openshift-pipelines added to pattern

- Externalized charts for pipelines, hypershift and cluster-autoscaler
- Pipelines have been added for deploying hive and hypershift clusters
- Added chart for hcp-cli imagestream
- Added letsencrypt(cert-manager) chart

Author: day0hero

.gitignore

@@ -8,3 +8,4 @@ vault.init
 super-linter.log
 common/pattern-vault.init
 .cursor/*
+examples/*

charts/all/hcp-cli/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: hcp-cli
+description: Builds the hcp CLI from ConsoleCLIDownload into an ImageStream for pipeline use
+type: application
+version: 0.1.0
+appVersion: "0.1.0"

charts/all/hcp-cli/templates/buildconfig.yaml

@@ -0,0 +1,38 @@
+apiVersion: build.openshift.io/v1
+kind: BuildConfig
+metadata:
+  name: {{ .Values.buildConfig.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  {{- if .Values.buildConfig.schedule }}
+  triggers:
+  - type: ConfigChange
+  - type: Cron
+    cron:
+      schedule: {{ .Values.buildConfig.schedule | quote }}
+  {{- else }}
+  triggers:
+  - type: ConfigChange
+  {{- end }}
+  runPolicy: Serial
+  serviceAccount: {{ .Values.serviceAccount.name }}
+  source:
+    type: Dockerfile
+    dockerfile: |
+      FROM {{ .Values.buildConfig.baseImage }} AS base
+
+      USER root
+      RUN curl -sSL "http://{{ .Values.buildConfig.hcpDownloadService }}/linux/amd64/hcp.tar.gz" \
+            -o /tmp/hcp.tar.gz && \
+          tar xzf /tmp/hcp.tar.gz -C /usr/local/bin && \
+          chmod +x /usr/local/bin/hcp && \
+          rm -f /tmp/hcp.tar.gz && \
+          hcp version
+  strategy:
+    type: Docker
+    dockerStrategy:
+      noCache: true
+  output:
+    to:
+      kind: ImageStreamTag
+      name: {{ .Values.imageStream.name }}:latest

charts/all/hcp-cli/templates/imagestream.yaml

@@ -0,0 +1,8 @@
+apiVersion: image.openshift.io/v1
+kind: ImageStream
+metadata:
+  name: {{ .Values.imageStream.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  lookupPolicy:
+    local: true

charts/all/hcp-cli/templates/rbac.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  namespace: {{ .Values.namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+rules:
+- apiGroups: ["console.openshift.io"]
+  resources: ["consoleclidownloads"]
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.serviceAccount.name }}
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccount.name }}
+  namespace: {{ .Values.namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Values.serviceAccount.name }}-builder
+  namespace: {{ .Values.namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:image-builder
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccount.name }}
+  namespace: {{ .Values.namespace }}

charts/all/hcp-cli/values.yaml

@@ -0,0 +1,17 @@
+namespace: cluster-provisioning
+
+imageStream:
+  name: hcp-cli
+
+buildConfig:
+  name: hcp-cli
+  # Base image that provides oc + kubectl
+  baseImage: quay.io/openshift/origin-cli:latest
+  # Schedule periodic rebuilds to pick up new hcp versions (cron format, empty to disable)
+  schedule: ""
+  # Internal service that serves the hcp CLI binaries (runs in the multicluster-engine namespace)
+  hcpDownloadService: hcp-cli-download.multicluster-engine.svc.cluster.local
+
+serviceAccount:
+  # SA used by the BuildConfig — needs permission to read consoleclidownloads
+  name: hcp-cli-builder