Added CCTV and Inlets

Makefile

@@ -0,0 +1,63 @@
+.DEFAULT_GOAL := default
+
+.PHONY: test # Run all tests, linting and format checks
+test: lint check-format run-tests
+
+.PHONY: lint # Perform lint checks against code
+lint:
+	@echo "⚠️ 'lint' unimplemented"
+
+.PHONY: check-format # Checks code formatting and returns a non-zero exit code if formatting errors found
+check-format:
+	@cd terraform && terraform fmt -check
+
+.PHONY: format # Performs automatic format fixes on all code
+format:
+	@cd terraform && terraform fmt
+
+.PHONY: run-tests # Runs all tests
+run-tests:
+	@echo "⚠️ 'run-tests' unimplemented"
+
+.PHONY: fetch-deps # Fetch all project dependencies
+fetch-deps:
+	@cd terraform && terraform init
+
+.PHONY: build # Build the project
+build: lint check-format fetch-deps
+	@echo "⚠️ 'build' unimplemented"
+
+.PHONY: docker-build # Build the docker image
+docker-build:
+	@echo "⚠️ 'docker-build' unimplemented"
+
+.PHONY: docker-publish # Push the docker image to the remote registry
+docker-publish:
+	@echo "⚠️ 'docker-publish' unimplemented"
+
+.PHONY: run # Run the application
+run:
+	@echo "⚠️ 'run' unimplemented"
+
+.PHONY: ci # Perform CI specific tasks to perform on a pull request
+ci:
+	@cd terraform
+	@PLAN=$(terraform plan)
+	@curl -X "POST" "https://git.cluster.fun/api/v1/repos/AverageMarcus/${REPO}/issues/${PR_ID}/comments?access_token=${ACCESS_TOKEN}" \
+		-H 'Content-Type: application/json; charset=utf-8' \
+		-d $'{"body": "<details><summary>Terraform Plan:</summary>'$PLAN'</details>"}'
+
+.PHONY: release # Release the latest version of the application
+release:
+	@cd terraform && terraform apply -auto-approve
+
+.PHONY: help # Show this list of commands
+help:
+	@echo "${REPO_NAME}"
+	@echo "Usage: make [target]"
+	@echo ""
+	@echo "target	description" | expand -t20
+	@echo "-----------------------------------"
+	@grep '^.PHONY: .* #' Makefile | sed 's/\.PHONY: \(.*\) # \(.*\)/\1	\2/' | expand -t20
+
+default: test build

manifests/cctv.yaml

@@ -0,0 +1,109 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cctv
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cctv-auth
+  namespace: cctv
+  annotations:
+    kube-1password: mr6spkkx7n3memkbute6ojaarm
+    kube-1password/vault: Kubernetes
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cctv-auth
+  namespace: cctv
+  labels:
+    app: cctv-auth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cctv-auth
+  template:
+    metadata:
+      labels:
+        app: cctv-auth
+    spec:
+      containers:
+      - args:
+        - --cookie-secure=false
+        - --provider=oidc
+        - --provider-display-name=Auth0
+        - --upstream=http://inlets.inlets.svc.cluster.local
+        - --http-address=$(HOST_IP):8080
+        - --redirect-url=https://cctv.cluster.fun/oauth2/callback
+        - --email-domain=*
+        - --pass-basic-auth=false
+        - --pass-access-token=false
+        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
+        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQN
+        env:
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: cctv-auth
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: cctv-auth
+        image: quay.io/oauth2-proxy/oauth2-proxy:v5.1.1
+        name: oauth-proxy
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cctv-auth
+  namespace: cctv
+  labels:
+    app: cctv-auth
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: cctv-auth
+  type: ClusterIP
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: cctv-auth
+  namespace: cctv
+  labels:
+    app: cctv-auth
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - cctv.cluster.fun
+    secretName: cctv-ingress
+  rules:
+  - host: cctv.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: cctv-auth
+          servicePort: 80

manifests/certmanager_chart.yaml

@@ -4,7 +4,9 @@ metadata:
   name: cert-manager
   labels:
     certmanager.k8s.io/disable-validation: "true"
+
 ---
+
 apiVersion: helm.fluxcd.io/v1
 kind: HelmRelease
 metadata:
@@ -14,9 +16,10 @@ spec:
   chart:
     repository: https://charts.jetstack.io
     name: cert-manager
-    version: v0.14.3
-  maxHistory: 4
+    version: v0.15.0
+  maxHistory: 5
   values:
+    installCRDs: "true"
     resources:
       requests:
         cpu: 10m

manifests/inlets.yaml

@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: inlets
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: inlets
+  namespace: inlets
+  annotations:
+    kube-1password: podju6t2s2osc3vbkimyce25ti
+    kube-1password/vault: Kubernetes
+    kube-1password/password-key: token
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: inlets
+  namespace: inlets
+  labels:
+    app: inlets
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      protocol: TCP
+      targetPort: 8000
+  selector:
+    app: inlets
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: inlets
+  namespace: inlets
+  labels:
+    app: inlets
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: inlets
+  template:
+    metadata:
+      labels:
+        app: inlets
+    spec:
+      containers:
+      - name: inlets
+        image: inlets/inlets:2.7.0
+        imagePullPolicy: Always
+        command: ["inlets"]
+        args:
+        - "server"
+        - "--token-from=/var/inlets/token"
+        volumeMounts:
+          - name: inlets-token-volume
+            mountPath: /var/inlets/
+      volumes:
+        - name: inlets-token-volume
+          secret:
+            secretName: inlets
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: inlets
+  namespace: inlets
+spec:
+  rules:
+  - host: inlets.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: inlets
+          servicePort: 80

tekton/bindings/gitea.yaml

@@ -17,3 +17,5 @@ spec:
     value: $(body.repository.name)
   - name: isprivate
     value: $(body.repository.private)
+  - name: prid
+    value: $(body.number)

tekton/pipelines/pr.yaml

@@ -69,6 +69,10 @@ spec:
       params:
         - name: TARGET
           value: "ci"
+        - name: REPO
+          value: $(params.projectname)
+        - name: PR_ID
+          value: $(params.prid)
       resources:
         inputs:
           - name: src

tekton/tasks/make.yaml

@@ -17,3 +17,13 @@ spec:
     image: docker.cluster.fun/averagemarcus/ci-builder:latest
     script: |
       make --dry-run -t $(params.TARGET) &> /dev/null && make $(params.TARGET) || echo "No '$(params.TARGET)' target found, skipping"
+    env:
+    - name: REPO
+      value: $(params.REPO)
+    - name: PR_ID
+      value: $(params.PR_ID)
+    - name: ACCESS_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: gitea-access-token
+          key: access-token

tekton/triggertemplates/pr.yaml

@@ -15,6 +15,8 @@ spec:
       description: The ref of the PR
     - name: projectname
       description: The name of the git project
+    - name: prid
+      description: The number of the PR
   resourcetemplates:
     - apiVersion: tekton.dev/v1beta1
       kind: PipelineRun
@@ -31,6 +33,8 @@ spec:
             value: $(params.gitrevision)
           - name: projectname
             value: $(params.projectname)
+          - name: prid
+            value: $(params.prid)
         resources:
           - name: git-source
             resourceSpec:

terraform/kubernetes-charts.tf

@@ -1,8 +1,8 @@
 provider "helm" {
   kubernetes {
     load_config_file = false
-    host  = scaleway_k8s_cluster_beta.k8s-cluster.kubeconfig[0].host
-    token = scaleway_k8s_cluster_beta.k8s-cluster.kubeconfig[0].token
+    host             = scaleway_k8s_cluster_beta.k8s-cluster.kubeconfig[0].host
+    token            = scaleway_k8s_cluster_beta.k8s-cluster.kubeconfig[0].token
     cluster_ca_certificate = base64decode(
       scaleway_k8s_cluster_beta.k8s-cluster.kubeconfig[0].cluster_ca_certificate
     )

terraform/kubernetes-cluster.tf

@@ -14,12 +14,12 @@ resource "scaleway_k8s_cluster_beta" "k8s-cluster" {
 
 
 resource "scaleway_k8s_pool_beta" "k8s-cluster-pool-1" {
-  cluster_id = scaleway_k8s_cluster_beta.k8s-cluster.id
-  name = "node pool 1"
-  node_type = "DEV1-M"
-  size = 1
-  min_size = 1
-  max_size = 2
+  cluster_id  = scaleway_k8s_cluster_beta.k8s-cluster.id
+  name        = "node pool 1"
+  node_type   = "DEV1-M"
+  size        = 1
+  min_size    = 1
+  max_size    = 2
   autoscaling = true
   autohealing = true
 }

terraform/kubernetes-manifests.tf

@@ -8,24 +8,24 @@ provider "kubectl" {
 }
 
 resource "kubectl_manifest" "manifests" {
-  for_each = fileset(path.module, "../manifests/*")
+  for_each  = fileset(path.module, "../manifests/*")
   yaml_body = file(each.key)
 }
 
 
 resource "kubectl_manifest" "tekton-install" {
-  for_each = fileset(path.module, "../tekton/1-Install/*")
+  for_each  = fileset(path.module, "../tekton/1-Install/*")
   yaml_body = file(each.key)
 }
 
 resource "kubectl_manifest" "tekton-setup" {
-  for_each = fileset(path.module, "../tekton/2-Setup/*")
+  for_each  = fileset(path.module, "../tekton/2-Setup/*")
   yaml_body = file(each.key)
 }
 
 
 resource "kubectl_manifest" "tekton" {
-  for_each = fileset(path.module, "../tekton/{bindings,conditions,eventlisteners,pipelines,tasks,triggertemplates}/*")
+  for_each  = fileset(path.module, "../tekton/{bindings,conditions,eventlisteners,pipelines,tasks,triggertemplates}/*")
   yaml_body = file(each.key)
 }
 

terraform/provider.tf

@@ -1,5 +1,5 @@
 provider "scaleway" {
-  zone   = "fr-par-1"
-  region = "fr-par"
+  zone            = "fr-par-1"
+  region          = "fr-par"
   organization_id = "5c1e5e2a-a6cd-4eb3-907f-2a83a29668fc"
 }