@vfarcic/dot-ai 0.103.0 → 0.105.0

package/scripts/dot.nu

@@ -0,0 +1,32 @@
+#!/usr/bin/env nu
+
+source ack.nu
+source anthropic.nu
+source argo-workflows.nu
+source argocd.nu
+source aso.nu
+source atlas.nu
+source backstage.nu
+source cert-manager.nu
+source cnpg.nu
+source common.nu
+source crossplane.nu
+source external-secrets.nu
+source gatekeeper.nu
+source github.nu
+source image.nu
+source ingress.nu
+source kro.nu
+source kubernetes.nu
+source kubevela.nu
+source kyverno.nu
+source mcp.nu
+source port.nu
+source prometheus.nu
+source registry.nu
+source storage.nu
+source tests.nu
+source toolhive.nu
+source velero.nu
+
+def main [] {}

package/scripts/external-secrets.nu

@@ -0,0 +1,110 @@
+#!/usr/bin/env nu
+
+# Installs External Secrets Operator (ESO) with optional cloud provider configuration
+#
+# Examples:
+# > main apply external_secrets --provider google --google_project_id my-project
+# > main apply external_secrets --provider azure --azure_key_vault_name my-vault
+def "main apply external_secrets" [
+    --provider: string               # Supported values: `google`, `azure`
+    --google_project_id: string    # Used only if `provider` is `google`
+    --azure_key_vault_name: string # Used only if `provider` is `azure`
+] {
+
+    print $"\nInstalling (ansi yellow_bold)External Secrets Operator \(ESO\)(ansi reset)...\n"
+
+    (
+        helm repo add external-secrets
+            https://charts.external-secrets.io
+    )
+
+    helm repo update
+
+    (
+        helm upgrade --install
+            external-secrets external-secrets/external-secrets
+            --namespace external-secrets --create-namespace
+            --wait
+    )
+
+    if $provider == "google" {
+
+        {
+            apiVersion: "external-secrets.io/v1beta1"
+            kind: "ClusterSecretStore"
+            metadata: { name: "google" }
+            spec: { provider: { gcpsm: {
+                auth: { secretRef: { secretAccessKeySecretRef: {
+                    name: "gcp-creds"
+                    key: "creds"
+                    namespace: "crossplane-system"
+                } } }
+                projectID: $google_project_id
+            } } }
+        } | to yaml | kubectl apply --filename -
+
+        start $"https://console.developers.google.com/apis/api/secretmanager.googleapis.com/overview?project=($google_project_id)"
+            
+        print $"
+(ansi yellow_bold)ENABLE(ansi reset) the API.
+Press the (ansi yellow_bold)enter key(ansi reset) to continue.
+"
+        input
+
+    } else if $provider == "azure" {
+
+        # FIXME: Uncomment and rewrite
+        
+        # az keyvault create --name $RESOURCE_GROUP \
+        #     --resource-group $RESOURCE_GROUP
+
+        # az keyvault key create --vault-name $RESOURCE_GROUP --name "ContosoFirstKey" --protection software
+
+        # export AZURE_UPN=$(az ad user list | jq ".[0].userPrincipalName" -r)
+
+        # export AZURE_SUBSCRIPTION_ID=$(az account show --query id -o tsv)
+
+        # az role assignment create \
+        #     --role "Key Vault Secrets Officer" \
+        #     --assignee $AZURE_UPN \
+        #     --scope "/subscriptions/$AZURE_SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults/$RESOURCE_GROUP"
+
+        {
+            apiVersion: "external-secrets.io/v1beta1"
+            kind: "ClusterSecretStore"
+            metadata: { name: "azure" }
+            spec: { provider: { azurekv: {
+                authType: "ManagedIdentity"
+                vaultUrl: $"https://($azure_key_vault_name).vault.azure.net"
+            } } }
+        } | to yaml | kubectl apply --filename -
+
+    } else if $provider == "aws" {
+
+        {
+            apiVersion: "external-secrets.io/v1beta1"
+            kind: "ClusterSecretStore"
+            metadata: { name: "aws" }
+            spec: {
+                provider: { aws: {
+                    service: "SecretsManager"
+                    region: "us-east-1"
+                    auth: { secretRef: {
+                        accessKeyIDSecretRef: {
+                            name: "aws-creds"
+                            key: "accessKeyID"
+                            namespace: "crossplane-system"
+                        }
+                        secretAccessKeySecretRef: {
+                            name: "aws-creds"
+                            key: "secretAccessKey"
+                            namespace: "crossplane-system"
+                        }
+                    } }
+                } }
+            }
+        } | to yaml | kubectl apply --filename -
+
+    }
+
+}

package/scripts/gatekeeper.nu

@@ -0,0 +1,19 @@
+#!/usr/bin/env nu
+
+# Installs Gatekeeper (Open Policy Agent) for Kubernetes policy enforcement
+def "main apply opa" [] {
+
+    (
+        helm repo add gatekeeper
+            https://open-policy-agent.github.io/gatekeeper/charts
+    )
+
+    helm repo update
+
+    (
+        helm upgrade --install gatekeeper gatekeeper/gatekeeper 
+            --namespace gatekeeper-system --create-namespace
+            --wait
+    )
+
+}

package/scripts/github.nu

@@ -0,0 +1,42 @@
+#!/usr/bin/env nu
+
+# Retrieves GitHub credentials (token and organization/username)
+#
+# Parameters:
+# --enable-org: Whether to retrieve GitHub organization/user (default: true)
+# --github-token: GitHub token (optional, falls back to GITHUB_TOKEN or REGISTRY_PASSWORD env var)
+# --github-org: GitHub organization/username (optional, falls back to GITHUB_ORG or REGISTRY_USER env var)
+#
+# Returns:
+# A record with org and token fields, and saves values to .env file
+def --env "main get github" [
+    --enable-org = true,
+    --github-token: string,
+    --github-org: string
+] {
+
+    mut token = $github_token
+    if ($token | is-empty) and ("GITHUB_TOKEN" in $env) {
+        $token = $env.GITHUB_TOKEN
+    } else if ($token | is-empty) and ("REGISTRY_PASSWORD" in $env) {
+        $token = $env.REGISTRY_PASSWORD
+    } else if ($token | is-empty) {
+        error make { msg: "GitHub token required via --github-token parameter or GITHUB_TOKEN/REGISTRY_PASSWORD environment variable" }
+    }
+    $"export GITHUB_TOKEN=($token)\n" | save --append .env
+
+    mut org = $github_org
+    if $enable_org {
+        if ($org | is-empty) and ("GITHUB_ORG" in $env) {
+            $org = $env.GITHUB_ORG
+        } else if ($org | is-empty) and ("REGISTRY_USER" in $env) {
+            $org = $env.REGISTRY_USER
+        } else if ($org | is-empty) {
+            error make { msg: "GitHub organization/username required via --github-org parameter or GITHUB_ORG/REGISTRY_USER environment variable" }
+        }
+        $"export GITHUB_ORG=($org)\n" | save --append .env
+    }
+
+    {org: $org, token: $token}
+
+}

package/scripts/image.nu

@@ -0,0 +1,67 @@
+#!/usr/bin/env nu
+
+# Builds a container image
+def "main build image" [
+    tag: string                                  # The tag of the image (e.g., 0.0.1)
+    --registry = "ghcr.io"                       # Image registry (e.g., ghcr.io)
+    --registry_user = "vfarcic"                  # Image registry user (e.g., vfarcic)
+    --image = "silly-demo"                       # Image name (e.g., silly-demo)
+    --builder = "docker"                         # Image builder; currently supported are: `docker` and `kaniko`
+    --push = true                                # Whether to push the image to the registry
+    --dockerfile = "Dockerfile"                  # Path to Dockerfile
+    --context = "."                              # Path to the context
+] {
+
+    if $builder == "docker" {
+
+        (
+            docker image build
+                --tag $"($registry)/($registry_user)/($image):latest"
+                --tag $"($registry)/($registry_user)/($image):($tag)"
+                --file $dockerfile
+                $context
+        )
+
+        if $push {
+
+            docker image push $"($registry)/($registry_user)/($image):latest"
+
+            docker image push $"($registry)/($registry_user)/($image):($tag)"
+
+        }
+
+    } else if $builder == "kaniko" {
+
+        (
+            executor --dockerfile=Dockerfile --context=.
+                $"--destination=($registry)/($registry_user)/($image):($tag)"
+                $"--destination=($registry)/($registry_user)/($image):latest"
+        )
+
+    } else {
+
+        echo $"Unsupported builder: ($builder)"
+
+    } 
+
+}
+
+# Retrieves a container registry address
+#
+# Parameters:
+# --container-registry: Container registry address (optional, falls back to CONTAINER_REGISTRY env var)
+def "main get container_registry" [
+    --container-registry: string
+] {
+
+    mut registry = $container_registry
+    if ($registry | is-empty) and ("CONTAINER_REGISTRY" in $env) {
+        $registry = $env.CONTAINER_REGISTRY
+    } else if ($registry | is-empty) {
+        error make { msg: "Container registry address required via --container-registry parameter or CONTAINER_REGISTRY environment variable" }
+    }
+    $"export CONTAINER_REGISTRY=($registry)\n" | save --append .env
+
+    $registry
+
+}

package/scripts/ingress.nu

@@ -0,0 +1,149 @@
+#!/usr/bin/env nu
+
+# Applies Ingress
+#
+# Examples:
+# > main apply ingress contour --provider aws
+def --env "main apply ingress" [
+    class = "contour"   # The class of Ingress controller to apply. Available options: traefik, contour, nginx
+    --provider = "none" # The cloud provider. Available options: aws, azure, google, upcloud, kind
+    --env_prefix = ""   # Prefix to add to environment variables
+] {
+
+    if $class == "traefik" {
+
+        (
+            helm upgrade --install traefik traefik
+                --repo https://helm.traefik.io/traefik
+                --namespace traefik --create-namespace --wait
+        )
+
+    } else if $class == "contour" {
+
+        (
+            helm upgrade --install contour 
+                oci://registry-1.docker.io/bitnamicharts/contour
+                --namespace contour --create-namespace --wait
+        )
+    
+    } else if $class == "nginx" {
+
+        if $provider == "kind" {
+
+            (
+                kubectl apply
+                    --filename https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
+            )
+
+            sleep 10sec
+
+            (
+                kubectl --namespace ingress-nginx wait
+                    --for=condition=Available
+                    deployment ingress-nginx-controller
+            )
+
+            sleep 5sec
+
+        }
+
+    } else {
+
+        print $"(ansi red_bold)($class)(ansi reset) is not a supported."
+        exit 1
+
+    }
+
+    main get ingress $class --provider $provider --env_prefix $env_prefix
+
+}
+
+# Gets the IP and hostname for an Ingress controller
+#
+# Examples:
+# > main get ingress contour --provider aws
+# > main get ingress nginx --provider kind --env_prefix TEST_
+def "main get ingress" [
+    class = "traefik" # The class of Ingress controller to apply. Available options: traefik, contour, nginx
+    --provider: string # The cloud provider. Available options: aws, azure, google, upcloud, kind
+    --env_prefix = ""  # Prefix to add to environment variables
+] {
+
+    mut service_name = $class
+
+    if $class == "contour" {
+        $service_name = "contour-envoy"
+    }
+    
+    mut ingress_ip = ""
+  
+    if $provider == "aws" or $provider == "upcloud" {
+
+        sleep 30sec
+
+        let ingress_hostname = (
+            kubectl --namespace $class
+                get service $service_name --output yaml
+                | from yaml
+                | get status.loadBalancer.ingress.0.hostname
+        )
+
+        while $ingress_ip == "" {
+            print "Waiting for Ingress Service IP..."
+            sleep 10sec
+            $ingress_ip = (dig +short $ingress_hostname)
+        }
+
+        $ingress_ip = $ingress_ip | lines | first
+
+    } else if $provider == "kind" {
+
+        $ingress_ip = "127.0.0.1"
+
+    } else {
+
+        while $ingress_ip == "" {
+
+            print $"Waiting for ($class) Ingress IP from ($service_name) Service..."
+
+            sleep 10sec
+
+            $ingress_ip = (
+                kubectl --namespace $class
+                    get service $service_name --output yaml
+                    | from yaml
+                    | get status.loadBalancer.ingress.0.ip
+            )
+
+        }
+    }
+
+    $"export ($env_prefix)INGRESS_IP=($ingress_ip)\n" | save --append .env
+    $"export ($env_prefix)INGRESS_HOST=($ingress_ip).nip.io\n" | save --append .env
+
+    {ip: $ingress_ip, host: $"($ingress_ip).nip.io", class: $class}
+
+}
+
+# Deletes an Ingress controller
+#
+# Examples:
+# > main delete ingress contour
+# > main delete ingress traefik
+def --env "main delete ingress" [
+    class = "contour"   # The class of Ingress controller to apply. Available options: traefik, contour, nginx
+] {
+
+    print $"Uninstalling (ansi yellow_bold)Ingress(ansi reset)..."
+
+    if $class == "traefik" {
+
+        helm uninstall traefik --namespace traefik
+
+    } else if $class == "contour" {
+
+        helm uninstall contour  --namespace contour
+    
+    }
+
+}

package/scripts/kro.nu

@@ -0,0 +1,11 @@
+#!/usr/bin/env nu
+
+# Installs Kro (Kubernetes Resource Orchestrator) for orchestrating Kubernetes resources
+def "main apply kro" [] {
+
+    (
+        helm upgrade --install kro oci://ghcr.io/kro-run/kro/kro
+            --namespace kro --create-namespace
+    )
+
+}