diff --git a/modules/ske/forgejo-connector/backplane/README.md b/modules/ske/forgejo-connector/backplane/README.md index d94e3806..b0b41b53 100644 --- a/modules/ske/forgejo-connector/backplane/README.md +++ b/modules/ske/forgejo-connector/backplane/README.md @@ -28,11 +28,11 @@ No resources. | [client\_key](#input\_client\_key) | Base64-encoded private key corresponding to the client certificate, used for authentication with the Kubernetes API server. | `string` | n/a | yes | | [cluster\_ca\_certificate](#input\_cluster\_ca\_certificate) | Base64-encoded certificate authority (CA) certificate used to verify the Kubernetes API server's identity. | `string` | n/a | yes | | [cluster\_host](#input\_cluster\_host) | The endpoint of the Kubernetes cluster. | `string` | n/a | yes | -| [cluster\_kubeconfig](#input\_cluster\_kubeconfig) | Raw kubeconfig content containing the configuration required to access and authenticate to the Kubernetes cluster. | `string` | n/a | yes | ## Outputs | Name | Description | |------|-------------| | [config\_tf](#output\_config\_tf) | Generates a config.tf that can be dropped into meshStack's BuildingBlockDefinition as an encrypted file input to configure this building block. | - \ No newline at end of file +| [kubeconfig\_cluster\_name](#output\_kubeconfig\_cluster\_name) | Cluster name to use when merging static kubeconfig and generated service-account credentials. | + diff --git a/modules/ske/forgejo-connector/backplane/outputs.tf b/modules/ske/forgejo-connector/backplane/outputs.tf index cb7b901a..326522c4 100644 --- a/modules/ske/forgejo-connector/backplane/outputs.tf +++ b/modules/ske/forgejo-connector/backplane/outputs.tf @@ -8,23 +8,10 @@ output "config_tf" { client_certificate = base64decode("${var.client_certificate}") client_key = base64decode("${var.client_key}") } - - locals { - stackit_kubeconfig_stub = { - apiVersion = "v1" - kind = "Config" - current-context = "stackit_k8s" - - clusters = [ - { - name = "stackit_k8s" - cluster = { - server = "${var.cluster_host}" - certificate-authority-data = "${var.cluster_ca_certificate}" - } - } - ] - } - } EOF -} \ No newline at end of file +} + +output "kubeconfig_cluster_name" { + description = "Cluster name to use when merging static kubeconfig and generated service-account credentials." + value = "stackit_k8s" +} diff --git a/modules/ske/forgejo-connector/backplane/variables.tf b/modules/ske/forgejo-connector/backplane/variables.tf index 83013d1f..08eaf08e 100644 --- a/modules/ske/forgejo-connector/backplane/variables.tf +++ b/modules/ske/forgejo-connector/backplane/variables.tf @@ -20,9 +20,3 @@ variable "client_key" { type = string sensitive = true } - -variable "cluster_kubeconfig" { - description = "Raw kubeconfig content containing the configuration required to access and authenticate to the Kubernetes cluster." - type = string - sensitive = true -} \ No newline at end of file diff --git a/modules/ske/forgejo-connector/buildingblock/README.md b/modules/ske/forgejo-connector/buildingblock/README.md index 396a213c..09f52164 100644 --- a/modules/ske/forgejo-connector/buildingblock/README.md +++ b/modules/ske/forgejo-connector/buildingblock/README.md @@ -55,27 +55,27 @@ No modules. | Name | Type | |------|------| -| [forgejo_repository_action_secret.additional](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | | [forgejo_repository_action_secret.container_registry](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | | [forgejo_repository_action_secret.kubeconfig](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | +| [forgejo_repository_action_secret.namespace](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | | [kubernetes_cluster_role_binding.forgejo_actions_clusterissuer_access](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/cluster_role_binding) | resource | | [kubernetes_role_binding.forgejo_actions](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/role_binding) | resource | | [kubernetes_secret.forgejo_actions](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/secret) | resource | | [kubernetes_secret.image_pull](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/secret) | resource | | [kubernetes_service_account.forgejo_actions](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/service_account) | resource | -| [forgejo_repository.this](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/data-sources/repository) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [additional\_environment\_variables](#input\_additional\_environment\_variables) | Map of additional environment variable key/value pairs to set as Forgejo repository action secrets. | `map(string)` | `{}` | no | -| [forgejo\_repository\_name](#input\_forgejo\_repository\_name) | The name of the Forgejo repository. | `string` | n/a | yes | -| [forgejo\_repository\_owner](#input\_forgejo\_repository\_owner) | The owner of the Forgejo repository. | `string` | n/a | yes | | [harbor\_host](#input\_harbor\_host) | The URL of the Harbor registry. | `string` | `"https://registry.onstackit.cloud"` | no | | [harbor\_password](#input\_harbor\_password) | The password for the Harbor registry. | `string` | n/a | yes | | [harbor\_username](#input\_harbor\_username) | The username for the Harbor registry. | `string` | n/a | yes | +| [kubeconfig](#input\_kubeconfig) | Static kubeconfig content of the SKE cluster. | `any` | n/a | yes | +| [kubeconfig\_cluster\_name](#input\_kubeconfig\_cluster\_name) | Cluster name used in merged kubeconfig context entries. | `string` | n/a | yes | | [namespace](#input\_namespace) | Associated namespace in kubernetes cluster. | `string` | n/a | yes | +| [repository\_id](#input\_repository\_id) | The ID of the Forgejo repository. | `string` | n/a | yes | +| [stage](#input\_stage) | Deployment stage used for secret suffixing (`dev` or `prod`). | `string` | n/a | yes | ## Outputs diff --git a/modules/ske/forgejo-connector/buildingblock/forgejo.tf b/modules/ske/forgejo-connector/buildingblock/forgejo.tf index 1498319f..e55d29c8 100644 --- a/modules/ske/forgejo-connector/buildingblock/forgejo.tf +++ b/modules/ske/forgejo-connector/buildingblock/forgejo.tf @@ -1,5 +1,9 @@ locals { + stage_suffix = upper(var.stage) + kubeconfig_user = { + current-context = var.kubeconfig_cluster_name + users = [ { name = kubernetes_service_account.forgejo_actions.metadata[0].name @@ -11,29 +15,30 @@ locals { contexts = [ { - name = "stackit_k8s" + name = var.kubeconfig_cluster_name context = { - cluster = "stackit_k8s" + cluster = var.kubeconfig_cluster_name namespace = var.namespace user = kubernetes_service_account.forgejo_actions.metadata[0].name } } ] } - kubeconfig = merge(local.stackit_kubeconfig_stub, local.kubeconfig_user) -} - -data "forgejo_repository" "this" { - name = var.forgejo_repository_name - owner = var.forgejo_repository_owner + kubeconfig = merge(var.kubeconfig, local.kubeconfig_user) } resource "forgejo_repository_action_secret" "kubeconfig" { - repository_id = data.forgejo_repository.this.id - name = "KUBECONFIG" + repository_id = var.repository_id + name = "KUBECONFIG_${local.stage_suffix}" data = yamlencode(local.kubeconfig) } +resource "forgejo_repository_action_secret" "namespace" { + repository_id = var.repository_id + name = "K8S_NAMESPACE_${local.stage_suffix}" + data = var.namespace +} + resource "forgejo_repository_action_secret" "container_registry" { for_each = { HOST = var.harbor_host @@ -41,15 +46,7 @@ resource "forgejo_repository_action_secret" "container_registry" { PASSWORD = var.harbor_password } - repository_id = data.forgejo_repository.this.id + repository_id = var.repository_id name = "STACKIT_HARBOR_${each.key}" data = each.value } - -resource "forgejo_repository_action_secret" "additional" { - for_each = var.additional_environment_variables - - repository_id = data.forgejo_repository.this.id - name = each.key - data = each.value -} \ No newline at end of file diff --git a/modules/ske/forgejo-connector/buildingblock/kubernetes.tf b/modules/ske/forgejo-connector/buildingblock/kubernetes.tf index dae6cb31..f57e3be8 100644 --- a/modules/ske/forgejo-connector/buildingblock/kubernetes.tf +++ b/modules/ske/forgejo-connector/buildingblock/kubernetes.tf @@ -65,12 +65,12 @@ resource "kubernetes_secret" "image_pull" { data = { ".dockerconfigjson" = jsonencode({ auths = { - "${local.harbor.host}" = { - username = local.harbor.username - password = local.harbor.password - auth = base64encode("${local.harbor.username}:${local.harbor.password}") + "${var.harbor_host}" = { + username = var.harbor_username + password = var.harbor_password + auth = base64encode("${var.harbor_username}:${var.harbor_password}") } } }) } -} \ No newline at end of file +} diff --git a/modules/ske/forgejo-connector/buildingblock/variables.tf b/modules/ske/forgejo-connector/buildingblock/variables.tf index 537e202d..f62fae60 100644 --- a/modules/ske/forgejo-connector/buildingblock/variables.tf +++ b/modules/ske/forgejo-connector/buildingblock/variables.tf @@ -4,6 +4,17 @@ variable "harbor_host" { default = "https://registry.onstackit.cloud" } +variable "kubeconfig" { + type = any + description = "Static kubeconfig content of the SKE cluster." + sensitive = true +} + +variable "kubeconfig_cluster_name" { + type = string + description = "Cluster name used in merged kubeconfig context entries." +} + variable "harbor_username" { type = string description = "The username for the Harbor registry." @@ -16,23 +27,22 @@ variable "harbor_password" { sensitive = true } -variable "forgejo_repository_name" { +variable "repository_id" { type = string - description = "The name of the Forgejo repository." + description = "The ID of the Forgejo repository." } -variable "forgejo_repository_owner" { +variable "stage" { type = string - description = "The owner of the Forgejo repository." -} + description = "Deployment stage used for secret suffixing (`dev` or `prod`)." -variable "additional_environment_variables" { - type = map(string) - description = "Map of additional environment variable key/value pairs to set as Forgejo repository action secrets." - default = {} + validation { + condition = can(regex("^(dev|prod)$", var.stage)) + error_message = "stage must be either 'dev' or 'prod'." + } } variable "namespace" { description = "Associated namespace in kubernetes cluster." type = string -} \ No newline at end of file +} diff --git a/modules/ske/forgejo-connector/meshstack_integration.tf b/modules/ske/forgejo-connector/meshstack_integration.tf index 9511809a..f3a8d282 100644 --- a/modules/ske/forgejo-connector/meshstack_integration.tf +++ b/modules/ske/forgejo-connector/meshstack_integration.tf @@ -1,11 +1,10 @@ -# This file is an example showing how to register the STACKIT connector -# building block in a meshStack instance. +# This file registers the SKE Forgejo connector building block definition. terraform { required_providers { meshstack = { source = "meshcloud/meshstack" - version = "~> 0.19.0" + version = "~> 0.20.0" } } } @@ -48,6 +47,11 @@ variable "forgejo_api_token" { sensitive = true } +variable "forgejo_repo_definition_uuid" { + type = string + description = "UUID of the Forgejo repository building block definition used as parent dependency." +} + variable "harbor_host" { type = string description = "The URL of the Harbor registry." @@ -66,11 +70,6 @@ variable "harbor_password" { sensitive = true } -variable "forgejo_repo_definition_uuid" { - type = string - description = "The Building Block definition UUID of the repository parent." -} - variable "meshstack" { type = object({ owning_workspace_identifier = string @@ -91,16 +90,15 @@ variable "hub" { output "building_block_definition_version_ref" { value = var.hub.bbd_draft ? meshstack_building_block_definition.this.version_latest : meshstack_building_block_definition.this.version_latest_release - description = "Version of BBD is consumed in Building Block compositions, for example in the backplane of starter kits." + description = "Version of BBD is consumed in building block compositions." } module "backplane" { source = "./backplane" cluster_host = var.cluster_host - cluster_ca_certificate = var.client_certificate + cluster_ca_certificate = var.cluster_ca_certificate client_key = var.client_key client_certificate = var.client_certificate - cluster_kubeconfig = var.cluster_kubeconfig } resource "meshstack_building_block_definition" "this" { @@ -109,12 +107,13 @@ resource "meshstack_building_block_definition" "this" { } spec = { - display_name = "STACKIT connector" - symbol = "data:image/png;base64,${filebase64("${path.module}/buildingblock/logo.png")}" - description = "Forgejo Actions Integration with STACKIT Kubernetes" - support_url = "https://portal.stackit.cloud/git" - target_type = "WORKSPACE_LEVEL" - run_transparency = true + display_name = "SKE Forgejo Connector" + symbol = "https://raw.githubusercontent.com/meshcloud/meshstack-hub/${var.hub.git_ref}/modules/ske/forgejo-connector/buildingblock/logo.png" + description = "Connects a Forgejo repository with a tenant namespace on STACKIT SKE." + support_url = "https://portal.stackit.cloud/git" + target_type = "TENANT_LEVEL" + supported_platforms = [{ name = "STACKIT_KUBERNETES_ENGINE" }] + run_transparency = true } version_spec = { @@ -125,26 +124,25 @@ resource "meshstack_building_block_definition" "this" { terraform = { terraform_version = "1.9.0" repository_url = "https://github.com/meshcloud/meshstack-hub.git" - repository_path = "modules/stackit/git-connector/buildingblock" + repository_path = "modules/ske/forgejo-connector/buildingblock" ref_name = var.hub.git_ref async = false use_mesh_http_backend_fallback = true } } - dependency_refs = [{ uuid = "${var.forgejo_repo_definition_uuid}" }] + dependency_refs = [{ uuid = var.forgejo_repo_definition_uuid }] inputs = { - # ── Static inputs from backplane ────────────────────────────────────── - config_tf = { - display_name = "config_k8s" - description = "Static config for kubernetes" + "config.tf" = { + display_name = "config.tf" + description = "Static Kubernetes provider config and kubeconfig stub." type = "FILE" assignment_type = "STATIC" - is_environment = true sensitive = { argument = { - secret_value = jsonencode(module.backplane.config_tf) + secret_value = "data:application/octet-stream;base64,${base64encode(module.backplane.config_tf)}" + secret_version = sha256(module.backplane.config_tf) } } } @@ -157,7 +155,8 @@ resource "meshstack_building_block_definition" "this" { is_environment = true sensitive = { argument = { - secret_value = jsonencode(var.forgejo_host) + secret_value = jsonencode(var.forgejo_host) + secret_version = sha256(jsonencode(var.forgejo_host)) } } } @@ -170,7 +169,8 @@ resource "meshstack_building_block_definition" "this" { is_environment = true sensitive = { argument = { - secret_value = jsonencode(var.forgejo_api_token) + secret_value = jsonencode(var.forgejo_api_token) + secret_version = sha256(jsonencode(var.forgejo_api_token)) } } } @@ -183,12 +183,38 @@ resource "meshstack_building_block_definition" "this" { argument = jsonencode(var.harbor_host) } + kubeconfig = { + display_name = "kubeconfig" + description = "Static cluster kubeconfig content merged with generated service-account credentials." + type = "CODE" + assignment_type = "STATIC" + sensitive = { + argument = { + secret_value = jsonencode(yamldecode(var.cluster_kubeconfig)) + secret_version = sha256(var.cluster_kubeconfig) + } + } + } + + kubeconfig_cluster_name = { + display_name = "kubeconfig_cluster_name" + description = "Cluster name used to connect static kubeconfig and generated user/context entries." + type = "STRING" + assignment_type = "STATIC" + argument = jsonencode(module.backplane.kubeconfig_cluster_name) + } + harbor_username = { display_name = "harbor_username" description = "The username for the Harbor registry." type = "STRING" assignment_type = "STATIC" - argument = jsonencode(var.harbor_username) + sensitive = { + argument = { + secret_value = jsonencode(var.harbor_username) + secret_version = sha256(jsonencode(var.harbor_username)) + } + } } harbor_password = { @@ -198,38 +224,40 @@ resource "meshstack_building_block_definition" "this" { assignment_type = "STATIC" sensitive = { argument = { - secret_value = jsonencode(var.harbor_password) + secret_value = jsonencode(var.harbor_password) + secret_version = sha256(jsonencode(var.harbor_password)) } } } - forgejo_repository_name = { - display_name = "forgejo_repository_name" - description = "The name of the Forgejo repository." + repository_id = { + display_name = "repository_id" + description = "ID of the parent Forgejo repository where action secrets are created." type = "STRING" assignment_type = "BUILDING_BLOCK_OUTPUT" - argument = "${var.forgejo_repo_definition_uuid}.repo_name" + argument = jsonencode("${var.forgejo_repo_definition_uuid}.repository_id") } - forgejo_repository_owner = { - display_name = "forgejo_repository_owner" - description = "The owner of the Forgejo repository." - type = "STRING" - assignment_type = "BUILDING_BLOCK_OUTPUT" - argument = "${var.forgejo_repo_definition_uuid}.repo_owner" - } - - # ── User inputs ──────────────────────────────────────────────────────── - namespace = { display_name = "namespace" description = "Associated namespace in kubernetes cluster." type = "STRING" - assignment_type = "USER_INPUT" + assignment_type = "PLATFORM_TENANT_ID" + } + + stage = { + display_name = "stage" + description = "Deployment stage used for secret suffixing (`dev` or `prod`)." + type = "STRING" + assignment_type = "USER_INPUT" + value_validation_regex = "^(dev|prod)$" + validation_regex_error_message = "Stage must be either 'dev' or 'prod'." } - } - outputs = { } + + outputs = {} + + permissions = ["TENANT_LIST", "TENANT_SAVE", "TENANT_DELETE"] } } diff --git a/modules/ske/ske-starterkit/backplane/main.tf b/modules/ske/ske-starterkit/backplane/main.tf deleted file mode 100644 index 4221baac..00000000 --- a/modules/ske/ske-starterkit/backplane/main.tf +++ /dev/null @@ -1,42 +0,0 @@ -variable "meshstack" { - type = object({ - owning_workspace_identifier = string - }) -} - -variable "hub" { - type = object({ - git_ref = string - bbd_draft = bool - }) -} - -variable "forgejo_token" { - type = string - sensitive = true -} - -variable "forgejo_organization" { - type = string -} - -variable "forgejo_base_url" { - type = string -} - -output "building_block_definition_version_refs" { - value = { - "git-repository" : module.git_repository.building_block_definition_version_ref - } -} - -module "git_repository" { - source = "github.com/meshcloud/meshstack-hub//modules/stackit/git-repository?ref=2e990f277119f33db50af78032768c434ab4b7bb" - - meshstack = var.meshstack - hub = var.hub - - forgejo_token = var.forgejo_token - forgejo_organization = var.forgejo_organization - forgejo_base_url = var.forgejo_base_url -} diff --git a/modules/ske/ske-starterkit/buildingblock/README.md b/modules/ske/ske-starterkit/buildingblock/README.md index 351e0e13..acbf4e59 100644 --- a/modules/ske/ske-starterkit/buildingblock/README.md +++ b/modules/ske/ske-starterkit/buildingblock/README.md @@ -24,6 +24,7 @@ No modules. | Name | Type | |------|------| +| [meshstack_building_block_v2.forgejo_connector](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_v2) | resource | | [meshstack_building_block_v2.git_repository](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_v2) | resource | | [meshstack_project.this](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/project) | resource | | [meshstack_project_user_binding.creator_to_admin](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/project_user_binding) | resource | @@ -34,11 +35,11 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [building\_block\_definition\_version\_refs](#input\_building\_block\_definition\_version\_refs) | n/a | `map(object({ uuid = string }))` | n/a | yes | -| [creator](#input\_creator) | Information about the creator of the resources who will be assigned Project Admin role | 
object({
    type        = string
    identifier  = string
    displayName = string
    username    = optional(string)
    email       = optional(string)
    euid        = optional(string)
  })
| n/a | yes | +| [creator](#input\_creator) | Information about the creator of the resources who will be assigned Project Admin role | 
object({
    type        = string
    identifier  = string
    displayName = string
    username    = optional(string)
    email       = optional(string)
    euid        = optional(string)
  })
| n/a | yes | | [full\_platform\_identifier](#input\_full\_platform\_identifier) | Full platform identifier of the SKE platform. | `string` | n/a | yes | -| [landing\_zone\_identifiers](#input\_landing\_zone\_identifiers) | SKE Landing zone identifiers for the dev/prod meshTenant. | 
object({
    dev  = string
    prod = string
  })
| n/a | yes | +| [landing\_zone\_identifiers](#input\_landing\_zone\_identifiers) | SKE Landing zone identifiers for the dev/prod meshTenant. | 
object({
    dev  = string
    prod = string
  })
| n/a | yes | | [name](#input\_name) | This name will be used for the created projects. | `string` | n/a | yes | -| [project\_tags](#input\_project\_tags) | Tags for dev/prod meshProject. | 
object({
    dev : map(list(string))
    prod : map(list(string))

    owner_tag_key = optional(string, null)
  })
| n/a | yes | +| [project\_tags](#input\_project\_tags) | Tags for dev/prod meshProject. | 
object({
    dev : map(list(string))
    prod : map(list(string))

    owner_tag_key = optional(string, null)
  })
| n/a | yes | | [repo\_clone\_addr](#input\_repo\_clone\_addr) | URL to clone into the starterkit git repository. | `string` | n/a | yes | | [workspace\_identifier](#input\_workspace\_identifier) | n/a | `string` | n/a | yes | diff --git a/modules/ske/ske-starterkit/buildingblock/main.tf b/modules/ske/ske-starterkit/buildingblock/main.tf index 1a8801a4..5b166344 100644 --- a/modules/ske/ske-starterkit/buildingblock/main.tf +++ b/modules/ske/ske-starterkit/buildingblock/main.tf @@ -66,3 +66,30 @@ resource "meshstack_tenant_v4" "this" { landing_zone_identifier = each.value } } + +resource "meshstack_building_block_v2" "forgejo_connector" { + for_each = meshstack_tenant_v4.this + + spec = { + building_block_definition_version_ref = var.building_block_definition_version_refs["forgejo-connector"] + + display_name = "${var.name} Forgejo Connector ${upper(each.key)}" + target_ref = { + kind = "meshTenant" + uuid = each.value.metadata.uuid + } + + parent_building_blocks = [{ + buildingblock_uuid = meshstack_building_block_v2.git_repository.metadata.uuid + definition_uuid = meshstack_building_block_v2.git_repository.spec.building_block_definition_version_ref.uuid + }] + + inputs = { + stage = { + value_string = each.key + } + } + } + + wait_for_completion = true +} diff --git a/modules/ske/ske-starterkit/meshstack_integration.tf b/modules/ske/ske-starterkit/meshstack_integration.tf index b2304344..095fb109 100644 --- a/modules/ske/ske-starterkit/meshstack_integration.tf +++ b/modules/ske/ske-starterkit/meshstack_integration.tf @@ -4,19 +4,6 @@ variable "meshstack" { }) } -variable "forgejo_token" { - type = string - sensitive = true -} - -variable "forgejo_organization" { - type = string -} - -variable "forgejo_base_url" { - type = string -} - variable "full_platform_identifier" { type = string } @@ -55,6 +42,13 @@ variable "notification_subscribers" { default = [] } +variable "building_block_definition_version_refs" { + type = map(object({ + content_hash = string # adding the content nicely tracks changes in dependent BBDs (draft mode) + uuid = string + })) +} + variable "hub" { type = object({ git_ref = optional(string, "main") @@ -67,17 +61,6 @@ variable "hub" { EOT } -module "backplane" { - source = "./backplane" # TODO revert to github.com/meshcloud/meshstack-hub//modules/ske/ske-starterkit/backplane link once pushed - - meshstack = var.meshstack - hub = var.hub - - forgejo_token = var.forgejo_token - forgejo_organization = var.forgejo_organization - forgejo_base_url = var.forgejo_base_url -} - locals { name_regex = "^[a-zA-Z0-9-]+$" # underscore and dots not allowed because of K8s namespace } @@ -204,7 +187,20 @@ EOT description = "Refs used to create auxiliary building blocks (composition)." display_name = "BBD Version Refs" # jsonencode twice is correct, see https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_definition#argument-1 - argument = jsonencode(jsonencode(module.backplane.building_block_definition_version_refs)) + argument = jsonencode(jsonencode(var.building_block_definition_version_refs)) + }, + # TODO remove before merge, leftover from dev attempts in grubinator2 instance + "git_repository_action_secrets" = { + assignment_type = "STATIC" + type = "CODE" + description = "REMOVEME Static sensitive Forgejo Actions secrets passed to the composed git-repository building block." + display_name = "REMOVEME Git Repository Action Secrets" + # jsonencode twice is correct, see https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_definition#argument-1 + sensitive = { + argument = { + secret_value = jsonencode({}) + } + } } } diff --git a/modules/stackit/git-repository/README.md b/modules/stackit/git-repository/README.md index a1fecd14..ec502005 100644 --- a/modules/stackit/git-repository/README.md +++ b/modules/stackit/git-repository/README.md @@ -14,6 +14,7 @@ It combines: - workspace-level target type - static inputs from backplane (`forgejo_base_url`, `forgejo_token`, `forgejo_organization`) +- optional static sensitive action secrets (`action_secrets`) - user inputs (`name`, `description`, `private`, `clone_addr`) - outputs exposed to users (`repository_html_url`, `repository_clone_url`, `repository_ssh_url`, `summary`) diff --git a/modules/stackit/git-repository/buildingblock/README.md b/modules/stackit/git-repository/buildingblock/README.md index 8ff4c960..92c494f7 100644 --- a/modules/stackit/git-repository/buildingblock/README.md +++ b/modules/stackit/git-repository/buildingblock/README.md @@ -22,12 +22,14 @@ No modules. | Name | Type | |------|------| | [forgejo_repository.repository](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository) | resource | +| [forgejo_repository_action_secret.action_secrets](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [clone\_addr](#input\_clone\_addr) | Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty to create an empty repository. | `string` | `""` | no | +| [action\_secrets](#input\_action\_secrets) | Map of Forgejo Actions secrets to create in the repository. | `map(string)` | `{}` | no | +| [clone\_addr](#input\_clone\_addr) | Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty or `null` to create an empty repository. | `string` | `"null"` | no | | [default\_branch](#input\_default\_branch) | Default branch name | `string` | `"main"` | no | | [description](#input\_description) | Short description of the repository | `string` | `""` | no | | [forgejo\_base\_url](#input\_forgejo\_base\_url) | STACKIT Git base URL | `string` | `"https://git-service.git.onstackit.cloud"` | no | diff --git a/modules/stackit/git-repository/buildingblock/main.tf b/modules/stackit/git-repository/buildingblock/main.tf index d4b02a13..b00d0e4d 100644 --- a/modules/stackit/git-repository/buildingblock/main.tf +++ b/modules/stackit/git-repository/buildingblock/main.tf @@ -1,4 +1,6 @@ -# ── Repository ───────────────────────────────────────────────────────────────── +locals { + have_clone_addr = trimspace(var.clone_addr) != "" && var.clone_addr != "null" +} resource "forgejo_repository" "repository" { owner = var.forgejo_organization @@ -6,9 +8,17 @@ resource "forgejo_repository" "repository" { description = var.description private = var.private default_branch = var.default_branch - auto_init = var.clone_addr == "" + auto_init = !local.have_clone_addr # One-time clone (not an ongoing mirror) - clone_addr = var.clone_addr != "" ? var.clone_addr : null + clone_addr = local.have_clone_addr ? var.clone_addr : null mirror = false } + +resource "forgejo_repository_action_secret" "action_secrets" { + for_each = var.action_secrets + + repository_id = forgejo_repository.repository.id + name = each.key + data = each.value +} diff --git a/modules/stackit/git-repository/buildingblock/variables.tf b/modules/stackit/git-repository/buildingblock/variables.tf index d9a843a9..c0ca2012 100644 --- a/modules/stackit/git-repository/buildingblock/variables.tf +++ b/modules/stackit/git-repository/buildingblock/variables.tf @@ -17,6 +17,18 @@ variable "forgejo_organization" { description = "STACKIT Git organization where the repository will be created" } +variable "action_secrets" { + type = map(string) + description = "Map of Forgejo Actions secrets to create in the repository." + sensitive = false # the whole map is not sensitive, but map values are! + default = {} + + validation { + condition = alltrue([for key in keys(var.action_secrets) : length(key) <= 30]) + error_message = "Forgejo Actions secret names must be 30 characters or less." + } +} + # ── User inputs (set per building block instance) ───────────────────────────── variable "name" { @@ -51,6 +63,6 @@ variable "default_branch" { variable "clone_addr" { type = string - description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty to create an empty repository." - default = "" + description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty or `null` to create an empty repository." + default = "null" # supporting the null string is a workaround for the Panel UI which does not support empty string as default for optional value } diff --git a/modules/stackit/git-repository/meshstack_integration.tf b/modules/stackit/git-repository/meshstack_integration.tf index a071a198..16b554e7 100644 --- a/modules/stackit/git-repository/meshstack_integration.tf +++ b/modules/stackit/git-repository/meshstack_integration.tf @@ -21,6 +21,17 @@ variable "forgejo_base_url" { type = string } +variable "action_secrets" { + type = map(string) + sensitive = false # the whole map is not sensitive, but map values are! + default = {} + + validation { + condition = alltrue([for key in keys(var.action_secrets) : length(key) <= 30]) + error_message = "Forgejo Actions secret names must be 30 characters or less." + } +} + variable "hub" { type = object({ git_ref = optional(string, "main") @@ -38,6 +49,11 @@ output "building_block_definition_version_ref" { description = "Version of BBD is consumed in Building Block compositions, for example in the backplane of starter kits." } +output "building_block_definition_uuid" { + value = meshstack_building_block_definition.this.ref.uuid + description = "UUID of the STACKIT Git Repository building block definition." +} + module "backplane" { source = "github.com/meshcloud/meshstack-hub//modules/stackit/git-repository/backplane?ref=a3843c80c76c4a0298769eea8d93807bb2b271fc" @@ -135,10 +151,22 @@ resource "meshstack_building_block_definition" "this" { clone_addr = { display_name = "Clone from URL" - description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty to create an empty repository." + description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave `null` to create an empty repository." type = "STRING" assignment_type = "USER_INPUT" - default_value = jsonencode("") + default_value = jsonencode("null") + } + action_secrets = { + display_name = "Repository Action Secrets" + description = "Static sensitive map of Forgejo Actions secrets created in each provisioned repository." + type = "CODE" + assignment_type = "STATIC" + sensitive = { + argument = { + secret_value = jsonencode(var.action_secrets) + secret_version = nonsensitive(sha256(jsonencode(var.action_secrets))) + } + } } }