feat: onboard unleash (#650)

* feat: started unleash onboarding

* feat: add oidc

* fix: fix postgres password

unleash/Pluralfile

@@ -0,0 +1,7 @@
+REPO unleash
+ATTRIBUTES Plural repository.yaml
+
+TF terraform/*
+HELM helm/*
+RECIPE plural/recipes/*
+TAG plural/tags/**/*

unleash/helm/unleash/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

unleash/helm/unleash/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: postgres
+  repository: https://pluralsh.github.io/module-library
+  version: 0.1.16
+- name: unleash
+  repository: https://docs.getunleash.io/helm-charts
+  version: 2.8.0
+- name: oidc-config
+  repository: https://pluralsh.github.io/module-library
+  version: 0.1.6
+digest: sha256:e72b181785ed4af17a09f15eb96d8ed5eb97de0017d026e0847f2fc521317e01
+generated: "2023-04-15T13:09:41.222634+02:00"

unleash/helm/unleash/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: unleash
+description: helm chart for unleash
+type: application
+version: 0.1.0
+appVersion: 4.22.5
+dependencies:
+- name: postgres
+  version: 0.1.16
+  repository: https://pluralsh.github.io/module-library
+- name: unleash
+  version: 2.8.0
+  repository: https://docs.getunleash.io/helm-charts
+- name: oidc-config
+  version: 0.1.6
+  repository: https://pluralsh.github.io/module-library
+  condition: oidc-config.enabled

unleash/helm/unleash/README.md

@@ -0,0 +1 @@
+A helm chart for unleash

unleash/helm/unleash/deps.yaml

@@ -0,0 +1,34 @@
+apiVersion: plural.sh/v1alpha1
+kind: Dependencies
+metadata:
+  application: true
+  description: Deploys unleash crafted for the target cloud
+spec:
+  dependencies:
+  - type: helm
+    name: bootstrap
+    repo: bootstrap
+    version: '>= 0.5.1'
+  - type: helm
+    name: ingress-nginx
+    repo: ingress-nginx
+    version: ">= 0.1.2"
+  - type: helm
+    name: postgres
+    repo: postgres
+    version: ">= 0.1.6"
+  - type: terraform
+    name: aws
+    repo: unleash
+    version: '>= 0.1.0'
+    optional: true
+  - type: terraform
+    name: azure
+    repo: unleash
+    version: '>= 0.1.0'
+    optional: true
+  - type: terraform
+    name: gcp
+    repo: unleash
+    version: '>= 0.1.0'
+    optional: true

unleash/helm/unleash/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "unleash-plural.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "unleash-plural.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "unleash-plural.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "unleash-plural.labels" -}}
+helm.sh/chart: {{ include "unleash-plural.chart" . }}
+{{ include "unleash-plural.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "unleash-plural.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "unleash-plural.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "unleash-plural.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "unleash-plural.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

unleash/helm/unleash/templates/ingress.yaml

@@ -0,0 +1,61 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := index .Values "oidc-config" "service" "name" -}}
+{{- $svcPort := index .Values "oidc-config" "service" "webPort" -}}
+{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "unleash-plural.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}

unleash/helm/unleash/templates/postgres-secrets.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: unleash.plural-postgres-unleash.credentials.postgresql.acid.zalan.do
+  labels:
+{{ include "unleash-plural.labels" . | indent 4 }}
+stringData:
+  username: {{ .Values.postgres.user }}
+  password: {{ .Values.postgres.password }}

unleash/helm/unleash/values.yaml

@@ -0,0 +1,42 @@
+# Default values for unleash.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+postgres:
+  team: plural
+  user: unleash
+  dbName: unleash
+  ownerChart: unleash
+  infix: '-postgres'
+  password: REPLACE_ME
+
+unleash:
+  image:
+    repository: dkr.plural.sh/unleash/unleashorg/unleash-server
+    pullPolicy: IfNotPresent
+    tag: 4.22.5
+  postgresql:
+    enabled: false
+  dbConfig:
+    host: plural-postgres-unleash
+    database: unleash
+    user: unleash
+    useExistingSecret:
+      name: unleash.plural-postgres-unleash.credentials.postgresql.acid.zalan.do
+      key: password
+    ssl: '{\"rejectUnauthorized\": false}'
+
+oidc-config:
+  enabled: false
+  service:
+    name: unleash-oauth2-proxy
+    selector:
+      app.kubernetes.io/instance: unleash
+      app.kubernetes.io/name: unleash
+  secret:
+    upstream: http://localhost:4242
+    env:
+      OAUTH2_PROXY_UPSTREAM_TIMEOUT: '120s'
+
+ingress:
+  enabled: false

unleash/helm/unleash/values.yaml.tpl

@@ -0,0 +1,80 @@
+{{ $unleashPgPwd := dedupe . "unleash.postgres.password" (randAlphaNum 20) }}
+
+postgres:
+  password: {{ $unleashPgPwd }}
+
+unleash:
+  {{- if .OIDC }}
+  ingress:
+    enabled: false
+  {{ else }}
+  ingress:
+    enabled: true
+    className: "nginx"
+    annotations:
+      kubernetes.io/tls-acme: "true"
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+    hosts:
+    - host: {{ .Values.hostname }}
+      paths:
+        - path: '/'
+          pathType: ImplementationSpecific
+    tls:
+    - secretName: unleash-tls
+      hosts:
+        - {{ .Values.hostname }}
+  {{ end }}
+  env:
+    - name: UNLEASH_URL
+      value: {{ .Values.hostname }}
+    {{ if .SMTP }}
+    - name: EMAIL_SERVER_HOST
+      value: {{ .SMTP.Server }}
+    - name: EMAIL_SERVER_USER
+      value: {{ .SMTP.User }}
+    - name: EMAIL_SERVER_PASSWORD
+      value: {{ .SMTP.Password }}
+    - name: EMAIL_SERVER_PORT
+      value: {{ .SMTP.Port }}
+    - name: EMAIL_FROM
+      value: {{ .SMTP.Sender }}
+    {{ end }}
+{{ if .OIDC }}
+    - name: AUTH_TYPE
+      value: none
+  podLabels:
+    security.plural.sh/inject-oauth-sidecar: "true"
+  podAnnotations:
+    security.plural.sh/oauth-env-secret: "unleash-proxy-config"
+  {{ if .Values.users }}
+    security.plural.sh/htpasswd-secret: httpaswd-users
+  {{ end }}
+{{ $prevSecret := dedupe . "unleash.oidc-config.cookieSecret" (randAlphaNum 32) }}
+oidc-config:
+  enabled: true
+  secret:
+    name: unleash-proxy-config
+    issuer: {{ .OIDC.Configuration.Issuer }}
+    clientID: {{ .OIDC.ClientId }}
+    clientSecret: {{ .OIDC.ClientSecret }}
+    cookieSecret: {{ dedupe . "unleash.oidc-config.secret.cookieSecret" $prevSecret }}
+  {{ if .Values.users }}
+  users:
+  {{ toYaml .Values.users | nindent 4 }}
+  {{ end }}
+ingress:
+  enabled: true
+  className: "nginx"
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+  - host: {{ .Values.hostname }}
+    paths:
+      - path: '/'
+        pathType: ImplementationSpecific
+  tls:
+  - secretName: unleash-tls
+    hosts:
+      - {{ .Values.hostname }}
+{{ end }}

unleash/plural/notes.tpl

@@ -0,0 +1,8 @@
+Your unleash installation is available at https://{{ .Values.hostname }}
+{{ if .OIDC }}
+Your unleash installation has been configured with OAuth against your plural account!
+{{ else }}
+You are using standard username/password authentication, so user management will be manual.
+The default login is admin/unleash4all. We recommend to change it at https://{{ .Values.hostname }}/profile/change-password
+We strongly recommend that you consider installing with OIDC enabled.
+{{ end }}

unleash/plural/recipes/unleash-aws.yaml

@@ -0,0 +1,23 @@
+name: unleash-aws
+description: Installs unleash on an aws eks cluster
+provider: AWS
+oidcSettings:
+  uriFormat: https://{domain}/oauth2/callback
+  authMethod: POST
+  domainKey: hostname
+dependencies:
+- repo: bootstrap
+  name: aws-k8s
+- repo: ingress-nginx
+  name: ingress-nginx-aws
+sections:
+- name: unleash
+  configuration:
+    - name: hostname
+      documentation: FQDN to use for your unleash installation
+      type: DOMAIN
+  items:
+  - type: TERRAFORM
+    name: aws
+  - type: HELM
+    name: unleash