Add tpk8s capabilities

manifests/tpk8s-toolkit-capabilities.tanzu.japan.com/10.0.0/secret_pass.yaml

@@ -0,0 +1,75 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:overlay", "overlay")
+#@ load("@ytt:base64", "base64")
+#@ load("@ytt:json", "json")
+
+
+#@ def dockerhub_config_fragment(user, password):
+username: #@ user
+password: #@ password
+#@ end
+
+#@ def dockerhub_config(url, user, password):
+#@ docker_config = { url.partition("/")[0] : dockerhub_config_fragment(user, password)}
+auths: #@ docker_config
+#@ end
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rabbitmq-repo-secret
+type: kubernetes.io/dockerconfigjson
+#@ repo = data.values.rabbitmq.package.repo
+data:
+  #@ url = repo.url
+  #@ user = repo.user
+  #@ password = repo.password
+  .dockerconfigjson: #@ base64.encode(json.encode(dockerhub_config(url, user, password)))
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-repo-secret
+type: kubernetes.io/dockerconfigjson
+#@ repo = data.values.postgres.package.repo
+data:
+  #@ url = repo.url
+  #@ user = repo.user
+  #@ password = repo.password
+  .dockerconfigjson: #@ base64.encode(json.encode(dockerhub_config(url, user, password)))
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gemfire-repo-secret
+type: kubernetes.io/dockerconfigjson
+#@ repo = data.values.gemfire.package.repo
+data:
+  #@ url = repo.url
+  #@ user = repo.user
+  #@ password = repo.password
+  .dockerconfigjson: #@ base64.encode(json.encode(dockerhub_config(url, user, password)))
+---
+apiVersion: secretgen.carvel.dev/v1alpha1
+kind: SecretExport
+metadata:
+  name: postgres-repo-secret
+spec:
+  toNamespaces:
+   - "*"
+---
+apiVersion: secretgen.carvel.dev/v1alpha1
+kind: SecretExport
+metadata:
+  name: rabbitmq-repo-secret
+spec:
+  toNamespaces:
+    - "*"
+---
+apiVersion: secretgen.carvel.dev/v1alpha1
+kind: SecretExport
+metadata:
+  name: gemfire-repo-secret
+spec:
+  toNamespaces:
+    - "*"

manifests/tpk8s-toolkit-capabilities.tanzu.japan.com/10.0.0/service_binding_role.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: resource-claims-rmq
+  labels:
+    servicebinding.io/controller: "true"
+rules:
+  - apiGroups: ["rabbitmq.com"]
+    resources: ["rabbitmqclusters"]
+    verbs: ["get", "list", "watch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: resource-claims-postgres
+  labels:
+    resourceclaims.services.apps.tanzu.vmware.com/controller: "true"
+rules:
+  - apiGroups: ["sql.tanzu.vmware.com"]
+    resources: ["postgres"]
+    verbs: ["get", "list", "watch", "update"]

manifests/tpk8s-toolkit-capabilities.tanzu.japan.com/10.0.0/tanzu-gemfire/overlay.yaml

@@ -0,0 +1,85 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:overlay", "overlay")
+
+#@ if data.values.gemfire.package.install:
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gemfire-install
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tap-registry
+  namespace: gemfire-install
+  annotations:
+    secretgen.carvel.dev/image-pull-secret: ""
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30K
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kapp-sa
+  namespace: gemfire-install
+secrets:
+  - name: tap-registry
+imagePullSecrets:
+  - name: tap-registry
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: gemfire-kapp-role-binding
+  namespace: gemfire-install
+subjects:
+- kind: ServiceAccount
+  name: kapp-sa
+  namespace: gemfire-install
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+---
+apiVersion: kappctrl.k14s.io/v1alpha1
+kind: App
+metadata:
+  name: gemfire
+  namespace: gemfire-install
+spec:
+  serviceAccountName: kapp-sa
+  fetch:
+  - imgpkgBundle:
+      image:  #@ data.values.gemfire.package.repo.url + ":" + data.values.gemfire.package.version
+      secretRef:
+        name: tap-registry
+    path: gemfire/
+  template:
+  - ytt:
+      ignoreUnknownComments: true
+      paths:
+      - gemfire/operator.yaml
+      - gemfire/certificates.yaml
+      - gemfire/functions.lib.yml
+      inline:
+        paths:
+          values-update.yaml: |
+            #@data/values
+            ---
+            namespace: gemfire-install
+            name: gemfire-operator
+            certManagerNamespace: ""
+            cpu: ""
+            memory: ""
+            imagePullSecretName: "tap-registry"
+            tlsSecretName: ""
+            registry:
+              server: ""
+              username: ""
+              password: ""
+  deploy:
+    - kapp: {}
+#@ end

manifests/tpk8s-toolkit-capabilities.tanzu.japan.com/10.0.0/tanzu-postgres/overlay.yaml

@@ -0,0 +1,86 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:overlay", "overlay")
+
+#@ if data.values.postgres.package.install:
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+  name: postgres-install
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tap-registry
+  namespace: postgres-install
+  annotations:
+    secretgen.carvel.dev/image-pull-secret: ""
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30K
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kapp-sa
+  namespace: postgres-install
+secrets:
+  - name: tap-registry
+imagePullSecrets:
+  - name: tap-registry
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: postgres-kapp-role-binding
+  namespace: postgres-install
+subjects:
+- kind: ServiceAccount
+  name: kapp-sa
+  namespace: postgres-install
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+---
+apiVersion: packaging.carvel.dev/v1alpha1
+kind: PackageRepository
+metadata:
+  name: tds-pack
+  namespace: postgres-install
+  annotations:
+    kapp.k14s.io/change-group: "pkgr"
+spec:
+  fetch:
+    imgpkgBundle:
+      image: #@ data.values.postgres.package.repo.url + ":" + data.values.postgres.package.version
+---
+apiVersion: packaging.carvel.dev/v1alpha1
+kind: PackageInstall
+metadata:
+  name: postgres
+  namespace: postgres-install
+spec:
+  serviceAccountName: kapp-sa
+  packageRef:
+    refName: postgres-operator.sql.tanzu.vmware.com
+    versionSelection:
+      constraints: #@ data.values.postgres.package.operator_version
+  values:
+  - secretRef:
+      name: change-default-reg-secret
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: change-default-reg-secret
+  namespace: postgres-install
+stringData:
+  change-default-reg-secret.yml: |
+    #@data/values-schema
+    ---    
+    dockerRegistrySecretName: tap-registry
+#@ end
+
+

manifests/tpk8s-toolkit-capabilities.tanzu.japan.com/10.0.0/tanzu-rabbitmq/overlay.yaml

@@ -0,0 +1,89 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:overlay", "overlay")
+
+#@ if data.values.rabbitmq.package.install:
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rabbitmq-install
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tap-registry
+  namespace: rabbitmq-install
+  annotations:
+    secretgen.carvel.dev/image-pull-secret: ""
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30K
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kapp-sa
+  namespace: rabbitmq-install
+secrets:
+  - name: tap-registry
+imagePullSecrets:
+  - name: tap-registry
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rabbit-kapp-role-binding
+  namespace: rabbitmq-install
+subjects:
+- kind: ServiceAccount
+  name: kapp-sa
+  namespace: rabbitmq-install
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+---
+apiVersion: packaging.carvel.dev/v1alpha1
+kind: PackageRepository
+metadata:
+  generation: 2
+  name: tmq-pack
+  namespace: rabbitmq-install
+  annotations:
+    kapp.k14s.io/change-group: "pkgr"
+spec:
+  fetch:
+    imgpkgBundle:
+      image: #@ data.values.rabbitmq.package.repo.url + ":" + data.values.rabbitmq.package.version
+---
+apiVersion: packaging.carvel.dev/v1alpha1
+kind: PackageInstall
+metadata:
+  name: rabbitmq
+  namespace: rabbitmq-install
+  annotations:
+    ext.packaging.carvel.dev/ytt-paths-from-secret-name.0: "namespace-overlay"
+spec:
+  serviceAccountName: kapp-sa 
+  packageRef:
+    refName: rabbitmq.tanzu.vmware.com
+    versionSelection:
+      constraints: #@ data.values.rabbitmq.package.operator_version
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: namespace-overlay
+  namespace: rabbitmq-install
+stringData:
+  overlay.yaml: |
+    #@ load("@ytt:overlay", "overlay")
+    
+    #@overlay/match by=overlay.subset({"kind":"Namespace", "metadata": {"name": "rabbitmq-system"}}), expects="0+"
+    ---
+    metadata:
+      labels:
+        #@overlay/match missing_ok=True
+        pod-security.kubernetes.io/enforce: baseline
+#@ end