feat: Add nexus community edition, enable S3 blobstore for operator (#…

…241)

clusters/core/addons/nexus-ce/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

clusters/core/addons/nexus-ce/Chart.yaml

@@ -0,0 +1,31 @@
+apiVersion: v2
+name: nexus-ce
+description: Nexus Community Edition chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"
+
+
+dependencies:
+  - name: oauth2-proxy
+    version: 6.16.1
+    repository: https://oauth2-proxy.github.io/manifests/
+    condition: oauth2-proxy.enabled

clusters/core/addons/nexus-ce/README.md

@@ -0,0 +1,95 @@
+# nexus-ce
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square)
+
+Nexus Community Edition chart for Kubernetes
+
+## Requirements
+
+| Repository | Name | Version |
+|------------|------|---------|
+| https://oauth2-proxy.github.io/manifests/ | oauth2-proxy | 6.16.1 |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` |  |
+| autoscaling.enabled | bool | `false` |  |
+| autoscaling.maxReplicas | int | `100` |  |
+| autoscaling.minReplicas | int | `1` |  |
+| autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
+| database | object | `{"existigSecret":"nexus-ce-pguser-nexus-ce","keys":{"dbname":"dbname","password":"password","port":"5432","url":"host","username":"user"},"pgo":{"enable":true}}` | This block configure database connections for Nexus CE. |
+| database.existigSecret | string | `"nexus-ce-pguser-nexus-ce"` | Name of the secret that contains the database credentials. |
+| database.keys | object | `{"dbname":"dbname","password":"password","port":"5432","url":"host","username":"user"}` | This block configures the database connection secret fields name for Nexus CE. |
+| database.pgo | object | `{"enable":true}` | Use PostgreSQL operator to create and manage database. |
+| docker.enabled | bool | `true` |  |
+| docker.registries[0].host | string | `"nexus-ce-ci-container.eks-sandbox.aws.main.edp.projects.epam.com"` |  |
+| docker.registries[0].port | int | `5000` |  |
+| eso.enabled | bool | `true` | Install components of the ESO. |
+| eso.generic.secretStore.providerConfig | object | `{}` | Defines SecretStore provider configuration. |
+| eso.roleArn | string | `"arn:aws:iam::093899590031:role/AWSIRSASandboxExternalSecretOperatorAccess"` | Role ARN for the ExternalSecretOperator to assume. |
+| eso.secretName | string | `"/edp/eks-sandbox/addons/nexus-ce"` | Value name in AWS ParameterStore, AWS SecretsManager or other Secret Store. |
+| eso.secretStoreName | string | `"aws-parameterstore"` | Defines Secret Store name. |
+| eso.type | string | `"aws"` | Defines provider type. One of `aws` or `generic`. |
+| fullnameOverride | string | `"nexus-ce"` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.repository | string | `"sonatype/nexus3"` |  |
+| image.tag | string | `"3.77.1"` |  |
+| imagePullSecrets | list | `[]` |  |
+| ingress.annotations."nginx.ingress.kubernetes.io/proxy-body-size" | string | `"900m"` |  |
+| ingress.className | string | `""` |  |
+| ingress.enabled | bool | `true` |  |
+| ingress.hosts[0].host | string | `"nexus-ce-ci.eks-sandbox.aws.main.edp.projects.epam.com"` |  |
+| ingress.hosts[0].paths[0].path | string | `"/"` |  |
+| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` |  |
+| ingress.tls | list | `[]` |  |
+| livenessProbe.failureThreshold | int | `6` |  |
+| livenessProbe.initialDelaySeconds | int | `0` |  |
+| livenessProbe.path | string | `"/"` |  |
+| livenessProbe.periodSeconds | int | `60` |  |
+| livenessProbe.timeoutSeconds | int | `1` |  |
+| nameOverride | string | `""` |  |
+| nexusAdminPassword | object | `{"secret":{"key":"password","name":"nexus-admin-password"}}` | Initial Nexus CE admin password. |
+| nodeSelector | object | `{}` |  |
+| oauth2-proxy.config.configFile | string | `"allowed_roles = [\"administrator\", \"developer\"]\nclient_id = \"nexus-ce\"\ncode_challenge_method=\"S256\"\ncookie_csrf_expire=\"5m\"\ncookie_csrf_per_request=\"true\"\ncookie_secure = \"false\"\nemail_domains = [ \"*\" ]\ninsecure_oidc_allow_unverified_email = \"true\"\noidc_issuer_url = \"https://idp.core.kuberocketci.io/realms/sandbox\"\npass_access_token = \"true\"\npass_authorization_header = \"true\"\npass_basic_auth = \"false\"\nprovider = \"keycloak-oidc\"\nredirect_url = \"https://nexus-ce.eks-sandbox.aws.main.edp.projects.epam.com/oauth2/callback\"\nskip_jwt_bearer_tokens = \"true\"\nupstreams = [ \"http://nexus-ce:8081\" ]\nwhitelist_domains = [\"*\"]\nsilence_ping_logging = \"true\""` |  |
+| oauth2-proxy.config.existingSecret | string | `"oauth2-proxy"` |  |
+| oauth2-proxy.enabled | bool | `true` |  |
+| oauth2-proxy.ingress.enabled | bool | `true` |  |
+| oauth2-proxy.ingress.hosts[0] | string | `"nexus-ce.eks-sandbox.aws.main.edp.projects.epam.com"` |  |
+| oauth2-proxy.redis.enabled | bool | `false` |  |
+| oauth2-proxy.redis.replica.replicaCount | int | `1` |  |
+| oauth2-proxy.sessionStorage.redis.clientType | string | `"standalone"` |  |
+| oauth2-proxy.sessionStorage.redis.cluster.connectionUrls | list | `[]` |  |
+| oauth2-proxy.sessionStorage.redis.existingSecret | string | `""` |  |
+| oauth2-proxy.sessionStorage.redis.password | string | `""` |  |
+| oauth2-proxy.sessionStorage.redis.passwordKey | string | `"redis-password"` |  |
+| oauth2-proxy.sessionStorage.redis.sentinel.connectionUrls | list | `[]` |  |
+| oauth2-proxy.sessionStorage.redis.sentinel.existingSecret | string | `""` |  |
+| oauth2-proxy.sessionStorage.redis.sentinel.masterName | string | `""` |  |
+| oauth2-proxy.sessionStorage.redis.sentinel.password | string | `""` |  |
+| oauth2-proxy.sessionStorage.redis.sentinel.passwordKey | string | `"redis-sentinel-password"` |  |
+| oauth2-proxy.sessionStorage.redis.standalone.connectionUrl | string | `""` |  |
+| oauth2-proxy.sessionStorage.type | string | `"cookie"` |  |
+| persistentVolume.accessMode | string | `"ReadWriteOnce"` | Access mode for the Persistent Volume. |
+| persistentVolume.enabled | bool | `true` |  |
+| persistentVolume.existingClaim | string | `""` | Existing Persistent Volume Claim. |
+| persistentVolume.storageClass | string | `"ebs-sc"` | Storage class for the Persistent Volume. |
+| persistentVolume.storageSize | string | `"20Gi"` | Storage size for the Persistent Volume. |
+| podAnnotations | object | `{}` |  |
+| podSecurityContext | object | `{}` |  |
+| readinessProbe.failureThreshold | int | `6` |  |
+| readinessProbe.initialDelaySeconds | int | `0` |  |
+| readinessProbe.path | string | `"/"` |  |
+| readinessProbe.periodSeconds | int | `60` |  |
+| readinessProbe.timeoutSeconds | int | `1` |  |
+| replicaCount | int | `1` |  |
+| resources | object | `{}` |  |
+| securityContext | object | `{}` |  |
+| service.port | int | `8081` |  |
+| service.type | string | `"ClusterIP"` |  |
+| serviceAccount.annotations."eks.amazonaws.com/role-arn" | string | `"arn:aws:iam::093899590031:role/NexusS3BlobStorePolicy"` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `""` |  |
+| tolerations | list | `[]` |  |
+

clusters/core/addons/nexus-ce/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "nexus-ce.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "nexus-ce.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "nexus-ce.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "nexus-ce.labels" -}}
+helm.sh/chart: {{ include "nexus-ce.chart" . }}
+{{ include "nexus-ce.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "nexus-ce.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "nexus-ce.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "nexus-ce.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "nexus-ce.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

clusters/core/addons/nexus-ce/templates/external-secret/nexus-admin-password-secret.yaml

@@ -0,0 +1,27 @@
+{{- if .Values.eso.enabled }}
+{{- $secretName := .Values.eso.secretName }}
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: nexus-admin-password
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: SecretStore
+    name: {{ .Values.eso.secretStoreName }}
+  data:
+  - secretKey: user
+    remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: {{ $secretName }}
+      metadataPolicy: None
+      property: nexus.user
+  - secretKey: password
+    remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      key: {{ $secretName }}
+      metadataPolicy: None
+      property: nexus.password
+{{- end }}

clusters/core/addons/nexus-ce/templates/external-secret/oauth2-proxy-secret.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.eso.enabled }}
+{{- $secretName := .Values.eso.secretName }}
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: oauth2-proxy
+spec:
+  data:
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: {{ $secretName }}
+        metadataPolicy: None
+        property: oauth2-proxy.client-id
+      secretKey: client-id
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: {{ $secretName }}
+        metadataPolicy: None
+        property: oauth2-proxy.client-secret
+      secretKey: client-secret
+    - remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: {{ $secretName }}
+        metadataPolicy: None
+        property: oauth2-proxy.cookie-secret
+      secretKey: cookie-secret
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: SecretStore
+    name: {{ .Values.eso.secretStoreName }}
+  target:
+    creationPolicy: Owner
+    deletionPolicy: Retain
+{{- end }}

clusters/core/addons/nexus-ce/templates/external-secret/sa.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.eso.enabled }}
+{{- if eq .Values.eso.type "aws" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    eks.amazonaws.com/role-arn: {{ .Values.eso.roleArn }}
+  name: externalsecrets-aws-nexus
+{{- end }}
+{{- end }}

clusters/core/addons/nexus-ce/templates/external-secret/secretstore.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.eso.enabled }}
+{{- if eq .Values.eso.type "aws" }}
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: {{ .Values.eso.secretStoreName }}
+spec:
+  provider:
+    aws:
+      service: ParameterStore
+      region: eu-central-1
+      auth:
+        jwt:
+          serviceAccountRef:
+            name: externalsecrets-aws-nexus
+{{- end }}
+{{- end }}

clusters/core/addons/nexus-ce/templates/nexus-ce/configmap.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "nexus-ce.name" . }}-properties
+data:
+  nexus.properties: |
+    nexus.scripts.allowCreation=true
+    jetty.request.header.size=100000