
+# A new team namespace: the record, the namespace and its quota, and a kustomization that lists them.
+kind: create
+params: { name: web }
+owner: bob
+values: { team: web, cpu: "4", memory: 8Gi }
@@ -0,0 +1,17 @@
+# The shop team: storefront, orders and payments.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: shop
+  labels:
+    team: shop
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: quota
+  namespace: shop
+spec:
+  hard:
+    requests.cpu: "12" # raised for the sales, see PLAT-142
+    requests.memory: 16Gi
@@ -0,0 +1,5 @@
+name: shop
+owner: alice
+team: shop
+cpu: "12"
+memory: 16Gi
@@ -0,0 +1,5 @@
+# More CPU for shop: the record and the quota change in place, the comments stay; the
+# kustomization and the README are left alone.
+kind: update
+key: shop
+values: { name: shop, owner: alice, team: shop, cpu: "12", memory: 16Gi }
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - manifests.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: web-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./policies/web
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: platform
+  targetNamespace: web
@@ -0,0 +1,4 @@
+name: web-policies
+owner: bob
+path: ./policies/web
+targetNamespace: web
@@ -0,0 +1,5 @@
+# A Flux Kustomization of the platform source, every ten minutes unless the form says otherwise.
+kind: create
+params: { name: web-policies }
+owner: bob
+values: { path: ./policies/web, targetNamespace: web }
@@ -0,0 +1,29 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: app
+  title: Application
+  description: An Argo CD Application that deploys a directory of a team's repository.
+  icon: rocket
+  category: Delivery
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "apps/{name}" }
+  params:
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,40}" }
+  schema: schemas/app.schema.json
+  generate:
+    kind: component
+    component: argocd.application
+    with:
+      name: ${{ params.name }}
+      repoURL: ${{ inputs.repoURL }}
+      path: ${{ inputs.path }}
+      targetRevision: ${{ inputs.?revision }}
+      destinationNamespace: ${{ inputs.namespace }}
+      automated: ${{ inputs.?autoSync.orValue(true) }}
+      syncOptions: [CreateNamespace=true]
+      cascadeDelete: true
+  ownership: { field: owner }
+  paramFields: { name: name }
+  deletion: allowed
@@ -0,0 +1,27 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: config
+  title: Configuration
+  description: Settings for an application, as a ConfigMap in its namespace.
+  icon: settings
+  category: Kubernetes
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "configs/{namespace}/{name}" }
+  params:
+    - { name: namespace, title: Namespace, type: enum, discover: true }
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,30}" }
+  schema: schemas/config.schema.json
+  generate:
+    kind: component
+    component: raw
+    with:
+      manifests:
+        - apiVersion: v1
+          kind: ConfigMap
+          metadata: { name: "${{ params.name }}", namespace: "${{ params.namespace }}" }
+          data: ${{ inputs.data }}
+  ownership: { field: owner }
+  paramFields: { name: name, namespace: namespace }
+  deletion: allowed
@@ -0,0 +1,37 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: database
+  title: PostgreSQL database
+  description: A managed PostgreSQL instance, claimed from the platform's Crossplane API.
+  icon: database
+  category: Data
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "databases/{namespace}/{name}" }
+  params:
+    - { name: namespace, title: Namespace, type: enum, discover: true }
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,30}" }
+  schema: schemas/database.schema.json
+  generate:
+    kind: component
+    component: crossplane.claim
+    with:
+      apiVersion: database.example.org/v1alpha1
+      kind: PostgreSQLInstance
+      name: ${{ params.name }}
+      namespace: ${{ params.namespace }}
+      spec:
+        parameters:
+          version: ${{ inputs.version }}
+          storageGB: ${{ inputs.storageGB }}
+          highAvailability: ${{ inputs.?highAvailability.orValue(false) }}
+        compositionSelector: { matchLabels: { provider: example } }
+        writeConnectionSecretToRef: { name: "${{ params.name }}-connection" }
+  ownership: { field: owner }
+  paramFields: { name: name, namespace: namespace }
+  deletion: approval
+  ui:
+    order: [version, storageGB, highAvailability]
+    fields:
+      version: { immutable: true }
@@ -0,0 +1,31 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: namespace
+  title: Team namespace
+  description: A team's namespace with a quota of CPU and memory requests.
+  icon: box
+  category: Kubernetes
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "namespaces/{name}" }
+  params:
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,30}" }
+  schema: schemas/namespace.schema.json
+  generate:
+    kind: component
+    component: k8s.namespace
+    with:
+      name: ${{ params.name }}
+      labels: { team: "${{ inputs.team }}" }
+      quota:
+        requests.cpu: ${{ inputs.?cpu }}
+        requests.memory: ${{ inputs.?memory }}
+  ownership: { field: owner }
+  paramFields: { name: name }
+  deletion: approval
+  approval:
+    rules:
+      - name: quota
+        when: inputs.?cpu != previous.?cpu || inputs.?memory != previous.?memory
+        approvers: [group:platform-admins]
@@ -0,0 +1,26 @@
+apiVersion: quai.dev/v1beta1
+kind: ResourceType
+metadata:
+  name: sync
+  title: Flux sync
+  description: A Flux Kustomization that applies a directory of the platform repository to a namespace.
+  icon: refresh
+  category: Delivery
+  version: 1.0.0
+spec:
+  locate: { strategy: dir, path: "flux/{name}" }
+  params:
+    - { name: name, title: Name, pattern: "[a-z][a-z0-9-]{1,40}" }
+  schema: schemas/sync.schema.json
+  generate:
+    kind: component
+    component: flux.kustomization
+    with:
+      name: ${{ params.name }}
+      source: platform
+      path: ${{ inputs.path }}
+      interval: ${{ inputs.?interval }}
+      targetNamespace: ${{ inputs.targetNamespace }}
+  ownership: { field: owner }
+  paramFields: { name: name }
+  deletion: approval