diff --git a/.gitignore b/.gitignore index 2088652d..f1dcfa92 100644 --- a/.gitignore +++ b/.gitignore @@ -20,6 +20,8 @@ yarn-error.log* *tfvars* .terraform.lock.hcl .env +__pycache__/ +*.pyc # Generated assets website/public/assets/building-block-logos/ diff --git a/modules/ske/forgejo-connector/backplane/README.md b/modules/ske/forgejo-connector/backplane/README.md deleted file mode 100644 index d94e3806..00000000 --- a/modules/ske/forgejo-connector/backplane/README.md +++ /dev/null @@ -1,38 +0,0 @@ -# Backplane module for stackit connector Building Block - -This backplane does not create any new resources. It simply transforms input variables -into a `config_tf` output that can be dropped into meshStack's BuildingBlockDefinition -as an encrypted file input to configure the access to the kubernetes cluster. - - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.0 | -| [kubernetes](#requirement\_kubernetes) | 2.35.1 | - -## Modules - -No modules. - -## Resources - -No resources. - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [client\_certificate](#input\_client\_certificate) | Base64-encoded client certificate used for authenticating to the Kubernetes API server. | `string` | n/a | yes | -| [client\_key](#input\_client\_key) | Base64-encoded private key corresponding to the client certificate, used for authentication with the Kubernetes API server. | `string` | n/a | yes | -| [cluster\_ca\_certificate](#input\_cluster\_ca\_certificate) | Base64-encoded certificate authority (CA) certificate used to verify the Kubernetes API server's identity. | `string` | n/a | yes | -| [cluster\_host](#input\_cluster\_host) | The endpoint of the Kubernetes cluster. | `string` | n/a | yes | -| [cluster\_kubeconfig](#input\_cluster\_kubeconfig) | Raw kubeconfig content containing the configuration required to access and authenticate to the Kubernetes cluster. | `string` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [config\_tf](#output\_config\_tf) | Generates a config.tf that can be dropped into meshStack's BuildingBlockDefinition as an encrypted file input to configure this building block. | - \ No newline at end of file diff --git a/modules/ske/forgejo-connector/backplane/main.tf b/modules/ske/forgejo-connector/backplane/main.tf deleted file mode 100644 index 25eec64a..00000000 --- a/modules/ske/forgejo-connector/backplane/main.tf +++ /dev/null @@ -1,11 +0,0 @@ -# BB creates -# - service account with permissions to -# - manage a "github-image-pull-secret" -# - manage pods and deployments -# -# BB puts kubeconfig for this SA into Forgejo -# -# Forgejo action workflow uses this SA to -# - update image pull secret -# - deployment -# \ No newline at end of file diff --git a/modules/ske/forgejo-connector/backplane/outputs.tf b/modules/ske/forgejo-connector/backplane/outputs.tf deleted file mode 100644 index cb7b901a..00000000 --- a/modules/ske/forgejo-connector/backplane/outputs.tf +++ /dev/null @@ -1,30 +0,0 @@ -output "config_tf" { - description = "Generates a config.tf that can be dropped into meshStack's BuildingBlockDefinition as an encrypted file input to configure this building block." - sensitive = true - value = <<-EOF - provider "kubernetes" { - host = "${var.cluster_host}" - cluster_ca_certificate = base64decode("${var.cluster_ca_certificate}") - client_certificate = base64decode("${var.client_certificate}") - client_key = base64decode("${var.client_key}") - } - - locals { - stackit_kubeconfig_stub = { - apiVersion = "v1" - kind = "Config" - current-context = "stackit_k8s" - - clusters = [ - { - name = "stackit_k8s" - cluster = { - server = "${var.cluster_host}" - certificate-authority-data = "${var.cluster_ca_certificate}" - } - } - ] - } - } - EOF -} \ No newline at end of file diff --git a/modules/ske/forgejo-connector/backplane/variables.tf b/modules/ske/forgejo-connector/backplane/variables.tf deleted file mode 100644 index 83013d1f..00000000 --- a/modules/ske/forgejo-connector/backplane/variables.tf +++ /dev/null @@ -1,28 +0,0 @@ -variable "cluster_host" { - type = string - description = "The endpoint of the Kubernetes cluster." -} - -variable "cluster_ca_certificate" { - description = "Base64-encoded certificate authority (CA) certificate used to verify the Kubernetes API server's identity." - type = string - sensitive = true -} - -variable "client_certificate" { - description = "Base64-encoded client certificate used for authenticating to the Kubernetes API server." - type = string - sensitive = true -} - -variable "client_key" { - description = "Base64-encoded private key corresponding to the client certificate, used for authentication with the Kubernetes API server." - type = string - sensitive = true -} - -variable "cluster_kubeconfig" { - description = "Raw kubeconfig content containing the configuration required to access and authenticate to the Kubernetes cluster." - type = string - sensitive = true -} \ No newline at end of file diff --git a/modules/ske/forgejo-connector/backplane/versions.tf b/modules/ske/forgejo-connector/backplane/versions.tf deleted file mode 100644 index f3bca1ee..00000000 --- a/modules/ske/forgejo-connector/backplane/versions.tf +++ /dev/null @@ -1,10 +0,0 @@ -terraform { - required_version = ">= 1.0" - - required_providers { - kubernetes = { - source = "hashicorp/kubernetes" - version = "2.35.1" - } - } -} \ No newline at end of file diff --git a/modules/ske/forgejo-connector/buildingblock/README.md b/modules/ske/forgejo-connector/buildingblock/README.md index 396a213c..1460c015 100644 --- a/modules/ske/forgejo-connector/buildingblock/README.md +++ b/modules/ske/forgejo-connector/buildingblock/README.md @@ -45,7 +45,11 @@ the backplane module's `config_tf` output. | Name | Version | |------|---------| +| [external](#requirement\_external) | ~> 2.3.0 | +| [forgejo](#requirement\_forgejo) | ~> 1.3.0 | | [kubernetes](#requirement\_kubernetes) | 2.35.1 | +| [random](#requirement\_random) | ~> 3.8.0 | +| [restapi](#requirement\_restapi) | 3.0.0 | ## Modules @@ -55,27 +59,32 @@ No modules. | Name | Type | |------|------| -| [forgejo_repository_action_secret.additional](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | -| [forgejo_repository_action_secret.container_registry](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | -| [forgejo_repository_action_secret.kubeconfig](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | +| [forgejo_repository_action_secret.this](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | +| [kubernetes_cluster_role.clusterissuer_reader](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/cluster_role) | resource | | [kubernetes_cluster_role_binding.forgejo_actions_clusterissuer_access](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/cluster_role_binding) | resource | +| [kubernetes_default_service_account.namespace_default](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/default_service_account) | resource | | [kubernetes_role_binding.forgejo_actions](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/role_binding) | resource | +| [kubernetes_secret.additional](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/secret) | resource | | [kubernetes_secret.forgejo_actions](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/secret) | resource | | [kubernetes_secret.image_pull](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/secret) | resource | | [kubernetes_service_account.forgejo_actions](https://registry.terraform.io/providers/hashicorp/kubernetes/2.35.1/docs/resources/service_account) | resource | -| [forgejo_repository.this](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/data-sources/repository) | data source | +| [random_string.resource_name_suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource | +| [restapi_object.action_variable](https://registry.terraform.io/providers/Mastercard/restapi/3.0.0/docs/resources/object) | resource | +| [terraform_data.await_pipeline_workflow](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | +| [external_external.repository_context](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/external) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [additional\_environment\_variables](#input\_additional\_environment\_variables) | Map of additional environment variable key/value pairs to set as Forgejo repository action secrets. | `map(string)` | `{}` | no | -| [forgejo\_repository\_name](#input\_forgejo\_repository\_name) | The name of the Forgejo repository. | `string` | n/a | yes | -| [forgejo\_repository\_owner](#input\_forgejo\_repository\_owner) | The owner of the Forgejo repository. | `string` | n/a | yes | +| [additional\_kubernetes\_secrets](#input\_additional\_kubernetes\_secrets) | Additional Kubernetes secrets to create in the tenant namespace. Map keys are secret names, values are secret data maps. | `map(map(string))` | `{}` | no | +| [app\_hostname](#input\_app\_hostname) | Public application hostname for this stage (used by deploy workflow and ingress). | `string` | n/a | yes | | [harbor\_host](#input\_harbor\_host) | The URL of the Harbor registry. | `string` | `"https://registry.onstackit.cloud"` | no | | [harbor\_password](#input\_harbor\_password) | The password for the Harbor registry. | `string` | n/a | yes | | [harbor\_username](#input\_harbor\_username) | The username for the Harbor registry. | `string` | n/a | yes | | [namespace](#input\_namespace) | Associated namespace in kubernetes cluster. | `string` | n/a | yes | +| [repository\_id](#input\_repository\_id) | The ID of the Forgejo repository. | `number` | n/a | yes | +| [stage](#input\_stage) | Deployment stage used for Forgejo workflow dispatch and action secret naming. | `string` | n/a | yes | ## Outputs diff --git a/modules/ske/forgejo-connector/buildingblock/forgejo.tf b/modules/ske/forgejo-connector/buildingblock/forgejo.tf index 1498319f..06f2f2e2 100644 --- a/modules/ske/forgejo-connector/buildingblock/forgejo.tf +++ b/modules/ske/forgejo-connector/buildingblock/forgejo.tf @@ -1,55 +1,112 @@ +provider "forgejo" { + # configured via env variables FORGEJO_HOST, FORGEJO_API_TOKEN +} + +provider "restapi" { + uri = data.external.repository_context.result.forgejo_host + write_returns_object = false + + headers = { + Authorization = "token ${data.external.repository_context.result.forgejo_api_token}" + Content-Type = "application/json" + } +} + +data "external" "repository_context" { + program = ["python3", "${path.module}/get_forgejo_repository_context.py"] + + query = { + FORGEJO_REPOSITORY_ID = tostring(var.repository_id) + } +} + locals { - kubeconfig_user = { - users = [ - { - name = kubernetes_service_account.forgejo_actions.metadata[0].name - user = { - "token" = kubernetes_secret.forgejo_actions.data.token + repository_owner = data.external.repository_context.result.owner + repository_name = data.external.repository_context.result.name + + action_secret = { + "KUBECONFIG_${upper(var.stage)}" = yamlencode(merge(local.kubeconfig, { + current-context = local.kubeconfig_cluster_name + + users = [ + { + name = kubernetes_service_account.forgejo_actions.metadata[0].name + user = { + "token" = kubernetes_secret.forgejo_actions.data.token + } } - } - ] - - contexts = [ - { - name = "stackit_k8s" - context = { - cluster = "stackit_k8s" - namespace = var.namespace - user = kubernetes_service_account.forgejo_actions.metadata[0].name + ] + + contexts = [ + { + name = local.kubeconfig_cluster_name + context = { + cluster = local.kubeconfig_cluster_name + namespace = var.namespace + user = kubernetes_service_account.forgejo_actions.metadata[0].name + } } - } - ] + ] + })) + } + + action_variable = { + "K8S_NAMESPACE_${upper(var.stage)}" = var.namespace + "APP_HOSTNAME_${upper(var.stage)}" = var.app_hostname } - kubeconfig = merge(local.stackit_kubeconfig_stub, local.kubeconfig_user) } -data "forgejo_repository" "this" { - name = var.forgejo_repository_name - owner = var.forgejo_repository_owner +resource "forgejo_repository_action_secret" "this" { + for_each = local.action_secret + + repository_id = var.repository_id + name = each.key + data = each.value } -resource "forgejo_repository_action_secret" "kubeconfig" { - repository_id = data.forgejo_repository.this.id - name = "KUBECONFIG" - data = yamlencode(local.kubeconfig) +resource "restapi_object" "action_variable" { + for_each = local.action_variable + + path = "/api/v1/repos/${local.repository_owner}/${local.repository_name}/actions/variables/${each.key}" + id_attribute = "name" + object_id = each.key + update_method = "PUT" + data = jsonencode({ + value = each.value + }) + ignore_server_additions = true } -resource "forgejo_repository_action_secret" "container_registry" { - for_each = { - HOST = var.harbor_host - USERNAME = var.harbor_username - PASSWORD = var.harbor_password - } +resource "terraform_data" "await_pipeline_workflow" { + depends_on = [ + forgejo_repository_action_secret.this, + restapi_object.action_variable, + ] - repository_id = data.forgejo_repository.this.id - name = "STACKIT_HARBOR_${each.key}" - data = each.value + triggers_replace = [ + sha256(file("${path.module}/trigger_and_await_forgejo_workflow.py")), + nonsensitive(sha256(jsonencode(local.action_secret))), + sha256(jsonencode(local.action_variable)), + ] + + provisioner "local-exec" { + command = "${path.module}/trigger_and_await_forgejo_workflow.py" + environment = { + REPOSITORY_ID = tostring(var.repository_id) + WORKFLOW_NAME = "pipeline.yaml" + WORKFLOW_ONLY_STAGE = var.stage + EXPECTED_WORKFLOW_TASK_NAME = "deploy_${var.stage}" + WORKFLOW_RUN_TITLE = "Triggered by meshStack Forgejo Connector ${title(var.stage)}" + } + } } -resource "forgejo_repository_action_secret" "additional" { - for_each = var.additional_environment_variables +moved { + from = forgejo_repository_action_secret.action_secrets + to = forgejo_repository_action_secret.this +} - repository_id = data.forgejo_repository.this.id - name = each.key - data = each.value -} \ No newline at end of file +moved { + from = restapi_object.action_variables + to = restapi_object.action_variable +} diff --git a/modules/ske/forgejo-connector/buildingblock/get_forgejo_repository_context.py b/modules/ske/forgejo-connector/buildingblock/get_forgejo_repository_context.py new file mode 100644 index 00000000..15ee1c25 --- /dev/null +++ b/modules/ske/forgejo-connector/buildingblock/get_forgejo_repository_context.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python3 + +import json +import os +import sys +import urllib.request + + +def normalize_host(raw_host: str) -> str: + host = raw_host.strip() + if not host.startswith(("https://", "http://")): + host = f"https://{host}" + return host.rstrip("/") + + +def main() -> None: + query = json.loads(sys.stdin.read()) + + forgejo_host = normalize_host(os.environ["FORGEJO_HOST"]) + forgejo_api_token = os.environ["FORGEJO_API_TOKEN"] + repository_id = query["FORGEJO_REPOSITORY_ID"] + + req = urllib.request.Request( + f"{forgejo_host}/api/v1/repositories/{repository_id}", + headers={"Authorization": f"token {forgejo_api_token}", "Content-Type": "application/json"}, + method="GET", + ) + with urllib.request.urlopen(req, timeout=30) as resp: + payload = json.loads(resp.read().decode("utf-8")) + + print( + json.dumps( + { + "forgejo_host": forgejo_host, + "forgejo_api_token": forgejo_api_token, + "owner": payload["owner"]["username"], + "name": payload["name"], + "default_branch": payload.get("default_branch", "main"), + } + ) + ) + + +if __name__ == "__main__": + main() diff --git a/modules/ske/forgejo-connector/buildingblock/kubeconfig-mock.yaml b/modules/ske/forgejo-connector/buildingblock/kubeconfig-mock.yaml new file mode 100644 index 00000000..305aca2c --- /dev/null +++ b/modules/ske/forgejo-connector/buildingblock/kubeconfig-mock.yaml @@ -0,0 +1,18 @@ +# This mock kubeconfig is only used as a fallback when kubeconfig.yaml is not +# injected by meshStack yet (e.g. local terraform validate). +current-context: mock-context +clusters: + - name: mock-cluster + cluster: + server: https://example.invalid # This must not be changed to avoid accidental usage via precondition check + certificate-authority-data: "" +users: + - name: mock-user + user: + client-certificate-data: "" + client-key-data: "" +contexts: + - name: mock-context + context: + cluster: mock-cluster + user: mock-user diff --git a/modules/ske/forgejo-connector/buildingblock/kubernetes.tf b/modules/ske/forgejo-connector/buildingblock/kubernetes.tf index dae6cb31..06b4f263 100644 --- a/modules/ske/forgejo-connector/buildingblock/kubernetes.tf +++ b/modules/ske/forgejo-connector/buildingblock/kubernetes.tf @@ -1,14 +1,47 @@ +locals { + kubeconfig = try( + yamldecode(file("${path.module}/kubeconfig.yaml")), + yamldecode(file("${path.module}/kubeconfig-mock.yaml")) + ) + kubeconfig_cluster = one(local.kubeconfig["clusters"])["cluster"] + kubeconfig_cluster_name = one(local.kubeconfig["clusters"])["name"] + kubeconfig_admin_user = one(local.kubeconfig["users"])["user"] +} + +provider "kubernetes" { + host = local.kubeconfig_cluster["server"] + cluster_ca_certificate = base64decode(local.kubeconfig_cluster["certificate-authority-data"]) + client_certificate = base64decode(local.kubeconfig_admin_user["client-certificate-data"]) + client_key = base64decode(local.kubeconfig_admin_user["client-key-data"]) +} + +resource "random_string" "resource_name_suffix" { + length = 5 + lower = true + upper = false + numeric = true + special = false +} + # Service account for forgejo actions to use resource "kubernetes_service_account" "forgejo_actions" { metadata { - name = "forgejo-actions" + name = "forgejo-actions-${random_string.resource_name_suffix.result}" namespace = var.namespace } + + # Unfortunately, check blocks only supported in Terraform, not OpenTofu. + lifecycle { + precondition { + condition = local.kubeconfig_cluster["server"] != "https://example.invalid" + error_message = "Mock kubeconfig detected. Ensure meshStack injected kubeconfig.yaml before apply." + } + } } resource "kubernetes_secret" "forgejo_actions" { metadata { - name = "forgejo-actions" + name = "forgejo-actions-${random_string.resource_name_suffix.result}" namespace = var.namespace annotations = { "kubernetes.io/service-account.name" = kubernetes_service_account.forgejo_actions.metadata[0].name @@ -20,7 +53,7 @@ resource "kubernetes_secret" "forgejo_actions" { resource "kubernetes_role_binding" "forgejo_actions" { metadata { - name = "forgejo-actions" + name = "forgejo-actions-${random_string.resource_name_suffix.result}" namespace = var.namespace } role_ref { @@ -36,15 +69,28 @@ resource "kubernetes_role_binding" "forgejo_actions" { } } +# The ClusterIssuer access is needed so that SSL certificates can be issued for projects using the connector. +resource "kubernetes_cluster_role" "clusterissuer_reader" { + metadata { + name = "${var.namespace}-clusterissuer-reader-${random_string.resource_name_suffix.result}" + } + + rule { + api_groups = ["cert-manager.io"] + resources = ["clusterissuers"] + verbs = ["get"] + } +} + resource "kubernetes_cluster_role_binding" "forgejo_actions_clusterissuer_access" { metadata { - name = "forgejo-actions-clusterissuer-access-${var.namespace}" + name = "${var.namespace}-forgejo-actions-clusterissuer-access-${random_string.resource_name_suffix.result}" } role_ref { api_group = "rbac.authorization.k8s.io" kind = "ClusterRole" - name = "clusterissuer-reader" # This role is created in the backplane module + name = kubernetes_cluster_role.clusterissuer_reader.metadata[0].name } subject { @@ -56,7 +102,7 @@ resource "kubernetes_cluster_role_binding" "forgejo_actions_clusterissuer_access resource "kubernetes_secret" "image_pull" { metadata { - name = "harbor-image-pull" + name = "harbor-image-pull-${random_string.resource_name_suffix.result}" namespace = var.namespace } @@ -65,12 +111,35 @@ resource "kubernetes_secret" "image_pull" { data = { ".dockerconfigjson" = jsonencode({ auths = { - "${local.harbor.host}" = { - username = local.harbor.username - password = local.harbor.password - auth = base64encode("${local.harbor.username}:${local.harbor.password}") + (var.harbor_host) = { + username = var.harbor_username + password = var.harbor_password + auth = base64encode("${var.harbor_username}:${var.harbor_password}") } } }) } -} \ No newline at end of file +} + +resource "kubernetes_secret" "additional" { + for_each = var.additional_kubernetes_secrets + + metadata { + name = each.key + namespace = var.namespace + } + + type = "Opaque" + + data = each.value +} + +resource "kubernetes_default_service_account" "namespace_default" { + metadata { + namespace = var.namespace + } + + image_pull_secret { + name = kubernetes_secret.image_pull.metadata[0].name + } +} diff --git a/modules/ske/forgejo-connector/buildingblock/main.tf b/modules/ske/forgejo-connector/buildingblock/main.tf deleted file mode 100644 index bc63beba..00000000 --- a/modules/ske/forgejo-connector/buildingblock/main.tf +++ /dev/null @@ -1 +0,0 @@ -# empty \ No newline at end of file diff --git a/modules/ske/forgejo-connector/buildingblock/outputs.tf b/modules/ske/forgejo-connector/buildingblock/outputs.tf deleted file mode 100644 index d3c76643..00000000 --- a/modules/ske/forgejo-connector/buildingblock/outputs.tf +++ /dev/null @@ -1 +0,0 @@ -# TODO: Implement outputs.tf diff --git a/modules/ske/forgejo-connector/buildingblock/provider.tf b/modules/ske/forgejo-connector/buildingblock/provider.tf deleted file mode 100644 index 0f9f92ed..00000000 --- a/modules/ske/forgejo-connector/buildingblock/provider.tf +++ /dev/null @@ -1,18 +0,0 @@ -terraform { - required_providers { - forgejo = { - source = "svalabs/forgejo" - } - - kubernetes = { - source = "hashicorp/kubernetes" - version = "2.35.1" - } - } -} - -# provide the following env variables for this Building Block: -# FORGEJO_HOST -# FORGEJO_API_TOKEN -provider "forgejo" { -} diff --git a/modules/ske/forgejo-connector/buildingblock/trigger_and_await_forgejo_workflow.py b/modules/ske/forgejo-connector/buildingblock/trigger_and_await_forgejo_workflow.py new file mode 100755 index 00000000..3e6e70f9 --- /dev/null +++ b/modules/ske/forgejo-connector/buildingblock/trigger_and_await_forgejo_workflow.py @@ -0,0 +1,318 @@ +#!/usr/bin/env python3 +"""Dispatch a Forgejo workflow and wait for completion. + +Triggers a workflow_dispatch event and polls until all jobs reach a terminal +state (success, failure, cancelled, skipped). + +Parallel-dispatch safety: Forgejo returns HTTP 204 with no body on dispatch, +so there is no run ID to correlate. Instead, we use a timestamp coincidence +window (2 s) combined with EXPECTED_WORKFLOW_TASK_NAME to identify the correct +run among concurrent dispatches (e.g. stage=dev vs stage=prod). + +API compatibility: Forgejo 8.x does not expose /actions/workflows/{wf}/runs. +The script probes that endpoint first, then falls back to /actions/tasks which +returns one entry per job. The tasks endpoint also lacks a separate 'conclusion' +field — the 'status' value IS the terminal state. + +Required environment variables: + FORGEJO_HOST – Forgejo instance URL (from provider) + FORGEJO_API_TOKEN – API token with repo action scope (from provider) + REPOSITORY_ID – numeric repository ID + WORKFLOW_ONLY_STAGE – value for the only_stage workflow input + EXPECTED_WORKFLOW_TASK_NAME – job name used to identify the correct run + +Optional: + WORKFLOW_NAME – workflow file name (default: pipeline.yaml) + WORKFLOW_RUN_TITLE – optional workflow_run_title dispatch input +""" + +import datetime as dt +import json +import os +import re +import time +import urllib.error +import urllib.request + + +def as_int(value, default: int = 0) -> int: + try: + return int(value) + except (TypeError, ValueError): + return default + + +def normalize_host(raw_host: str) -> str: + host = raw_host.strip() + if not host.startswith(("https://", "http://")): + host = f"https://{host}" + return host.rstrip("/") + + +def request_json(host: str, token: str, method: str, path: str, payload: dict | None = None): + body = None if payload is None else json.dumps(payload).encode("utf-8") + req = urllib.request.Request( + f"{host}{path}", + headers={"Authorization": f"token {token}", "Content-Type": "application/json"}, + method=method, + data=body, + ) + with urllib.request.urlopen(req, timeout=30) as resp: + raw = resp.read().decode("utf-8") + headers = dict(resp.headers.items()) + status = resp.status + data = json.loads(raw) if raw else {} + return status, headers, data + + +def parse_timestamp(ts: str | None): + if not ts: + return None + return dt.datetime.fromisoformat(ts.replace("Z", "+00:00")) + + +def main() -> None: + host = normalize_host(os.environ["FORGEJO_HOST"]) + token = os.environ["FORGEJO_API_TOKEN"] + repository_id = os.environ["REPOSITORY_ID"] + workflow_name = os.environ.get("WORKFLOW_NAME", "pipeline.yaml") + only_stage = os.environ["WORKFLOW_ONLY_STAGE"] + expected_task_name = os.environ["EXPECTED_WORKFLOW_TASK_NAME"] + workflow_run_title = os.environ.get("WORKFLOW_RUN_TITLE", "").strip() + + _, _, repo = request_json(host, token, "GET", f"/api/v1/repositories/{repository_id}") + owner = repo["owner"]["username"] + repo_name = repo["name"] + default_branch = repo.get("default_branch", "main") + + dispatch_inputs = {"only_stage": only_stage} + if workflow_run_title: + dispatch_inputs["workflow_run_title"] = workflow_run_title + + dispatch_at = dt.datetime.now(dt.timezone.utc) + dispatch_path = f"/api/v1/repos/{owner}/{repo_name}/actions/workflows/{workflow_name}/dispatches" + try: + status, headers, dispatch_response = request_json( + host, + token, + "POST", + dispatch_path, + {"ref": default_branch, "inputs": dispatch_inputs}, + ) + except urllib.error.HTTPError as exc: + if workflow_run_title and exc.code in {400, 422}: + print( + "Dispatch input workflow_run_title was rejected by workflow schema. " + "Retrying without workflow_run_title." + ) + status, headers, dispatch_response = request_json( + host, + token, + "POST", + dispatch_path, + {"ref": default_branch, "inputs": {"only_stage": only_stage}}, + ) + else: + raise + if status not in (200, 201, 202, 204): + raise SystemExit(f"Workflow dispatch failed with status {status}") + + expected_run_id = None + expected_run_number = None + + if "id" in dispatch_response: + expected_run_id = int(dispatch_response["id"]) + if "run_id" in dispatch_response: + expected_run_id = int(dispatch_response["run_id"]) + if "run_number" in dispatch_response: + expected_run_number = int(dispatch_response["run_number"]) + expected_jobs = dispatch_response.get("jobs", []) + if not isinstance(expected_jobs, list): + expected_jobs = [] + if expected_jobs: + print(f"Dispatched workflow jobs: {', '.join(expected_jobs)}") + + location = headers.get("Location", "") + m = re.search(r"/actions/runs/(\d+)", location) + if m: + expected_run_id = int(m.group(1)) + + deadline = time.time() + 900 + run_list_candidates = [ + f"/api/v1/repos/{owner}/{repo_name}/actions/workflows/{workflow_name}/runs?limit=30", + f"/api/v1/repos/{owner}/{repo_name}/actions/tasks?limit=30", + ] + runs_path = None + + for candidate in run_list_candidates: + try: + request_json(host, token, "GET", candidate) + runs_path = candidate + break + except urllib.error.HTTPError as exc: + if exc.code == 404: + continue + raise + + if runs_path is None: + raise SystemExit( + "Could not find a supported Forgejo workflow runs endpoint. " + "Tried: " + ", ".join(run_list_candidates) + ) + + uses_tasks_endpoint = "/actions/tasks" in runs_path + print(f"Polling workflow status via {runs_path}") + seen_job_status: dict[str, str] = {} + last_wait_reason: tuple | None = None + last_run_state: tuple | None = None + + while time.time() < deadline: + _, _, payload = request_json(host, token, "GET", runs_path) + runs = payload.get("workflow_runs", []) + + if uses_tasks_endpoint: + if expected_run_number is not None: + candidates = [r for r in runs if as_int(r.get("run_number"), -1) == expected_run_number] + else: + candidates = [] + for run in runs: + if run.get("event") != "workflow_dispatch": + continue + if run.get("head_branch") != default_branch: + continue + created_at = parse_timestamp(run.get("created_at")) + if created_at and created_at >= dispatch_at - dt.timedelta(seconds=2): + candidates.append(run) + + # Disambiguate parallel dispatches: group by run_number and pick + # the run whose job list contains the expected task name. + if expected_task_name and candidates: + by_run: dict[int, list[dict]] = {} + for task in candidates: + rn = as_int(task.get("run_number"), -1) + if rn >= 0: + by_run.setdefault(rn, []).append(task) + + matched_run = None + for rn in sorted(by_run, reverse=True): + if any( + str(t.get("name", "")).strip() == expected_task_name + for t in by_run[rn] + ): + matched_run = rn + break + + if matched_run is not None: + candidates = by_run[matched_run] + expected_run_number = matched_run + print(f"Identified run {matched_run} by expected task '{expected_task_name}'") + else: + candidates = [] + elif expected_run_id is not None: + candidates = [r for r in runs if as_int(r.get("id")) == expected_run_id] + elif expected_run_number is not None: + candidates = [r for r in runs if as_int(r.get("run_number"), -1) == expected_run_number] + else: + candidates = [] + for run in runs: + if run.get("event") != "workflow_dispatch": + continue + if run.get("head_branch") != default_branch: + continue + created_at = parse_timestamp(run.get("created_at")) + if created_at and created_at >= dispatch_at - dt.timedelta(seconds=2): + candidates.append(run) + candidates.sort(key=lambda r: as_int(r.get("id")), reverse=True) + + if candidates: + if uses_tasks_endpoint: + # /actions/tasks returns one task per job in the workflow. + # Wait for all jobs in the dispatched composition to reach terminal states. + by_job_name: dict[str, dict] = {} + for task in candidates: + task_name = str(task.get("name") or task.get("display_title") or "").strip() + if not task_name: + continue + prev = by_job_name.get(task_name) + if prev is None or as_int(task.get("id")) > as_int(prev.get("id")): + by_job_name[task_name] = task + + if expected_jobs: + missing_jobs = [job for job in expected_jobs if job not in by_job_name] + if missing_jobs: + wait_reason = ("missing", tuple(missing_jobs)) + if wait_reason != last_wait_reason: + print(f"Awaiting jobs to appear: {', '.join(missing_jobs)}") + last_wait_reason = wait_reason + time.sleep(10) + continue + relevant_tasks = [by_job_name[job] for job in expected_jobs] + else: + relevant_tasks = list(by_job_name.values()) + + for task in relevant_tasks: + task_name = str(task.get("name") or task.get("display_title") or "unknown").strip() + task_status = str(task.get("status") or "unknown") + previous_status = seen_job_status.get(task_name) + if previous_status != task_status: + print(f"Job {task_name}: {task_status}") + seen_job_status[task_name] = task_status + + terminal_statuses = {"success", "failure", "cancelled", "skipped"} + non_terminal = [t for t in relevant_tasks if t.get("status") not in terminal_statuses] + if non_terminal: + running = tuple( + f"{str(t.get('name') or t.get('display_title') or 'unknown').strip()}={t.get('status')}" + for t in non_terminal + ) + wait_reason = ("running", running) + if wait_reason != last_wait_reason: + print(f"Awaiting jobs: {', '.join(running)}") + last_wait_reason = wait_reason + time.sleep(10) + continue + + last_wait_reason = None + failed = [ + t + for t in relevant_tasks + if t.get("status") not in {"success", "skipped"} + ] + run_id = expected_run_id if expected_run_id is not None else as_int(relevant_tasks[0].get("id")) + html_url = relevant_tasks[0].get("url", "") + if not failed: + print(f"Workflow run {run_id} completed successfully: {html_url}") + return + + failed_statuses = ", ".join( + f"{t.get('name', t.get('display_title', 'unknown'))}={t.get('status')}" for t in failed + ) + raise SystemExit(f"Workflow run {run_id} failed jobs: {failed_statuses}: {html_url}") + else: + run = candidates[0] + run_id = run.get("id") + status_val = run.get("status") + conclusion = run.get("conclusion") + html_url = run.get("html_url", run.get("url", "")) + run_state = (status_val, conclusion) + if run_state != last_run_state: + print(f"Workflow run {run_id}: status={status_val} conclusion={conclusion}") + last_run_state = run_state + + if conclusion is None and status_val in {"success", "failure", "cancelled", "skipped"}: + conclusion = status_val + status_val = "completed" + + if status_val == "completed": + if conclusion == "success": + print(f"Workflow run {run_id} completed successfully: {html_url}") + return + raise SystemExit(f"Workflow run {run_id} failed with conclusion={conclusion}: {html_url}") + + time.sleep(10) + + raise SystemExit("Timed out waiting for dispatched pipeline workflow to complete.") + + +if __name__ == "__main__": + main() diff --git a/modules/ske/forgejo-connector/buildingblock/variables.tf b/modules/ske/forgejo-connector/buildingblock/variables.tf index 537e202d..b5532371 100644 --- a/modules/ske/forgejo-connector/buildingblock/variables.tf +++ b/modules/ske/forgejo-connector/buildingblock/variables.tf @@ -1,38 +1,48 @@ -variable "harbor_host" { +variable "namespace" { + description = "Associated namespace in kubernetes cluster." type = string - description = "The URL of the Harbor registry." - default = "https://registry.onstackit.cloud" } -variable "harbor_username" { - type = string - description = "The username for the Harbor registry." - sensitive = true +variable "repository_id" { + type = number + description = "The ID of the Forgejo repository." } -variable "harbor_password" { +variable "stage" { type = string - description = "The password for the Harbor registry." - sensitive = true + description = "Deployment stage used for Forgejo workflow dispatch and action secret naming." + + validation { + condition = can(regex("^[a-z]+$", var.stage)) + error_message = "stage must match ^[a-z]+$." + } } -variable "forgejo_repository_name" { +variable "app_hostname" { type = string - description = "The name of the Forgejo repository." + description = "Public application hostname for this stage (used by deploy workflow and ingress)." +} + +variable "additional_kubernetes_secrets" { + type = map(map(string)) + description = "Additional Kubernetes secrets to create in the tenant namespace. Map keys are secret names, values are secret data maps." + default = {} } -variable "forgejo_repository_owner" { +variable "harbor_host" { type = string - description = "The owner of the Forgejo repository." + description = "The URL of the Harbor registry." + default = "https://registry.onstackit.cloud" } -variable "additional_environment_variables" { - type = map(string) - description = "Map of additional environment variable key/value pairs to set as Forgejo repository action secrets." - default = {} +variable "harbor_username" { + type = string + description = "The username for the Harbor registry." + sensitive = true } -variable "namespace" { - description = "Associated namespace in kubernetes cluster." +variable "harbor_password" { type = string -} \ No newline at end of file + description = "The password for the Harbor registry." + sensitive = true +} diff --git a/modules/ske/forgejo-connector/buildingblock/versions.tf b/modules/ske/forgejo-connector/buildingblock/versions.tf new file mode 100644 index 00000000..9c27d488 --- /dev/null +++ b/modules/ske/forgejo-connector/buildingblock/versions.tf @@ -0,0 +1,27 @@ +terraform { + required_providers { + external = { + source = "hashicorp/external" + version = "~> 2.3.0" + } + forgejo = { + source = "svalabs/forgejo" + version = "~> 1.3.0" + } + + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.35.1" + } + + random = { + source = "hashicorp/random" + version = "~> 3.8.0" + } + + restapi = { + source = "Mastercard/restapi" + version = "3.0.0" + } + } +} diff --git a/modules/ske/forgejo-connector/meshstack_integration.tf b/modules/ske/forgejo-connector/meshstack_integration.tf index 9511809a..2df4b35f 100644 --- a/modules/ske/forgejo-connector/meshstack_integration.tf +++ b/modules/ske/forgejo-connector/meshstack_integration.tf @@ -1,41 +1,6 @@ -# This file is an example showing how to register the STACKIT connector -# building block in a meshStack instance. - -terraform { - required_providers { - meshstack = { - source = "meshcloud/meshstack" - version = "~> 0.19.0" - } - } -} - -variable "cluster_host" { - type = string - description = "The endpoint of the Kubernetes cluster." -} - -variable "cluster_ca_certificate" { - description = "Base64-encoded certificate authority (CA) certificate used to verify the Kubernetes API server's identity." - type = string - sensitive = true -} - -variable "client_certificate" { - description = "Base64-encoded client certificate used for authenticating to the Kubernetes API server." - type = string - sensitive = true -} - -variable "client_key" { - description = "Base64-encoded private key corresponding to the client certificate, used for authentication with the Kubernetes API server." - type = string - sensitive = true -} - -variable "cluster_kubeconfig" { - description = "Raw kubeconfig content containing the configuration required to access and authenticate to the Kubernetes cluster." - type = string +variable "kubeconfig" { + description = "Kubeconfig content containing the configuration required to access and authenticate to the Kubernetes cluster." + type = any sensitive = true } @@ -48,6 +13,11 @@ variable "forgejo_api_token" { sensitive = true } +variable "forgejo_repo_definition_uuid" { + type = string + description = "UUID of the Forgejo repository building block definition used as parent dependency for tenant building blocks (connector)." +} + variable "harbor_host" { type = string description = "The URL of the Harbor registry." @@ -66,9 +36,17 @@ variable "harbor_password" { sensitive = true } -variable "forgejo_repo_definition_uuid" { - type = string - description = "The Building Block definition UUID of the repository parent." +variable "additional_kubernetes_secrets" { + type = map(map(string)) + description = "Additional Kubernetes secrets provisioned in tenant namespaces by the connector." + sensitive = true + default = { + "stackit-ai" = { + STACKIT_AI_BASE_URL = "https://example.invalid/v1" + STACKIT_AI_API_KEY = "dummy-api-key" + STACKIT_AI_MODEL = "dummy-model" + } + } } variable "meshstack" { @@ -89,18 +67,12 @@ variable "hub" { EOT } -output "building_block_definition_version_ref" { - value = var.hub.bbd_draft ? meshstack_building_block_definition.this.version_latest : meshstack_building_block_definition.this.version_latest_release - description = "Version of BBD is consumed in Building Block compositions, for example in the backplane of starter kits." -} - -module "backplane" { - source = "./backplane" - cluster_host = var.cluster_host - cluster_ca_certificate = var.client_certificate - client_key = var.client_key - client_certificate = var.client_certificate - cluster_kubeconfig = var.cluster_kubeconfig +output "building_block_definition" { + value = { + uuid = meshstack_building_block_definition.this.metadata.uuid + version_ref = var.hub.bbd_draft ? meshstack_building_block_definition.this.version_latest : meshstack_building_block_definition.this.version_latest_release + } + description = "BBD is consumed in building block compositions." } resource "meshstack_building_block_definition" "this" { @@ -109,12 +81,13 @@ resource "meshstack_building_block_definition" "this" { } spec = { - display_name = "STACKIT connector" - symbol = "data:image/png;base64,${filebase64("${path.module}/buildingblock/logo.png")}" - description = "Forgejo Actions Integration with STACKIT Kubernetes" - support_url = "https://portal.stackit.cloud/git" - target_type = "WORKSPACE_LEVEL" - run_transparency = true + display_name = "SKE Forgejo Connector" + symbol = "https://raw.githubusercontent.com/meshcloud/meshstack-hub/${var.hub.git_ref}/modules/ske/forgejo-connector/buildingblock/logo.png" + description = "Connects a Forgejo repository with a tenant namespace on STACKIT SKE." + support_url = "https://portal.stackit.cloud/git" + target_type = "TENANT_LEVEL" + supported_platforms = [{ name = "KUBERNETES" }] + run_transparency = true } version_spec = { @@ -125,43 +98,81 @@ resource "meshstack_building_block_definition" "this" { terraform = { terraform_version = "1.9.0" repository_url = "https://github.com/meshcloud/meshstack-hub.git" - repository_path = "modules/stackit/git-connector/buildingblock" + repository_path = "modules/ske/forgejo-connector/buildingblock" ref_name = var.hub.git_ref async = false use_mesh_http_backend_fallback = true } } - dependency_refs = [{ uuid = "${var.forgejo_repo_definition_uuid}" }] + dependency_refs = [{ uuid = var.forgejo_repo_definition_uuid }] inputs = { - # ── Static inputs from backplane ────────────────────────────────────── - config_tf = { - display_name = "config_k8s" - description = "Static config for kubernetes" + namespace = { + display_name = "K8S Namespace" + description = "Provided namespace in Kubernetes cluster." + type = "STRING" + assignment_type = "PLATFORM_TENANT_ID" + } + + "kubeconfig.yaml" = { + display_name = "kubeconfig.yaml" + description = "kubeconfig.yaml file providing admin credentials to cluster." type = "FILE" assignment_type = "STATIC" - is_environment = true sensitive = { argument = { - secret_value = jsonencode(module.backplane.config_tf) + secret_value = "data:application/yaml;base64,${base64encode(yamlencode(var.kubeconfig))}" # data type application/yaml is ignored anyway + secret_version = nonsensitive(sha256(yamlencode(var.kubeconfig))) } } } - FORGEJO_HOST = { - display_name = "FORGEJO_HOST" - description = "The URL of the Forgejo instance to connect to." + repository_id = { + display_name = "repository_id" + description = "ID of the parent Forgejo repository where action secrets are created." + type = "INTEGER" + assignment_type = "BUILDING_BLOCK_OUTPUT" + argument = jsonencode("${var.forgejo_repo_definition_uuid}.repository_id") + } + + stage = { + display_name = "stage" + description = "Deployment stage for this connector instance (dev or prod)." type = "STRING" + assignment_type = "USER_INPUT" + default_value = jsonencode("dev") + } + + app_hostname = { + display_name = "app_hostname" + description = "Public application hostname for this stage (for example 'ai-summarizer-klhyt-dev.likvid.stackit.run')." + type = "STRING" + assignment_type = "USER_INPUT" + } + + additional_kubernetes_secrets = { + display_name = "additional_kubernetes_secrets" + description = "Static sensitive map of additional Kubernetes Opaque secrets to create in the tenant namespace." + type = "CODE" assignment_type = "STATIC" - is_environment = true sensitive = { argument = { - secret_value = jsonencode(var.forgejo_host) + secret_value = jsonencode(var.additional_kubernetes_secrets) + secret_version = nonsensitive(sha256(jsonencode(var.additional_kubernetes_secrets))) } } } + FORGEJO_HOST = { + display_name = "FORGEJO_HOST" + description = "The Host of the Forgejo instance to connect to." + type = "STRING" + assignment_type = "STATIC" + is_environment = true + argument = jsonencode(var.forgejo_host) + } + FORGEJO_API_TOKEN = { display_name = "FORGEJO_API_TOKEN" description = "The API token for authenticating with the Forgejo instance." @@ -170,7 +181,8 @@ resource "meshstack_building_block_definition" "this" { is_environment = true sensitive = { argument = { - secret_value = jsonencode(var.forgejo_api_token) + secret_value = var.forgejo_api_token + secret_version = nonsensitive(sha256(var.forgejo_api_token)) } } } @@ -188,7 +200,12 @@ resource "meshstack_building_block_definition" "this" { description = "The username for the Harbor registry." type = "STRING" assignment_type = "STATIC" - argument = jsonencode(var.harbor_username) + sensitive = { + argument = { + secret_value = var.harbor_username + secret_version = nonsensitive(sha256(var.harbor_username)) + } + } } harbor_password = { @@ -198,38 +215,20 @@ resource "meshstack_building_block_definition" "this" { assignment_type = "STATIC" sensitive = { argument = { - secret_value = jsonencode(var.harbor_password) + secret_value = var.harbor_password + secret_version = nonsensitive(sha256(var.harbor_password)) } } } - - forgejo_repository_name = { - display_name = "forgejo_repository_name" - description = "The name of the Forgejo repository." - type = "STRING" - assignment_type = "BUILDING_BLOCK_OUTPUT" - argument = "${var.forgejo_repo_definition_uuid}.repo_name" - } - - forgejo_repository_owner = { - display_name = "forgejo_repository_owner" - description = "The owner of the Forgejo repository." - type = "STRING" - assignment_type = "BUILDING_BLOCK_OUTPUT" - argument = "${var.forgejo_repo_definition_uuid}.repo_owner" - } - - # ── User inputs ──────────────────────────────────────────────────────── - - namespace = { - display_name = "namespace" - description = "Associated namespace in kubernetes cluster." - type = "STRING" - assignment_type = "USER_INPUT" - } } + } +} - outputs = { +terraform { + required_providers { + meshstack = { + source = "meshcloud/meshstack" + version = "~> 0.20.0" } } } diff --git a/modules/ske/ske-starterkit/backplane/main.tf b/modules/ske/ske-starterkit/backplane/main.tf deleted file mode 100644 index 4221baac..00000000 --- a/modules/ske/ske-starterkit/backplane/main.tf +++ /dev/null @@ -1,42 +0,0 @@ -variable "meshstack" { - type = object({ - owning_workspace_identifier = string - }) -} - -variable "hub" { - type = object({ - git_ref = string - bbd_draft = bool - }) -} - -variable "forgejo_token" { - type = string - sensitive = true -} - -variable "forgejo_organization" { - type = string -} - -variable "forgejo_base_url" { - type = string -} - -output "building_block_definition_version_refs" { - value = { - "git-repository" : module.git_repository.building_block_definition_version_ref - } -} - -module "git_repository" { - source = "github.com/meshcloud/meshstack-hub//modules/stackit/git-repository?ref=2e990f277119f33db50af78032768c434ab4b7bb" - - meshstack = var.meshstack - hub = var.hub - - forgejo_token = var.forgejo_token - forgejo_organization = var.forgejo_organization - forgejo_base_url = var.forgejo_base_url -} diff --git a/modules/ske/ske-starterkit/buildingblock/README.md b/modules/ske/ske-starterkit/buildingblock/README.md index 351e0e13..a1d132f3 100644 --- a/modules/ske/ske-starterkit/buildingblock/README.md +++ b/modules/ske/ske-starterkit/buildingblock/README.md @@ -15,6 +15,7 @@ This building block creates a dev and prod meshStack project pair, each with a d | Name | Version | |------|---------| | [meshstack](#requirement\_meshstack) | ~>0.20.0 | +| [random](#requirement\_random) | 3.8.1 | ## Modules @@ -24,25 +25,32 @@ No modules. | Name | Type | |------|------| +| [meshstack_building_block_v2.forgejo_connector](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_v2) | resource | | [meshstack_building_block_v2.git_repository](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_v2) | resource | | [meshstack_project.this](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/project) | resource | | [meshstack_project_user_binding.creator_to_admin](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/project_user_binding) | resource | | [meshstack_tenant_v4.this](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/tenant_v4) | resource | +| [random_string.name_suffix](https://registry.terraform.io/providers/hashicorp/random/3.8.1/docs/resources/string) | resource | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [building\_block\_definition\_version\_refs](#input\_building\_block\_definition\_version\_refs) | n/a | `map(object({ uuid = string }))` | n/a | yes | -| [creator](#input\_creator) | Information about the creator of the resources who will be assigned Project Admin role | 
object({
    type        = string
    identifier  = string
    displayName = string
    username    = optional(string)
    email       = optional(string)
    euid        = optional(string)
  })
| n/a | yes | +| [add\_random\_name\_suffix](#input\_add\_random\_name\_suffix) | Whether to append a random suffix to the provided name for shared environments. | `bool` | n/a | yes | +| [building\_block\_definitions](#input\_building\_block\_definitions) | n/a | 
map(object({
    uuid = string
    version_ref = object({
      uuid = string
    })
  }))
| n/a | yes | +| [creator](#input\_creator) | Information about the creator of the resources who will be assigned Project Admin role | 
object({
    type        = string
    identifier  = string
    displayName = string
    username    = optional(string)
    email       = optional(string)
    euid        = optional(string)
  })
| n/a | yes | +| [dns\_zone\_name](#input\_dns\_zone\_name) | DNS zone name used for application ingress hostnames (for example 'likvid.stackit.run'). | `string` | n/a | yes | | [full\_platform\_identifier](#input\_full\_platform\_identifier) | Full platform identifier of the SKE platform. | `string` | n/a | yes | -| [landing\_zone\_identifiers](#input\_landing\_zone\_identifiers) | SKE Landing zone identifiers for the dev/prod meshTenant. | 
object({
    dev  = string
    prod = string
  })
| n/a | yes | +| [landing\_zone\_identifiers](#input\_landing\_zone\_identifiers) | SKE Landing zone identifiers for the dev/prod meshTenant. | 
object({
    dev  = string
    prod = string
  })
| n/a | yes | | [name](#input\_name) | This name will be used for the created projects. | `string` | n/a | yes | -| [project\_tags](#input\_project\_tags) | Tags for dev/prod meshProject. | 
object({
    dev : map(list(string))
    prod : map(list(string))

    owner_tag_key = optional(string, null)
  })
| n/a | yes | +| [project\_tags](#input\_project\_tags) | Tags for dev/prod meshProject. | 
object({
    dev : map(list(string))
    prod : map(list(string))

    owner_tag_key = optional(string, null)
  })
| n/a | yes | | [repo\_clone\_addr](#input\_repo\_clone\_addr) | URL to clone into the starterkit git repository. | `string` | n/a | yes | | [workspace\_identifier](#input\_workspace\_identifier) | n/a | `string` | n/a | yes | ## Outputs -No outputs. +| Name | Description | +|------|-------------| +| [dev\_link](#output\_dev\_link) | Public URL for the dev stage application. | +| [prod\_link](#output\_prod\_link) | Public URL for the prod stage application. | \ No newline at end of file diff --git a/modules/ske/ske-starterkit/buildingblock/main.tf b/modules/ske/ske-starterkit/buildingblock/main.tf index 1a8801a4..561a5281 100644 --- a/modules/ske/ske-starterkit/buildingblock/main.tf +++ b/modules/ske/ske-starterkit/buildingblock/main.tf @@ -1,15 +1,35 @@ +resource "random_string" "name_suffix" { + length = 5 + upper = false + numeric = false + special = false +} + +locals { + name = var.add_random_name_suffix ? "${var.name}-${random_string.name_suffix.result}" : var.name + + app_hostnames = { + for stage, _ in var.landing_zone_identifiers : + stage => ( + stage == "prod" + ? "${local.name}.${var.dns_zone_name}" + : "${local.name}-${stage}.${var.dns_zone_name}" + ) + } +} + resource "meshstack_building_block_v2" "git_repository" { spec = { - building_block_definition_version_ref = var.building_block_definition_version_refs["git-repository"] # provisioned in backplane + building_block_definition_version_ref = var.building_block_definitions["git-repository"].version_ref # provisioned in backplane - display_name = "${var.name} Git Repo" + display_name = "Git Repo ${local.name}" target_ref = { kind = "meshWorkspace" identifier = var.workspace_identifier } inputs = { - name = { value_string = var.name } + name = { value_string = local.name } clone_addr = { value_string = var.repo_clone_addr } } } @@ -19,7 +39,7 @@ resource "meshstack_building_block_v2" "git_repository" { resource "meshstack_project" "this" { for_each = tomap(var.landing_zone_identifiers) metadata = { - name = "${var.name}-${each.key}" + name = "${local.name}-${each.key}" owned_by_workspace = var.workspace_identifier } spec = { @@ -66,3 +86,29 @@ resource "meshstack_tenant_v4" "this" { landing_zone_identifier = each.value } } + +resource "meshstack_building_block_v2" "forgejo_connector" { + for_each = meshstack_tenant_v4.this + + spec = { + building_block_definition_version_ref = var.building_block_definitions["forgejo-connector"].version_ref + + display_name = "Forgejo Connector ${title(each.key)}" + target_ref = { + kind = "meshTenant" + uuid = each.value.metadata.uuid + } + + parent_building_blocks = [{ + buildingblock_uuid = meshstack_building_block_v2.git_repository.metadata.uuid + definition_uuid = var.building_block_definitions["git-repository"].uuid + }] + + inputs = { + stage = { value_string = each.key } + app_hostname = { value_string = local.app_hostnames[each.key] } + } + } + + wait_for_completion = true +} diff --git a/modules/ske/ske-starterkit/buildingblock/outputs.tf b/modules/ske/ske-starterkit/buildingblock/outputs.tf index a912bb20..d595a194 100644 --- a/modules/ske/ske-starterkit/buildingblock/outputs.tf +++ b/modules/ske/ske-starterkit/buildingblock/outputs.tf @@ -1,2 +1,9 @@ -# Building Block composition does not have outputs -# Keep file to please CI validation +output "dev_link" { + value = "https://${local.name}-dev.${var.dns_zone_name}" + description = "Public URL for the dev stage application." +} + +output "prod_link" { + value = "https://${local.name}.${var.dns_zone_name}" + description = "Public URL for the prod stage application." +} diff --git a/modules/ske/ske-starterkit/buildingblock/variables.tf b/modules/ske/ske-starterkit/buildingblock/variables.tf index d0628fc5..5d951f1b 100644 --- a/modules/ske/ske-starterkit/buildingblock/variables.tf +++ b/modules/ske/ske-starterkit/buildingblock/variables.tf @@ -47,6 +47,21 @@ variable "repo_clone_addr" { description = "URL to clone into the starterkit git repository." } -variable "building_block_definition_version_refs" { - type = map(object({ uuid = string })) +variable "dns_zone_name" { + type = string + description = "DNS zone name used for application ingress hostnames (for example 'likvid.stackit.run')." +} + +variable "add_random_name_suffix" { + type = bool + description = "Whether to append a random suffix to the provided name for shared environments." +} + +variable "building_block_definitions" { + type = map(object({ + uuid = string + version_ref = object({ + uuid = string + }) + })) } diff --git a/modules/ske/ske-starterkit/buildingblock/versions.tf b/modules/ske/ske-starterkit/buildingblock/versions.tf index f9d4a802..f6259e42 100644 --- a/modules/ske/ske-starterkit/buildingblock/versions.tf +++ b/modules/ske/ske-starterkit/buildingblock/versions.tf @@ -5,5 +5,9 @@ terraform { source = "meshcloud/meshstack" version = "~>0.20.0" } + random = { + source = "hashicorp/random" + version = "3.8.1" + } } } diff --git a/modules/ske/ske-starterkit/meshstack_integration.tf b/modules/ske/ske-starterkit/meshstack_integration.tf index b2304344..8c638d51 100644 --- a/modules/ske/ske-starterkit/meshstack_integration.tf +++ b/modules/ske/ske-starterkit/meshstack_integration.tf @@ -4,19 +4,6 @@ variable "meshstack" { }) } -variable "forgejo_token" { - type = string - sensitive = true -} - -variable "forgejo_organization" { - type = string -} - -variable "forgejo_base_url" { - type = string -} - variable "full_platform_identifier" { type = string } @@ -45,6 +32,17 @@ variable "repo_clone_addr" { description = "URL to clone into the starterkit git repository." } +variable "dns_zone_name" { + type = string + description = "DNS zone name used for application ingress hostnames." +} + +variable "add_random_name_suffix" { + type = bool + default = true + description = "Whether to append a random suffix to starterkit names for shared environments." +} + variable "tags" { type = map(list(string)) default = {} @@ -55,6 +53,16 @@ variable "notification_subscribers" { default = [] } +variable "building_block_definitions" { + type = map(object({ + uuid = string + version_ref = object({ + content_hash = string # adding the content nicely tracks changes in dependent BBDs (draft mode) + uuid = string + }) + })) +} + variable "hub" { type = object({ git_ref = optional(string, "main") @@ -67,17 +75,6 @@ variable "hub" { EOT } -module "backplane" { - source = "./backplane" # TODO revert to github.com/meshcloud/meshstack-hub//modules/ske/ske-starterkit/backplane link once pushed - - meshstack = var.meshstack - hub = var.hub - - forgejo_token = var.forgejo_token - forgejo_organization = var.forgejo_organization - forgejo_base_url = var.forgejo_base_url -} - locals { name_regex = "^[a-zA-Z0-9-]+$" # underscore and dots not allowed because of K8s namespace } @@ -198,13 +195,52 @@ EOT display_name = "Clone from URL" argument = jsonencode(var.repo_clone_addr) } + "dns_zone_name" = { + assignment_type = "STATIC" + type = "STRING" + display_name = "DNS Zone Name" + argument = jsonencode(var.dns_zone_name) + } + "add_random_name_suffix" = { + assignment_type = "STATIC" + type = "BOOLEAN" + display_name = "Add Random Name Suffix" + argument = jsonencode(var.add_random_name_suffix) + } + "building_block_definitions" = { + assignment_type = "STATIC" + type = "CODE" + description = "Definitions used to create auxiliary building blocks (composition)." + display_name = "BBDs" + # jsonencode twice is correct, see https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_definition#argument-1 + argument = jsonencode(jsonencode(var.building_block_definitions)) + }, + # TODO remove inputs below before merge, leftover from dev attempts in grubinator2 instance + "apps_base_domain" = { + assignment_type = "STATIC" + type = "STRING" + display_name = "REMOVEME" + argument = jsonencode(var.dns_zone_name) + } "building_block_definition_version_refs" = { assignment_type = "STATIC" type = "CODE" - description = "Refs used to create auxiliary building blocks (composition)." - display_name = "BBD Version Refs" + description = "REMOVEME" + display_name = "REMOVEME" + # jsonencode twice is correct, see https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_definition#argument-1 + argument = jsonencode(jsonencode(var.building_block_definitions)) + }, + "git_repository_action_secrets" = { + assignment_type = "STATIC" + type = "CODE" + description = "REMOVEME" + display_name = "REMOVEME" # jsonencode twice is correct, see https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_definition#argument-1 - argument = jsonencode(jsonencode(module.backplane.building_block_definition_version_refs)) + sensitive = { + argument = { + secret_value = jsonencode({}) + } + } } } diff --git a/modules/stackit/git-repository/README.md b/modules/stackit/git-repository/README.md index a1fecd14..af0ff3f8 100644 --- a/modules/stackit/git-repository/README.md +++ b/modules/stackit/git-repository/README.md @@ -13,9 +13,10 @@ It combines: `meshstack_integration.tf` creates a `meshstack_building_block_definition` with: - workspace-level target type -- static inputs from backplane (`forgejo_base_url`, `forgejo_token`, `forgejo_organization`) +- static inputs from backplane (`FORGEJO_HOST`, `FORGEJO_API_TOKEN`, `forgejo_organization`) +- optional static sensitive action secrets (`action_secrets`) - user inputs (`name`, `description`, `private`, `clone_addr`) -- outputs exposed to users (`repository_html_url`, `repository_clone_url`, `repository_ssh_url`, `summary`) +- outputs exposed to users (`repository_id`, `repository_html_url`, `repository_clone_url`, `repository_ssh_url`, `summary`) This allows platform teams to publish a reusable self-service Git repository building block for tenants. diff --git a/modules/stackit/git-repository/buildingblock/README.md b/modules/stackit/git-repository/buildingblock/README.md index 8ff4c960..0cb4f7a7 100644 --- a/modules/stackit/git-repository/buildingblock/README.md +++ b/modules/stackit/git-repository/buildingblock/README.md @@ -11,7 +11,9 @@ description: Provisions a Git repository on STACKIT Git (Forgejo) with optional | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.4.0 | +| [external](#requirement\_external) | ~> 2.3.0 | | [forgejo](#requirement\_forgejo) | ~> 1.3.0 | +| [restapi](#requirement\_restapi) | 3.0.0 | ## Modules @@ -21,18 +23,21 @@ No modules. | Name | Type | |------|------| -| [forgejo_repository.repository](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository) | resource | +| [forgejo_repository.this](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository) | resource | +| [forgejo_repository_action_secret.this](https://registry.terraform.io/providers/svalabs/forgejo/latest/docs/resources/repository_action_secret) | resource | +| [restapi_object.action_variable](https://registry.terraform.io/providers/Mastercard/restapi/3.0.0/docs/resources/object) | resource | +| [external_external.forgejo_env](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/external) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [clone\_addr](#input\_clone\_addr) | Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty to create an empty repository. | `string` | `""` | no | +| [action\_secrets](#input\_action\_secrets) | Map of Forgejo Actions secrets to create in the repository. | `map(string)` | `{}` | no | +| [action\_variables](#input\_action\_variables) | Map of Forgejo Actions variables to create in the repository. | `map(string)` | `{}` | no | +| [clone\_addr](#input\_clone\_addr) | Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty or `null` to create an empty repository. | `string` | `"null"` | no | | [default\_branch](#input\_default\_branch) | Default branch name | `string` | `"main"` | no | | [description](#input\_description) | Short description of the repository | `string` | `""` | no | -| [forgejo\_base\_url](#input\_forgejo\_base\_url) | STACKIT Git base URL | `string` | `"https://git-service.git.onstackit.cloud"` | no | | [forgejo\_organization](#input\_forgejo\_organization) | STACKIT Git organization where the repository will be created | `string` | n/a | yes | -| [forgejo\_token](#input\_forgejo\_token) | STACKIT Git API token (from backplane) | `string` | n/a | yes | | [name](#input\_name) | Name of the Git repository to create | `string` | n/a | yes | | [private](#input\_private) | Whether the repository should be private | `bool` | `true` | no | diff --git a/modules/stackit/git-repository/buildingblock/main.tf b/modules/stackit/git-repository/buildingblock/main.tf index d4b02a13..277ca1b2 100644 --- a/modules/stackit/git-repository/buildingblock/main.tf +++ b/modules/stackit/git-repository/buildingblock/main.tf @@ -1,14 +1,79 @@ -# ── Repository ───────────────────────────────────────────────────────────────── +provider "forgejo" { + # configured via env variables FORGEJO_HOST, FORGEJO_API_TOKEN +} + +data "external" "forgejo_env" { + program = ["python3", "-c", <<-PY +import json +import os + +print(json.dumps({ + "forgejo_host": os.environ["FORGEJO_HOST"], + "forgejo_auth_header": f'token {os.environ["FORGEJO_API_TOKEN"]}', +})) +PY + ] +} + +provider "restapi" { + uri = data.external.forgejo_env.result.forgejo_host + write_returns_object = true -resource "forgejo_repository" "repository" { + headers = { + Authorization = data.external.forgejo_env.result.forgejo_auth_header + Content-Type = "application/json" + } +} + +locals { + have_clone_addr = trimspace(var.clone_addr) != "" && var.clone_addr != "null" +} + +resource "forgejo_repository" "this" { owner = var.forgejo_organization name = var.name description = var.description private = var.private default_branch = var.default_branch - auto_init = var.clone_addr == "" + auto_init = !local.have_clone_addr # One-time clone (not an ongoing mirror) - clone_addr = var.clone_addr != "" ? var.clone_addr : null + clone_addr = local.have_clone_addr ? var.clone_addr : null mirror = false } + +resource "forgejo_repository_action_secret" "this" { + for_each = var.action_secrets + + repository_id = forgejo_repository.this.id + name = each.key + data = each.value +} + +resource "restapi_object" "action_variable" { + for_each = var.action_variables + + path = "/api/v1/repos/${var.forgejo_organization}/${forgejo_repository.this.name}/actions/variables/${each.key}" + id_attribute = "name" + object_id = each.key + update_method = "PUT" + data = jsonencode({ + value = each.value + }) + ignore_server_additions = true +} + +moved { + from = forgejo_repository.repository + to = forgejo_repository.this +} + +moved { + from = forgejo_repository_action_secret.action_secrets + to = forgejo_repository_action_secret.this +} + +moved { + from = restapi_object.action_variables + to = restapi_object.action_variable +} diff --git a/modules/stackit/git-repository/buildingblock/outputs.tf b/modules/stackit/git-repository/buildingblock/outputs.tf index 3e87adc2..b0ec3c3f 100644 --- a/modules/stackit/git-repository/buildingblock/outputs.tf +++ b/modules/stackit/git-repository/buildingblock/outputs.tf @@ -1,5 +1,5 @@ output "repository_id" { - value = forgejo_repository.repository.id + value = forgejo_repository.this.id description = "The ID of the created repository" } @@ -9,17 +9,17 @@ output "repository_name" { } output "repository_html_url" { - value = forgejo_repository.repository.html_url + value = forgejo_repository.this.html_url description = "Web URL of the repository" } output "repository_ssh_url" { - value = forgejo_repository.repository.ssh_url + value = forgejo_repository.this.ssh_url description = "SSH clone URL" } output "repository_clone_url" { - value = forgejo_repository.repository.clone_url + value = forgejo_repository.this.clone_url description = "HTTPS clone URL" } @@ -28,8 +28,8 @@ output "summary" { value = templatefile("${path.module}/SUMMARY.md.tftpl", { name = var.name owner = var.forgejo_organization - repo_html_url = forgejo_repository.repository.html_url - repo_clone_url = forgejo_repository.repository.clone_url + repo_html_url = forgejo_repository.this.html_url + repo_clone_url = forgejo_repository.this.clone_url clone_addr = var.clone_addr default_branch = var.default_branch }) diff --git a/modules/stackit/git-repository/buildingblock/provider.tf b/modules/stackit/git-repository/buildingblock/provider.tf deleted file mode 100644 index 87ab7ea6..00000000 --- a/modules/stackit/git-repository/buildingblock/provider.tf +++ /dev/null @@ -1,4 +0,0 @@ -provider "forgejo" { - host = var.forgejo_base_url - api_token = var.forgejo_token -} diff --git a/modules/stackit/git-repository/buildingblock/variables.tf b/modules/stackit/git-repository/buildingblock/variables.tf index d9a843a9..e909783e 100644 --- a/modules/stackit/git-repository/buildingblock/variables.tf +++ b/modules/stackit/git-repository/buildingblock/variables.tf @@ -1,20 +1,26 @@ # ── Backplane inputs (static, set once per building block definition) ────────── -variable "forgejo_base_url" { +variable "forgejo_organization" { type = string - description = "STACKIT Git base URL" - default = "https://git-service.git.onstackit.cloud" + description = "STACKIT Git organization where the repository will be created" } -variable "forgejo_token" { - type = string - description = "STACKIT Git API token (from backplane)" - sensitive = true +variable "action_variables" { + type = map(string) + description = "Map of Forgejo Actions variables to create in the repository." + default = {} } -variable "forgejo_organization" { - type = string - description = "STACKIT Git organization where the repository will be created" +variable "action_secrets" { + type = map(string) + description = "Map of Forgejo Actions secrets to create in the repository." + sensitive = false # the whole map is not sensitive, but map values are! + default = {} + + validation { + condition = alltrue([for key in keys(var.action_secrets) : (length(key) <= 30)]) + error_message = "Forgejo Actions secret names must be 30 characters or less." + } } # ── User inputs (set per building block instance) ───────────────────────────── @@ -51,6 +57,6 @@ variable "default_branch" { variable "clone_addr" { type = string - description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty to create an empty repository." - default = "" + description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty or `null` to create an empty repository." + default = "null" # supporting the null string is a workaround for the Panel UI which does not support empty string as default for optional value } diff --git a/modules/stackit/git-repository/buildingblock/versions.tf b/modules/stackit/git-repository/buildingblock/versions.tf index 3b581c8f..ebf1e4d5 100644 --- a/modules/stackit/git-repository/buildingblock/versions.tf +++ b/modules/stackit/git-repository/buildingblock/versions.tf @@ -2,9 +2,17 @@ terraform { required_version = ">= 1.4.0" required_providers { + external = { + source = "hashicorp/external" + version = "~> 2.3.0" + } forgejo = { source = "svalabs/forgejo" version = "~> 1.3.0" } + restapi = { + source = "Mastercard/restapi" + version = "3.0.0" + } } } diff --git a/modules/stackit/git-repository/meshstack_integration.tf b/modules/stackit/git-repository/meshstack_integration.tf index a071a198..2435132b 100644 --- a/modules/stackit/git-repository/meshstack_integration.tf +++ b/modules/stackit/git-repository/meshstack_integration.tf @@ -21,6 +21,22 @@ variable "forgejo_base_url" { type = string } +variable "action_secrets" { + type = map(string) + sensitive = false # the whole map is not sensitive, but map values are! + default = {} + + validation { + condition = alltrue([for key in keys(var.action_secrets) : length(key) <= 30]) + error_message = "Forgejo Actions secret names must be 30 characters or less." + } +} + +variable "action_variables" { + type = map(string) + default = {} +} + variable "hub" { type = object({ git_ref = optional(string, "main") @@ -33,9 +49,12 @@ variable "hub" { EOT } -output "building_block_definition_version_ref" { - value = var.hub.bbd_draft ? meshstack_building_block_definition.this.version_latest : meshstack_building_block_definition.this.version_latest_release - description = "Version of BBD is consumed in Building Block compositions, for example in the backplane of starter kits." +output "building_block_definition" { + value = { + uuid = meshstack_building_block_definition.this.metadata.uuid + version_ref = var.hub.bbd_draft ? meshstack_building_block_definition.this.version_latest : meshstack_building_block_definition.this.version_latest_release + } + description = "BBD is consumed in Building Block compositions, for example in the backplane of starter kits." } module "backplane" { @@ -78,19 +97,21 @@ resource "meshstack_building_block_definition" "this" { inputs = { # ── Static inputs from backplane ────────────────────────────────────── - forgejo_base_url = { - display_name = "STACKIT Git Base URL" - description = "Base URL of the STACKIT Git instance" + FORGEJO_HOST = { + display_name = "FORGEJO_HOST" + description = "The Host of the Forgejo instance to connect to." type = "STRING" assignment_type = "STATIC" + is_environment = true argument = jsonencode(var.forgejo_base_url) } - forgejo_token = { - display_name = "STACKIT Git API Token" - description = "Personal Access Token for the STACKIT Git API" + FORGEJO_API_TOKEN = { + display_name = "FORGEJO_API_TOKEN" + description = "The API token for authenticating with the Forgejo instance." type = "STRING" assignment_type = "STATIC" + is_environment = true sensitive = { argument = { secret_value = var.forgejo_token @@ -118,31 +139,62 @@ resource "meshstack_building_block_definition" "this" { } description = { - display_name = "Repository Description" - description = "Short description of the repository." - type = "STRING" - assignment_type = "USER_INPUT" - default_value = jsonencode("") + display_name = "Repository Description" + description = "Short description of the repository." + type = "STRING" + assignment_type = "USER_INPUT" + updateable_by_consumer = true + default_value = jsonencode("") } private = { - display_name = "Private Repository" - description = "If true, the repository has private visibility in Forgejo." - type = "BOOLEAN" - assignment_type = "USER_INPUT" - default_value = jsonencode(true) + display_name = "Private Repository" + description = "If true, the repository has private visibility in Forgejo." + type = "BOOLEAN" + assignment_type = "USER_INPUT" + updateable_by_consumer = true + default_value = jsonencode(true) } clone_addr = { display_name = "Clone from URL" - description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave empty to create an empty repository." + description = "Optional URL to clone into this repository, e.g. 'https://github.com/owner/repo.git'. Leave `null` to create an empty repository." type = "STRING" assignment_type = "USER_INPUT" - default_value = jsonencode("") + default_value = jsonencode("null") + } + + action_variables = { + display_name = "Repository Action Variables" + description = "Static non-sensitive map of Forgejo Actions variables created in each provisioned repository." + type = "CODE" + assignment_type = "STATIC" + # jsonencode twice is correct, see https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block_definition#argument-1 + argument = jsonencode(jsonencode(var.action_variables)) + } + + action_secrets = { + display_name = "Repository Action Secrets" + description = "Static sensitive map of Forgejo Actions secrets created in each provisioned repository." + type = "CODE" + assignment_type = "STATIC" + sensitive = { + argument = { + secret_value = jsonencode(var.action_secrets) + secret_version = nonsensitive(sha256(jsonencode(var.action_secrets))) + } + } } } outputs = { + repository_id = { + display_name = "Repository ID" + type = "INTEGER" + assignment_type = "NONE" + description = "Numeric Forgejo repository ID, primarily intended for wiring dependent building blocks." + } + repository_html_url = { display_name = "Open Repository" type = "STRING"