Initial implementation using kustomize and envsubst

.cruft.json

@@ -21,9 +21,9 @@
       "auto_release": "y",
       "copyright_holder": "VSHN AG <info@vshn.ch>",
       "copyright_year": "2026",
-      "github_owner": "vshn",
+      "github_owner": "projectsyn",
       "github_name": "component-capi-provider-cloudscale",
-      "github_url": "https://github.com/vshn/component-capi-provider-cloudscale",
+      "github_url": "https://github.com/projectsyn/component-capi-provider-cloudscale",
       "_template": "https://github.com/projectsyn/commodore-component-template.git",
       "_commit": "c61b93c6740fb1aaad80e82716a8400d2df31e80"
     }

.gitignore

@@ -13,3 +13,4 @@
 /_public
 
 # Additional entries
+envsubst-v*

.yamllint.yml

@@ -22,3 +22,4 @@ ignore: |
   manifests/
   vendor/
   compiled/
+  tests/golden/**

CONTRIBUTING.md

@@ -3,4 +3,4 @@
 This code repository is part of Project Syn and the contribution guide at
 https://syn.tools/syn/about/contribution_guide.html does apply.
 
-Submit Pull Requests at https://github.com/vshn/component-capi-provider-cloudscale/pulls.
+Submit Pull Requests at https://github.com/projectsyn/component-capi-provider-cloudscale/pulls.

class/capi-provider-cloudscale.yml

@@ -8,4 +8,21 @@ parameters:
       - input_paths:
           - ${_base_directory}/component/main.jsonnet
         input_type: jsonnet
-        output_path: capi-provider-cloudscale/
+        output_path: ${_base_directory}/manifests/capi-provider-cloudscale/
+      - input_type: external
+        output_path: .
+        input_paths:
+          - ${_kustomize_wrapper}
+        env_vars:
+          INPUT_DIR: ${_base_directory}/manifests/capi-provider-cloudscale/
+        args:
+          - ${_base_directory}/manifests/capi-provider-cloudscale-rendered/
+      - input_type: external
+        output_path: .
+        input_paths:
+          - ${_base_directory}/envsubst-dir
+        # map env vars from parameters as needed
+        env_vars: ${capi_provider_cloudscale:variables}
+        args:
+          - ${_base_directory}/manifests/capi-provider-cloudscale-rendered
+          - \${compiled_target_dir}/capi-provider-cloudscale/10_kustomize

class/defaults.yml

@@ -2,4 +2,13 @@ parameters:
   capi_provider_cloudscale:
     =_metadata:
       multi_tenant: true
-    namespace: syn-capi-provider-cloudscale
+    namespace: syn-cluster-api
+
+    images:
+      capi-provider-cloudscale:
+        registry: quay.io
+        image: cloudscalech/cluster-api-cloudscale-controller
+        tag: v1.0.1
+
+    variables:
+      CLOUDSCALE_API_TOKEN: ?{vaultkv:${cluster:tenant}/${cluster:name}/cloudscale/token}

component/app.jsonnet

@@ -3,7 +3,13 @@ local inv = kap.inventory();
 local params = inv.parameters.capi_provider_cloudscale;
 local argocd = import 'lib/argocd.libjsonnet';
 
-local app = argocd.App('capi-provider-cloudscale', params.namespace);
+local app = argocd.App('capi-provider-cloudscale', params.namespace) {
+  spec+: {
+    syncOptions+: [
+      'ServerSideApply=true',
+    ],
+  },
+};
 
 local appPath =
   local project = std.get(std.get(app, 'spec', {}), 'project', 'syn');

component/main.jsonnet

@@ -1,10 +1,45 @@
-// main template for capi-provider-cloudscale
+local com = import 'lib/commodore.libjsonnet';
 local kap = import 'lib/kapitan.libjsonnet';
 local kube = import 'lib/kube.libjsonnet';
 local inv = kap.inventory();
 // The hiera parameters for the component
 local params = inv.parameters.capi_provider_cloudscale;
 
-// Define outputs below
-{
+assert std.member(inv.applications, 'capi-core') : 'Component capi-provider-cloudscale requires component capi-core';
+assert std.length(params.variables.CLOUDSCALE_API_TOKEN) > 0 : 'capi-provider-cloudscale:variables:CLOUDSCALE_API_TOKEN must be set';
+
+local manifest_path = 'config/default';
+
+com.Kustomization(
+  'https://github.com/cloudscale-ch/cluster-api-provider-cloudscale/' + manifest_path,
+  params.images['capi-provider-cloudscale'].tag,
+  {
+    'quay.io/cloudscalech/capcs-staging': {
+      local image = params.images['capi-provider-cloudscale'],
+      newTag: image.tag,
+      newName: '%(registry)s/%(image)s' % image,
+    },
+  },
+  {
+    namespace: params.namespace,
+    labels+: [
+      {
+        pairs: {
+          'app.kubernetes.io/managed-by': 'commodore',
+        },
+      },
+    ],
+    patchesStrategicMerge: [ 'rm-namespace.yaml' ],
+  },
+) {
+  'rm-namespace': [
+    {
+      '$patch': 'delete',
+      apiVersion: 'v1',
+      kind: 'Namespace',
+      metadata: {
+        name: 'capcs-system',
+      },
+    },
+  ],
 }

docs/modules/ROOT/pages/references/parameters.adoc

@@ -6,14 +6,49 @@ The parent key for all of the following parameters is `capi_provider_cloudscale`
 
 [horizontal]
 type:: string
-default:: `syn-capi-provider-cloudscale`
+default:: `syn-cluster-api`
 
 The namespace in which to deploy this component.
+The component assumes that this namespace already exists via dependency `component-capi-core`.
 
+== `images`
+
+[horizontal]
+type:: dict
+default:: See `class/defaults.yml`
+
+The default Docker image location and tag to use for the CAPI provider cloudscale component (key `capi-provider-cloudscale`).
+
+Entries in this dict should be dictionaries with keys `registry`, `image`, and `tag`. This structure provides the basis for dependency maintenance with Renovate.
+
+The value of `capi-provider-cloudscale.tag` in this dict is used by the component to select the version of the upstream CAPI provider cloudscale components.
+
+== `variables`
+
+[horizontal]
+type:: dict
+default:: See `class/defaults.yml`
+
+An object with environment variables that the generated manifests will be templated with, similar to `clusterctl`.
+Variables should be specified in the format:
+
+[source,yaml]
+----
+variables:
+  CLOUDSCALE_API_TOKEN: <cloudscale-api-token>
+----
+
+Note that the `CLOUDSCALE_API_TOKEN` variable is mandatory for this component.
+The default is a reference to vault.
 
 == Example
 
 [source,yaml]
 ----
 namespace: example-namespace
+images:
+  capi-provider-cloudscale:
+    tag: v1.14.0
+variables:
+  CLOUDSCALE_API_TOKEN: value
 ----

envsubst-dir

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+basedir=$(dirname "$0")
+version="${ENVSUBST_VERSION:-v1.4.3}"
+
+src="$1"
+dst="$2"
+
+ensure_envsubst () {
+  set -eu
+
+  local dir="$1"
+  # Version with leading `v`.
+  local version="$2"
+
+  local arch
+  arch=$(uname -m)
+  case $arch in
+    aarch64|arm64) arch="arm64";;
+    x86_64|amd64) arch="x86_64";;
+    *)
+      >&2 echo "Unsupported arch: $arch"
+      exit 5
+    ::
+  esac
+
+  local os
+  os=$(uname -s)
+  if [[ "$os" != "Linux" && "$os" != "Darwin" ]]; then
+    >&2 echo "Unsupported os: $os"
+    exit 5
+  fi
+
+  if [ ! -x "${dir}/envsubst-${version}-${os}-${arch}" ]; then
+    download_envsubst "${dir}" "${version}" "${os}" "${arch}"
+  else
+    >&2 echo "envsubst-${version}-${os}-${arch} already installed"
+  fi
+
+  echo "${dir}/envsubst-${version}-${os}-${arch}"
+}
+
+download_envsubst () {
+  set -eu
+
+  local dir="$1"
+  local version="$2"
+  local os="$3"
+  local arch="$4"
+
+  local url="https://github.com/a8m/envsubst/releases/download/${version}/envsubst-${os}-${arch}"
+
+  >&2 echo "Downloading envsubst-${version}-${os}-${arch} from ${url}"
+
+  curl -fsSLo "${dir}/envsubst-${version}-${os}-${arch}" "${url}"
+  chmod +x "${dir}/envsubst-${version}-${os}-${arch}"
+
+  >&2 echo "envsubst-${version}-${os}-${arch} successfully installed"
+}
+
+envsubst="$(ensure_envsubst "${basedir}" "${version}")"
+
+mkdir -p "$dst"
+
+find "$src" -type f -name '*.yaml' -print0 |
+while IFS= read -r -d '' file; do
+    relative="${file#$src/}"
+    output="$dst/$relative"
+
+    mkdir -p "$(dirname "$output")"
+
+    "$envsubst" \
+        -no-unset \
+        -i "$file" \
+        -o "$output"
+done

tests/defaults.yml

@@ -1,3 +1,6 @@
 # Overwrite parameters here
 
-# parameters: {...}
+applications:
+  - capi-core
+
+parameters: {}

tests/golden/defaults/capi-provider-cloudscale/apps/capi-provider-cloudscale.yaml

@@ -0,0 +1,3 @@
+spec:
+  syncOptions:
+    - ServerSideApply=true

tests/golden/defaults/capi-provider-cloudscale/capi-provider-cloudscale/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_capcs-mutating-webhook-configuration.yaml

@@ -0,0 +1,90 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: capcs-system/capcs-serving-cert
+  labels:
+    app.kubernetes.io/managed-by: commodore
+    cluster.x-k8s.io/provider: infrastructure-cloudscale-ch-cloudscale
+  name: capcs-mutating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: capcs-webhook-service
+      namespace: syn-cluster-api
+      path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-cloudscalecluster
+  failurePolicy: Fail
+  name: mcloudscalecluster-v1beta2.kb.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - cloudscaleclusters
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: capcs-webhook-service
+      namespace: syn-cluster-api
+      path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-cloudscaleclustertemplate
+  failurePolicy: Fail
+  name: mcloudscaleclustertemplate-v1beta2.kb.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - cloudscaleclustertemplates
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: capcs-webhook-service
+      namespace: syn-cluster-api
+      path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-cloudscalemachine
+  failurePolicy: Fail
+  name: mcloudscalemachine-v1beta2.kb.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - cloudscalemachines
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: capcs-webhook-service
+      namespace: syn-cluster-api
+      path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-cloudscalemachinetemplate
+  failurePolicy: Fail
+  name: mcloudscalemachinetemplate-v1beta2.kb.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - cloudscalemachinetemplates
+  sideEffects: None