Skip to content

Commit 6773186

Browse files
minmzzhangmlorenzofr
minmzzhang
and
mlorenzofr
authored
feat: add feature-aware values-hub.yaml generator (#119)
* feat: add feature-aware values-hub.yaml generator Add a declarative, composable YAML generator using ruamel.yaml for producing values-hub.yaml overrides per deployment scenario. Features are defined as small YAML fragment files under scripts/features/ with automatic dependency resolution. Supported scenarios: rhtpa, quay, rhtas, pipelines, storage, and full supply-chain (with registry option 1/2/3). Usage: python3 scripts/gen-feature-variants.py --features rhtpa python3 scripts/gen-feature-variants.py --features supply-chain --registry-option all Signed-off-by: Min Zhang <minzhang@redhat.com> * fix: address review feedback for gen-feature-variants - Rename _merge_into to merge_into_applications for clarity on which section it targets (review: Manuel) - Strip comments from clusterGroup.namespaces/subscriptions/ applications in generated output to avoid confusing placement of commented-out blocks near merged content; preserve all other comments (top-level headers, spire, sharedValueFiles, imperative, etc.) - Add gen-feature-variants.md with environment setup and usage Signed-off-by: Min Zhang <minzhang@redhat.com> * fix: align gen-feature-variants with PR #99 review refactor Update feature YAML files and gen-feature-variants script/docs for: - org -> repository (e.g. "ztvp/qtodo") - embeddedOCP -> embeddedOpenShift - Rename option-3-embedded-ocp.yaml -> option-3-embedded-openshift.yaml Signed-off-by: Min Zhang <minzhang@redhat.com> * chore: add __pycache__ and *.pyc to .gitignore Signed-off-by: Min Zhang <minzhang@redhat.com> * fix: rename embedded-ocp to embedded-openshift in output filenames Signed-off-by: Min Zhang <minzhang@redhat.com> * fix: sync supply-chain feature with PR review feedback - Add empty supply-chain and qtodo override placeholders in features/supply-chain.yaml for future enablement - Pin RHTAS operator channel to stable-v1.3 Signed-off-by: Min Zhang <minzhang@redhat.com> * chore: remove legacy gen-byo-container-registry-variants.py The new gen-feature-variants.py covers all registry options declaratively; no need to maintain two generators. Signed-off-by: Min Zhang <minzhang@redhat.com> * Override value job.image in quay-registry application --------- Signed-off-by: Min Zhang <minzhang@redhat.com> Co-authored-by: Manuel Lorenzo <mlorenzofr@gmail.com>
1 parent b9352f9 commit 6773186

15 files changed

Lines changed: 929 additions & 534 deletions

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ super-linter-output
1414
# GitHub Actions leftovers
1515
github_conf
1616

17+
# Python bytecode cache
18+
__pycache__/
19+
*.pyc
20+
1721
# Editor and IDE specific files
1822
.cursorrules
1923
.cursor/

‎scripts/features/features.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Feature registry for gen-feature-variants.py
2+
# Each feature maps to a YAML fragment file in this directory.
3+
# Dependencies are resolved automatically (topological order).
4+
features:
5+
storage:
6+
description: "ODF object storage + NooBaa MCG (S3 backend)"
7+
depends_on: []
8+
9+
quay:
10+
description: "Red Hat Quay container registry"
11+
depends_on: [storage]
12+
13+
rhtas:
14+
description: "Red Hat Trusted Artifact Signer (SPIFFE + Email)"
15+
depends_on: []
16+
17+
rhtpa:
18+
description: "Red Hat Trusted Profile Analyzer"
19+
depends_on: [storage]
20+
21+
pipelines:
22+
description: "OpenShift Pipelines"
23+
depends_on: []
24+
25+
supply-chain:
26+
description: "Full secure supply chain pipeline"
27+
depends_on: [pipelines, rhtas, rhtpa, storage]
28+
registry_option_required: true
29+
org: ztvp
30+
image_name: qtodo
31+
32+
# Registry options (only used with supply-chain feature)
33+
# Each maps to a file under registry/ subdirectory.
34+
registry_options:
35+
1:
36+
label: "built-in-quay-registry"
37+
file: "registry/option-1-quay.yaml"
38+
2:
39+
label: "byo-external-registry"
40+
file: "registry/option-2-byo.yaml"
41+
3:
42+
label: "embedded-openshift-registry"
43+
file: "registry/option-3-embedded-openshift.yaml"

‎scripts/features/pipelines.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# OpenShift Pipelines (Tekton)
2+
# Required for the secure supply chain pipeline flow
3+
clusterGroup:
4+
namespaces:
5+
- openshift-pipelines
6+
7+
subscriptions:
8+
openshift-pipelines:
9+
name: openshift-pipelines-operator-rh
10+
namespace: openshift-operators

‎scripts/features/quay.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Red Hat Quay container registry
2+
# Depends on: storage (ODF + NooBaa MCG for backend)
3+
clusterGroup:
4+
namespaces:
5+
- quay-enterprise:
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "32"
8+
labels:
9+
openshift.io/cluster-monitoring: "true"
10+
11+
subscriptions:
12+
quay-operator:
13+
name: quay-operator
14+
namespace: openshift-operators
15+
channel: stable-3.15
16+
annotations:
17+
argocd.argoproj.io/sync-wave: "28"
18+
19+
applications:
20+
quay-registry:
21+
name: quay-registry
22+
namespace: quay-enterprise
23+
project: hub
24+
chart: quay
25+
chartVersion: 0.1.*
26+
annotations:
27+
argocd.argoproj.io/sync-wave: "41"

‎scripts/features/registry/option-1-quay.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# OPTION 1: Built-in Quay Registry
2+
# Enables global.registry pointing to the pattern's own Quay instance.
3+
# Includes Quay namespace, subscription, and application (only needed for option 1).
4+
# Adds quay.enabled and registry.tlsVerify overrides to supply-chain app.
5+
# Adds imagePullTrust to ztvp-certificates for node-level kubelet trust.
6+
global:
7+
registry:
8+
enabled: true
9+
domain: "quay-registry-quay-quay-enterprise.apps.{{ .Values.global.clusterDomain }}"
10+
# Placeholders auto-replaced by the generator (supply-chain defines org=ztvp, image_name=qtodo)
11+
repository: org/image-name
12+
user: quay-user
13+
vaultPath: "secret/data/hub/infra/quay/quay-users"
14+
passwordVaultKey: "quay-user-password"
15+
16+
clusterGroup:
17+
namespaces:
18+
- quay-enterprise:
19+
annotations:
20+
argocd.argoproj.io/sync-wave: "32"
21+
labels:
22+
openshift.io/cluster-monitoring: "true"
23+
24+
subscriptions:
25+
quay-operator:
26+
name: quay-operator
27+
namespace: openshift-operators
28+
channel: stable-3.15
29+
annotations:
30+
argocd.argoproj.io/sync-wave: "28"
31+
32+
applications:
33+
quay-registry:
34+
name: quay-registry
35+
namespace: quay-enterprise
36+
project: hub
37+
chart: quay
38+
chartVersion: 0.1.*
39+
annotations:
40+
argocd.argoproj.io/sync-wave: "41"
41+
overrides:
42+
- name: job.image
43+
value: "registry.redhat.io/openshift4/ose-cli:latest"
44+
45+
merge_into_applications:
46+
supply-chain:
47+
overrides:
48+
- name: quay.enabled
49+
value: "true"
50+
- name: registry.tlsVerify
51+
value: "false"
52+
- name: rhtas.enabled
53+
value: "true"
54+
- name: rhtpa.enabled
55+
value: "true"
56+
ztvp-certificates:
57+
overrides:
58+
- name: imagePullTrust.enabled
59+
value: "true"
60+
- name: imagePullTrust.registries[0]
61+
value: "quay-registry-quay-quay-enterprise.apps.{{ $.Values.global.clusterDomain }}"

‎scripts/features/registry/option-2-byo.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# OPTION 2: BYO/External Registry (quay.io, ghcr.io, etc.)
2+
# Enables global.registry pointing to an external registry.
3+
# No imagePullTrust needed (external registries use public CAs).
4+
# After generating, update domain/repository/user below and set the password
5+
# in ~/values-secret.yaml (see docs/supply-chain.md for details).
6+
global:
7+
registry:
8+
enabled: true
9+
domain: quay.io
10+
# Placeholders auto-replaced by the generator (supply-chain defines org=ztvp, image_name=qtodo)
11+
repository: org/image-name
12+
user: your-username
13+
vaultPath: "secret/data/hub/infra/registry/registry-user"
14+
passwordVaultKey: "registry-password"
15+
16+
clusterGroup:
17+
merge_into_applications:
18+
supply-chain:
19+
overrides:
20+
- name: rhtas.enabled
21+
value: "true"
22+
- name: rhtpa.enabled
23+
value: "true"

‎scripts/features/registry/option-3-embedded-openshift.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# OPTION 3: Embedded OpenShift Image Registry
2+
# Enables global.registry pointing to the built-in OpenShift image registry.
3+
# Adds embeddedOpenShift overrides to supply-chain app.
4+
# Adds imagePullTrust to ztvp-certificates for node-level kubelet trust.
5+
global:
6+
registry:
7+
enabled: true
8+
domain: "default-route-openshift-image-registry.apps.{{ .Values.global.clusterDomain }}"
9+
# Placeholders auto-replaced by the generator (supply-chain defines org=ztvp, image_name=qtodo)
10+
repository: org/image-name
11+
user: _token
12+
vaultPath: "secret/data/hub/infra/registry/registry-user"
13+
passwordVaultKey: "registry-password"
14+
15+
clusterGroup:
16+
merge_into_applications:
17+
supply-chain:
18+
overrides:
19+
- name: registry.embeddedOpenShift.ensureImageNamespaceRBAC
20+
value: "true"
21+
- name: registry.embeddedOpenShift.tokenRefresher.enabled
22+
value: "true"
23+
- name: rhtas.enabled
24+
value: "true"
25+
- name: rhtpa.enabled
26+
value: "true"
27+
ztvp-certificates:
28+
overrides:
29+
- name: imagePullTrust.enabled
30+
value: "true"
31+
- name: imagePullTrust.registries[0]
32+
value: "default-route-openshift-image-registry.apps.{{ $.Values.global.clusterDomain }}"

‎scripts/features/rhtas.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Red Hat Trusted Artifact Signer (RHTAS) with SPIFFE + Email issuers
2+
# Depends on: Vault, SPIRE, Keycloak (all in base config)
3+
clusterGroup:
4+
namespaces:
5+
- trusted-artifact-signer:
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "32"
8+
labels:
9+
openshift.io/cluster-monitoring: "true"
10+
11+
subscriptions:
12+
rhtas-operator:
13+
name: rhtas-operator
14+
namespace: openshift-operators
15+
channel: stable-v1.3
16+
annotations:
17+
argocd.argoproj.io/sync-wave: "29"
18+
catalogSource: redhat-operators
19+
20+
applications:
21+
trusted-artifact-signer:
22+
name: trusted-artifact-signer
23+
namespace: trusted-artifact-signer
24+
project: hub
25+
path: charts/rhtas-operator
26+
annotations:
27+
argocd.argoproj.io/sync-wave: "46"
28+
overrides:
29+
- name: rhtas.zeroTrust.spire.enabled
30+
value: "true"
31+
- name: rhtas.zeroTrust.spire.trustDomain
32+
value: "apps.{{ $.Values.global.clusterDomain }}"
33+
- name: rhtas.zeroTrust.spire.issuer
34+
value: "https://spire-spiffe-oidc-discovery-provider.apps.{{ $.Values.global.clusterDomain }}"
35+
- name: rhtas.zeroTrust.email.enabled
36+
value: "true"
37+
- name: rhtas.zeroTrust.email.issuer
38+
value: "https://keycloak.apps.{{ $.Values.global.clusterDomain }}/realms/ztvp"

‎scripts/features/rhtpa.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Red Hat Trusted Profile Analyzer (RHTPA) with SPIFFE Integration
2+
# Depends on: storage (NooBaa MCG), Vault, SPIRE, Keycloak
3+
clusterGroup:
4+
namespaces:
5+
- rhtpa-operator:
6+
operatorGroup: true
7+
targetNamespace: rhtpa-operator
8+
annotations:
9+
argocd.argoproj.io/sync-wave: "26"
10+
- trusted-profile-analyzer:
11+
annotations:
12+
argocd.argoproj.io/sync-wave: "32"
13+
labels:
14+
openshift.io/cluster-monitoring: "true"
15+
16+
subscriptions:
17+
rhtpa-operator:
18+
name: rhtpa-operator
19+
namespace: rhtpa-operator
20+
channel: stable-v1.1
21+
catalogSource: redhat-operators
22+
annotations:
23+
argocd.argoproj.io/sync-wave: "27"
24+
25+
applications:
26+
trusted-profile-analyzer:
27+
name: trusted-profile-analyzer
28+
namespace: trusted-profile-analyzer
29+
project: hub
30+
path: charts/rhtpa-operator
31+
annotations:
32+
argocd.argoproj.io/sync-wave: "41"
33+
ignoreDifferences:
34+
- group: batch
35+
kind: Job
36+
jsonPointers:
37+
- /status
38+
39+
merge_into_applications:
40+
vault:
41+
jwt:
42+
roles:
43+
- name: rhtpa
44+
audience: rhtpa
45+
subject: "spiffe://apps.{{ $.Values.global.clusterDomain }}/ns/trusted-profile-analyzer/sa/rhtpa"
46+
policies:
47+
- hub-infra-rhtpa-jwt-secret

‎scripts/features/storage.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# ODF + NooBaa MCG: shared object storage backend
2+
# Required for RHTPA and Quay (provides S3-compatible storage via NooBaa MCG)
3+
clusterGroup:
4+
namespaces:
5+
- openshift-storage:
6+
operatorGroup: true
7+
targetNamespace: openshift-storage
8+
annotations:
9+
openshift.io/cluster-monitoring: "true"
10+
argocd.argoproj.io/sync-wave: "26"
11+
12+
subscriptions:
13+
odf:
14+
name: odf-operator
15+
namespace: openshift-storage
16+
channel: stable-4.20
17+
annotations:
18+
argocd.argoproj.io/sync-wave: "27"
19+
20+
applications:
21+
noobaa-mcg:
22+
name: noobaa-mcg
23+
namespace: openshift-storage
24+
project: hub
25+
path: charts/noobaa-mcg
26+
annotations:
27+
argocd.argoproj.io/sync-wave: "36"

0 commit comments

Comments
 (0)