devspace.yaml

version: v2beta1

name: infra

require:
  commands:
    - name: yq
      versionArgs: ["--version"]
      versionRegEx: "yq \\(https://github.com/mikefarah/yq/\\) version (v\\d+\\.\\d+\\.\\d+)"
      version: ">= 4"

vars:
  CLUSTER_PROVIDER:
    value: ""
  ISTIO_CHART_VERSION: 1.26.2
  GATEWAY_EXT_AUTHZ_PROVIDER_NAME: gateway-ext-authz-grpc
  GATEWAY_EXT_AUTHZ_SERVICE_NAME: gateway-ext-authz
  GATEWAY_EXT_AUTHZ_SERVICE_NAMESPACE: istio-ingress
  GATEWAY_EXT_AUTHZ_SERVICE_PORT:
    value: 3001
  GATEWAY_NAMESPACE:
    command: ./scripts/cluster-env-var.sh
    args: ["GATEWAY_NAMESPACE", "istio-ingress"]
  GATEWAY_PROVIDER:
    command: ./scripts/cluster-env-var.sh
    args: ["GATEWAY_PROVIDER", "local-istio"]
  DNS_DOMAIN:
    command: ./scripts/cluster-env-var.sh
    args: ["DNS_DOMAIN", "int.kube"]
  DNS_MODE:
    command: ./scripts/cluster-env-var.sh
    args: ["DNS_MODE", "local"]
  DNS_SERVICE_ID:
    command: ./scripts/cluster-env-var.sh
    args: ["DNS_SERVICE_ID", "kube"]
  HOST_INTEGRATION:
    value: "true"
  GKE_DNS_DOMAIN:
    value: gcp.kube
  GKE_DNS_NAMESERVERS:
    command: ./scripts/cluster-env-var.sh
    args: ["GKE_DNS_NAMESERVERS", ""]
  GKE_SELECTED_CONTEXT:
    command: ./scripts/cluster-env-var.sh
    args: ["GKE_SELECTED_CONTEXT", ""]
  GKE_PROJECT_ID:
    command: ./scripts/cluster-env-var.sh
    args: ["GKE_PROJECT_ID", ""]
  GKE_REGION:
    command: ./scripts/cluster-env-var.sh
    args: ["GKE_REGION", "us-central1"]
  GKE_GCLOUD_CONFIGURATION:
    value: devspace-starter-pack
  GKE_GCLOUD_ACCOUNT:
    value: ""
  GKE_PROTECTION:
    value: iap
  GKE_IAP_OAUTH_CLIENT_ID:
    value: ""
  GKE_IAP_OAUTH_CLIENT_SECRET:
    value: ""
  GKE_IAP_SECRET_NAME:
    value: iap-oauth-client
  GCP_BILLING_ACCOUNT_ID:
    value: ""
  GCP_ORG_ID:
    value: ""
  GCP_FOLDER_ID:
    value: ""
  DEV_REGISTRY_HOST:
    command: ./scripts/cluster-env-var.sh
    args: ["DEV_REGISTRY_HOST", ""]
  DEV_REGISTRY:
    command: ./scripts/cluster-env-var.sh
    args: ["DEV_REGISTRY", ""]
  DEV_REGISTRY_IMAGE_PREFIX:
    command: ./scripts/cluster-env-var.sh
    args: ["DEV_REGISTRY_IMAGE_PREFIX", ""]
  DEV_REGISTRY_REPOSITORY:
    value: devspace-dev
  DEV_REGISTRY_WRITER_MEMBERS:
    value: ""
  GKE_IAP_ACCESSOR_MEMBERS:
    value: ""
  CONFIG_CONNECTOR_ENABLED:
    value: "false"
  CONFIG_CONNECTOR_MODE:
    value: ""
  CONFIG_CONNECTOR_PROJECT_ID:
    value: ""
  CONFIG_CONNECTOR_SERVICE_ACCOUNT:
    value: ""
  GRAFANA_ROUTE_MANIFEST:
    value: ./manifests/grafana-route.yaml
  METALLB_CHART_VERSION: v0.15.2
  POSTGRES_VERSION: 16
  POSTGRES_CHART_VERSION: 16.7.20
  REDIS_CHART_VERSION: 21.2.12
  OTEL_COLLECTOR_CHART_VERSION: 0.153.0
  JAEGER_CHART_VERSION: 4.7.0
  # XXX pin all versions

  # XXX modify default bridge to carve out LB CIDR block, do not just alias it...
  DOCKER_CIDR_PREFIX:
    command: ./scripts/docker-cidr-prefix.sh
    default: "172.18.255"

deployments:
  trust-bundle:
    kubectl:
      inlineManifest: |
        apiVersion: trust.cert-manager.io/v1alpha1
        kind: Bundle
        metadata:
          name: cluster-trust-bundle
        spec:
          sources:
          - useDefaultCAs: true # XXX outdated ca-certificates?
          - secret:
              name: "cluster-root-ca-secret"
              key: "tls.crt"
          target:
            configMap:
              key: "trust-bundle.pem"
            namespaceSelector:
              matchLabels:
                kubernetes.io/metadata.name: ${DEVSPACE_NAMESPACE}

profiles:
  - name: local-network
    description: Network, Gateways, Ingress
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^(kind(?:-.+)?|docker-desktop|minikube|rancher-desktop|microk8s)$"
    merge:
      vars:
        GATEWAY_NAMESPACE: istio-ingress
        GATEWAY_PROVIDER: local-istio
        DNS_DOMAIN: int.kube
        DNS_MODE: local
        DNS_SERVICE_ID: kube
      deployments:
        metallb:
          namespace: metallb-system
          helm:
            chart:
              name: metallb
              version: ${METALLB_CHART_VERSION}
              repo: https://metallb.github.io/metallb

        metallb-resources:
          namespace: metallb-system
          kubectl:
            inlineManifest: |-
              ---
              apiVersion: metallb.io/v1beta1
              kind: IPAddressPool
              metadata:
                name: host-pool
              spec:
                addresses:
                - ${DOCKER_CIDR_PREFIX}.192/26
              ---
              apiVersion: metallb.io/v1beta1
              kind: L2Advertisement
              metadata:
                name: host-pool
              spec:
                ipAddressPools:
                - host-pool

        istio-base:
          namespace: istio-system
          helm:
            chart:
              name: base
              version: ${ISTIO_CHART_VERSION}
              repo: https://istio-release.storage.googleapis.com/charts

        istiod:
          namespace: istio-system
          helm:
            chart:
              name: istiod
              version: ${ISTIO_CHART_VERSION}
              repo: https://istio-release.storage.googleapis.com/charts
            values:
              meshConfig:
                enablePrometheusMerge: true
                enableTracing: true
                defaultConfig:
                  proxyStatsMatcher:
                    inclusionRegexps:
                      - ".*ext_authz.*"
                      - "cluster\\.outbound\\|${GATEWAY_EXT_AUTHZ_SERVICE_PORT}\\|\\|${GATEWAY_EXT_AUTHZ_SERVICE_NAME}\\.${GATEWAY_EXT_AUTHZ_SERVICE_NAMESPACE}\\.svc\\.cluster\\.local;.*"
                extensionProviders:
                  - name: otel-tracing
                    opentelemetry:
                      service: otel-collector.observability.svc.cluster.local
                      port: 4317
                      resource_detectors:
                        environment: {}
                  - name: ${GATEWAY_EXT_AUTHZ_PROVIDER_NAME}
                    envoyExtAuthzGrpc:
                      service: ${GATEWAY_EXT_AUTHZ_SERVICE_NAME}.${GATEWAY_EXT_AUTHZ_SERVICE_NAMESPACE}.svc.cluster.local
                      port: 3001
                      timeout: 1s
                      includeRequestHeadersInCheck:
                        - authorization
                        - cookie
                        - x-request-id
                        - x-b3-traceid
                        - x-b3-spanid
                        - x-b3-parentspanid
                        - x-b3-sampled
                        - x-b3-flags
                        - b3
                        - traceparent
                        - tracestate
                      headersToUpstreamOnAllow:
                        - authorization
                      headersToDownstreamOnDeny:
                        - www-authenticate

        istio-ingress-gateway:
          namespace: istio-ingress
          helm:
            chart:
              name: gateway
              version: ${ISTIO_CHART_VERSION}
              repo: https://istio-release.storage.googleapis.com/charts
            values:
              service:
                type: LoadBalancer
              labels:
                istio: ingressgateway

        gateway-api-crds:
          namespace: istio-ingress
          kubectl:
            kustomize: true
            manifests:
              - https://github.com/kubernetes-sigs/gateway-api/config/crd?ref=v1.3.0

        cluster-gateway:
          namespace: istio-ingress
          kubectl:
            manifests:
              - ./manifests/gateway.yaml

        istio-gateway:
          namespace: istio-ingress
          kubectl:
            manifests:
              - ./manifests/istio-telemetry.yaml
              - ./manifests/istio-gateway-cert.yaml
              - ./manifests/istio-gateway.yaml

  - name: local-dns
    description: Local DNS integration for development
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^(kind(?:-.+)?|docker-desktop|minikube|rancher-desktop|microk8s)$"
    merge:
      deployments:
        etcd:
          namespace: external-dns
          helm:
            chart:
              name: oci://registry-1.docker.io/bitnamicharts/etcd
              version: 12.0.18
            values:
              image:
                repository: bitnamilegacy/etcd
                tag: "3.6.4-debian-12-r3"
              persistence:
                enabled: true
              securityContext:
                runAsUser: 999

        coredns-external:
          namespace: external-dns
          helm:
            chart:
              name: coredns
              repo: https://coredns.github.io/helm
            values:
              service:
                loadBalancerIP: ${DOCKER_CIDR_PREFIX}.254

            valuesFiles:
              - ./helm-values/coredns-external.yaml

        external-dns:
          namespace: external-dns
          helm:
            chart:
              name: external-dns
              version: 1.21.1
              repo: https://kubernetes-sigs.github.io/external-dns/
            valuesFiles:
              - ./helm-values/external-dns.yaml

  - name: local-certs
    description: Certificate Management
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^(kind(?:-.+)?|docker-desktop|minikube|rancher-desktop|microk8s)$"
    merge:
      deployments:
        cert-manager:
          namespace: cert-manager
          helm:
            chart:
              name: cert-manager
              repo: https://charts.jetstack.io
            values:
              global:
                leaderElection:
                  namespace: cert-manager
              installCRDs: true
              config:
                apiVersion: controller.config.cert-manager.io/v1alpha1
                kind: ControllerConfiguration
                enableGatewayAPI: true
              securityContext:
                runAsUser: 999
              cainjector:
                securityContext:
                  runAsUser: 999
              webhook:
                securityContext:
                  runAsUser: 999
              startupapicheck:
                securityContext:
                  runAsUser: 999

        trust-manager:
          namespace: cert-manager
          helm:
            chart:
              name: trust-manager
              repo: https://charts.jetstack.io

        reflector:
          namespace: reflector
          helm:
            chart:
              name: oci://ghcr.io/emberstack/helm-charts/reflector
            values:
              reflector:
                securityContext:
                  runAsUser: 999

        cert-chain:
          namespace: cert-manager
          helm:
            chart:
              name: cert-chain
              path: ./charts/cert-chain
            values:
              gatewayCert:
                enabled: false

  - name: local-aux
    description: Auxiliary services
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^(kind(?:-.+)?|docker-desktop|minikube|rancher-desktop|microk8s)$"
    merge:
      deployments:
        reloader:
          namespace: reloader
          helm:
            chart:
              name: reloader
              repo: https://stakater.github.io/stakater-charts
            values:
              securityContext:
                runAsUser: 999

  - name: with-test
    description: Shared test service applications
    merge:
      deployments:
        httpbin:
          namespace: httpbin
          helm:
            chart:
              name: test-services
              path: ./charts/test-services
            values:
              gatewayProvider: ${GATEWAY_PROVIDER}
              dnsDomain: ${DNS_DOMAIN}
              gatewayNamespace: ${GATEWAY_NAMESPACE}
              istioGatewayNamespace: istio-ingress
              istioGatewayName: istio-gateway

  - name: gke-network
    description: GKE Gateway API networking without Istio
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^gke_.+"
    merge:
      vars:
        GATEWAY_NAMESPACE: gke-gateway
        GATEWAY_PROVIDER: gke-gateway
        DNS_DOMAIN: ${GKE_DNS_DOMAIN}
        DNS_MODE: cloud-dns
        DNS_SERVICE_ID: gcp-kube
      deployments:
        gke-gateway:
          namespace: gke-gateway
          kubectl:
            inlineManifest: |-
              ---
              apiVersion: v1
              kind: Namespace
              metadata:
                name: gke-gateway
              ---
              apiVersion: gateway.networking.k8s.io/v1
              kind: Gateway
              metadata:
                name: gateway
                namespace: gke-gateway
              spec:
                gatewayClassName: gke-l7-regional-external-managed
                listeners:
                - name: http
                  hostname: "*.${GKE_DNS_DOMAIN}"
                  port: 80
                  protocol: HTTP
                  allowedRoutes:
                    namespaces:
                      from: All
                - name: https
                  hostname: "*.${GKE_DNS_DOMAIN}"
                  port: 443
                  protocol: HTTPS
                  tls:
                    mode: Terminate
                    certificateRefs:
                    - name: gateway-tls-secret
                  allowedRoutes:
                    namespaces:
                      from: All

  - name: gke-dns
    description: external-dns backed by Google Cloud DNS for GKE
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^gke_.+"
    merge:
      vars:
        DNS_DOMAIN: ${GKE_DNS_DOMAIN}
        DNS_MODE: cloud-dns
        DNS_SERVICE_ID: gcp-kube
      deployments:
        external-dns:
          namespace: external-dns
          helm:
            chart:
              name: external-dns
              version: 1.21.1
              repo: https://kubernetes-sigs.github.io/external-dns/
            values:
              provider:
                name: google
              policy: sync
              registry: txt
              txtOwnerId: ${GKE_PROJECT_ID}
              domainFilters:
                - ${GKE_DNS_DOMAIN}
              sources:
                - gateway-httproute
              serviceAccount:
                create: true
                name: external-dns
                annotations:
                  iam.gke.io/gcp-service-account: external-dns@${GKE_PROJECT_ID}.iam.gserviceaccount.com
              rbac:
                create: true
              logLevel: debug
              extraArgs:
                google-project: ${GKE_PROJECT_ID}
                gateway-namespace: gke-gateway
                gateway-name: gateway

  - name: gke-certs
    description: Internal CA and trusted TLS for GKE Gateway
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^gke_.+"
    merge:
      vars:
        GATEWAY_NAMESPACE: gke-gateway
        GATEWAY_PROVIDER: gke-gateway
        DNS_DOMAIN: ${GKE_DNS_DOMAIN}
        DNS_MODE: cloud-dns
        DNS_SERVICE_ID: gcp-kube
      deployments:
        cert-manager:
          namespace: cert-manager
          helm:
            chart:
              name: cert-manager
              repo: https://charts.jetstack.io
            values:
              installCRDs: true
              global:
                leaderElection:
                  namespace: cert-manager
              config:
                apiVersion: controller.config.cert-manager.io/v1alpha1
                kind: ControllerConfiguration
                enableGatewayAPI: true
        trust-manager:
          namespace: cert-manager
          helm:
            chart:
              name: trust-manager
              repo: https://charts.jetstack.io
        reflector:
          namespace: reflector
          helm:
            chart:
              name: oci://ghcr.io/emberstack/helm-charts/reflector
        cert-chain:
          namespace: cert-manager
          helm:
            chart:
              name: cert-chain
              path: ./charts/cert-chain
            values:
              issuers:
                intermediate:
                  namespace: gke-gateway
              gatewayCert:
                enabled: true
                dnsNames:
                  - "*.${GKE_DNS_DOMAIN}"

  - name: gke-config-connector
    description: Config Connector cluster-mode configuration for managed GKE
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^gke_.+"
          CONFIG_CONNECTOR_ENABLED: "^true$"
    merge:
      deployments:
        gke-config-connector:
          kubectl:
            inlineManifest: |-
              apiVersion: core.cnrm.cloud.google.com/v1beta1
              kind: ConfigConnector
              metadata:
                name: configconnector.core.cnrm.cloud.google.com
              spec:
                mode: ${CONFIG_CONNECTOR_MODE}
                googleServiceAccount: ${CONFIG_CONNECTOR_SERVICE_ACCOUNT}
                stateIntoSpec: Absent

  - name: with-o11y
    description: Shared observability base with Prometheus metrics and lightweight tracing
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^(kind(?:-.+)?|docker-desktop|minikube|rancher-desktop|microk8s)$"
      - vars:
          DEVSPACE_CONTEXT: "^gke_.+"
    merge:
      deployments:
        prometheus:
          namespace: observability
          helm:
            chart:
              name: kube-prometheus-stack
              repo: https://prometheus-community.github.io/helm-charts
            valuesFiles:
              - ./helm-values/prometheus.yaml
        jaeger:
          namespace: observability
          helm:
            chart:
              name: jaeger
              version: ${JAEGER_CHART_VERSION}
              repo: https://jaegertracing.github.io/helm-charts
            valuesFiles:
              - ./helm-values/jaeger.yaml

        otel-collector:
          namespace: observability
          helm:
            chart:
              name: opentelemetry-collector
              version: ${OTEL_COLLECTOR_CHART_VERSION}
              repo: https://open-telemetry.github.io/opentelemetry-helm-charts
            valuesFiles:
              - ./helm-values/otel-collector.yaml

  - name: local-o11y
    description: Local observability overlay for metrics-server, Istio monitors, and local routes
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^(kind(?:-.+)?|docker-desktop|minikube|rancher-desktop|microk8s)$"
    merge:
      deployments:
        metric-server:
          namespace: kube-system
          helm:
            chart:
              name: metrics-server
              repo: https://kubernetes-sigs.github.io/metrics-server
            values:
              args:
                - --kubelet-insecure-tls

        jaeger-route:
          namespace: observability
          kubectl:
            manifests:
              - ./manifests/jaeger-route.yaml

        istio-metrics-monitors:
          namespace: observability
          kubectl:
            manifests:
              - ./manifests/istio-metrics-monitors.yaml

  - name: gke-o11y
    description: GKE observability overlay for managed metrics, routes, and IAP
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^gke_.+"
    merge:
      vars:
        GRAFANA_ROUTE_MANIFEST: ./manifests/grafana-route-gke.yaml
      deployments:
        prometheus:
          helm:
            values:
              defaultRules:
                rules:
                  kubeControllerManager: false
                  kubelet: false
                  kubeProxy: false
                  kubeSchedulerAlerting: false
                  kubeSchedulerRecording: false
              kubelet:
                enabled: false
              kubeControllerManager:
                enabled: false
              kubeScheduler:
                enabled: false
              kubeEtcd:
                enabled: false
              kubeProxy:
                enabled: false
              coreDns:
                enabled: false
              kubeDns:
                enabled: false
              prometheusOperator:
                kubeletService:
                  enabled: false
        jaeger-route:
          namespace: observability
          kubectl:
            manifests:
              - ./manifests/jaeger-route-gke.yaml
        gke-o11y-protection:
          namespace: observability
          helm:
            chart:
              name: gke-iap-protection
              path: ./charts/gke-iap-protection
            values:
              protection: ${GKE_PROTECTION}
              oauthClientID: ${GKE_IAP_OAUTH_CLIENT_ID}
              oauthClientSecret: ${GKE_IAP_OAUTH_CLIENT_SECRET}
              secretName: ${GKE_IAP_SECRET_NAME}
              targets:
                - policyName: jaeger-iap
                  serviceName: jaeger
                - policyName: grafana-iap
                  serviceName: grafana
        grafana-health-check:
          namespace: observability
          kubectl:
            inlineManifest: |-
              apiVersion: networking.gke.io/v1
              kind: HealthCheckPolicy
              metadata:
                name: grafana
              spec:
                default:
                  config:
                    type: HTTP
                    httpHealthCheck:
                      portSpecification: USE_SERVING_PORT
                      requestPath: /api/health
                targetRef:
                  group: ""
                  kind: Service
                  name: grafana

  - name: o11y-grafana
    description: Grafana UI for observability
    activation:
      - vars:
          DEVSPACE_CONTEXT: "^gke_.+"
    merge:
      deployments:
        grafana:
          namespace: observability
          helm:
            chart:
              name: grafana
              repo: https://grafana.github.io/helm-charts
            valuesFiles:
              - ./helm-values/grafana.yaml

        grafana-route:
          namespace: observability
          kubectl:
            manifests:
              - ${GRAFANA_ROUTE_MANIFEST}

        grafana-datasource-prometheus:
          namespace: observability
          kubectl:
            manifests:
              - ./manifests/grafana-datasource-prometheus.yaml

        grafana-dashboards-kubernetes:
          namespace: observability
          kubectl:
            manifests:
              - ./manifests/grafana-dashboards-kubernetes.yaml

  - name: o11y-addons
    description: Observability addons for logs and Grafana trace exploration
    merge:
      deployments:
        alloy:
          namespace: observability
          helm:
            chart:
              name: alloy
              version: 1.10.0
              repo: https://grafana.github.io/helm-charts
            valuesFiles:
              - ./helm-values/alloy.yaml

        loki:
          namespace: observability
          helm:
            chart:
              name: loki
              repo: https://grafana.github.io/helm-charts
            valuesFiles:
              - ./helm-values/loki.yaml

        tempo:
          namespace: observability
          helm:
            chart:
              name: tempo
              repo: https://grafana.github.io/helm-charts
            valuesFiles:
              - ./helm-values/tempo.yaml

        grafana-datasources-addons:
          namespace: observability
          kubectl:
            manifests:
              - ./manifests/grafana-datasources-addons.yaml

  - name: local-psql
    description: PostgreSQL for data storage
    merge:
      deployments:
        postgres:
          helm:
            chart:
              name: oci://registry-1.docker.io/bitnamicharts/postgresql
              version: ${POSTGRES_CHART_VERSION}
            valuesFiles:
              - ./helm-values/postgresql.yaml

  - name: local-redis
    description: Redis for data storage
    merge:
      deployments:
        redis:
          helm:
            chart:
              name: oci://registry-1.docker.io/bitnamicharts/redis
              version: ${REDIS_CHART_VERSION}
            valuesFiles:
              - ./helm-values/redis.yaml

  - name: local-es
    description: ElasticSearch
    merge:
      deployments:
        elasticsearch:
          namespace: elasticsearch
          helm:
            chart:
              name: elasticsearch
              repo: https://helm.elastic.co
            values:
              replicas: 1
              minimumMasterNodes: 1
              esJavaOpts: "-Xmx128m -Xms128m"
              protocol: http
              extraEnvs:
                - name: xpack.security.http.ssl.enabled
                  value: "false"
              secret:
                password: "elastic"

hooks:
  - name: docker-mac-net-connect-hook
    os: darwin
    command: |
      # check if docker-mac-net-connect is running, otherwise install and start it
      echo >&2 "I: Checking whether docker-mac-net-connect is installed..."
      if ! sudo brew services list | grep -q docker-mac-net-connect; then
        echo >&2 "I: Installing docker-mac-net-connect..."
        if ! brew install chipmk/tap/docker-mac-net-connect; then
          echo >&2 "E: Failed to install docker-mac-net-connect. Please check your Homebrew setup."
          exit 1
        fi
      else
        echo >&2 "I: docker-mac-net-connect is already installed."
      fi
      sudo brew services start chipmk/tap/docker-mac-net-connect
    events: ["after:deploy:metallb"]

  - name: metallb-node-label-hook
    command: kubectl label nodes --all node.kubernetes.io/exclude-from-external-load-balancers-
    silent: true
    events: ["before:deploy:metallb"]

  - name: wait-for-metallb-hook
    command: |
      echo >&2 "I: Waiting for MetalLB controller rollout..."
      kubectl rollout status deployment/metallb-controller -n metallb-system --timeout=300s
    events: ["after:deploy:metallb"]

  - name: update-cluster-dns-hook-darwin
    os: darwin
    command: |
      if [ "${HOST_INTEGRATION}" != "true" ]; then
        echo >&2 "I: Skipping host DNS integration because HOST_INTEGRATION=${HOST_INTEGRATION}"
        exit 0
      fi
      devspace run update-cluster-dns
    events: ["after:deploy:cert-chain"]

  - name: update-cluster-dns-hook-linux
    os: linux
    command: |
      if [ "${HOST_INTEGRATION}" != "true" ]; then
        echo >&2 "I: Skipping host DNS integration because HOST_INTEGRATION=${HOST_INTEGRATION}"
        exit 0
      fi
      devspace run update-cluster-dns-linux
    events: ["after:deploy:cert-chain"]

  - name: cert-chain-hook-darwin
    os: darwin
    command: |
      if [ "${HOST_INTEGRATION}" != "true" ]; then
        echo >&2 "I: Skipping host CA import because HOST_INTEGRATION=${HOST_INTEGRATION}"
        exit 0
      fi
      while ! devspace run import-root-ca; do
        echo >&2 "I: Waiting for root CA to be available..."
        sleep 5
      done
      echo >&2 "I: Root CA imported successfully."
    events: ["after:deploy:cert-chain"]

  - name: cert-chain-hook-linux
    os: linux
    command: |
      if [ "${HOST_INTEGRATION}" != "true" ]; then
        echo >&2 "I: Skipping host CA import because HOST_INTEGRATION=${HOST_INTEGRATION}"
        exit 0
      fi
      while ! devspace run import-root-ca-linux; do
        echo >&2 "I: Waiting for root CA to be available..."
        sleep 5
      done
    events: ["after:deploy:cert-chain"]

  - name: wait-for-trust-manager-hook
    wait:
      running: true
    container:
      namespace: cert-manager
      containerName: trust-manager
      labelSelector:
        app.kubernetes.io/instance: trust-manager
    events: ["after:deploy:trust-manager"]

  - name: delete-etcd-pvc-hook
    command: |
      echo >&2 "I: Deleting etcd PVC..."
      kubectl -n external-dns delete pvc data-etcd-0 --ignore-not-found
    events: ["after:purge:etcd"]

pipelines:
  deploy:
    run: |-
      devspace run check-tools
      ./scripts/devspace-cluster-backend.sh validate-provider
      ./scripts/devspace-cluster-backend.sh publish-cluster-env
      if [ "${CONFIG_CONNECTOR_ENABLED}" = "true" ]; then
        ./scripts/config-connector.sh install-operator
      fi

      PHASES=(
        # Phase entries are filtered against enabled deployments, so profile-only
        # names like gke-gateway are no-ops unless their profile is active.
        "etcd gateway-api-crds gke-gateway gke-config-connector"
        "cert-manager metallb reflector prometheus"
        "metallb-resources"
        "cert-chain trust-manager"
        "istio-base"
        "istiod"
        "istio-ingress-gateway istio-metrics-monitors"
      )
      run_dependencies --all
      ensure_pull_secrets --all
      build_images --all

      enabled="$(get_config_value deployments | yq 'keys | join(" ")')"
      for phase in "${PHASES[@]}"; do
        final=()
        for d in $phase; do
          if is_in "$d" "$enabled"; then
            final+=("$d")
          fi
        done
        if [ ${#final[@]} -gt 0 ]; then
          create_deployments "${final[@]}"
        fi
      done

      create_deployments --all --except ${PHASES[@]}
      if is_in "grafana" "$enabled"; then
        # These dashboard ConfigMaps are too large for client-side apply's last-applied annotation.
        # DevSpace's kubectl deploy path adds --force, which kubectl rejects with --server-side.
        kubectl -n observability apply --server-side -f ./manifests/grafana-dashboards-candidates.yaml
        kubectl -n observability apply --server-side -f ./manifests/grafana-dashboards-istio.yaml
      fi

commands:
  check-tools:
    description: Check required local tools for the active cluster provider
    section: network
    command: HOST_INTEGRATION="${HOST_INTEGRATION}" DNS_MODE="${DNS_MODE}" DOCKER_CIDR_PREFIX="${DOCKER_CIDR_PREFIX}" ./scripts/check-tools.sh

  ensure-cluster:
    description: Ensure/select a development cluster backend
    section: network
    command: ./scripts/devspace-cluster-backend.sh ensure

  destroy-cluster:
    description: Destroy the starter-pack-managed GKE cluster backend
    section: network
    command: ./scripts/devspace-cluster-backend.sh destroy-cluster

  test-install:
    description: Run install diagnostics for the current cluster provider
    section: network
    command: ./scripts/devspace-cluster-backend.sh test-install

  print-cluster-env:
    description: Print the cluster environment contract
    section: network
    command: ./scripts/devspace-cluster-backend.sh print-cluster-env

  check-gke-service-extensions:
    description: Check GKE Service Extensions CRD capabilities
    section: network
    command: ./scripts/devspace-cluster-backend.sh check-gke-service-extensions

  docker-mac-net-connect:
    description: Connect Docker for Mac to the cluster
    section: network
    command: |
      # check if docker-mac-net-connect is running, otherwise install and start it
      echo >&2 "I: Checking whether docker-mac-net-connect is installed..."
      if ! sudo brew services list | grep -q docker-mac-net-connect; then
        echo >&2 "I: Installing docker-mac-net-connect..."
        if ! brew install chipmk/tap/docker-mac-net-connect; then
          echo >&2 "E: Failed to install docker-mac-net-connect. Please check your Homebrew setup."
          exit 1
        fi
      else
        echo >&2 "I: docker-mac-net-connect is already installed."
      fi
      sudo brew services start chipmk/tap/docker-mac-net-connect

  update-cluster-dns:
    description: Make external cluster DNS available on the host
    section: network
    command: ./scripts/cluster-dns-command.sh update-darwin "${DOCKER_CIDR_PREFIX}"

  update-cluster-dns-linux:
    description: Make external cluster DNS available on a Linux host
    section: network
    command: ./scripts/cluster-dns-command.sh update-linux "${DOCKER_CIDR_PREFIX}"

  reset-cluster-dns:
    description: Reset DNS service
    section: network
    command: ./scripts/cluster-dns-command.sh reset-darwin "${DOCKER_CIDR_PREFIX}"

  reset-cluster-dns-linux:
    description: Reset Linux systemd-resolved cluster DNS service
    section: network
    command: ./scripts/cluster-dns-command.sh reset-linux "${DOCKER_CIDR_PREFIX}"

  gke-gateway-resources:
    description: Print GKE Gateway generated load balancer resource names
    section: network
    command: |
      GATEWAY_NAME="${GATEWAY_NAME:-gateway}"
      GATEWAY_NS="${GATEWAY_NAMESPACE:-gke-gateway}"
      echo "gateway=${GATEWAY_NS}/${GATEWAY_NAME}"
      echo "region=${GKE_REGION}"
      echo "address=$(kubectl -n "${GATEWAY_NS}" get gateway "${GATEWAY_NAME}" -o go-template='{{ range .status.addresses }}{{ .value }}{{ "\n" }}{{ end }}' | head -n1)"
      echo "forwarding_rules=$(kubectl -n "${GATEWAY_NS}" get gateway "${GATEWAY_NAME}" -o go-template='{{ index .metadata.annotations "networking.gke.io/forwarding-rules" }}')"
      echo "backend_services=$(kubectl -n "${GATEWAY_NS}" get gateway "${GATEWAY_NAME}" -o go-template='{{ index .metadata.annotations "networking.gke.io/backend-services" }}')"
      echo "url_maps=$(kubectl -n "${GATEWAY_NS}" get gateway "${GATEWAY_NAME}" -o go-template='{{ index .metadata.annotations "networking.gke.io/url-maps" }}')"

  gke-dev-registry-info:
    description: Print GKE dev image registry configuration
    section: network
    command: |
      HOST="${DEV_REGISTRY_HOST}"
      REGISTRY="${DEV_REGISTRY}"
      PREFIX=""
      if [ -z "${HOST}" ]; then
        HOST="${GKE_REGION}-docker.pkg.dev"
      fi
      if [ -z "${REGISTRY}" ]; then
        if [ -z "${GKE_PROJECT_ID}" ]; then
          echo >&2 "E: GKE registry configuration is missing."
          echo >&2 "I: Set the required GKE vars, then run 'devspace --var CLUSTER_PROVIDER=gke run ensure-cluster'."
          exit 1
        fi
        REGISTRY="${HOST}/${GKE_PROJECT_ID}/${DEV_REGISTRY_REPOSITORY}"
      fi
      if [ -z "${PREFIX}" ]; then
        PREFIX="${REGISTRY}"
      fi
      echo "export DEV_REGISTRY_HOST=${HOST}"
      echo "export DEV_REGISTRY=${REGISTRY}"
      echo "export DEV_REGISTRY_IMAGE_PREFIX=${PREFIX}"
      echo "gcloud auth configure-docker ${HOST}"

  import-root-ca:
    description: Import the root CA certificate of the cluster
    section: network
    command: |
      CERTFILE=$(mktemp -t cluster-root-ca.XXXXXX.crt)
      # Ensure cleanup on exit
      trap 'rm -f "${CERTFILE}"' EXIT

      echo >&2 "I: Extracting Root CA certificate..."
      kubectl get secret -n "${GATEWAY_NAMESPACE}" cluster-root-ca-secret -o jsonpath='{.data.tls\.crt}' | base64 -d > "${CERTFILE}"
      if [ ! -s "${CERTFILE}" ]; then
        echo >&2 "E: Failed to extract certificate or certificate is empty"
        exit 1
      fi
      openssl x509 -in "${CERTFILE}" -subject -issuer -dates -noout

      # Add to system keychain (requires admin password)
      echo >&2 "I: Adding certificate to macOS keychain..."
      sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${CERTFILE}"

      echo >&2 "I: Root CA certificate imported successfully to system keychain."

  import-root-ca-linux:
    description: Import the root CA certificate of the cluster into the Linux trust store
    section: network
    command: |
      CERTFILE=$(mktemp -t cluster-root-ca.XXXXXX.crt)
      # Ensure cleanup on exit
      trap 'rm -f "${CERTFILE}"' EXIT

      echo >&2 "I: Extracting Root CA certificate..."
      kubectl get secret -n "${GATEWAY_NAMESPACE}" cluster-root-ca-secret -o jsonpath='{.data.tls\.crt}' | base64 -d > "${CERTFILE}"
      if [ ! -s "${CERTFILE}" ]; then
        echo >&2 "E: Failed to extract certificate or certificate is empty"
        exit 1
      fi
      openssl x509 -in "${CERTFILE}" -subject -issuer -dates -noout

      echo >&2 "I: Adding certificate to Linux trust store..."
      sudo install -m 0644 "${CERTFILE}" /usr/local/share/ca-certificates/devspace-starter-pack-cluster-root-ca.crt
      sudo update-ca-certificates

      echo >&2 "I: Root CA certificate imported successfully to Linux trust store."

  port-forward-otel:
    description: Forward the local OpenTelemetry Collector OTLP ports
    section: observability
    command: kubectl -n observability port-forward service/otel-collector 4317:4317 4318:4318