Fix kamaji to use default kubelet-config

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @kvaps

ADOPTERS.md

@@ -26,3 +26,6 @@ This list is sorted in chronological order, based on the submission date.
 | Organization | Contact | Date | Description of Use |
 | ------------ | ------- | ---- | ------------------ |
 | [Ænix](https://aenix.io/) | @kvaps | 2024-02-14 | Ænix provides consulting services for cloud providers and uses Cozystack as the main tool for organizing managed services for them. |
+| [Mediatech](https://mediatech.dev/) | @ugenk | 2024-05-01 | We're developing and hosting software for our and our custmer services. We're using cozystack as a kubernetes distribution for that. |
+| [Bootstack](https://bootstack.app/) | @mrkhachaturov | 2024-08-01| At Bootstack, we utilize a Kubernetes operator specifically designed to simplify and streamline cloud infrastructure creation.|
+| [gohost](https://gohost.kz/) | @karabass_off | 2024-02-01| Our company has been working in the market of Kazakhstan for more than 15 years, providing clients with a standard set of services: VPS/VDC, IaaS, shared hosting, etc. Now we are expanding the lineup by introducing Bare Metal Kubenetes cluster under Cozystack management.|

Makefile

@@ -3,7 +3,10 @@
 build:
 	make -C packages/apps/http-cache image
 	make -C packages/apps/kubernetes image
+	make -C packages/system/cilium image
+	make -C packages/system/kubeovn image
 	make -C packages/system/dashboard image
+	make -C packages/system/kamaji image
 	make -C packages/core/installer image
 	make manifests
 
@@ -18,6 +21,8 @@ repos:
 	make -C packages/system repo
 	make -C packages/apps repo
 	make -C packages/extra repo
+	mkdir -p _out/logos
+	cp ./packages/apps/*/logos/*.svg ./packages/extra/*/logos/*.svg _out/logos/
 
 assets:
 	make -C packages/core/installer/ assets

hack/e2e.sh

@@ -0,0 +1,318 @@
+#!/bin/bash
+if [ "$COZYSTACK_INSTALLER_YAML" = "" ]; then
+  echo 'COZYSTACK_INSTALLER_YAML variable is not set!' >&2
+  echo 'please set it with following command:' >&2
+  echo >&2
+  echo 'export COZYSTACK_INSTALLER_YAML=$(helm template -n cozy-system installer packages/core/installer)' >&2
+  echo >&2
+  exit 1
+fi
+
+if [ "$(cat /proc/sys/net/ipv4/ip_forward)" != 1 ]; then
+  echo "IPv4 forwarding is not enabled!" >&2
+  echo 'please enable forwarding with the following command:' >&2
+  echo >&2
+  echo 'echo 1 > /proc/sys/net/ipv4/ip_forward' >&2
+  echo >&2
+  exit 1
+fi
+
+set -x
+set -e
+
+kill `cat srv1/qemu.pid srv2/qemu.pid srv3/qemu.pid` || true
+
+ip link del cozy-br0 || true
+ip link add cozy-br0 type bridge
+ip link set cozy-br0 up
+ip addr add 192.168.123.1/24 dev cozy-br0
+
+# Enable forward & masquerading
+echo 1 > /proc/sys/net/ipv4/ip_forward
+iptables -t nat -A POSTROUTING -s 192.168.123.0/24 -j MASQUERADE
+
+rm -rf srv1 srv2 srv3
+mkdir -p srv1 srv2 srv3
+
+# Prepare cloud-init
+for i in 1 2 3; do
+  echo "local-hostname: srv$i" > "srv$i/meta-data"
+  echo '#cloud-config' > "srv$i/user-data"
+  cat > "srv$i/network-config" <<EOT
+version: 2
+ethernets:
+  eth0:
+    dhcp4: false
+    addresses:
+      - "192.168.123.1$i/26"
+    gateway4: "192.168.123.1"
+    nameservers:
+      search: [cluster.local]
+      addresses: [8.8.8.8]
+EOT
+
+  ( cd srv$i && genisoimage \
+      -output seed.img \
+      -volid cidata -rational-rock -joliet \
+      user-data meta-data network-config
+  )
+done
+
+# Prepare system drive
+if [ ! -f nocloud-amd64.raw ]; then
+  wget https://github.com/aenix-io/cozystack/releases/latest/download/nocloud-amd64.raw.xz -O nocloud-amd64.raw.xz
+  rm -f nocloud-amd64.raw
+  xz --decompress nocloud-amd64.raw.xz
+fi
+for i in 1 2 3; do
+  cp nocloud-amd64.raw srv$i/system.img
+  qemu-img resize srv$i/system.img 20G
+done
+
+# Prepare data drives
+for i in 1 2 3; do
+  qemu-img create srv$i/data.img 100G
+done
+
+# Prepare networking
+for i in 1 2 3; do
+  ip link del cozy-srv$i || true
+  ip tuntap add dev cozy-srv$i mode tap
+  ip link set cozy-srv$i up
+  ip link set cozy-srv$i master cozy-br0
+done
+
+# Start VMs
+for i in 1 2 3; do
+  qemu-system-x86_64 -machine type=pc,accel=kvm -cpu host -smp 4 -m 8192 \
+    -device virtio-net,netdev=net0,mac=52:54:00:12:34:5$i -netdev tap,id=net0,ifname=cozy-srv$i,script=no,downscript=no \
+    -drive file=srv$i/system.img,if=virtio,format=raw \
+    -drive file=srv$i/seed.img,if=virtio,format=raw \
+    -drive file=srv$i/data.img,if=virtio,format=raw \
+    -display none -daemonize -pidfile srv$i/qemu.pid
+done
+
+sleep 5
+
+# Wait for VM to start up
+timeout 60 sh -c 'until nc -nzv 192.168.123.11 50000 && nc -nzv 192.168.123.12 50000 && nc -nzv 192.168.123.13 50000; do sleep 1; done'
+
+cat > patch.yaml <<\EOT
+machine:
+  kubelet:
+    nodeIP:
+      validSubnets:
+      - 192.168.123.0/24
+    extraConfig:
+      maxPods: 512
+  kernel:
+    modules:
+    - name: openvswitch
+    - name: drbd
+      parameters:
+        - usermode_helper=disabled
+    - name: zfs
+    - name: spl
+  install:
+    image: ghcr.io/aenix-io/cozystack/talos:v1.7.1
+  files:
+  - content: |
+      [plugins]
+        [plugins."io.containerd.grpc.v1.cri"]
+          device_ownership_from_security_context = true      
+    path: /etc/cri/conf.d/20-customization.part
+    op: create
+
+cluster:
+  network:
+    cni:
+      name: none
+    dnsDomain: cozy.local
+    podSubnets:
+    - 10.244.0.0/16
+    serviceSubnets:
+    - 10.96.0.0/16
+EOT
+
+cat > patch-controlplane.yaml <<\EOT
+machine:
+  network:
+    interfaces:
+    - interface: eth0
+      vip:
+        ip: 192.168.123.10
+cluster:
+  allowSchedulingOnControlPlanes: true
+  controllerManager:
+    extraArgs:
+      bind-address: 0.0.0.0
+  scheduler:
+    extraArgs:
+      bind-address: 0.0.0.0
+  apiServer:
+    certSANs:
+    - 127.0.0.1
+  proxy:
+    disabled: true
+  discovery:
+    enabled: false
+  etcd:
+    advertisedSubnets:
+    - 192.168.123.0/24
+EOT
+
+# Gen configuration
+if [ ! -f secrets.yaml ]; then
+  talosctl gen secrets
+fi
+
+rm -f controlplane.yaml worker.yaml talosconfig kubeconfig
+talosctl gen config --with-secrets secrets.yaml cozystack https://192.168.123.10:6443 --config-patch=@patch.yaml --config-patch-control-plane @patch-controlplane.yaml
+export TALOSCONFIG=$PWD/talosconfig
+
+# Apply configuration
+talosctl apply -f controlplane.yaml -n 192.168.123.11 -e 192.168.123.11 -i
+talosctl apply -f controlplane.yaml -n 192.168.123.12 -e 192.168.123.12 -i
+talosctl apply -f controlplane.yaml -n 192.168.123.13 -e 192.168.123.13 -i
+
+# Wait for VM to be configured
+timeout 60 sh -c 'until nc -nzv 192.168.123.11 50000 && nc -nzv 192.168.123.12 50000 && nc -nzv 192.168.123.13 50000; do sleep 1; done'
+
+# Bootstrap
+talosctl bootstrap -n 192.168.123.11 -e 192.168.123.11
+
+# Wait for etcd
+timeout 120 sh -c 'while talosctl etcd members -n 192.168.123.11,192.168.123.12,192.168.123.13 -e 192.168.123.10 2>&1 | grep "rpc error"; do sleep 1; done'
+
+rm -f kubeconfig
+talosctl kubeconfig kubeconfig -e 192.168.123.10 -n 192.168.123.10
+export KUBECONFIG=$PWD/kubeconfig
+
+# Wait for kubernetes nodes appear
+timeout 60 sh -c 'until [ $(kubectl get node -o name | wc -l) = 3 ]; do sleep 1; done'
+kubectl create ns cozy-system
+kubectl create -f - <<\EOT
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cozystack
+  namespace: cozy-system
+data:
+  bundle-name: "paas-full"
+  ipv4-pod-cidr: "10.244.0.0/16"
+  ipv4-pod-gateway: "10.244.0.1"
+  ipv4-svc-cidr: "10.96.0.0/16"
+  ipv4-join-cidr: "100.64.0.0/16"
+EOT
+
+#
+echo "$COZYSTACK_INSTALLER_YAML" | kubectl apply -f -
+
+# wait for cozystack pod to start
+kubectl wait deploy  --timeout=1m --for=condition=available -n cozy-system cozystack
+
+# wait for helmreleases appear
+timeout 60 sh -c 'until kubectl get hr -A | grep cozy; do sleep 1; done'
+
+sleep 5
+
+kubectl get hr -A | awk 'NR>1 {print "kubectl wait --timeout=15m --for=condition=ready -n " $1 " hr/" $2 " &"} END{print "wait"}' | sh -x
+# Wait for linstor controller
+kubectl wait deploy --timeout=5m --for=condition=available -n cozy-linstor linstor-controller
+
+# Wait for all linstor nodes become Online
+timeout 60 sh -c 'until [ $(kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor node list | grep -c Online) = 3 ]; do sleep 1; done'
+
+kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor ps cdp zfs srv1 /dev/vdc --pool-name data --storage-pool data
+kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor ps cdp zfs srv2 /dev/vdc --pool-name data --storage-pool data
+kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor ps cdp zfs srv3 /dev/vdc --pool-name data --storage-pool data
+
+kubectl create -f- <<EOT
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: local
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: linstor.csi.linbit.com
+parameters:
+  linstor.csi.linbit.com/storagePool: "data"
+  linstor.csi.linbit.com/layerList: "storage"
+  linstor.csi.linbit.com/allowRemoteVolumeAccess: "false"
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: true
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: replicated
+provisioner: linstor.csi.linbit.com
+parameters:
+  linstor.csi.linbit.com/storagePool: "data"
+  linstor.csi.linbit.com/autoPlace: "3"
+  linstor.csi.linbit.com/layerList: "drbd storage"
+  linstor.csi.linbit.com/allowRemoteVolumeAccess: "true"
+  property.linstor.csi.linbit.com/DrbdOptions/auto-quorum: suspend-io
+  property.linstor.csi.linbit.com/DrbdOptions/Resource/on-no-data-accessible: suspend-io
+  property.linstor.csi.linbit.com/DrbdOptions/Resource/on-suspended-primary-outdated: force-secondary
+  property.linstor.csi.linbit.com/DrbdOptions/Net/rr-conflict: retry-connect
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: true
+EOT
+kubectl create -f- <<EOT
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: cozystack
+  namespace: cozy-metallb
+spec:
+  ipAddressPools:
+  - cozystack
+---
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: cozystack
+  namespace: cozy-metallb
+spec:
+  addresses:
+  - 192.168.123.200-192.168.123.250
+  autoAssign: true
+  avoidBuggyIPs: false
+EOT
+
+kubectl patch -n tenant-root hr/tenant-root --type=merge -p '{"spec":{ "values":{
+  "host": "example.org",
+  "ingress": true,
+  "monitoring": true,
+  "etcd": true
+}}}'
+
+# Wait for HelmRelease be created
+timeout 60 sh -c 'until kubectl get hr -n tenant-root etcd ingress monitoring tenant-root; do sleep 1; done'
+
+# Wait for HelmReleases be installed
+kubectl wait --timeout=2m --for=condition=ready -n tenant-root hr etcd ingress monitoring tenant-root
+
+# Wait for nginx-ingress-controller
+timeout 60 sh -c 'until kubectl get deploy -n tenant-root root-ingress-controller; do sleep 1; done'
+kubectl wait --timeout=5m --for=condition=available -n tenant-root deploy root-ingress-controller
+
+# Wait for etcd
+kubectl wait --timeout=5m --for=jsonpath=.status.readyReplicas=3 -n tenant-root sts etcd
+
+# Wait for Victoria metrics
+kubectl wait --timeout=5m --for=condition=available deploy -n tenant-root vmalert-vmalert vminsert-longterm vminsert-shortterm
+kubectl wait --timeout=5m --for=jsonpath=.status.readyReplicas=2 -n tenant-root sts vmalertmanager-alertmanager vmselect-longterm vmselect-shortterm vmstorage-longterm vmstorage-shortterm
+
+# Wait for grafana
+kubectl wait --timeout=5m --for=condition=ready -n tenant-root clusters.postgresql.cnpg.io grafana-db
+kubectl wait --timeout=5m --for=condition=available -n tenant-root deploy grafana-deployment 
+
+# Get IP of nginx-ingress
+ip=$(kubectl get svc -n tenant-root root-ingress-controller -o jsonpath='{.status.loadBalancer.ingress..ip}')
+
+# Check Grafana
+curl -sS -k "https://$ip" -H 'Host: grafana.example.org' | grep Found

manifests/cozystack-installer.yaml

@@ -68,7 +68,7 @@ spec:
       serviceAccountName: cozystack
       containers:
       - name: cozystack
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.5.0"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.10.1"
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: localhost
@@ -87,7 +87,7 @@ spec:
             fieldRef:
               fieldPath: metadata.name
       - name: darkhttpd
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.5.0"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.10.1"
         command:
         - /usr/bin/darkhttpd
         - /cozystack/assets

packages/apps/Makefile

@@ -11,7 +11,7 @@ repo:
 	rm -rf "$(TMP)"
 
 fix-chartnames:
-	find . -name Chart.yaml -maxdepth 2 | awk -F/ '{print $$2}' | while read i; do sed -i "s/^name: .*/name: $$i/" "$$i/Chart.yaml"; done
+	find . -maxdepth 2 -name Chart.yaml  | awk -F/ '{print $$2}' | while read i; do sed -i "s/^name: .*/name: $$i/" "$$i/Chart.yaml"; done
 
 gen-versions-map: fix-chartnames
 	../../hack/gen_versions_map.sh

packages/apps/bucket/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: bucket
+description: S3 compatible storage
+icon: /logos/bucket.svg
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "0.1.0"

packages/apps/bucket/Makefile

@@ -0,0 +1,2 @@
+generate:
+	readme-generator -v values.yaml -s values.schema.json -r README.md

packages/apps/bucket/logos/bucket.svg

@@ -0,0 +1,12 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_683_3091)"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M72 30.1641L117.983 36.7789V40.6739C117.983 46.4653 97.3862 51.1332 71.9827 51.1332C46.5792 51.1332 26 46.4653 26 40.6739V36.4431L72 30.1641ZM72 58.2678C91.2084 58.2678 107.658 55.5986 114.547 51.8048L116.803 48.111L117.723 44.753V48.9171L102.679 111.033C102.679 114.895 88.9533 118 72.0172 118C55.0812 118 41.3743 114.895 41.3743 111.033L26.33 48.9171V44.8369L29.8007 51.9382C36.7065 55.6653 52.9997 58.2678 72 58.2678Z" fill="#8C3123"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M72.0003 26C97.4038 26 118 30.6839 118 36.442C118 42.2 97.3866 46.8507 72.0003 46.8507C46.6141 46.8507 26.0176 42.2345 26.0176 36.442C26.0176 30.6494 46.5968 26 72.0003 26ZM72.0003 54.1037C95.6857 54.1037 115.172 50.058 117.706 44.8197L102.662 106.937C102.662 110.799 88.9364 113.905 72.0003 113.905C55.0643 113.905 41.339 110.816 41.339 106.954L26.2959 44.837C28.8466 50.058 48.3333 54.1037 72.0003 54.1037Z" fill="#E05243"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M61.1725 60.0293H81.0928V79.1676H61.1725V60.0293ZM45.3301 95.3688C45.3301 90.142 49.7104 85.9342 55.1511 85.9342C60.5917 85.9342 64.9721 90.142 64.9721 95.3688C64.9721 100.596 60.5917 104.803 55.1511 104.803C49.7104 104.803 45.3301 100.596 45.3301 95.3688ZM96.4487 104.368H76.7722L86.6105 86.7737L96.4487 104.368Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_683_3091" x1="0" y1="0" x2="151" y2="180" gradientUnits="userSpaceOnUse">
+<stop stop-color="#FFF0EE"/>
+<stop offset="1" stop-color="#EC887D"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/bucket/templates/bucketclaim.yaml

@@ -0,0 +1,20 @@
+{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
+{{- $seaweedfs := index $myNS.metadata.annotations "namespace.cozystack.io/seaweedfs" }}
+apiVersion: objectstorage.k8s.io/v1alpha1
+kind: BucketClaim
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  bucketClassName: {{ $seaweedfs }}
+  protocols:
+    - s3
+---
+apiVersion: objectstorage.k8s.io/v1alpha1
+kind: BucketAccess
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  bucketAccessClassName: {{ $seaweedfs }}
+  bucketClaimName: {{ .Release.Name }}
+  credentialsSecretName: {{ .Release.Name }}
+  protocol: s3

packages/apps/bucket/templates/dashboard-resourcemap.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]

packages/apps/clickhouse/.helmignore

@@ -0,0 +1,3 @@
+.helmignore
+/logos
+/Makefile

packages/apps/clickhouse/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: clickhouse
 description: Managed ClickHouse service
-icon: https://cdn.worldvectorlogo.com/logos/clickhouse.svg
+icon: /logos/clickhouse.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.2.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/clickhouse/logos/clickhouse.svg

@@ -0,0 +1,11 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_683_3202)"/>
+<path d="M23 105H34V116H23V105Z" fill="#FF0000"/>
+<path d="M23 28H34V105H23V28ZM45 28H55.9999V116H45V28ZM66.9999 28H77.9999V116H66.9999V28ZM88.9999 28H99.9999V116H88.9999V28ZM111 63.7499H122V80.2499H111V63.7499Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_683_3202" x1="-0.499998" y1="1.5" x2="153.5" y2="162" gradientUnits="userSpaceOnUse">
+<stop stop-color="#FFCC00"/>
+<stop offset="1" stop-color="#FF7A00"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/clickhouse/templates/clickhouse.yaml

@@ -14,6 +14,7 @@ spec:
       {{- range $name, $u := . }}
       {{ $name }}/password_sha256_hex: {{ sha256sum $u.password }}
       {{ $name }}/profile: {{ ternary "readonly" "default" (index $u "readonly" | default false) }}
+      {{ $name }}/networks/ip: ["::/0"]
       {{- end }}
     {{- end }}
     profiles:

packages/apps/ferretdb/.helmignore

@@ -0,0 +1,3 @@
+.helmignore
+/logos
+/Makefile

packages/apps/ferretdb/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: ferretdb
+description: Managed FerretDB service
+icon: /logos/ferretdb.svg
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.22.0"

packages/apps/ferretdb/Makefile

@@ -0,0 +1,2 @@
+generate:
+	readme-generator -v values.yaml -s values.schema.json -r README.md

packages/apps/ferretdb/README.md

@@ -0,0 +1,34 @@
+# Managed FerretDB Service
+
+## Parameters
+
+### Common parameters
+
+| Name                     | Description                                                                                                             | Value   |
+| ------------------------ | ----------------------------------------------------------------------------------------------------------------------- | ------- |
+| `external`               | Enable external access from outside the cluster                                                                         | `false` |
+| `size`                   | Persistent Volume size                                                                                                  | `10Gi`  |
+| `replicas`               | Number of Postgres replicas                                                                                             | `2`     |
+| `quorum.minSyncReplicas` | Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.           | `0`     |
+| `quorum.maxSyncReplicas` | Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances). | `0`     |
+
+### Configuration parameters
+
+| Name    | Description         | Value |
+| ------- | ------------------- | ----- |
+| `users` | Users configuration | `{}`  |
+
+### Backup parameters
+
+| Name                     | Description                                    | Value                                                  |
+| ------------------------ | ---------------------------------------------- | ------------------------------------------------------ |
+| `backup.enabled`         | Enable pereiodic backups                       | `false`                                                |
+| `backup.s3Region`        | The AWS S3 region where backups are stored     | `us-east-1`                                            |
+| `backup.s3Bucket`        | The S3 bucket used for storing backups         | `s3.example.org/postgres-backups`                      |
+| `backup.schedule`        | Cron schedule for automated backups            | `0 2 * * *`                                            |
+| `backup.cleanupStrategy` | The strategy for cleaning up old backups       | `--keep-last=3 --keep-daily=3 --keep-within-weekly=1m` |
+| `backup.s3AccessKey`     | The access key for S3, used for authentication | `oobaiRus9pah8PhohL1ThaeTa4UVa7gu`                     |
+| `backup.s3SecretKey`     | The secret key for S3, used for authentication | `ju3eum4dekeich9ahM1te8waeGai0oog`                     |
+| `backup.resticPassword`  | The password for Restic backup encryption      | `ChaXoveekoh6eigh4siesheeda2quai0`                     |
+
+

packages/apps/ferretdb/logos/ferretdb.svg

@@ -0,0 +1,12 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="-0.00195312" width="144" height="144" rx="24" fill="url(#paint0_linear_683_2952)"/>
+<path d="M69.5923 22.131C58.2662 23.6787 46.9037 30.8714 40.3302 40.6679C39.274 42.2521 37.4531 45.548 37.4531 45.8757C37.4531 45.9122 38.3272 45.3841 39.3833 44.6921C52.3847 36.1156 67.8989 34.5314 80.5178 40.4858C83.2674 41.7787 84.9973 43.0351 87.4555 45.4933C91.589 49.645 94.6117 55.1988 96.7058 62.5007C97.7983 66.2518 98.7088 71.3686 98.9455 74.8465C99.0001 75.7934 99.1458 76.631 99.2369 76.6856C99.7467 76.9952 102.041 73.6629 103.662 70.276C106.229 64.8861 107.431 59.5872 107.413 53.7057C107.395 45.3841 104.518 38.3917 98.727 32.5648C93.592 27.3934 87.1095 23.8426 80.3175 22.4587C78.7333 22.1492 77.5679 22.0581 74.5999 22.0035C72.5422 21.9853 70.3025 22.0399 69.5923 22.131Z" fill="white"/>
+<path d="M45.52 46.4402C44.3364 47.0229 42.3516 48.8438 40.6035 50.9379C39.8205 51.8666 38.6369 53.0137 37.7629 53.6693C35.7234 55.1989 32.2455 58.604 30.4792 60.8073C21.2654 72.2244 18.6979 85.244 23.0863 98.3182C26.6917 109.025 35.0315 116.127 47.8508 119.35C52.8401 120.624 60.324 121.335 63.456 120.843L64.2572 120.715L63.019 119.987C56.1906 116.018 51.4198 109.317 50.0905 101.869C49.6899 99.611 49.6717 95.605 50.0723 93.4017C50.9645 88.4488 53.4592 83.8965 56.8461 81.0559C58.4303 79.7266 61.1981 78.3609 63.4014 77.8329C66.7155 77.0317 68.7367 76.1212 70.8307 74.4642C72.1782 73.408 73.3618 71.8056 74.3451 69.7298C75.1827 67.9635 76.9672 62.3551 76.9672 61.4628C76.9672 60.8437 76.3299 60.0061 75.4195 59.4416C74.946 59.1502 74.1994 58.9864 72.2875 58.7861C64.0569 57.9302 59.9599 56.4371 55.007 52.5221C54.2968 51.9576 53.441 51.3203 53.095 51.1018C52.749 50.9015 52.0571 50.1367 51.5836 49.4265C50.1451 47.3325 48.3606 45.985 46.9949 45.9668C46.7036 45.9668 46.0298 46.1853 45.52 46.4402ZM54.4607 54.8711C55.0798 55.1806 55.7535 55.5812 55.972 55.7451L56.3727 56.0729L55.7353 58.6222C55.1891 60.8437 55.098 61.4082 55.1526 62.9924C55.2073 64.5584 55.2619 64.9043 55.6261 65.4142C56.227 66.2336 57.2649 66.7253 58.4303 66.7253C60.0873 66.7253 61.3802 65.7784 63.5289 62.956C64.148 62.1548 64.6396 61.7177 65.368 61.3718C66.497 60.8073 67.2982 60.7527 69.811 60.9712L71.4863 61.135V62.1183C71.4863 63.6661 72.3057 64.5584 73.9809 64.8133L74.7821 64.9226L74.4908 65.5963C73.2161 68.6736 69.9385 72.1516 66.8611 73.6994C66.3695 73.9361 65.2587 74.3731 64.4029 74.6645C63.0008 75.1197 62.6184 75.1743 60.2148 75.1743C57.8294 75.1743 57.4288 75.1197 56.1177 74.6827C52.1663 73.3716 49.2347 70.4581 47.9054 66.5432C47.4319 65.1593 47.4137 61.135 47.8872 59.4598C48.5245 57.1472 49.6535 55.2353 50.8371 54.4887C51.6018 53.997 53.0222 54.1609 54.4607 54.8711Z" fill="white"/>
+<path d="M113.022 61.7361C113.022 62.5555 112.111 66.3431 111.347 68.7102C108.47 77.5781 103.262 85.5355 96.4697 91.3443C91.6989 95.4413 88.3119 97.244 82.9402 98.5733C79.4805 99.4291 77.2226 99.7023 72.8341 99.8115C67.3532 99.9572 61.9451 99.4655 57.1014 98.4094C56.1727 98.2091 55.3898 98.0816 55.3351 98.1363C55.1166 98.3366 55.9542 101.123 56.6826 102.598C58.0119 105.329 59.5232 107.368 62.2182 110.063C65.0588 112.904 67.1711 114.47 70.4487 116.163C78.57 120.351 87.8931 120.916 97.453 117.766C107.541 114.47 114.952 108.516 118.94 100.503C121.598 95.1864 122.691 89.5051 122.29 83.0227C121.799 75.0288 118.849 67.1989 114.57 62.5738C113.896 61.8454 113.277 61.2627 113.186 61.2627C113.095 61.2627 113.022 61.4812 113.022 61.7361Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_683_2952" x1="5.5" y1="11" x2="141" y2="124.5" gradientUnits="userSpaceOnUse">
+<stop stop-color="#45ADC6"/>
+<stop offset="1" stop-color="#216778"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/ferretdb/templates/backup-cronjob.yaml

@@ -0,0 +1,99 @@
+{{- if .Values.backup.enabled }}
+{{ $image := .Files.Get "images/backup.json" | fromJson }}
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .Release.Name }}-backup
+spec:
+  schedule: "{{ .Values.backup.schedule }}"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        spec:
+          restartPolicy: OnFailure
+      template:
+        metadata:
+          annotations:
+            checksum/config: {{ include (print $.Template.BasePath "/backup-script.yaml") . | sha256sum }}
+            checksum/secret: {{ include (print $.Template.BasePath "/backup-secret.yaml") . | sha256sum }}
+        spec:
+          restartPolicy: Never
+          containers:
+          - name: mysqldump
+            image: "{{ index $image "image.name" }}@{{ index $image "containerimage.digest" }}"
+            command:
+            - /bin/sh
+            - /scripts/backup.sh
+            env:
+            - name: REPO_PREFIX
+              value: {{ required "s3Bucket is not specified!" .Values.backup.s3Bucket | quote }}
+            - name: CLEANUP_STRATEGY
+              value: {{ required "cleanupStrategy is not specified!" .Values.backup.cleanupStrategy | quote }}
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgres-superuser
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgres-superuser
+                  key: password
+            - name: PGHOST
+              value: {{ .Release.Name }}-postgres-rw
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: postgres
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-backup
+                  key: s3AccessKey
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-backup
+                  key: s3SecretKey
+            - name: AWS_DEFAULT_REGION
+              value: {{ .Values.backup.s3Region }}
+            - name: RESTIC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-backup
+                  key: resticPassword
+            volumeMounts:
+            - mountPath: /scripts
+              name: scripts
+            - mountPath: /tmp
+              name: tmp
+            - mountPath: /.cache
+              name: cache
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              privileged: false
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true
+          volumes:
+          - name: scripts
+            secret:
+              secretName: {{ .Release.Name }}-backup-script
+          - name: tmp
+            emptyDir: {}
+          - name: cache
+            emptyDir: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 9000
+            runAsGroup: 9000
+            seccompProfile:
+              type: RuntimeDefault
+{{- end }}

packages/apps/ferretdb/templates/backup-script.yaml

@@ -0,0 +1,50 @@
+{{- if .Values.backup.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-backup-script
+stringData:
+  backup.sh: |
+    #!/bin/sh
+    set -e
+    set -o pipefail
+
+    JOB_ID="job-$(uuidgen|cut -f1 -d-)"
+    DB_LIST=$(psql -Atq -c 'SELECT datname FROM pg_catalog.pg_database;' | grep -v '^\(postgres\|app\|template.*\)$')
+    echo DB_LIST=$(echo "$DB_LIST" | shuf) # shuffle list
+    echo "Job ID: $JOB_ID"
+    echo "Target repo: $REPO_PREFIX"
+    echo "Cleanup strategy: $CLEANUP_STRATEGY"
+    echo "Start backup for:"
+    echo "$DB_LIST"
+    echo
+    echo "Backup started at `date +%Y-%m-%d\ %H:%M:%S`"
+    for db in $DB_LIST; do
+      (
+        set -x
+        restic -r "s3:${REPO_PREFIX}/$db" cat config >/dev/null 2>&1 || \
+          restic -r "s3:${REPO_PREFIX}/$db" init --repository-version 2
+        restic -r "s3:${REPO_PREFIX}/$db" unlock --remove-all >/dev/null 2>&1 || true # no locks, k8s takes care of it
+        pg_dump -Z0 -Ft -d "$db" | \
+          restic -r "s3:${REPO_PREFIX}/$db" backup --tag "$JOB_ID" --stdin --stdin-filename dump.tar
+        restic -r "s3:${REPO_PREFIX}/$db" tag --tag "$JOB_ID" --set "completed"
+      )
+    done
+    echo "Backup finished at `date +%Y-%m-%d\ %H:%M:%S`"
+
+    echo
+    echo "Run cleanup:"
+    echo
+
+    echo "Cleanup started at `date +%Y-%m-%d\ %H:%M:%S`"
+    for db in $DB_LIST; do
+      (
+        set -x
+        restic forget -r "s3:${REPO_PREFIX}/$db" --group-by=tags --keep-tag "completed" # keep completed snapshots only
+        restic forget -r "s3:${REPO_PREFIX}/$db" --group-by=tags $CLEANUP_STRATEGY
+        restic prune -r "s3:${REPO_PREFIX}/$db"
+      )
+    done
+    echo "Cleanup finished at `date +%Y-%m-%d\ %H:%M:%S`"
+{{- end }}

packages/apps/ferretdb/templates/backup-secret.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.backup.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-backup
+stringData:
+  s3AccessKey: {{ required "s3AccessKey is not specified!" .Values.backup.s3AccessKey }}
+  s3SecretKey: {{ required "s3SecretKey is not specified!" .Values.backup.s3SecretKey }}
+  resticPassword: {{ required "resticPassword is not specified!" .Values.backup.resticPassword }}
+{{- end }}

packages/apps/ferretdb/templates/external-svc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}
+  {{- if .Values.external }}
+  externalTrafficPolicy: Local
+  allocateLoadBalancerNodePorts: false
+  {{- end }}
+  ports:
+  - name: ferretdb
+    port: 27017
+  selector:
+    app: {{ .Release.Name }}

packages/apps/ferretdb/templates/ferretdb.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+    spec:
+      containers:
+      - name: ferretdb
+        image: ghcr.io/ferretdb/ferretdb:1.22.0
+        ports:
+        - containerPort: 27017
+        env:
+          - name: FERRETDB_POSTGRESQL_URL
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-postgres-app
+                key: uri

packages/apps/ferretdb/templates/init-job.yaml

@@ -0,0 +1,66 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name }}-init-job
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation
+spec:
+  template:
+    metadata:
+      name: {{ .Release.Name }}-init-job
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/init-script.yaml") . | sha256sum }}
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: postgres
+        image: ghcr.io/cloudnative-pg/postgresql:15.3
+        command:
+        - bash
+        - /scripts/init.sh
+        env:
+        - name: PGUSER
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Release.Name }}-postgres-superuser
+              key: username
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Release.Name }}-postgres-superuser
+              key: password
+        - name: PGHOST
+          value: {{ .Release.Name }}-postgres-rw
+        - name: PGPORT
+          value: "5432"
+        - name: PGDATABASE
+          value: postgres
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+        volumeMounts:
+        - mountPath: /etc/secret
+          name: secret
+        - mountPath: /scripts
+          name: scripts
+      securityContext:
+        fsGroup: 26
+        runAsGroup: 26
+        runAsNonRoot: true
+        runAsUser: 26
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+      - name: secret
+        secret:
+          secretName: {{ .Release.Name }}-postgres-superuser
+      - name: scripts
+        secret:
+          secretName: {{ .Release.Name }}-init-script

packages/apps/ferretdb/templates/init-script.yaml

@@ -0,0 +1,101 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-init-script
+stringData:
+  init.sh: |
+    #!/bin/bash
+    set -e
+    echo "== create users"
+    {{- if .Values.users }}
+    psql -v ON_ERROR_STOP=1 <<\EOT
+    {{- range $user, $u := .Values.users }}
+    SELECT 'CREATE ROLE {{ $user }} LOGIN INHERIT;'
+    WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '{{ $user }}')\gexec
+    ALTER ROLE {{ $user }} WITH PASSWORD '{{ $u.password }}' LOGIN INHERIT {{ ternary "REPLICATION" "NOREPLICATION" (default false $u.replication) }};
+    COMMENT ON ROLE {{ $user }} IS 'user managed by helm';
+    {{- end }}
+    EOT
+    {{- end }}
+
+    echo "== delete users"
+    MANAGED_USERS=$(echo '\du+' | psql | awk -F'|' '$4 == " user managed by helm" {print $1}' | awk NF=NF RS= OFS=' ')
+    DEFINED_USERS="{{ join " " (keys .Values.users) }}"
+    DELETE_USERS=$(for user in $MANAGED_USERS; do case " $DEFINED_USERS " in *" $user "*) :;; *) echo $user;; esac; done)
+
+    echo "users to delete: $DELETE_USERS"
+    for user in $DELETE_USERS; do
+    # https://stackoverflow.com/a/51257346/2931267
+    psql -v ON_ERROR_STOP=1 --echo-all <<EOT
+    REASSIGN OWNED BY $user TO postgres;
+    DROP OWNED BY $user;
+    DROP USER $user;
+    EOT
+    done
+    
+    echo "== create roles"
+    psql -v ON_ERROR_STOP=1 --echo-all <<\EOT
+    SELECT 'CREATE ROLE app_admin NOINHERIT;'
+    WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'app_admin')\gexec
+    COMMENT ON ROLE app_admin IS 'role managed by helm';
+    EOT
+
+    echo "== grant privileges on databases to roles"
+    psql -v ON_ERROR_STOP=1 --echo-all -d "app" <<\EOT
+    ALTER DATABASE app OWNER TO app_admin;
+
+    DO $$
+    DECLARE
+        schema_record record;
+    BEGIN
+        -- Loop over all schemas
+        FOR schema_record IN SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT IN ('pg_catalog', 'information_schema') LOOP
+            -- Changing Schema Ownership
+            EXECUTE format('ALTER SCHEMA %I OWNER TO %I', schema_record.schema_name, 'app_admin');
+    
+            -- Add rights for the admin role
+            EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', schema_record.schema_name, 'app_admin');
+            EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO %I', schema_record.schema_name, 'app_admin');
+            EXECUTE format('GRANT ALL ON ALL SEQUENCES IN SCHEMA %I TO %I', schema_record.schema_name, 'app_admin');
+            EXECUTE format('GRANT ALL ON ALL FUNCTIONS IN SCHEMA %I TO %I', schema_record.schema_name, 'app_admin');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO %I', schema_record.schema_name, 'app_admin');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO %I', schema_record.schema_name, 'app_admin');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON FUNCTIONS TO %I', schema_record.schema_name, 'app_admin');
+        END LOOP;
+    END$$;
+    EOT
+
+    echo "== setup event trigger for schema creation"
+    psql -v ON_ERROR_STOP=1 --echo-all -d "app" <<\EOT
+    CREATE OR REPLACE FUNCTION auto_grant_schema_privileges()
+    RETURNS event_trigger LANGUAGE plpgsql AS $$
+    DECLARE
+      obj record;
+    BEGIN
+      FOR obj IN SELECT * FROM pg_event_trigger_ddl_commands() WHERE command_tag = 'CREATE SCHEMA' LOOP
+        -- Set owner for schema
+        EXECUTE format('ALTER SCHEMA %I OWNER TO %I', obj.object_identity, 'app_admin');
+
+        -- Set privileges for admin role
+        EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', obj.object_identity, 'app_admin');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO %I', obj.object_identity, 'app_admin');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO %I', obj.object_identity, 'app_admin');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON FUNCTIONS TO %I', obj.object_identity, 'app_admin');
+      END LOOP;
+    END;
+    $$;
+
+    DROP EVENT TRIGGER IF EXISTS trigger_auto_grant;
+    CREATE EVENT TRIGGER trigger_auto_grant ON ddl_command_end
+    WHEN TAG IN ('CREATE SCHEMA')
+    EXECUTE PROCEDURE auto_grant_schema_privileges();
+    EOT
+
+    echo "== assign roles to users"
+    psql -v ON_ERROR_STOP=1 --echo-all <<\EOT
+    GRANT app_admin TO app;
+    {{- range $user, $u := $.Values.users }}
+    GRANT app_admin TO {{ $user }};
+    {{- end }}
+    EOT

packages/apps/ferretdb/templates/postgres.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: {{ .Release.Name }}-postgres
+spec:
+  instances: {{ .Values.replicas }}
+  enableSuperuserAccess: true
+
+  minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}
+  maxSyncReplicas: {{ .Values.quorum.maxSyncReplicas }}
+
+  monitoring:
+    enablePodMonitor: true
+
+  storage:
+    size: {{ required ".Values.size is required" .Values.size }}
+
+  inheritedMetadata:
+    labels:
+      policy.cozystack.io/allow-to-apiserver: "true"
+
+  {{- if .Values.users }}
+  managed:
+    roles:
+    {{- range $user, $config := .Values.users }}
+    - name: {{ $user }}
+      ensure: present
+      passwordSecret:
+        name: {{ printf "%s-user-%s" $.Release.Name $user }}
+      login: true
+      inRoles:
+      - app
+    {{- end }}
+  {{- end }}
+
+{{- range $user, $config := .Values.users }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ printf "%s-user-%s" $.Release.Name $user }}
+  labels:
+    cnpg.io/reload: "true"
+type: kubernetes.io/basic-auth
+data:
+  username: {{ $user | b64enc }}
+  password: {{ $config.password | b64enc }}
+{{- end }}

packages/apps/ferretdb/values.schema.json

@@ -0,0 +1,81 @@
+{
+    "title": "Chart Values",
+    "type": "object",
+    "properties": {
+        "external": {
+            "type": "boolean",
+            "description": "Enable external access from outside the cluster",
+            "default": false
+        },
+        "size": {
+            "type": "string",
+            "description": "Persistent Volume size",
+            "default": "10Gi"
+        },
+        "replicas": {
+            "type": "number",
+            "description": "Number of Postgres replicas",
+            "default": 2
+        },
+        "quorum": {
+            "type": "object",
+            "properties": {
+                "minSyncReplicas": {
+                    "type": "number",
+                    "description": "Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.",
+                    "default": 0
+                },
+                "maxSyncReplicas": {
+                    "type": "number",
+                    "description": "Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances).",
+                    "default": 0
+                }
+            }
+        },
+        "backup": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean",
+                    "description": "Enable pereiodic backups",
+                    "default": false
+                },
+                "s3Region": {
+                    "type": "string",
+                    "description": "The AWS S3 region where backups are stored",
+                    "default": "us-east-1"
+                },
+                "s3Bucket": {
+                    "type": "string",
+                    "description": "The S3 bucket used for storing backups",
+                    "default": "s3.example.org/postgres-backups"
+                },
+                "schedule": {
+                    "type": "string",
+                    "description": "Cron schedule for automated backups",
+                    "default": "0 2 * * *"
+                },
+                "cleanupStrategy": {
+                    "type": "string",
+                    "description": "The strategy for cleaning up old backups",
+                    "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+                },
+                "s3AccessKey": {
+                    "type": "string",
+                    "description": "The access key for S3, used for authentication",
+                    "default": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu"
+                },
+                "s3SecretKey": {
+                    "type": "string",
+                    "description": "The secret key for S3, used for authentication",
+                    "default": "ju3eum4dekeich9ahM1te8waeGai0oog"
+                },
+                "resticPassword": {
+                    "type": "string",
+                    "description": "The password for Restic backup encryption",
+                    "default": "ChaXoveekoh6eigh4siesheeda2quai0"
+                }
+            }
+        }
+    }
+}

packages/apps/ferretdb/values.yaml

@@ -0,0 +1,48 @@
+## @section Common parameters
+
+## @param external Enable external access from outside the cluster
+## @param size Persistent Volume size
+## @param replicas Number of Postgres replicas
+##
+external: false
+size: 10Gi
+replicas: 2
+
+## Configuration for the quorum-based synchronous replication
+## @param quorum.minSyncReplicas Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.
+## @param quorum.maxSyncReplicas Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances).
+quorum:
+  minSyncReplicas: 0
+  maxSyncReplicas: 0
+
+## @section Configuration parameters
+
+## @param users [object] Users configuration
+## Example:
+## users:
+##   user1:
+##     password: strongpassword
+##   user2:
+##     password: hackme
+##
+users: {}
+
+## @section Backup parameters
+
+## @param backup.enabled Enable pereiodic backups
+## @param backup.s3Region The AWS S3 region where backups are stored
+## @param backup.s3Bucket The S3 bucket used for storing backups
+## @param backup.schedule Cron schedule for automated backups
+## @param backup.cleanupStrategy The strategy for cleaning up old backups
+## @param backup.s3AccessKey The access key for S3, used for authentication
+## @param backup.s3SecretKey The secret key for S3, used for authentication
+## @param backup.resticPassword The password for Restic backup encryption
+backup:
+  enabled: false
+  s3Region: us-east-1
+  s3Bucket: s3.example.org/postgres-backups
+  schedule: "0 2 * * *"
+  cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+  s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu
+  s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
+  resticPassword: ChaXoveekoh6eigh4siesheeda2quai0

packages/apps/ferretdb/values2.yaml

@@ -0,0 +1,56 @@
+## @section Common parameters
+
+## @param external Enable external access from outside the cluster
+## @param size Persistent Volume size
+## @param replicas Number of Postgres replicas
+##
+external: false
+size: 10Gi
+replicas: 1
+
+## Configuration for the quorum-based synchronous replication
+## @param quorum.minSyncReplicas Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.
+## @param quorum.maxSyncReplicas Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances).
+quorum:
+  minSyncReplicas: 0
+  maxSyncReplicas: 0
+
+## @section Configuration parameters
+
+## @param users [object] Users configuration
+## Example:
+## users:
+##   user1:
+##     password: strongpassword
+##   user2:
+##     password: hackme
+##
+users:
+  foo:
+    password: asd
+  bar:
+    password: asd
+  baz:
+    password: asd
+  boo:
+    password: asd
+
+## @section Backup parameters
+
+## @param backup.enabled Enable pereiodic backups
+## @param backup.s3Region The AWS S3 region where backups are stored
+## @param backup.s3Bucket The S3 bucket used for storing backups
+## @param backup.schedule Cron schedule for automated backups
+## @param backup.cleanupStrategy The strategy for cleaning up old backups
+## @param backup.s3AccessKey The access key for S3, used for authentication
+## @param backup.s3SecretKey The secret key for S3, used for authentication
+## @param backup.resticPassword The password for Restic backup encryption
+backup:
+  enabled: false
+  s3Region: us-east-1
+  s3Bucket: s3.example.org/postgres-backups
+  schedule: "0 2 * * *"
+  cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+  s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu
+  s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
+  resticPassword: ChaXoveekoh6eigh4siesheeda2quai0

packages/apps/http-cache/.helmignore

@@ -1,23 +1,3 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
+.helmignore
+/logos
+/Makefile

packages/apps/http-cache/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: http-cache
 description: Layer7 load balacner and caching service
-icon: https://www.svgrepo.com/show/373924/nginx.svg
+icon: /logos/nginx.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #

packages/apps/http-cache/Makefile

@@ -14,7 +14,9 @@ image-nginx:
 		--metadata-file images/nginx-cache.json \
 		--push=$(PUSH) \
 		--load=$(LOAD)
-	echo "$(REGISTRY)/nginx-cache:$(call settag,$(NGINX_CACHE_TAG))" > images/nginx-cache.tag
+	echo "$(REGISTRY)/nginx-cache:$(call settag,$(NGINX_CACHE_TAG))@$$(yq e '."containerimage.digest"' images/nginx-cache.json -o json -r)" \
+		> images/nginx-cache.tag
+	rm -f images/nginx-cache.json
 
 generate:
 	readme-generator -v values.yaml -s values.schema.json -r README.md

packages/apps/http-cache/images/nginx-cache.json

@@ -1,4 +0,0 @@
-{
-  "containerimage.config.digest": "sha256:fbf82620e58e1502946ab32b5b11ada483f06c0c903d6a532a46ab842f913555",
-  "containerimage.digest": "sha256:f51a4f2f3d9452ead2c77e3a85a29167d08d86e924196b250c5f7d3b8ebf990c"
-}

packages/apps/http-cache/images/nginx-cache.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0
+ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0@sha256:f77d5b63f1ed9dfda4725696d9170130939219a2465260b6ba941947460de2da

packages/apps/http-cache/images/nginx.json

@@ -1,4 +0,0 @@
-{
-  "containerimage.config.digest": "sha256:b1916dbacb372ed89ea3f920f08ee68730be2edc016f2caa373a7bbfbad25845",
-  "containerimage.digest": "sha256:f77d5b63f1ed9dfda4725696d9170130939219a2465260b6ba941947460de2da"
-}

packages/apps/http-cache/logos/nginx.svg

@@ -0,0 +1,10 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_681_2825)"/>
+<path d="M26.0026 37.8588C26.0026 60.919 26.0026 83.9814 26.0026 107.046C25.973 108.323 26.1996 109.593 26.6692 110.783C27.1387 111.972 27.8418 113.056 28.7374 113.972C30.4539 115.659 32.7 116.709 35.1009 116.948C37.5019 117.187 39.9126 116.6 41.931 115.284C43.282 114.371 44.3881 113.143 45.1527 111.707C45.9174 110.271 46.3175 108.671 46.3181 107.046C46.3181 90.3528 46.2861 73.6597 46.3181 56.9666C61.6168 75.1889 76.9474 93.3856 92.31 111.557C94.4444 113.708 97.0875 115.291 99.997 116.162C102.906 117.032 105.989 117.162 108.962 116.539C111.061 116.128 112.973 115.057 114.415 113.485C115.857 111.913 116.754 109.921 116.974 107.804C117.009 84.2681 117.009 60.7343 116.974 37.2025C116.754 34.6907 115.595 32.3522 113.726 30.6486C111.858 28.945 109.415 28 106.881 28C104.346 28 101.903 28.945 100.035 30.6486C98.1663 32.3522 97.0074 34.6907 96.7869 37.2025C96.7869 54.1632 96.6844 71.1048 96.7869 88.0591C81.7616 70.4358 66.9219 52.6596 51.9543 34.9725C49.981 32.4554 47.3685 30.5073 44.3863 29.3291C41.4041 28.1509 38.1599 27.7852 34.9883 28.2698C32.5857 28.5359 30.3583 29.6493 28.7099 31.4084C27.0615 33.1675 26.101 35.4559 26.0026 37.8588Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_681_2825" x1="10" y1="15.5" x2="144" y2="131.5" gradientUnits="userSpaceOnUse">
+<stop stop-color="#00C54A"/>
+<stop offset="1" stop-color="#019639"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/http-cache/templates/nginx/deployment.yaml

@@ -52,7 +52,7 @@ spec:
       shareProcessNamespace: true
       containers:
       - name: nginx
-        image: "{{ $.Files.Get "images/nginx-cache.tag" | trim }}@{{ index ($.Files.Get "images/nginx-cache.json" | fromJson) "containerimage.digest" }}"
+        image: "{{ $.Files.Get "images/nginx-cache.tag" | trim }}"
         readinessProbe:
           httpGet:
             path: /healthz
@@ -81,7 +81,7 @@ spec:
         - mountPath: /run
           name: run
       - name: reloader
-        image: "{{ $.Files.Get "images/nginx-cache.tag" | trim }}@{{ index ($.Files.Get "images/nginx-cache.json" | fromJson) "containerimage.digest" }}"
+        image: "{{ $.Files.Get "images/nginx-cache.tag" | trim }}"
         command: ["/usr/bin/nginx-reloader.sh"]
         #command: ["sleep", "infinity"]
         volumeMounts:

packages/apps/kafka/.helmignore

@@ -0,0 +1,3 @@
+.helmignore
+/logos
+/Makefile

packages/apps/kafka/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: kafka
 description: Managed Kafka service
-icon: https://upload.wikimedia.org/wikipedia/commons/0/05/Apache_kafka.svg
+icon: /logos/kafka.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.2.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/kafka/logos/kafka.svg

@@ -0,0 +1,10 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_681_2820)"/>
+<path d="M91.0307 77.8185C86.8577 77.8185 83.1166 79.6818 80.5547 82.6154L73.9901 77.9315C74.6869 75.9978 75.087 73.9215 75.087 71.7482C75.087 69.6126 74.7008 67.5711 74.0269 65.666L80.5769 61.0318C83.1385 63.9505 86.8699 65.8037 91.0307 65.8037C98.7328 65.8037 105 59.4884 105 51.7247C105 43.961 98.7328 37.6457 91.0307 37.6457C83.3285 37.6457 77.0614 43.961 77.0614 51.7247C77.0614 53.1143 77.2697 54.4543 77.6435 55.7233L71.0891 60.3598C68.3512 56.9365 64.409 54.5463 59.9174 53.8166V45.8553C66.2451 44.5158 71.0128 38.8495 71.0128 32.079C71.0128 24.3153 64.7457 18 57.0435 18C49.3414 18 43.0742 24.3153 43.0742 32.079C43.0742 38.7589 47.7184 44.3552 53.9196 45.7903V53.8551C45.4567 55.3523 39 62.7961 39 71.7482C39 80.744 45.5206 88.2151 54.0446 89.6613V98.1772C47.7801 99.565 43.0742 105.196 43.0742 111.921C43.0742 119.685 49.3414 126 57.0435 126C64.7457 126 71.0128 119.685 71.0128 111.921C71.0128 105.196 66.307 99.565 60.0424 98.1772V89.6611C64.3569 88.9286 68.2601 86.6407 71.0252 83.2234L77.6337 87.9376C77.2669 89.1952 77.0614 90.5219 77.0614 91.8975C77.0614 99.6612 83.3285 105.976 91.0307 105.976C98.7328 105.976 105 99.6612 105 91.8975C105 84.1338 98.7328 77.8185 91.0307 77.8185ZM91.0307 44.8985C94.7656 44.8985 97.8034 47.9615 97.8034 51.7247C97.8034 55.4879 94.7656 58.5506 91.0307 58.5506C87.2958 58.5506 84.258 55.4879 84.258 51.7247C84.258 47.9615 87.2958 44.8985 91.0307 44.8985ZM50.2705 32.079C50.2705 28.3158 53.3086 25.2531 57.0435 25.2531C60.7785 25.2531 63.8163 28.3158 63.8163 32.079C63.8163 35.8422 60.7785 38.9049 57.0435 38.9049C53.3086 38.9049 50.2705 35.8422 50.2705 32.079ZM63.8163 111.921C63.8163 115.684 60.7785 118.747 57.0435 118.747C53.3086 118.747 50.2705 115.684 50.2705 111.921C50.2705 108.158 53.3086 105.095 57.0435 105.095C60.7785 105.095 63.8163 108.158 63.8163 111.921ZM57.043 81.2681C51.8339 81.2681 47.5962 76.998 47.5962 71.7482C47.5962 66.4982 51.8339 62.2273 57.043 62.2273C62.2519 62.2273 66.4895 66.4982 66.4895 71.7482C66.4895 76.998 62.2519 81.2681 57.043 81.2681ZM91.0307 98.7237C87.2958 98.7237 84.258 95.6607 84.258 91.8975C84.258 88.1343 87.2958 85.0716 91.0307 85.0716C94.7656 85.0716 97.8034 88.1343 97.8034 91.8975C97.8034 95.6607 94.7656 98.7237 91.0307 98.7237Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_681_2820" x1="140" y1="130.5" x2="4" y2="9.49999" gradientUnits="userSpaceOnUse">
+<stop/>
+<stop offset="1" stop-color="#434141"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/kafka/templates/kafka.yaml

@@ -26,11 +26,25 @@ spec:
         {{- end }}
         tls: false
     config:
+      {{- if eq (int .Values.kafka.replicas) 1 }}
+      offsets.topic.replication.factor: 1
+      transaction.state.log.replication.factor: 1
+      transaction.state.log.min.isr: 1
+      default.replication.factor: 1
+      min.insync.replicas: 1
+      {{- else if eq (int .Values.kafka.replicas) 2 }}
+      offsets.topic.replication.factor: 2
+      transaction.state.log.replication.factor: 2
+      transaction.state.log.min.isr: 2
+      default.replication.factor: 2
+      min.insync.replicas: 2
+      {{- else }}
       offsets.topic.replication.factor: 3
       transaction.state.log.replication.factor: 3
       transaction.state.log.min.isr: 2
       default.replication.factor: 3
       min.insync.replicas: 2
+      {{- end }}
     storage:
       type: jbod
       volumes:
@@ -51,3 +65,8 @@ spec:
   entityOperator:
     topicOperator: {}
     userOperator: {}
+    template:
+      pod:
+        metadata:
+         labels:
+           policy.cozystack.io/allow-to-apiserver: "true"

packages/apps/kafka/templates/topics.yaml

@@ -8,8 +8,12 @@ metadata:
     strimzi.io/cluster: "{{ $.Release.Name }}"
 spec:
   topicName: "{{ $topic.name }}"
-  partitions: 10
-  replicas: 3
+  {{- with $topic.partitions }}
+  partitions: {{ . }}
+  {{- end }}
+  {{- with $topic.replicas }}
+  replicas: {{ . }}
+  {{- end }}
   {{- with $topic.config }}
   config:
     {{- toYaml . | nindent 4 }}

packages/apps/kafka/values.yaml

@@ -32,6 +32,6 @@ zookeeper:
 ##       max.compaction.lag.ms: 5400000
 ##       min.insync.replicas: 2
 ##     partitions: 1
-##     replicationFactor: 3
+##     replicas: 3
 ##
 topics: []

packages/apps/kubernetes/.helmignore

@@ -1,23 +1,3 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
+.helmignore
+/logos
+/Makefile

packages/apps/kubernetes/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: kubernetes
 description: Managed Kubernetes service
-icon: https://upload.wikimedia.org/wikipedia/commons/thumb/3/39/Kubernetes_logo_without_workmark.svg/723px-Kubernetes_logo_without_workmark.svg.png
+icon: /logos/kubernetes.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #
@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.8.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.19.0"
+appVersion: "1.30.1"

packages/apps/kubernetes/Makefile

@@ -1,4 +1,4 @@
-UBUNTU_CONTAINER_DISK_TAG = v1.29.1
+UBUNTU_CONTAINER_DISK_TAG = v1.30.1
 
 include ../../../scripts/common-envs.mk
 
@@ -17,4 +17,6 @@ image-ubuntu-container-disk:
 		--metadata-file images/ubuntu-container-disk.json \
 		--push=$(PUSH) \
 		--load=$(LOAD)
-	echo "$(REGISTRY)/ubuntu-container-disk:$(call settag,$(UBUNTU_CONTAINER_DISK_TAG))" > images/ubuntu-container-disk.tag
+	echo "$(REGISTRY)/ubuntu-container-disk:$(call settag,$(UBUNTU_CONTAINER_DISK_TAG))@$$(yq e '."containerimage.digest"' images/ubuntu-container-disk.json -o json -r)" \
+		> images/ubuntu-container-disk.tag
+	rm -f images/ubuntu-container-disk.json

packages/apps/kubernetes/README.md

@@ -36,3 +36,13 @@ kubectl get secret -n <namespace> kubernetes-<clusterName>-admin-kubeconfig -o g
 | `host`                  | The hostname used to access the Kubernetes cluster externally (defaults to using the cluster name as a subdomain for the tenant host). | `""`  |
 | `controlPlane.replicas` | Number of replicas for Kubernetes contorl-plane components                                                                             | `2`   |
 | `nodeGroups`            | nodeGroups configuration                                                                                                               | `{}`  |
+
+### Cluster Addons
+
+| Name                          | Description                                                                        | Value   |
+| ----------------------------- | ---------------------------------------------------------------------------------- | ------- |
+| `addons.certManager.enabled`  | Enables the cert-manager                                                           | `false` |
+| `addons.ingressNginx.enabled` | Enable Ingress-NGINX controller (expect nodes with 'ingress-nginx' role)           | `false` |
+| `addons.ingressNginx.hosts`   | List of domain names that should be passed through to the cluster by upper cluster | `[]`    |
+| `addons.fluxcd.enabled`       | Enables Flux CD                                                                    | `false` |
+

packages/apps/kubernetes/images/ubuntu-container-disk.json

@@ -1,4 +0,0 @@
-{
-  "containerimage.config.digest": "sha256:77f663f46e86e66579e9025bb96511b9f547470bbd78716c11f9ccc25587c597",
-  "containerimage.digest": "sha256:e3e5e5ec8732c5d585ccba38fd457dc9bf0b0d9bc394131c19934c2c11b66ec9"
-}

packages/apps/kubernetes/images/ubuntu-container-disk.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.29.1
+ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1@sha256:81caf89efe252ae2ca1990d08a3a314552d70ff36bcd4022b173c7150fbec805

packages/apps/kubernetes/images/ubuntu-container-disk/Dockerfile

@@ -26,8 +26,8 @@ RUN qemu-img resize image.img 5G \
  && guestfish --remote sh "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg" \
  && guestfish --remote sh 'echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list' \
 # kubernetes repo
- && guestfish --remote sh "curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.29/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg" \
- && guestfish --remote sh "echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.29/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list" \
+ && guestfish --remote sh "curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg" \
+ && guestfish --remote sh "echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list" \
 # install containerd
  && guestfish --remote command "apt-get update -y" \
  && guestfish --remote command "apt-get install -y containerd.io" \

packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml

@@ -14,6 +14,7 @@ spec:
     metadata:
       labels:
         app: {{ .Release.Name }}-cluster-autoscaler
+        policy.cozystack.io/allow-to-apiserver: "true"
     spec:
       tolerations:
         - key: CriticalAddonsOnly

packages/apps/kubernetes/templates/cluster.yaml

@@ -2,6 +2,54 @@
 {{- $etcd := index $myNS.metadata.annotations "namespace.cozystack.io/etcd" }}
 {{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
 {{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
+{{- $kubevirtmachinetemplateNames := list }}
+{{- define "kubevirtmachinetemplate" -}}
+spec:
+  virtualMachineBootstrapCheck:
+    checkStrategy: ssh
+  virtualMachineTemplate:
+    metadata:
+      namespace: {{ $.Release.Namespace }}
+      labels:
+        {{- range .group.roles }}
+        node-role.kubernetes.io/{{ . }}: ""
+        {{- end }}
+    spec:
+      runStrategy: Always
+      template:
+        metadata:
+          labels:
+            {{- range .group.roles }}
+            node-role.kubernetes.io/{{ . }}: ""
+            {{- end }}
+        spec:
+          domain:
+            cpu:
+              threads: 1
+              cores: {{ .group.resources.cpu }}
+              sockets: 1
+            devices:
+              disks:
+              - name: system
+                disk:
+                  bus: virtio
+                  pciAddress: 0000:07:00.0
+              - name: ephemeral
+                disk:
+                  bus: virtio
+                  pciAddress: 0000:08:00.0
+              networkInterfaceMultiqueue: true
+            memory:
+              guest: {{ .group.resources.memory }}
+          evictionStrategy: External
+          volumes:
+          - name: system
+            containerDisk:
+              image: "{{ $.Files.Get "images/ubuntu-container-disk.tag" | trim }}"
+          - name: ephemeral
+            emptyDisk:
+              capacity: {{ .group.ephemeralStorage | default "20Gi" }}
+{{- end }}
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
 kind: Cluster
@@ -39,7 +87,9 @@ metadata:
 spec:
   dataStoreName: "{{ $etcd }}"
   addons:
-    coreDNS: {}
+    coreDNS:
+      dnsServiceIPs:
+      - 10.95.0.10
     konnectivity: {}
   kubelet:
     cgroupfs: systemd
@@ -54,8 +104,11 @@ spec:
       hostname: {{ .Values.host | default (printf "%s.%s" .Release.Name $host) }}:443
       className: "{{ $ingress }}"
   deployment:
+    podAdditionalMetadata:
+      labels:
+        policy.cozystack.io/allow-to-etcd: "true"
   replicas: 2
-  version: 1.29.0
+  version: 1.30.1
 ---
 apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
 kind: KubevirtCluster
@@ -74,6 +127,23 @@ metadata:
 spec:
   template:
     spec:
+      diskSetup:
+        filesystems:
+        - device: /dev/vdb
+          filesystem: xfs
+          label: ephemeral
+          partition: "none"
+      mounts:
+      - ["LABEL=ephemeral", "/ephemeral"]
+      - ["/ephemeral/kubelet", "/var/lib/kubelet", "none", "bind,nofail"]
+      - ["/ephemeral/containerd", "/var/lib/containerd", "none", "bind,nofail"]
+      preKubeadmCommands:
+      - sed -i 's|root:x:|root::|' /etc/passwd
+      - systemctl stop containerd.service
+      - mkdir -p /ephemeral/kubelet /ephemeral/containerd
+      - mount -o bind /ephemeral/kubelet /var/lib/kubelet
+      - mount -o bind /ephemeral/containerd /var/lib/containerd
+      - systemctl start containerd.service
       joinConfiguration:
         nodeRegistration:
           kubeletExtraArgs: {}
@@ -84,41 +154,20 @@ spec:
         skipPhases:
         - addon/kube-proxy
 ---
+{{- $context := deepCopy $ }}
+{{- $_ := set $context "group" $group }}
+{{- $kubevirtmachinetemplate := include "kubevirtmachinetemplate" $context }}
+{{- $kubevirtmachinetemplateHash := $kubevirtmachinetemplate | sha256sum | trunc 6 }}
+{{- $kubevirtmachinetemplateName := printf "%s-%s-%s" $.Release.Name $groupName $kubevirtmachinetemplateHash }}
+{{- $kubevirtmachinetemplateNames = append $kubevirtmachinetemplateNames $kubevirtmachinetemplateName }}
 apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
 kind: KubevirtMachineTemplate
 metadata:
-  name: {{ $.Release.Name }}-{{ $groupName }}
+  name: {{ $.Release.Name }}-{{ $groupName }}-{{ $kubevirtmachinetemplateHash }}
   namespace: {{ $.Release.Namespace }}
 spec:
   template:
-    spec:
-      virtualMachineBootstrapCheck:
-        checkStrategy: ssh
-      virtualMachineTemplate:
-        metadata:
-          namespace: {{ $.Release.Namespace }}
-        spec:
-          runStrategy: Always
-          template:
-            spec:
-              domain:
-                cpu:
-                  threads: 1
-                  cores: {{ $group.resources.cpu }}
-                  sockets: 1
-                devices:
-                  disks:
-                  - disk:
-                      bus: virtio
-                    name: containervolume
-                  networkInterfaceMultiqueue: true
-                memory:
-                  guest: {{ $group.resources.memory }}
-              evictionStrategy: External
-              volumes:
-              - containerDisk:
-                  image: "{{ $.Files.Get "images/ubuntu-container-disk.tag" | trim }}@{{ index ($.Files.Get "images/ubuntu-container-disk.json" | fromJson) "containerimage.digest" }}"
-                name: containervolume
+    {{- $kubevirtmachinetemplate | nindent 4 }}
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
 kind: MachineDeployment
@@ -133,18 +182,55 @@ metadata:
 spec:
   clusterName: {{ $.Release.Name }}
   template:
+    metadata:
+      labels:
+        cluster.x-k8s.io/cluster-name: {{ $.Release.Name }}
+        cluster.x-k8s.io/deployment-name: {{ $.Release.Name }}-{{ $groupName }}
+        {{- range $group.roles }}
+        node-role.kubernetes.io/{{ . }}: ""
+        {{- end }}
     spec:
       bootstrap:
         configRef:
           apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
           kind: KubeadmConfigTemplate
           name: {{ $.Release.Name }}-{{ $groupName }}
-          namespace: default
+          namespace: {{ $.Release.Namespace }}
       clusterName: {{ $.Release.Name }}
       infrastructureRef:
         apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
         kind: KubevirtMachineTemplate
-        name: {{ $.Release.Name }}-{{ $groupName }}
+        name: {{ $.Release.Name }}-{{ $groupName }}-{{ $kubevirtmachinetemplateHash }}
         namespace: default
-      version: v1.29.0
+      version: v1.30.1
+{{- end }}
+---
+{{- /*
+We must preserve all previous KubevirtMachineTemplates until a MachineSet references them.
+*/ -}}
+{{- $mss := (lookup "cluster.x-k8s.io/v1beta1" "MachineSet" $.Release.Namespace "").items }}
+{{- $oldKubevirtmachinetemplates := dict }}
+{{- range $kmt := (lookup "infrastructure.cluster.x-k8s.io/v1alpha1" "KubevirtMachineTemplate" .Release.Namespace "").items }}
+{{- range $or := $kmt.metadata.ownerReferences }}
+{{- if and (eq $or.kind "Cluster") (eq $or.name $.Release.Name) }}
+{{- range $ms := $mss }}
+{{- if and (eq $ms.spec.template.spec.infrastructureRef.kind "KubevirtMachineTemplate") (eq $ms.spec.template.spec.infrastructureRef.name $kmt.metadata.name) }}
+{{- if not (has $kmt.metadata.name $kubevirtmachinetemplateNames) }}
+{{- $oldKubevirtmachinetemplates = merge $oldKubevirtmachinetemplates (dict $kmt.metadata.name $kmt) }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- range $oldKubevirtmachinetemplates }}
+---
+apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+kind: KubevirtMachineTemplate
+metadata:
+  name: {{ .metadata.name }}
+  namespace: {{ .metadata.Namespace }}
+spec:
+  {{- .spec | toYaml | nindent 2 }}
 {{- end }}

packages/apps/kubernetes/templates/csi/deploy.yaml

@@ -13,6 +13,7 @@ spec:
     metadata:
       labels:
         app: {{ .Release.Name }}-kcsi-driver
+        policy.cozystack.io/allow-to-apiserver: "true"
     spec:
       serviceAccountName: {{ .Release.Name }}-kcsi
       priorityClassName: system-cluster-critical

packages/apps/kubernetes/templates/dashboard-resourcemap.yaml

@@ -0,0 +1,26 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ .Release.Name }}-admin-kubeconfig
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - ""
+  resources:
+  - services
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]

packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml

@@ -0,0 +1,39 @@
+{{- if .Values.addons.certManager.enabled }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-cert-manager
+  labels:
+    cozystack.io/repository: system
+    coztstack.io/target-cluster-name: {{ .Release.Name }}
+spec:
+  interval: 5m
+  releaseName: cert-manager
+  chart:
+    spec:
+      chart: cozy-cert-manager
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-kubeconfig
+  targetNamespace: cozy-cert-manager
+  storageNamespace: cozy-cert-manager
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
+{{- end }}

packages/apps/kubernetes/templates/helmreleases/cilium.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-cilium
@@ -6,7 +6,7 @@ metadata:
     cozystack.io/repository: system
     coztstack.io/target-cluster-name: {{ .Release.Name }}
 spec:
-  interval: 1m
+  interval: 5m
   releaseName: cilium
   chart:
     spec:
@@ -23,10 +23,17 @@ spec:
   storageNamespace: cozy-cilium
   install:
     createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
   values:
     cilium:
       tunnel: disabled
-      autoDirectNodeRoutes: true
+      autoDirectNodeRoutes: false
+      bpf:
+        masquerade: true
       cgroup:
         autoMount:
           enabled: true
@@ -38,9 +45,11 @@ spec:
         chainingMode: ~
         customConf: false
         configMap: ""
-      routingMode: native
+      routingMode: tunnel
       enableIPv4Masquerade: true
-      ipv4NativeRoutingCIDR: "10.244.0.0/16"
+      ipv4NativeRoutingCIDR: ""
   dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
+  {{- end }}

packages/apps/kubernetes/templates/helmreleases/csi.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-csi
@@ -6,7 +6,7 @@ metadata:
     cozystack.io/repository: system
     coztstack.io/target-cluster-name: {{ .Release.Name }}
 spec:
-  interval: 1m
+  interval: 5m
   releaseName: csi
   chart:
     spec:
@@ -23,6 +23,13 @@ spec:
   storageNamespace: cozy-csi
   install:
     createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
   dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
+  {{- end }}

packages/apps/kubernetes/templates/helmreleases/delete.yaml

@@ -20,17 +20,23 @@ spec:
           effect: "NoSchedule"
       containers:
         - name: kubectl
-          image: docker.io/clastix/kubectl:v1.29.1
+          image: docker.io/clastix/kubectl:v1.30.1
           command:
-            - kubectl
-            - --namespace={{ .Release.Namespace }}
-            - patch
-            - helmrelease
-            - {{ .Release.Name }}-cilium
-            - {{ .Release.Name }}-csi
-            - -p
-            - '{"spec": {"suspend": true}}'
-            - --type=merge
+            - /bin/sh
+            - -c
+            - |
+                kubectl
+                --namespace={{ .Release.Namespace }}
+                patch
+                helmrelease
+                {{ .Release.Name }}-cilium
+                {{ .Release.Name }}-csi
+                {{ .Release.Name }}-cert-manager
+                {{ .Release.Name }}-ingress-nginx
+                {{ .Release.Name }}-fluxcd-operator
+                {{ .Release.Name }}-fluxcd
+                -p '{"spec": {"suspend": true}}'
+                --type=merge --field-manager=flux-client-side-apply || true
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -60,6 +66,10 @@ rules:
     resourceNames:
       - {{ .Release.Name }}-cilium
       - {{ .Release.Name }}-csi
+      - {{ .Release.Name }}-cert-manager
+      - {{ .Release.Name }}-ingress-nginx
+      - {{ .Release.Name }}-fluxcd-operator
+      - {{ .Release.Name }}-fluxcd
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml

@@ -0,0 +1,84 @@
+{{- if .Values.addons.fluxcd.enabled }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-fluxcd-operator
+  labels:
+    cozystack.io/repository: system
+    coztstack.io/target-cluster-name: {{ .Release.Name }}
+spec:
+  interval: 5m
+  releaseName: fluxcd-operator
+  chart:
+    spec:
+      chart: cozy-fluxcd-operator
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-kubeconfig
+  targetNamespace: cozy-fluxcd
+  storageNamespace: cozy-fluxcd
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
+  values:
+    flux-operator:
+      fullnameOverride: flux-operator
+      tolerations: []
+      hostNetwork: false
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-fluxcd
+  labels:
+    cozystack.io/repository: system
+    coztstack.io/target-cluster-name: {{ .Release.Name }}
+spec:
+  interval: 5m
+  releaseName: fluxcd
+  chart:
+    spec:
+      chart: cozy-fluxcd
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-kubeconfig
+  targetNamespace: cozy-fluxcd
+  storageNamespace: cozy-fluxcd
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
+  - name: {{ .Release.Name }}-fluxcd-operator
+    namespace: {{ .Release.Namespace }}
+{{- end }}

packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml

@@ -0,0 +1,49 @@
+{{- if .Values.addons.ingressNginx.enabled }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-ingress-nginx
+  labels:
+    cozystack.io/repository: system
+    coztstack.io/target-cluster-name: {{ .Release.Name }}
+spec:
+  interval: 5m
+  releaseName: ingress-nginx
+  chart:
+    spec:
+      chart: cozy-ingress-nginx
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-kubeconfig
+  targetNamespace: cozy-ingress-nginx
+  storageNamespace: cozy-ingress-nginx
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
+  values:
+    ingress-nginx:
+      fullnameOverride: ingress-nginx
+      controller:
+        kind: DaemonSet
+        hostNetwork: true
+        service:
+          enabled: false
+      nodeSelector:
+        node-role.kubernetes.io/ingress-nginx: ""
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
+{{- end }}

packages/apps/kubernetes/templates/ingress.yaml

@@ -0,0 +1,58 @@
+{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
+{{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
+{{- if .Values.addons.ingressNginx.hosts }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}-ingress-nginx
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: AUTO_HTTP
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($scheme = http) {
+        set $proxy_upstream_name "{{ .Release.Namespace }}-{{ .Release.Name }}-ingress-nginx-80";
+        set $proxy_host $proxy_upstream_name;
+      }
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+spec:
+  ingressClassName: "{{ $ingress }}"
+  rules:
+  {{- range .Values.addons.ingressNginx.hosts }}
+  - host: {{ . | quote }}
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: {{ $.Release.Name }}-ingress-nginx
+            port:
+              number: 443
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: {{ $.Release.Name }}-ingress-nginx
+            port:
+              number: 80
+  {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-ingress-nginx
+spec:
+  ports:
+  - appProtocol: http
+    name: http
+    port: 80
+    targetPort: 80
+  - appProtocol: https
+    name: https
+    port: 443
+    targetPort: 443
+  selector:
+    cluster.x-k8s.io/cluster-name: {{ .Release.Name }}
+    node-role.kubernetes.io/ingress-nginx: ""
+{{- end }}

packages/apps/kubernetes/templates/kccm/manager.yaml

@@ -13,6 +13,7 @@ spec:
     metadata:
       labels:
         k8s-app: {{ .Release.Name }}-kccm
+        policy.cozystack.io/allow-to-apiserver: "true"
     spec:
       tolerations:
         - key: CriticalAddonsOnly

packages/apps/kubernetes/values.schema.json

@@ -16,6 +16,47 @@
                     "default": 2
                 }
             }
+        },
+        "addons": {
+            "type": "object",
+            "properties": {
+                "certManager": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enables the cert-manager",
+                            "default": false
+                        }
+                    }
+                },
+                "ingressNginx": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enable Ingress-NGINX controller (expect nodes with 'ingress-nginx' role)",
+                            "default": false
+                        },
+                        "hosts": {
+                            "type": "array",
+                            "description": "List of domain names that should be passed through to the cluster by upper cluster",
+                            "default": [],
+                            "items": {}
+                        }
+                    }
+                },
+                "fluxcd": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enables Flux CD",
+                            "default": false
+                        }
+                    }
+                }
+            }
         }
     }
 }

packages/apps/kubernetes/values.yaml

@@ -16,3 +16,37 @@ nodeGroups:
     resources:
       cpu: 2
       memory: 1024Mi
+    ephemeralStorage: 20Gi
+    roles:
+    - ingress-nginx
+
+## @section Cluster Addons
+##
+addons:
+
+  ## Cert-manager: automatically creates and manages SSL/TLS certificate
+  ##
+  certManager:
+    ## @param addons.certManager.enabled Enables the cert-manager
+    enabled: false
+
+  ## Ingress-NGINX Controller
+  ##
+  ingressNginx:
+    ## @param addons.ingressNginx.enabled Enable Ingress-NGINX controller (expect nodes with 'ingress-nginx' role)
+    ##
+    enabled: false
+    ## @param addons.ingressNginx.hosts List of domain names that should be passed through to the cluster by upper cluster
+    ## e.g:
+    ## hosts:
+    ## - example.org
+    ## - foo.example.net
+    ##
+    hosts: []
+
+  ## Flux CD
+  ##
+  fluxcd:
+    ## @param addons.fluxcd.enabled Enables Flux CD
+    ##
+    enabled: false

packages/apps/mysql/.helmignore

@@ -1,23 +1,3 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
+.helmignore
+/logos
+/Makefile

packages/apps/mysql/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: mysql
 description: Managed MariaDB service
-icon: https://static-00.iconduck.com/assets.00/mariadb-icon-512x340-txozryr2.png
+icon: /logos/mariadb.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #

packages/apps/mysql/logos/mariadb.svg

@@ -0,0 +1,12 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="-0.00195312" width="144" height="144" rx="24" fill="url(#paint0_linear_683_2930)"/>
+<path d="M133.191 29.0022C131.213 29.0654 131.839 29.6354 127.564 30.6873C123.248 31.7496 117.975 31.4239 113.327 33.3733C99.4516 39.1924 96.6676 59.0813 84.0535 66.2059C74.6247 71.5318 65.112 71.9565 56.5594 74.6365C50.9389 76.399 44.7906 80.0135 39.6982 84.4018C35.7455 87.8093 35.6423 90.8054 31.5123 95.0791C27.0947 99.6504 13.9551 95.1564 8 102.153C9.91835 104.093 10.7594 104.636 14.5398 104.133C13.7571 105.616 9.14332 106.866 10.0465 109.049C10.9968 111.345 22.1511 112.901 32.2908 106.78C37.0131 103.929 40.7743 99.8193 48.1288 98.8384C57.6459 97.5699 68.6093 99.652 79.6268 101.241C77.9932 106.112 74.7133 109.351 72.086 113.231C71.2724 114.107 73.7202 114.205 76.5126 113.675C81.5359 112.433 85.1561 111.433 88.9472 109.227C93.6047 106.515 94.3104 99.5639 100.025 98.0599C103.209 102.954 111.869 104.11 117.242 100.195C112.527 98.8607 111.224 88.8244 112.815 84.4018C114.323 80.2156 115.813 73.5192 117.331 67.9855C118.961 62.0425 119.562 54.5519 121.535 51.5247C124.503 46.9701 127.783 45.406 130.63 42.8377C133.477 40.2695 136.083 37.7694 135.998 31.8927C135.97 29.9998 134.992 28.9447 133.191 29.0022Z" fill="#04244E"/>
+<path d="M128.953 32.4844C129.427 34.1004 130.168 34.8421 133.375 35.1387C132.906 39.2041 130.195 41.4276 127.154 43.5611C124.479 45.4376 121.547 47.2445 119.664 50.1757C117.734 53.1785 116.509 63.4554 113.517 73.6044C110.931 82.3738 107.025 91.0445 100.204 94.8437C99.4919 93.0502 100.295 89.74 98.878 88.652C97.9611 91.2674 96.9242 93.7627 95.7098 96.0821C91.7077 103.732 85.7822 109.459 75.8801 111.208C80.5785 104.85 85.071 98.2844 85.1683 87.3262C81.8617 88.0417 81.9319 95.8522 78.5345 97.9402C76.3563 98.1772 74.1498 98.1758 71.9291 98.0424C62.8091 97.4959 53.4535 94.7549 44.9219 97.4923C39.1128 99.3568 34.3619 103.755 29.4428 105.888C23.6614 108.396 19.2831 109.427 12.0836 108.396C11.1695 107.164 17.3526 105.575 16.9829 102.902C14.1653 102.59 12.5293 103.273 10.0801 102.16C10.3505 101.662 10.7479 101.247 11.2483 100.901C15.7373 97.794 28.4882 100.167 31.9006 96.8167C34.007 94.75 35.3889 92.5867 36.8197 90.4838C38.2072 88.4434 39.6415 86.4597 41.8268 84.6719C42.6337 84.0118 43.511 83.3596 44.4421 82.723C48.166 80.1743 52.7729 77.8628 57.3066 76.2694C63.4826 74.0984 69.741 73.9195 76.3237 71.4043C80.3904 69.85 84.8127 67.9302 88.4174 65.2439C89.2733 64.6051 90.0831 63.9245 90.8319 63.1949C101.125 53.1608 103.165 35.461 119.224 33.8116C121.166 33.6121 122.756 33.6767 124.203 33.6327C125.871 33.583 127.347 33.3893 128.953 32.4844ZM109.375 89.1339C109.567 92.2013 111.348 98.2872 112.92 99.7663C109.841 100.515 104.537 99.278 103.177 97.1062C103.876 93.9707 107.514 91.1041 109.375 89.1339Z" fill="white"/>
+<path d="M130.109 35.9187C129.49 37.2169 128.305 38.8908 128.305 42.1956C128.3 42.763 127.875 43.1517 127.867 42.277C127.899 39.047 128.754 37.6507 129.662 35.8155C130.085 35.0636 130.339 35.3738 130.109 35.9187ZM129.486 35.4297C128.756 36.6684 126.998 38.9278 126.707 42.2203C126.653 42.7848 126.194 43.1343 126.264 42.2618C126.581 39.0477 127.986 37.036 129.052 35.2873C129.536 34.5761 129.763 34.9074 129.486 35.4297ZM128.918 34.7817C128.086 35.9543 125.38 38.6678 124.814 41.9247C124.712 42.4819 124.225 42.7928 124.368 41.929C124.954 38.752 127.287 36.255 128.496 34.6037C129.038 33.9346 129.237 34.284 128.918 34.7817ZM128.411 34.0588L128.137 34.3499C126.927 35.6472 124.116 38.8114 123.179 41.7074C122.999 42.245 122.474 42.4848 122.737 41.6493C123.763 38.5864 126.589 35.2873 128.018 33.8227C128.65 33.2364 128.796 33.6106 128.411 34.0588ZM113.886 40.6162C114.513 37.9231 116.607 36.696 120.223 36.9953C121.096 41.0151 116.213 42.6366 113.886 40.6162Z" fill="#04244E"/>
+<defs>
+<linearGradient id="paint0_linear_683_2930" x1="140.5" y1="141" x2="5.99999" y2="-5.50228e-06" gradientUnits="userSpaceOnUse">
+<stop stop-color="#C49A6C"/>
+<stop offset="1" stop-color="#E7BF93"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/nats/.helmignore

@@ -0,0 +1,3 @@
+.helmignore
+/logos
+/Makefile

packages/apps/nats/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: nats
+description: Managed NATS service
+icon: /logos/nats.svg
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.4.1"

packages/apps/nats/Makefile

@@ -0,0 +1,2 @@
+generate:
+	readme-generator -v values.yaml -s values.schema.json -r README.md

packages/apps/nats/README.md

@@ -0,0 +1,11 @@
+# Managed NATS Service
+
+## Parameters
+
+### Common parameters
+
+| Name       | Description                                     | Value   |
+| ---------- | ----------------------------------------------- | ------- |
+| `external` | Enable external access from outside the cluster | `false` |
+| `replicas` | Persistent Volume size for NATS                 | `3`     |
+

packages/apps/nats/logos/nats.svg

@@ -0,0 +1,12 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_681_2821)"/>
+<rect width="144" height="144" rx="24" fill="black" fill-opacity="0.3"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M117.48 25H27V98.9693H66.0689L87.7075 119V98.9693H117.48V25Z" fill="white"/>
+<path d="M92.1352 72.4552V42.625H102.773V81.1999H86.6519L54.114 50.8414V81.2322H43.4443V42.625H60.1262L92.1352 72.4552Z" fill="black"/>
+<defs>
+<linearGradient id="paint0_linear_681_2821" x1="10" y1="15.5" x2="144" y2="131.5" gradientUnits="userSpaceOnUse">
+<stop stop-color="#385C93"/>
+<stop offset="1" stop-color="#32A574"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/nats/templates/nats.yaml

@@ -0,0 +1,43 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-system
+spec:
+  chart:
+    spec:
+      chart: cozy-nats
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '*'
+  interval: 1m0s
+  timeout: 5m0s
+  values:
+    nats:
+      fullnameOverride: {{ .Release.Name }}
+      config:
+        cluster:
+          enabled: true
+          replicas: {{ .Values.replicas }}
+        monitor:
+          enabled: true
+        jetstream:
+          enabled: true
+          fileStore:
+            enabled: true
+            pvc:
+              enabled: true
+              size: 10Gi
+              storageClassName: local
+      promExporter:
+        enabled: true
+        podMonitor:
+          enabled: true
+      {{- if .Values.external }}
+      service:
+        merge:
+          spec:
+            type: LoadBalancer
+      {{- end }}

packages/apps/nats/values.schema.json

@@ -0,0 +1,16 @@
+{
+    "title": "Chart Values",
+    "type": "object",
+    "properties": {
+        "external": {
+            "type": "boolean",
+            "description": "Enable external access from outside the cluster",
+            "default": false
+        },
+        "replicas": {
+            "type": "number",
+            "description": "Persistent Volume size for NATS",
+            "default": 3
+        }
+    }
+}

packages/apps/nats/values.yaml

@@ -0,0 +1,8 @@
+
+## @section Common parameters
+
+## @param external Enable external access from outside the cluster
+## @param replicas Persistent Volume size for NATS
+##
+external: false
+replicas: 2

packages/apps/postgres/.helmignore

@@ -1,23 +1,3 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
+.helmignore
+/logos
+/Makefile

packages/apps/postgres/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: postgres
 description: Managed PostgreSQL service
-icon: https://cdn-icons-png.flaticon.com/512/5968/5968342.png
+icon: /logos/postgres.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.4.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/postgres/README.md

@@ -6,7 +6,7 @@ PostgreSQL is currently the leading choice among relational databases, known for
 
 This managed service is controlled by the CloudNativePG operator, ensuring efficient management and seamless operation.
 
-- Docs: https://cloudnative-pg.io/documentation/
+- Docs: https://cloudnative-pg.io/docs/
 - Github: https://github.com/cloudnative-pg/cloudnative-pg
 
 ## HowTos
@@ -35,11 +35,13 @@ more details:
 
 ### Common parameters
 
-| Name       | Description                                     | Value   |
-| ---------- | ----------------------------------------------- | ------- |
-| `external` | Enable external access from outside the cluster | `false` |
-| `size`     | Persistent Volume size                          | `10Gi`  |
-| `replicas` | Number of MariaDB replicas                      | `2`     |
+| Name                     | Description                                                                                                             | Value   |
+| ------------------------ | ----------------------------------------------------------------------------------------------------------------------- | ------- |
+| `external`               | Enable external access from outside the cluster                                                                         | `false` |
+| `size`                   | Persistent Volume size                                                                                                  | `10Gi`  |
+| `replicas`               | Number of Postgres replicas                                                                                             | `2`     |
+| `quorum.minSyncReplicas` | Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.           | `0`     |
+| `quorum.maxSyncReplicas` | Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances). | `0`     |
 
 ### Configuration parameters
 

packages/apps/postgres/logos/postgres.svg

@@ -0,0 +1,20 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_683_2849)"/>
+<path d="M94.481 93.3049C95.0718 88.3477 94.8948 87.6208 98.5612 88.4238L99.492 88.5061C102.311 88.6353 105.999 88.0495 108.166 87.0358C112.83 84.8564 115.595 81.2176 110.996 82.1738C100.506 84.3532 99.7849 80.7759 99.7849 80.7759C110.862 64.224 115.493 43.2128 111.496 38.0697C100.594 24.0412 81.7231 30.675 81.4073 30.8472L81.3068 30.8659C79.234 30.4328 76.9143 30.174 74.3085 30.1316C69.5613 30.053 65.9591 31.3849 63.2266 33.4721C63.2266 33.4721 29.5621 19.5047 31.1282 51.0375C31.4613 57.7454 40.6758 101.795 51.6659 88.4901C55.6827 83.6249 59.5646 79.5113 59.5646 79.5113C61.4922 80.8009 63.8 81.4588 66.2204 81.2225L66.4075 81.0618C66.3489 81.6659 66.3747 82.2567 66.4824 82.9562C63.6517 86.1419 64.4835 86.7012 58.8231 87.8745C53.0965 89.0631 56.4609 91.1793 58.6569 91.7324C61.3199 92.403 67.4804 93.353 71.644 87.4845L71.4782 88.1541C72.5888 89.0489 72.5137 94.5854 72.6712 98.5411C72.8289 102.497 73.0919 106.189 73.8926 108.365C74.6933 110.541 75.6381 116.147 83.0771 114.541C89.2943 113.2 94.0478 111.269 94.481 93.3049Z" fill="black" stroke="black" stroke-width="6"/>
+<path d="M110.998 82.1727C100.506 84.3521 99.7849 80.7748 99.7849 80.7748C110.862 64.2218 115.493 43.2102 111.497 38.0678C100.595 24.0401 81.7231 30.6743 81.4082 30.8465L81.3068 30.8648C79.2341 30.4315 76.9144 30.1733 74.3073 30.1305C69.56 30.0521 65.9591 31.3838 63.2267 33.4706C63.2267 33.4706 29.5615 19.5038 31.1272 51.0364C31.4603 57.7447 40.6746 101.795 51.6651 88.4895C55.6821 83.6243 59.5634 79.5106 59.5634 79.5106C61.4912 80.8002 63.799 81.4581 66.2184 81.2218L66.4063 81.0611C66.3479 81.6652 66.3746 82.256 66.4816 82.9555C63.6503 86.1412 64.4822 86.7005 58.8223 87.8738C53.0953 89.0625 56.4597 91.1786 58.6563 91.7317C61.3193 92.4023 67.4802 93.3524 71.643 87.4838L71.477 88.1534C72.5864 89.0482 73.3654 93.9739 73.2348 98.439C73.1042 102.904 73.0171 105.97 73.8912 108.364C74.7653 110.759 75.6365 116.146 83.0769 114.541C89.2941 113.199 92.5159 109.722 92.9641 103.922C93.2822 99.7988 94.0019 100.408 94.0474 96.7219L94.6247 94.9766C95.2905 89.3872 94.7305 87.584 98.5608 88.4227L99.4917 88.505C102.311 88.6342 106.001 88.0484 108.166 87.0347C112.829 84.8553 115.595 81.2166 110.997 82.1727H110.998Z" fill="#336791"/>
+<path d="M72.0933 85.377C71.8045 95.7774 72.1659 106.25 73.1764 108.796C74.1876 111.341 76.3514 116.292 83.7925 114.686C90.0091 113.344 92.271 110.747 93.2526 105.014C93.9755 100.796 95.3691 89.081 95.5479 86.6809" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M63.175 33.2393C63.175 33.2393 29.4868 19.3732 31.053 50.9058C31.386 57.6141 40.601 101.665 51.5913 88.3597C55.6075 83.4938 59.2397 79.6776 59.2397 79.6776" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M81.3713 30.7078C80.2052 31.076 100.111 23.3796 111.423 37.9368C115.419 43.0795 110.789 64.0911 99.7115 80.6445" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M99.711 80.6448C99.711 80.6448 100.433 84.223 110.924 82.0422C115.521 81.0861 112.755 84.7252 108.093 86.9057C104.267 88.694 95.6883 89.1523 95.5482 86.6812C95.1876 80.3053 100.063 82.2423 99.711 80.6448ZM99.711 80.6448C99.3929 79.206 97.2128 77.7939 95.7705 74.2725C94.5114 71.199 78.5019 47.6289 100.21 51.1294C101.006 50.9637 94.5485 30.3348 74.2325 29.9994C53.9211 29.6639 54.5875 55.1545 54.5875 55.1545" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="bevel"/>
+<path d="M66.4077 82.8253C63.576 86.0108 64.4088 86.5702 58.7485 87.7439C53.0214 88.9327 56.3862 91.0485 58.5822 91.6013C61.2452 92.2724 67.4061 93.2224 71.5689 87.3524C72.8366 85.5651 71.5614 82.7134 69.8201 81.9864C68.9787 81.6354 67.8537 81.1956 66.4077 82.8253Z" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M66.2225 82.7691C65.9372 80.8961 66.8336 78.6674 67.7943 76.0599C69.238 72.1477 72.569 68.2348 69.9044 55.8246C67.9182 46.5767 54.5963 53.9 54.588 55.154C54.5798 56.4075 55.1905 61.5099 54.3654 67.4515C53.2888 75.2048 59.2643 81.7621 66.1451 81.0913" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M63.0528 54.9665C62.9928 55.3948 63.8314 56.5377 64.9249 56.6904C66.0166 56.8437 66.951 55.9506 67.0102 55.5227C67.0694 55.0945 66.2318 54.6227 65.1379 54.4694C64.0456 54.3158 63.1108 54.5393 63.0531 54.9665H63.0528Z" fill="white" stroke="white" stroke-width="2"/>
+<path d="M96.3034 54.0924C96.3627 54.5207 95.5251 55.6635 94.4313 55.8162C93.3389 55.9696 92.4045 55.0765 92.3446 54.6486C92.2868 54.2203 93.1247 53.7486 94.2173 53.5953C95.31 53.4419 96.2442 53.6652 96.3034 54.0926V54.0924Z" fill="white" stroke="white"/>
+<path d="M100.21 51.1289C100.39 54.4883 99.492 56.7765 99.3787 60.3527C99.211 65.5508 101.84 71.5005 97.8789 77.4575" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<defs>
+<linearGradient id="paint0_linear_683_2849" x1="140" y1="130.5" x2="4" y2="9.49999" gradientUnits="userSpaceOnUse">
+<stop stop-color="#002C4C"/>
+<stop offset="1" stop-color="#00477B"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/postgres/templates/dashboard-resourcemap.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  resourceNames:
+  - postgres-service-r
+  - postgres-service-ro
+  - postgres-service-rw
+  verbs: ["get", "list", "watch"]

packages/apps/postgres/templates/db.yaml

@@ -11,8 +11,15 @@ spec:
     parameters:
       max_wal_senders: "30"
 
+  minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}
+  maxSyncReplicas: {{ .Values.quorum.maxSyncReplicas }}
+
   monitoring:
     enablePodMonitor: true
 
   storage:
     size: {{ required ".Values.size is required" .Values.size }}
+
+  inheritedMetadata:
+    labels:
+      policy.cozystack.io/allow-to-apiserver: "true"

packages/apps/postgres/templates/init-script.yaml

@@ -53,60 +53,93 @@ stringData:
 
     echo "== grant privileges on databases to roles"
     {{- range $database, $d := .Values.databases }}
-
-    # admin
     psql -v ON_ERROR_STOP=1 --echo-all -d "{{ $database }}" <<\EOT
-    DO $$DECLARE r record;
+    ALTER DATABASE {{ $database }} OWNER TO {{ $database }}_admin;
+    GRANT CONNECT ON DATABASE {{ $database }} TO {{ $database }}_readonly;
+
+    DO $$
     DECLARE
-        v_schema varchar := 'public';
-        v_new_owner varchar := '{{ $database }}_admin';
+        schema_record record;
     BEGIN
-        FOR r IN
-            select 'ALTER TABLE "' || table_schema || '"."' || table_name || '" OWNER TO ' || v_new_owner || ';' as a from information_schema.tables where table_schema = v_schema
-            union all
-            select 'ALTER TABLE "' || sequence_schema || '"."' || sequence_name || '" OWNER TO ' || v_new_owner || ';' as a from information_schema.sequences where sequence_schema = v_schema
-            union all
-            select 'ALTER TABLE "' || table_schema || '"."' || table_name || '" OWNER TO ' || v_new_owner || ';' as a from information_schema.views where table_schema = v_schema
-            union all
-            select 'ALTER FUNCTION "'||nsp.nspname||'"."'||p.proname||'"('||pg_get_function_identity_arguments(p.oid)||') OWNER TO ' || v_new_owner || ';' as a from pg_proc p join pg_namespace nsp ON p.pronamespace = nsp.oid where nsp.nspname = v_schema
-        LOOP
-            EXECUTE r.a;
+        -- Loop over all schemas
+        FOR schema_record IN SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT IN ('pg_catalog', 'information_schema') LOOP
+            -- Changing Schema Ownership
+            EXECUTE format('ALTER SCHEMA %I OWNER TO %I', schema_record.schema_name, '{{ $database }}_admin');
+    
+            -- Add rights for the admin role
+            EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_admin');
+            EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_admin');
+            EXECUTE format('GRANT ALL ON ALL SEQUENCES IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_admin');
+            EXECUTE format('GRANT ALL ON ALL FUNCTIONS IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_admin');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO %I', schema_record.schema_name, '{{ $database }}_admin');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO %I', schema_record.schema_name, '{{ $database }}_admin');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON FUNCTIONS TO %I', schema_record.schema_name, '{{ $database }}_admin');
+    
+            -- Add rights for the readonly role
+            EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_readonly');
+            EXECUTE format('GRANT SELECT ON ALL TABLES IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_readonly');
+            EXECUTE format('GRANT USAGE ON ALL SEQUENCES IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_readonly');
+            EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_readonly');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT SELECT ON TABLES TO %I', schema_record.schema_name, '{{ $database }}_readonly');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT USAGE ON SEQUENCES TO %I', schema_record.schema_name, '{{ $database }}_readonly');
+            EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT EXECUTE ON FUNCTIONS TO %I', schema_record.schema_name, '{{ $database }}_readonly');
         END LOOP;
     END$$;
-    ALTER DATABASE {{ $database }} OWNER TO {{ $database }}_admin;
-    ALTER SCHEMA public OWNER TO {{ $database }}_admin;
-    GRANT ALL ON SCHEMA public TO {{ $database }}_admin;
-    GRANT ALL ON ALL TABLES IN SCHEMA public TO {{ $database }}_admin;
-    GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO {{ $database }}_admin;
-    GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO {{ $database }}_admin;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO {{ $database }}_admin;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO {{ $database }}_admin;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON FUNCTIONS TO {{ $database }}_admin;
     EOT
 
-    # readonly
+    echo "== setup event trigger for schema creation"
     psql -v ON_ERROR_STOP=1 --echo-all -d "{{ $database }}" <<\EOT
-    GRANT CONNECT ON DATABASE {{ $database }} TO {{ $database }}_readonly;
-    GRANT USAGE ON SCHEMA public TO {{ $database }}_readonly;
-    GRANT SELECT ON ALL TABLES IN SCHEMA public TO {{ $database }}_readonly;
-    GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO {{ $database }}_readonly;
-    GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO {{ $database }}_readonly;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO {{ $database }}_readonly;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE ON SEQUENCES TO {{ $database }}_readonly;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO {{ $database }}_readonly;
+    CREATE OR REPLACE FUNCTION auto_grant_schema_privileges()
+    RETURNS event_trigger LANGUAGE plpgsql AS $$
+    DECLARE
+      obj record;
+    BEGIN
+      FOR obj IN SELECT * FROM pg_event_trigger_ddl_commands() WHERE command_tag = 'CREATE SCHEMA' LOOP
+        EXECUTE format('ALTER SCHEMA %I OWNER TO %I', obj.object_identity, '{{ $database }}_admin');
+        EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_admin');
+        EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('GRANT SELECT ON ALL TABLES IN SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('GRANT USAGE ON ALL SEQUENCES IN SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+
+        -- Set owner for schema
+        EXECUTE format('ALTER SCHEMA %I OWNER TO %I', obj.object_identity, '{{ $database }}_admin');
+
+        -- Set privileges for admin role
+        EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_admin');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO %I', obj.object_identity, '{{ $database }}_admin');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO %I', obj.object_identity, '{{ $database }}_admin');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON FUNCTIONS TO %I', obj.object_identity, '{{ $database }}_admin');
+
+        -- Set privileges for readonly role
+        EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('GRANT SELECT ON ALL TABLES IN SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('GRANT USAGE ON ALL SEQUENCES IN SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT SELECT ON TABLES TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT USAGE ON SEQUENCES TO %I', obj.object_identity, '{{ $database }}_readonly');
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT EXECUTE ON FUNCTIONS TO %I', obj.object_identity, '{{ $database }}_readonly');
+      END LOOP;
+    END;
+    $$;
+
+    DROP EVENT TRIGGER IF EXISTS trigger_auto_grant;
+    CREATE EVENT TRIGGER trigger_auto_grant ON ddl_command_end
+    WHEN TAG IN ('CREATE SCHEMA')
+    EXECUTE PROCEDURE auto_grant_schema_privileges();
     EOT
     {{- end }}
 
     echo "== assign roles to users"
     psql -v ON_ERROR_STOP=1 --echo-all <<\EOT
     {{- range $database, $d := .Values.databases }}
-    {{- range $user, $u := $.Values.roles }}
-    {{- if has $user $d.users.admin }}
+    {{- range $user, $u := $.Values.users }}
+    {{- if has $user $d.roles.admin }}
     GRANT {{ $database }}_admin TO {{ $user }};
     {{- else }}
     REVOKE {{ $database }}_admin FROM {{ $user }};
     {{- end }}
-    {{- if has $user $d.users.readonly }}
+    {{- if has $user $d.roles.readonly }}
     GRANT {{ $database }}_readonly TO {{ $user }};
     {{- else }}
     REVOKE {{ $database }}_readonly FROM {{ $user }};

packages/apps/postgres/values.schema.json

@@ -14,9 +14,24 @@
         },
         "replicas": {
             "type": "number",
-            "description": "Number of MariaDB replicas",
+            "description": "Number of Postgres replicas",
             "default": 2
         },
+        "quorum": {
+            "type": "object",
+            "properties": {
+                "minSyncReplicas": {
+                    "type": "number",
+                    "description": "Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.",
+                    "default": 0
+                },
+                "maxSyncReplicas": {
+                    "type": "number",
+                    "description": "Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances).",
+                    "default": 0
+                }
+            }
+        },
         "databases": {
             "type": "object",
             "description": "Databases configuration",

packages/apps/postgres/values.yaml

@@ -2,12 +2,19 @@
 
 ## @param external Enable external access from outside the cluster
 ## @param size Persistent Volume size
-## @param replicas Number of MariaDB replicas
+## @param replicas Number of Postgres replicas
 ##
 external: false
 size: 10Gi
 replicas: 2
 
+## Configuration for the quorum-based synchronous replication
+## @param quorum.minSyncReplicas Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.
+## @param quorum.maxSyncReplicas Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances).
+quorum:
+  minSyncReplicas: 0
+  maxSyncReplicas: 0
+
 ## @section Configuration parameters
 
 ## @param users [object] Users configuration

packages/apps/rabbitmq/.helmignore

@@ -1,23 +1,3 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
+.helmignore
+/logos
+/Makefile

packages/apps/rabbitmq/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: rabbitmq
 description: Managed RabbitMQ service
-icon: https://static-00.iconduck.com/assets.00/rabbitmq-icon-484x512-s9lfaapn.png
+icon: /logos/rabbitmq.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #

packages/apps/rabbitmq/logos/rabbitmq.svg

@@ -0,0 +1,10 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="-0.00195312" width="144" height="144" rx="24" fill="url(#paint0_linear_683_2972)"/>
+<path d="M111.411 62.8H82.4939C81.7969 62.7997 81.1285 62.5228 80.6356 62.0301C80.1427 61.5373 79.8656 60.8691 79.8653 60.1722V30.0412C79.8653 27.81 78.0556 26 75.8249 26H65.5021C63.27 26 61.4614 27.81 61.4614 30.0412V59.9898C61.4614 61.5435 60.205 62.8065 58.6508 62.8133L49.1743 62.8584C47.6069 62.8669 46.3336 61.5955 46.3366 60.0298L46.3954 30.048C46.4005 27.8134 44.5902 26 42.355 26H32.0407C29.8083 26 28 27.81 28 30.0412V114.412C28 116.394 29.6061 118 31.5871 118H111.411C113.394 118 115 116.394 115 114.412V66.388C115 64.4058 113.394 62.8 111.411 62.8ZM97.8508 94.4779C97.8508 97.0755 95.7445 99.1817 93.1464 99.1817H84.9884C82.39 99.1817 80.2836 97.0755 80.2836 94.4779V86.3217C80.2836 83.7238 82.39 81.6179 84.9884 81.6179H93.1464C95.7445 81.6179 97.8508 83.7238 97.8508 86.3217V94.4779Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_683_2972" x1="5" y1="-7.5" x2="141" y2="124.5" gradientUnits="userSpaceOnUse">
+<stop stop-color="#FF822F"/>
+<stop offset="1" stop-color="#FF6600"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/redis/.helmignore

@@ -1,23 +1,3 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
+.helmignore
+/logos
+/Makefile

packages/apps/redis/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: redis
 description: Managed Redis service
-icon: https://cdn4.iconfinder.com/data/icons/redis-2/1451/Untitled-2-512.png
+icon: /logos/redis.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #

packages/apps/redis/logos/redis.svg

@@ -0,0 +1,18 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_683_3213)"/>
+<path d="M120.149 95.5491C114.586 98.4485 85.7709 110.296 79.6363 113.495C73.5016 116.693 70.0937 116.662 65.2472 114.346C60.4012 112.029 29.7364 99.6423 24.2125 97.0019C21.4519 95.6827 20 94.5687 20 93.5166V82.9809C20 82.9809 59.922 74.2901 66.3669 71.9778C72.8115 69.6656 75.0476 69.5821 80.532 71.591C86.0173 73.6008 118.812 79.5176 124.233 81.5029L124.23 91.8896C124.231 92.9311 122.98 94.0736 120.149 95.5491Z" fill="#912626"/>
+<path d="M120.147 85.0752C114.585 87.9734 85.77 99.8218 79.6354 103.02C73.5011 106.219 70.0932 106.187 65.2472 103.871C60.4007 101.555 29.7371 89.1668 24.2136 86.528C18.6901 83.8876 18.5744 82.0704 24.0003 79.9458C29.4261 77.8205 59.9215 65.8561 66.3672 63.5438C72.8118 61.2324 75.0475 61.1481 80.5319 63.1578C86.0168 65.1668 114.66 76.5676 120.079 78.5525C125.501 80.5399 125.709 82.1763 120.147 85.0752Z" fill="#C6302B"/>
+<path d="M120.149 78.502C114.586 81.4018 85.7709 93.2493 79.6363 96.4488C73.5016 99.6462 70.0937 99.6152 65.2472 97.2985C60.4008 94.983 29.7364 82.5952 24.2125 79.9547C21.4519 78.6355 20 77.5232 20 76.4707V65.9338C20 65.9338 59.922 57.2434 66.3669 54.9311C72.8115 52.6189 75.0476 52.535 80.532 54.5443C86.0177 56.5536 118.813 62.4693 124.233 64.455L124.23 74.8428C124.231 75.884 122.98 77.0264 120.149 78.502Z" fill="#912626"/>
+<path d="M120.147 68.0282C114.585 70.9271 85.77 82.7747 79.6354 85.9737C73.5011 89.1716 70.0932 89.1402 65.2472 86.8235C60.4007 84.5084 29.7371 72.1201 24.2136 69.4809C18.6901 66.8413 18.5744 65.0237 24.0003 62.8984C29.4261 60.7742 59.9219 48.809 66.3672 46.4972C72.8118 44.1853 75.0475 44.1014 80.5319 46.1108C86.0168 48.1197 114.66 59.5197 120.079 61.5055C125.501 63.4924 125.709 65.1292 120.147 68.0282Z" fill="#C6302B"/>
+<path d="M120.149 60.8224C114.586 63.7214 85.7709 75.5698 79.6363 78.7692C73.5016 81.9671 70.0937 81.9357 65.2472 79.619C60.4008 77.3035 29.7364 64.9152 24.2125 62.276C21.4519 60.9556 20 59.8428 20 58.7915V48.2542C20 48.2542 59.922 39.5642 66.3669 37.2524C72.8115 34.9397 75.0476 34.8567 80.532 36.8656C86.0177 38.8749 118.813 44.7905 124.233 46.7763L124.23 57.1637C124.231 58.204 122.98 59.3465 120.149 60.8224Z" fill="#912626"/>
+<path d="M120.147 50.349C114.585 53.2479 85.7698 65.0963 79.6352 68.2941C73.5009 71.492 70.093 71.4606 65.2469 69.1451C60.4009 66.8283 29.7369 54.4409 24.2138 51.8013C18.6899 49.1621 18.5746 47.3441 24 45.2192C29.4259 43.0946 59.9217 31.131 66.367 28.8184C72.8116 26.5061 75.0473 26.423 80.5317 28.4324C86.0166 30.4417 114.659 41.8418 120.079 43.8275C125.501 45.8128 125.709 47.45 120.147 50.349Z" fill="#C6302B"/>
+<path d="M84.8541 40.0994L75.8926 41.0298L73.8865 45.857L70.6463 40.4703L60.2983 39.5404L68.0197 36.7558L65.703 32.4814L72.9321 35.3088L79.7471 33.0775L77.9052 37.4972L84.8541 40.0994ZM73.3515 63.5184L56.6266 56.5816L80.592 52.9029L73.3515 63.5184ZM50.1637 42.7826C57.2381 42.7826 62.973 45.0057 62.973 47.7475C62.973 50.4901 57.2381 52.7128 50.1637 52.7128C43.0893 52.7128 37.3545 50.4897 37.3545 47.7475C37.3545 45.0057 43.0893 42.7826 50.1637 42.7826Z" fill="white"/>
+<path d="M95.4434 41.4174L109.627 47.0224L95.4556 52.622L95.4434 41.4174Z" fill="#621B1C"/>
+<path d="M79.7529 47.6261L95.4449 41.4189L95.4571 52.6236L93.9184 53.2254L79.7529 47.6261Z" fill="#9A2928"/>
+<defs>
+<linearGradient id="paint0_linear_683_3213" x1="189" y1="210.5" x2="0" y2="0" gradientUnits="userSpaceOnUse">
+<stop stop-color="#A80000"/>
+<stop offset="1" stop-color="#FFCFCF"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/tcp-balancer/.helmignore

@@ -1,23 +1,3 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
+.helmignore
+/logos
+/Makefile

packages/apps/tcp-balancer/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: tcp-balancer
 description: Layer4 load balancer service
-icon: https://cdn.icon-icons.com/icons2/2699/PNG/512/haproxy_logo_icon_171017.png
+icon: /logos/haproxy.svg
 
 # A chart can be either an 'application' or a 'library' chart.
 #

packages/apps/tcp-balancer/logos/haproxy.svg

@@ -0,0 +1,79 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_linear_683_2985)"/>
+<path d="M72.1645 59.4243L62.5 48.498" stroke="white" stroke-width="0.26" stroke-miterlimit="10"/>
+<path d="M41.6855 51.0215L49.247 62.0693" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M72.1646 59.4414L81.7263 48.3936M83.7171 71.6294L95.064 62.0678M83.7171 71.6108L95.064 81.593M81.8291 94.2017L72.1646 83.4811M62.5001 94.2017L72.1646 83.4904M49.2559 81.1724L60.1821 71.6108M60.1915 71.6108L49.2652 62.0491L72.1646 59.4227L95.064 62.0491" stroke="white" stroke-width="0.26" stroke-miterlimit="10"/>
+<path d="M81.7168 48.3936L83.717 71.6108L81.829 94.1924" stroke="white" stroke-width="0.26" stroke-miterlimit="10"/>
+<path d="M95.064 81.5925L72.1646 83.4805M49.2559 81.1719L72.1553 83.4992" stroke="white" stroke-width="0.26" stroke-miterlimit="10"/>
+<path d="M62.5012 94.2014L60.1738 71.6198M62.5012 48.4961L60.1738 71.6105" stroke="white" stroke-width="0.26" stroke-miterlimit="10"/>
+<path d="M38.75 64.9948L49.2557 62.0506M51.4615 40.6187L62.5093 48.4979M62.4906 48.4979L65.0142 35.6836L81.7168 48.3951" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M79.2031 35.6836L81.7267 48.3951M92.7558 40.6187L81.708 48.3951M102.626 51.0215L81.7174 48.3951M102.626 51.0028L95.0645 62.0506L105.776 64.9948" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M95.0639 62.0506L105.57 78.0148M79.2025 35.6836L62.5 48.4979" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M95.0637 62.0511L92.7363 40.6191M95.0637 81.5951L105.569 78.0153" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M95.065 81.5949L105.776 64.9951M95.065 81.5949L102.626 91.7828M95.065 81.5949L92.7377 102.186M81.8301 94.2035L92.7564 102.186" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M81.829 94.203L102.625 91.7822M81.829 94.203L79.3241 107.111M81.829 94.203L65.0143 107.101M62.5 94.203L65.0236 107.139" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M62.5012 94.2031L79.3253 107.111M51.4628 102.185L62.5105 94.2031L41.6768 91.8851L49.2569 81.1738" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M51.4618 102.185L49.256 81.1731L38.6475 77.9111L49.256 62.0498" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M49.2557 81.1745L38.75 64.9953M51.4615 40.6191L49.2557 62.0511" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M41.6855 51.0217L62.4819 48.498" stroke="white" stroke-width="0.13" stroke-miterlimit="10"/>
+<path d="M43.376 36.8338L51.4609 40.6192L50.8346 31.7959L65.0136 35.6841" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M58.9289 28.2244L65.0136 35.6831L67.5373 26.7383L79.2019 35.6831M51.4609 40.6181L58.9196 28.2244" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M76.5667 26.4404L79.2025 35.6843L85.2966 28.2256M65.0049 35.6843L76.5574 26.4404M92.7552 40.6194L85.2779 28.2256" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M92.7549 40.6192L93.4932 31.7959M92.7549 40.6192L101.036 36.4132M92.7549 40.6192L107.149 42.825M79.2021 35.6841L93.4839 31.7959" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M102.625 51.0214L107.139 42.8244M102.625 51.0214L101.045 36.4219M102.625 51.0214L112.083 50.283M102.625 51.0214L115.56 58.3773" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M105.774 64.9949L112.083 50.2832M105.774 64.9949L115.541 58.3774M105.774 64.9949L116.7 67.2007L105.568 78.0149" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M117.019 75.9121L105.569 78.0151L115.337 84.5297L102.625 91.7827M105.775 64.9951L117.019 75.9214" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M102.625 91.7833L111.971 92.7273M105.578 78.0156L111.971 92.718M107.055 100.064L102.643 91.7833L100.961 106.28" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M100.943 106.279L92.7458 102.185M92.7551 102.185L93.3813 111.345M92.7551 102.185L107.037 100.082M92.7551 102.185L85.2871 114.794" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M79.3232 107.103L85.277 114.767M79.3232 107.103L93.3993 111.309M79.3232 107.103L76.5659 116.561M79.3232 107.103L67.5557 116.561" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M65.0136 107.102L67.5373 116.561M65.0136 107.102L76.5568 116.561M65.0136 107.102L59.0224 114.766M51.4609 102.186L59.0224 114.794" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M65.0139 107.101L50.7322 111.513M50.7228 111.532L51.4612 102.185L43.2642 106.699L41.6846 91.8848" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M51.461 102.186L37.0671 100.195M41.6844 91.886L37.0578 100.167M41.6844 91.886L32.2255 92.8301M41.6844 91.886L28.6738 84.6423L38.6467 77.9127L27.2998 75.9219" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M38.6467 77.9123L32.2536 92.8296M38.7495 64.9951L27.2998 75.9214" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M38.6467 77.9122L27.2998 67.2009M38.7589 64.9951L28.9822 58.4805" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M27.2998 67.2007L38.7495 64.9949L32.2442 50.2832" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M41.6836 51.0217L32.2247 50.2833M41.6836 51.0217L28.9814 58.4804M41.6836 51.0217L37.1785 43.2453M41.6836 51.0217L43.366 36.8428" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M51.461 40.6191L37.1699 43.2456" stroke="white" stroke-width="0.101" stroke-miterlimit="10"/>
+<path d="M54.5645 77.0702L54.6392 66.0224L65.687 66.0971L65.6123 77.1449L54.5645 77.0702ZM66.5189 64.9101L66.5937 53.8623L77.6415 53.9371L77.5667 64.9849L66.5189 64.9101ZM66.5189 89.1274L66.5937 78.0796L77.6415 78.1544L77.5667 89.2022L66.5189 89.1274ZM78.5761 76.9673L78.6509 65.9195L89.6987 65.9943L89.6239 77.0421L78.5761 76.9673Z" fill="white"/>
+<path d="M77.9406 52.2366L77.9966 44.5723L85.6983 44.6283L85.6422 52.2926L77.9406 52.2366ZM58.6864 52.2366L58.7424 44.5723L66.4441 44.6283L66.388 52.2926L58.6864 52.2366ZM45.358 65.8921L45.4141 58.2278L53.1157 58.2839L53.0597 65.9482L45.358 65.8921ZM45.3486 85.165L45.4328 77.5007L53.1344 77.5848L53.0503 85.2491L45.3486 85.165ZM91.269 85.0154L91.325 77.3511L99.0267 77.4072L98.9706 85.0715L91.269 85.0154ZM91.4185 65.9482L91.5026 58.2839L99.2043 58.368L99.1202 66.0323L91.4185 65.9482Z" fill="white"/>
+<path d="M39.1143 53.5263L39.1517 48.4791L44.1802 48.5165L44.1428 53.5637L39.1143 53.5263ZM48.9563 43.2637L48.9937 38.2164L54.0223 38.2538L53.9849 43.301L48.9563 43.2637ZM62.4997 38.1884L62.5371 33.1412L67.5656 33.1786L67.5282 38.2258L62.4997 38.1884ZM36.1514 67.4903L36.1888 62.4431L41.1892 62.4805L41.1519 67.5277L36.1514 67.4903ZM100.083 48.5539L105.13 48.5165L105.167 53.545L100.12 53.5824L100.083 48.5539ZM90.2407 38.1136L95.2879 38.0762L95.3253 43.1048L90.2781 43.1421L90.2407 38.1136ZM76.6506 33.1692L81.6978 33.1318L81.7352 38.1604L76.688 38.1977L76.6506 33.1692ZM103.018 62.4992L108.065 62.4618L108.102 67.4903L103.055 67.5277L103.018 62.4992Z" fill="white"/>
+<path d="M58.583 98.2405L58.6391 90.5762L66.3408 90.6323L66.2847 98.2965L58.583 98.2405ZM77.8372 98.2405L77.8933 90.5762L85.595 90.6323L85.5389 98.2965L77.8372 98.2405Z" fill="white"/>
+<path d="M100.045 94.3619L100.082 89.3147L105.111 89.3521L105.074 94.3993L100.045 94.3619ZM90.3152 104.727L90.3526 99.6802L95.3811 99.7176L95.3437 104.765L90.3152 104.727ZM76.7718 109.7L76.8092 104.653L81.8377 104.69L81.8004 109.737L76.7718 109.7ZM103.008 80.3979L103.045 75.3507L108.074 75.3881L108.037 80.4353L103.008 80.3979ZM39.1233 89.3147L44.1706 89.2773L44.2079 94.3058L39.1607 94.3432L39.1233 89.3147ZM48.9654 99.6428L54.0126 99.6054L54.05 104.634L49.0028 104.671L48.9654 99.6428ZM62.4433 104.597L67.4906 104.559L67.5279 109.588L62.4807 109.625L62.4433 104.597ZM36.1885 75.3694L41.2357 75.332L41.2731 80.3606L36.2259 80.3979L36.1885 75.3694Z" fill="white"/>
+<path d="M110.625 51.6384L110.644 48.9092L113.429 48.9279L113.41 51.6571L110.625 51.6384Z" fill="white"/>
+<path d="M114.224 59.8913L114.242 57.1621L117.028 57.1808L117.009 59.91L114.224 59.8913Z" fill="white"/>
+<path d="M105.767 44.3376L105.785 41.6084L108.571 41.6271L108.552 44.3563L105.767 44.3376Z" fill="white"/>
+<path d="M41.9736 38.0945L41.9923 35.3652L44.7776 35.3839L44.7589 38.1132L41.9736 38.0945Z" fill="white"/>
+<path d="M26 68.5554L26.0187 65.8262L28.804 65.8449L28.7853 68.5741L26 68.5554Z" fill="white"/>
+<path d="M99.624 38.0945L99.6427 35.3652L102.428 35.3839L102.409 38.1132L99.624 38.0945Z" fill="white"/>
+<path d="M27.5898 59.8816L27.6085 57.1523L30.3939 57.171L30.3752 59.9003L27.5898 59.8816Z" fill="white"/>
+<path d="M57.6299 29.6355L57.6486 26.9062L60.4339 26.9249L60.4152 29.6542L57.6299 29.6355Z" fill="white"/>
+<path d="M30.9727 51.6384L30.9913 48.9092L33.7767 48.9279L33.758 51.6571L30.9727 51.6384Z" fill="white"/>
+<path d="M35.9453 44.2361L35.964 41.5068L38.7493 41.5255L38.7306 44.2548L35.9453 44.2361Z" fill="white"/>
+<path d="M49.4229 30.4204L52.1521 30.4017L52.1708 33.187L49.4415 33.2057L49.4229 30.4204ZM66.303 25.046L69.0322 25.0273L69.0509 27.8127L66.3217 27.8314L66.303 25.046Z" fill="white"/>
+<path d="M92.2227 33.2244L92.2414 30.4951L95.0267 30.5138L95.008 33.243L92.2227 33.2244Z" fill="white"/>
+<path d="M115.598 68.4529L115.616 65.7236L118.402 65.7423L118.383 68.4716L115.598 68.4529Z" fill="white"/>
+<path d="M75.1914 27.7292L75.2101 25L77.9954 25.0187L77.9767 27.7479L75.1914 27.7292Z" fill="white"/>
+<path d="M83.8662 29.5232L83.8849 26.7939L86.6702 26.8126L86.6515 29.5419L83.8662 29.5232Z" fill="white"/>
+<path d="M99.624 107.7L99.6427 104.971L102.428 104.989L102.409 107.719L99.624 107.7Z" fill="white"/>
+<path d="M115.598 77.239L115.616 74.5098L118.402 74.5285L118.383 77.2577L115.598 77.239Z" fill="white"/>
+<path d="M41.9736 107.7L41.9923 104.971L44.7776 104.989L44.7589 107.719L41.9736 107.7Z" fill="white"/>
+<path d="M114.224 86.0329L114.242 83.3037L117.028 83.3224L117.009 86.0516L114.224 86.0329Z" fill="white"/>
+<path d="M83.8662 116.27L83.8849 113.541L86.6702 113.56L86.6515 116.289L83.8662 116.27Z" fill="white"/>
+<path d="M110.625 94.2683L110.644 91.5391L113.429 91.5578L113.41 94.287L110.625 94.2683Z" fill="white"/>
+<path d="M105.767 101.672L105.785 98.9424L108.571 98.9611L108.552 101.69L105.767 101.672Z" fill="white"/>
+<path d="M92.1094 110.065L94.8386 110.046L94.8573 112.831L92.128 112.85L92.1094 110.065ZM75.332 115.215L78.0613 115.196L78.08 117.981L75.3507 118L75.332 115.215Z" fill="white"/>
+<path d="M49.4785 112.886L49.4972 110.157L52.2825 110.176L52.2638 112.905L49.4785 112.886Z" fill="white"/>
+<path d="M30.8594 94.1658L30.8781 91.4365L33.6634 91.4552L33.6447 94.1845L30.8594 94.1658Z" fill="white"/>
+<path d="M27.5801 86.0144L27.5988 83.2852L30.3841 83.3039L30.3654 86.0331L27.5801 86.0144Z" fill="white"/>
+<path d="M35.832 101.672L35.8507 98.9424L38.636 98.9611L38.6173 101.69L35.832 101.672Z" fill="white"/>
+<path d="M26 77.239L26.0187 74.5098L28.804 74.5285L28.7853 77.2577L26 77.239Z" fill="white"/>
+<path d="M66.4053 117.962L66.424 115.232L69.2093 115.251L69.1906 117.98L66.4053 117.962Z" fill="white"/>
+<path d="M57.5176 116.168L57.5363 113.438L60.3216 113.457L60.3029 116.186L57.5176 116.168Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_683_2985" x1="10" y1="15.5" x2="144" y2="131.5" gradientUnits="userSpaceOnUse">
+<stop stop-color="#00A8DA"/>
+<stop offset="0.495" stop-color="#3579BC"/>
+<stop offset="1" stop-color="#286EA5"/>
+</linearGradient>
+</defs>
+</svg>

packages/apps/tenant/.helmignore

@@ -0,0 +1,3 @@
+.helmignore
+/logos
+/Makefile

packages/apps/tenant/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: tenant
 description: Separated tenant namespace
-icon: https://upload.wikimedia.org/wikipedia/commons/0/04/User_icon_1.svg
+icon: /logos/tenant.svg
 
 type: application
-version: 1.1.0
+version: 1.4.0

packages/apps/tenant/README.md

@@ -25,7 +25,7 @@ tenant-root (example.org)
 
 Thus, you can create `tenant-u1` with a set of services like `etcd`, `ingress`, `monitoring`. And create another tenant namespace `tenant-u2` inside of `tenant-u1`.
 
-Let's see what will happen when you run Kubernetes and Postgres under `tenant-u2` namesapce.
+Let's see what will happen when you run Kubernetes and Postgres under `tenant-u2` namespace.
 
 Since `tenant-u2` does not have its own cluster services like `etcd`, `ingress`, and `monitoring`, the applications will use the cluster services of the parent tenant.  
 This in turn means:
@@ -56,3 +56,5 @@ tenant-u1
 | `etcd`       | Deploy own Etcd cluster                                                                                                     | `false` |
 | `monitoring` | Deploy own Monitoring Stack                                                                                                 | `false` |
 | `ingress`    | Deploy own Ingress Controller                                                                                               | `false` |
+| `seaweedfs`  | Deploy own SeaweedFS                                                                                                        | `false` |
+| `isolated`   | Enforce tenant namespace with network policies                                                                              | `false` |