[draft] Laas helm chart

.ci/publish-helm-charts

@@ -16,3 +16,15 @@ ${SOURCE_PATH}/hack/update-helm-chart-version.sh
 $SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-service
 $SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-service-target-shoot-sidecar-server
 $SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/sidecar-rbac
+
+CHART_REPO="eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/resource-cluster"
+
+$SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-instance/resource-cluster/landscaper
+$SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-instance/resource-cluster/deployer
+
+CHART_REPO="eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/target-cluster"
+
+$SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-instance/target-cluster/landscaper
+$SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-instance/target-cluster/helm-deployer
+$SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-instance/target-cluster/manifest-deployer
+$SOURCE_PATH/hack/create-helm-chart.sh ${CHART_REPO} charts/landscaper-instance/target-cluster/container-deployer

.landscaper/landscaper-instance/blueprint/installation/landscaper-deployment-subinst.yaml

@@ -19,6 +19,8 @@ imports:
       dataRef: landscaperControllerKubeconfigYaml
     - name: landscaperWebhooksKubeconfigYaml
       dataRef: landscaperWebhooksKubeconfigYaml
+    - name: landscaperDeployerKubeconfigYaml
+      dataRef: landscaperDeployerKubeconfigYaml
     - name: registryConfig
       dataRef: registryConfig
     - name: landscaperConfig

.landscaper/landscaper-instance/blueprint/installation/landscaper-rbac-subinst.yaml

@@ -28,3 +28,5 @@ exports:
       dataRef: landscaperWebhooksKubeconfigYaml
     - name: landscaperUserKubeconfigYaml
       dataRef: landscaperUserKubeconfigYaml
+    - name: landscaperDeployerKubeconfigYaml
+      dataRef: landscaperDeployerKubeconfigYaml

.landscaper/landscaper-instance/blueprint/landscaper/blueprint.yaml

@@ -30,6 +30,12 @@ imports:
     schema:
       type: string
 
+  - name: landscaperDeployerKubeconfigYaml
+    required: true
+    type: data
+    schema:
+      type: string
+
   - name: registryConfig
     type: data
     schema:

.landscaper/landscaper-instance/blueprint/rbac/blueprint.yaml

@@ -48,6 +48,11 @@ exports:
     schema:
       type: string
 
+  - name: landscaperDeployerKubeconfigYaml
+    type: data
+    schema:
+      type: string
+
 exportExecutions:
   - name: export-execution
     file: /export-execution.yaml

.landscaper/landscaper-instance/blueprint/rbac/deploy-execution.yaml

@@ -12,24 +12,38 @@ deployItems:
       createNamespace: true
 
       chart:
-        {{ $landscaperComponent := getComponent .cd "name" "landscaper" }}
-        {{ $resource := getResource $landscaperComponent "name" "landscaper-controller-rbac-chart" }}
+        {{ $resource := getResource .cd "name" "landscaper-instance-resource-cluster-landscaper" }}
         ref: {{ $resource.access.imageReference }}
 
       values:
-        global:
-          serviceAccount:
-            controller:
-              create: true
-              annotations: {}
-              name: landscaper-controller
+        controller:
+          serviceAccountName: "landscaper-controller"
+          clusterRoleName: "landscaper.gardener.cloud:controller"
 
-            webhooksServer:
-              create: true
-              annotations: {}
-              name: landscaper-webhooks
+        webhooksServer:
+          serviceAccountName: "landscaper-webhooks"
+          clusterRoleName: "landscaper.gardener.cloud:webhooks-server"
 
-            user:
-              create: true
-              annotations: {}
-              name: landscaper-user
+        user:
+          serviceAccountName: "landscaper-user"
+          clusterRoleName: "landscaper.gardener.cloud:user"
+
+  - name: deployer-rbac
+    type: landscaper.gardener.cloud/helm
+    target:
+      import: shootCluster
+    config:
+      apiVersion: helm.deployer.landscaper.gardener.cloud/v1alpha1
+      kind: ProviderConfiguration
+      updateStrategy: patch
+      name: deployer-rbac
+      namespace: {{ .imports.targetClusterNamespace }}
+      createNamespace: true
+
+      chart:
+        {{ $resource := getResource .cd "name" "landscaper-instance-resource-cluster-deployer" }}
+        ref: {{ $resource.access.imageReference }}
+
+      values:
+        serviceAccountName: "landscaper-deployer"
+        clusterRoleName: "landscaper.gardener.cloud:deployer"

.landscaper/landscaper-instance/blueprint/rbac/export-execution.yaml

@@ -7,3 +7,6 @@ exports:
 
   landscaperUserKubeconfigYaml: |
     {{- getOidcKubeconfig .imports.shootConfig.kubernetes.kubeAPIServer.oidcConfig.issuerURL .imports.shootConfig.kubernetes.kubeAPIServer.oidcConfig.clientID .imports.shootCluster | b64dec | nindent 4 }}
+
+  landscaperDeployerKubeconfigYaml: |
+    {{- getServiceAccountKubeconfig "landscaper-deployer" .imports.targetClusterNamespace .imports.rotationConfig.tokenExpirationSeconds .imports.shootCluster | b64dec | nindent 4 }}

.landscaper/landscaper-instance/blueprint/shoot/blueprint.yaml

@@ -62,12 +62,6 @@ imports:
         - user
         - password
 
-  - name: subaccountId
-    required: false
-    type: data
-    schema:
-      type: string
-
   - name: rotationConfig
     type: data
     schema:

.landscaper/landscaper-instance/resources.yaml

@@ -75,6 +75,54 @@ access:
   imageReference: eu.gcr.io/gardener-project/landscaper-service/charts/sidecar-rbac:${VERSION}
 ...
 ---
+type: helm.io/chart
+name: landscaper-instance-resource-cluster-landscaper
+relation: local
+access:
+  type: ociRegistry
+  imageReference: eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/resource-cluster/landscaper:${VERSION}
+...
+---
+type: helm.io/chart
+name: landscaper-instance-resource-cluster-deployer
+relation: local
+access:
+  type: ociRegistry
+  imageReference: eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/resource-cluster/deployer:${VERSION}
+...
+---
+type: helm.io/chart
+name: landscaper-instance-target-cluster-landscaper
+relation: local
+access:
+  type: ociRegistry
+  imageReference: eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/target-cluster/landscaper:${VERSION}
+...
+---
+type: helm.io/chart
+name: landscaper-instance-target-cluster-helm-deployer
+relation: local
+access:
+  type: ociRegistry
+  imageReference: eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/target-cluster/helm-deployer:${VERSION}
+...
+---
+type: helm.io/chart
+name: landscaper-instance-target-cluster-manifest-deployer
+relation: local
+access:
+  type: ociRegistry
+  imageReference: eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/target-cluster/manifest-deployer:${VERSION}
+...
+---
+type: helm.io/chart
+name: landscaper-instance-target-cluster-container-deployer
+relation: local
+access:
+  type: ociRegistry
+  imageReference: eu.gcr.io/gardener-project/landscaper-service/charts/landscaper-instance/target-cluster/container-deployer:${VERSION}
+...
+---
 type: ociImage
 name: ls-service-target-shoot-sidecar-image
 relation: local

.landscaper/landscaper-instance/test/component-descriptor.yaml

@@ -0,0 +1,13 @@
+component:
+  componentReferences: []
+  name: github.com/gardener/landscaper-service/landscaper-instance
+  provider: internal
+  repositoryContexts:
+  - baseUrl: eu.gcr.io/gardener-project/development
+    componentNameMapping: urlPath
+    type: ociRegistry
+  resources: []
+  sources: []
+  version: v0.1.0
+meta:
+  schemaVersion: v2

.landscaper/landscaper-instance/test/export-templates.yaml

@@ -0,0 +1,49 @@
+installations:
+  - name: shoot
+    selector: .*/shoot-cluster
+    template: |
+      dataExports:
+        shootClusterKubeconfig: |
+          apiVersion: v1
+          kind: Config
+        shootClusterEndpoint: test-shoot.api.mycluster.net
+      targetExports:
+        shootCluster:
+          metadata:
+            name: shoot-cluster
+            namespace: default
+          spec:
+            type: landscaper.gardener.cloud/kubernetes-cluster
+            config:
+              kubeconfig: |
+                apiVersion: v1
+                kind: Config
+
+  - name: landscaper-rbac
+    selector: .*/landscaper-rbac
+    template: |
+      dataExports:
+        landscaperControllerKubeconfigYaml: |
+          apiVersion: v1
+          kind: Config
+        landscaperWebhooksKubeconfigYaml: |
+          apiVersion: v1
+          kind: Config
+        landscaperUserKubeconfigYaml: |
+          apiVersion: v1
+          kind: Config
+        landscaperDeployerKubeconfigYaml: |
+          apiVersion: v1
+          kind: Config
+      targetExports: {}
+
+  - name: sidecar-rbac
+    selector: .*/sidecar-rbac
+    template: |
+      dataExports:
+        sidecarControllerKubeconfigYaml: |
+          apiVersion: v1
+          kind: Config
+      targetExports: {}
+
+deployItems: []

.landscaper/landscaper-instance/test/render.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+TEST_DIR="$(dirname $0)"
+BASE_DIR="$(dirname $0)/.."
+
+RENDER_TMP_DIR="$(mktemp -d)"
+RESOURCES_FILE="${RENDER_TMP_DIR}/resources.yaml"
+COMPONENT_DESCRIPTOR_FILE="${RENDER_TMP_DIR}/test/component-descriptor.yaml"
+
+cp -R "${BASE_DIR}/." "${RENDER_TMP_DIR}"
+export VERSION=v0.1.0
+envsubst <"${BASE_DIR}/resources.yaml" >"${RESOURCES_FILE}"
+
+LANDSCAPER_COMPONENT_REF="$(yq ./.landscaper/landscaper-instance/component-references.yaml -ojson -I=0)"
+yq ".component.componentReferences += [${LANDSCAPER_COMPONENT_REF}]" "${TEST_DIR}/component-descriptor.yaml" > "${COMPONENT_DESCRIPTOR_FILE}"
+
+# render global installation blueprint
+echo "!!! render global installation blueprint !!!"
+landscaper-cli blueprints render ${BASE_DIR}/blueprint/installation \
+    -c "${COMPONENT_DESCRIPTOR_FILE}" \
+    -f "${TEST_DIR}/values-global.yaml" \
+    -e "${TEST_DIR}/export-templates.yaml" \
+    -r "${RESOURCES_FILE}"
+
+# render shoot blueprint
+echo "!!! render shoot blueprint !!!"
+landscaper-cli blueprints render ${BASE_DIR}/blueprint/shoot \
+    -c "${COMPONENT_DESCRIPTOR_FILE}" \
+    -f "${TEST_DIR}/values-shoot.yaml" \
+    -r "${RESOURCES_FILE}"
+
+# render shoot blueprint
+echo "!!! render landscaper rbac blueprint !!!"
+landscaper-cli blueprints render ${BASE_DIR}/blueprint/rbac \
+    -c "${COMPONENT_DESCRIPTOR_FILE}" \
+    -f "${TEST_DIR}/values-rbac.yaml" \
+    -r "${RESOURCES_FILE}"
+
+# render shoot blueprint
+echo "!!! render sidecar rbac blueprint !!!"
+landscaper-cli blueprints render ${BASE_DIR}/blueprint/rbac \
+    -c "${COMPONENT_DESCRIPTOR_FILE}" \
+    -f "${TEST_DIR}/values-sidecar-rbac.yaml" \
+    -r "${RESOURCES_FILE}"