some examples with abstractions

daanvinken · Nov 11, 2024 · ddcef4a · ddcef4a
1 parent b0de66d
commit ddcef4a
Show file tree

Hide file tree

Showing 16 changed files with 520 additions and 9 deletions.
diff --git a/cluster/images/provider-consul/Dockerfile b/cluster/images/provider-consul/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.17.1
+FROM alpine:3.20.3
 RUN apk --no-cache add ca-certificates bash
 
 ARG TARGETOS
@@ -26,8 +26,10 @@ ENV TF_FORK 0
 
 RUN mkdir -p ${PLUGIN_DIR}
 
-ADD https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip /tmp
-ADD ${TERRAFORM_PROVIDER_DOWNLOAD_URL_PREFIX}/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip /tmp
+RUN echo "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip -O /tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip"
+RUN echo "${TERRAFORM_PROVIDER_DOWNLOAD_URL_PREFIX}/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip -O /tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip"; exit  1;
+RUN wget https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip -O /tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip
+RUN wget ${TERRAFORM_PROVIDER_DOWNLOAD_URL_PREFIX}/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip -O /tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip
 ADD terraformrc.hcl ${TF_CLI_CONFIG_FILE}
 
 RUN unzip /tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip -d /usr/local/bin \

diff --git a/examples-generated/acl/v1alpha1/policy.yaml b/examples-generated/acl/v1alpha1/policy.yaml
@@ -12,6 +12,6 @@ spec:
     - dc1
     name: my_policy
     rules: |
-      node_prefix "" {
-        policy = "read"
-      }
+        node_prefix "" {
+          policy = "read"
+        }
diff --git a/examples/abstractionsv2/consulagent.yaml b/examples/abstractionsv2/consulagent.yaml
diff --git a/examples/abstractionsv2/serviceACL/composition.yaml b/examples/abstractionsv2/serviceACL/composition.yaml
@@ -0,0 +1,192 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: consulserviceacl.composite.daanvinken
+spec:
+  compositeTypeRef:
+    apiVersion: daanvinken.io/v1alpha1
+    kind: ConsulServiceACL
+  resources:
+    # Consul ACL Policy Resource
+    - name: consul_acl_policy
+      base:
+        apiVersion: acl.daanvinken.io/v1alpha1
+        kind: Policy
+        metadata:
+          generateName: "policy-"
+          labels:
+            crossplane.io/composite: "consulserviceacl"
+        spec:
+          forProvider:
+            datacenters:
+              - ""  # Patch dynamically
+            rules: ""  # Inject full policy dynamically
+      patches:
+        - fromFieldPath: "spec.parameters.dc"
+          toFieldPath: "spec.forProvider.datacenters[0]"
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.name"
+          transforms:
+            - type: string
+              string:
+                fmt: "policy-%s"
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.rules"
+          transforms:
+            - type: string
+              string:
+                fmt: |
+                  agent_prefix "" {
+                    policy = "read"
+                  }
+                  service_prefix "" {
+                    policy = "read"
+                  }
+                  service_prefix "%[1]s" {
+                    policy = "write"
+                  }
+                  key_prefix "%[1]s" {
+                    policy = "write"
+                  }
+                  key_prefix "app/%[1]s" {
+                    policy = "write"
+                  }
+                  session_prefix "" {
+                    policy = "write"
+                  }
+                  session_prefix "session/%[1]s" {
+                    policy = "write"
+                  }
+                  key_prefix "preloader/%[1]s" {
+                    policy = "write"
+                  }
+
+    # Vault Consul Secret Backend Role
+    - name: consul_secret_backend_role
+      base:
+        apiVersion: consul.vault.upbound.io/v1alpha1
+        kind: SecretBackendRole
+        metadata:
+          generateName: "backend-role-"
+        spec:
+          forProvider:
+            backend: ""  # Patch backend path dynamically
+            policies:
+              - "policy-placeholder"  # Reference policy dynamically
+      patches:
+        - fromFieldPath: "spec.parameters.consul_backend_path"
+          toFieldPath: "spec.forProvider.backend"
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.name"
+          transforms:
+            - type: string
+              string:
+                fmt: "service_ref_%[1]s"
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.policies[0]"
+          transforms:
+            - type: string
+              string:
+                fmt: "policy-%[1]s"
+
+    # Consul ACL Role Resource
+    - name: consul_acl_role
+      base:
+        apiVersion: acl.daanvinken.io/v1alpha1
+        kind: Role
+        metadata:
+          generateName: "role-"
+        spec:
+          forProvider:
+            description: "ACL Role for service"
+            serviceIdentities:
+              - serviceName: "foo"
+      patches:
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.name"
+          transforms:
+            - type: string
+              string:
+                fmt: "role-%[1]s"
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.policies[0]"
+          transforms:
+            - type: string
+              string:
+                fmt: "policy-%[1]s"
+
+    # Vault Policy Resource
+    - name: vault_policy
+      base:
+        apiVersion: vault.vault.upbound.io/v1alpha1
+        kind: Policy
+        metadata:
+          generateName: "vault-policy-"
+        spec:
+          forProvider:
+            name: ""  # Patch dynamically
+            policy: ""  # Inject full policy dynamically
+      patches:
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.name"
+          transforms:
+            - type: string
+              string:
+                fmt: "policy_consul_service_ref_%[1]s"
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.policy"
+          transforms:
+            - type: string
+              string:
+                fmt: |
+                  path "consul/creds/service_ref_%[1]s" {
+                    capabilities = ["read"]
+                  }
+
+                  path "secrets/creds/service_ref_%[1]s" {
+                    capabilities = ["read"]
+                  }
+
+                  path "secrets-kv2/data/service/%[1]s/*" {
+                    capabilities = ["read"]
+                  }
+
+                  path "something/v1/ica1/v1/issue/%[1]s" {
+                    capabilities = ["create", "update"]
+                  }
+
+                  path "containersinfra/v1/ica2/v1/issue/%[1]s" {
+                    capabilities = ["create", "update"]
+                  }
+
+                  path "transit/encrypt/something-main_%[1]s" {
+                    capabilities = ["update"]
+                  }
+
+                  path "transit/decrypt/something-main_%[1]s" {
+                    capabilities = ["update"]
+                  }
+
+    # Consul ACL Token Resource
+    - name: consul_acl_token
+      base:
+        apiVersion: acl.daanvinken.io/v1alpha1
+        kind: Token
+        metadata:
+          generateName: "token-"
+        spec:
+          forProvider:
+            description: "Generated by Crossplane"
+      patches:
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.name"
+          transforms:
+            - type: string
+              string:
+                fmt: "role-%[1]s"
+        - fromFieldPath: "metadata.name"
+          toFieldPath: "spec.forProvider.policies[0]"
+          transforms:
+            - type: string
+              string:
+                fmt: "policy-%[1]s"
diff --git a/examples/abstractionsv2/serviceACL/example-2.yaml b/examples/abstractionsv2/serviceACL/example-2.yaml
@@ -0,0 +1,8 @@
+apiVersion: daanvinken.io/v1alpha1
+kind: ConsulServiceACL
+metadata:
+  name: acr-main
+spec:
+  parameters:
+    consul_backend_path: "consul"
+    dc: "AMS3"
diff --git a/examples/abstractionsv2/serviceACL/example.yaml b/examples/abstractionsv2/serviceACL/example.yaml
@@ -0,0 +1,8 @@
+apiVersion: daanvinken.io/v1alpha1
+kind: ConsulServiceACL
+metadata:
+  name: system-logsearch
+spec:
+  parameters:
+    consul_backend_path: "consul"
+    dc: "AMS2"
diff --git a/examples/abstractionsv2/serviceACL/tmp/test.yaml b/examples/abstractionsv2/serviceACL/tmp/test.yaml
@@ -0,0 +1,53 @@
+apiVersion: acl.daanvinken.io/v1alpha1
+kind: Policy
+metadata:
+  name: policy-my-service
+spec:
+  forProvider:
+    name: "policy-my-service"  # Unique policy name
+    datacenters:
+      - "AMS2"                 # Specify the data center
+    rules: |
+      agent_prefix "" {
+        policy = "read"
+      }
+
+      service_prefix "" {
+        policy = "read"
+      }
+
+      service_prefix "my-service" {
+        policy = "write"
+      }
+
+      key_prefix "my-service" {
+        policy = "write"
+      }
+
+      key_prefix "app/my-service" {
+        policy = "write"
+      }
+
+      session_prefix "" {
+        policy = "write"
+      }
+
+      session_prefix "session/my-service" {
+        policy = "write"
+      }
+
+      key_prefix "preloader/my-service" {
+        policy = "write"
+      }
+---
+apiVersion: consul.vault.upbound.io/v1alpha1
+kind: SecretBackendRole
+metadata:
+  name: example-consul-backend-role
+spec:
+  forProvider:
+    backend: "consul"  # The backend path for Consul secrets in Vault
+    name: "service_ref_my-service"      # Unique name for the backend role, typically linked to a specific service
+    policies:
+      - "policy-my-service"             # Consul ACL policy to associate with this role
+
diff --git a/examples/abstractionsv2/serviceACL/xrd.yaml b/examples/abstractionsv2/serviceACL/xrd.yaml
@@ -0,0 +1,38 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: CompositeResourceDefinition
+metadata:
+  name: consulserviceacls.daanvinken.io
+spec:
+  group: daanvinken.io
+  names:
+    kind: ConsulServiceACL
+    plural: consulserviceacls
+    shortNames:
+      - csa
+  claimNames:
+    kind: ConsulServiceACL
+    plural: consulserviceacls
+  versions:
+    - name: v1alpha1
+      served: true
+      referenceable: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                parameters:
+                  type: object
+                  properties:
+                    consul_backend_path:
+                      type: string
+                      description: "Backend path for the Consul secrets in Vault."
+                    dc:
+                      type: string
+                      description: "Data center name for the Consul ACL."
+                  required:
+                    - consul_backend_path
+                    - dc
+
diff --git a/examples/openstack/abstractions/adyencompute.yaml b/examples/openstack/abstractions/adyencompute.yaml
@@ -0,0 +1,19 @@
+apiVersion: daanvinken.io/v1alpha1
+kind: AdyenCompute
+metadata:
+  name: adyencompute-example-mvp
+spec:
+  parameters:
+    computeInstanceName: "crossplane-instance-mvp"
+    imageName: "cirros"
+    flavorName: "1C-500M-1G-STG1-CIRROS"
+    network:
+      - name: osstg1test
+    securityGroups:
+      - default
+    consulServices:
+      - serviceName: service3
+        main_keys: true
+      - serviceName: service4
+        main_keys: false
+    providerConfigName: "openstack-ams2-nonprod"