feat(ledger): integrate Ledger v3 operator

.gitignore

@@ -31,3 +31,6 @@ charts
 
 # E2E test artifacts
 tests/e2e/artifacts/
+
+# Local scratch files
+tmp/

Dockerfile

@@ -0,0 +1,37 @@
+FROM golang:1.26-alpine AS builder
+
+RUN apk add --no-cache git
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG VERSION=latest
+ARG COMMIT=unknown
+ARG LICENCE_PUBLIC_KEY_B64=""
+
+WORKDIR /src/cmd
+
+RUN set -e; \
+    LDFLAGS="-X github.com/formancehq/operator/v3/cmd.Version=${VERSION} \
+    -X github.com/formancehq/operator/v3/cmd.BuildDate=$(date +%s) \
+    -X github.com/formancehq/operator/v3/cmd.Commit=${COMMIT}"; \
+    if [ -n "$LICENCE_PUBLIC_KEY_B64" ]; then \
+        LICENCE_PUBLIC_KEY="$(printf '%s' "$LICENCE_PUBLIC_KEY_B64" | base64 -d)"; \
+        LDFLAGS="${LDFLAGS} -X 'github.com/formancehq/go-libs/v5/pkg/authn/licence.formancePublicKey=${LICENCE_PUBLIC_KEY}'"; \
+    fi; \
+    CGO_ENABLED=0 go build -buildvcs=false -o /usr/bin/operator -ldflags="${LDFLAGS}" .
+
+FROM alpine:3.20
+
+RUN apk update && apk add --no-cache ca-certificates curl
+RUN addgroup -S operator && adduser -S -G operator operator
+
+ENTRYPOINT ["/usr/bin/operator"]
+
+COPY --from=builder /usr/bin/operator /usr/bin/operator
+
+USER operator

Earthfile

@@ -45,9 +45,13 @@ compile:
     SAVE ARTIFACT main
 
 build-image:
-    FROM core+final-image
-    ENTRYPOINT ["/usr/bin/operator"]
-    COPY --pass-args (+compile/main) /usr/bin/operator
+    ARG LICENCE_PUBLIC_KEY_B64=""
+    ARG EARTHLY_BUILD_SHA
+    FROM DOCKERFILE \
+        --build-arg LICENCE_PUBLIC_KEY_B64=$LICENCE_PUBLIC_KEY_B64 \
+        --build-arg VERSION=$tag \
+        --build-arg COMMIT=$EARTHLY_BUILD_SHA \
+        -f Dockerfile .
     ARG REPOSITORY=ghcr.io
     ARG tag=latest
     DO --pass-args core+SAVE_IMAGE --COMPONENT=operator --TAG=$tag

PROJECT

@@ -173,4 +173,10 @@ resources:
   kind: Broker
   path: github.com/formancehq/operator/api/formance.com/v1beta1
   version: v1beta1
+- api:
+    crdVersion: v1
+  group: formance.com
+  kind: LedgerConfiguration
+  path: github.com/formancehq/operator/api/formance.com/v1beta1
+  version: v1beta1
 version: "3"

api/formance.com/v1beta1/gateway_types.go

@@ -86,6 +86,9 @@ type GatewayStatus struct {
 	// Detected http apis. See [GatewayHTTPAPI](#gatewayhttpapi)
 	//+optional
 	SyncHTTPAPIs []string `json:"syncHTTPAPIs"`
+	// Detected grpc apis. See [GatewayGRPCAPI](#gatewaygrpcapi)
+	//+optional
+	SyncGRPCAPIs []string `json:"syncGRPCAPIs,omitempty"`
 }
 
 //+kubebuilder:object:root=true

api/formance.com/v1beta1/gatewaybackend_types.go

@@ -0,0 +1,50 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+const GatewayBackendTLSSecretLabel = "formance.com/gateway-backend-tls"
+
+// GatewayBackendTLS configures TLS when Gateway connects to a backend.
+type GatewayBackendTLS struct {
+	// SecretName contains the CA used to verify the backend certificate.
+	// The Secret must carry the `formance.com/gateway-backend-tls: "true"`
+	// label so that certificate rotations trigger a Gateway rollout.
+	// +kubebuilder:validation:MinLength=1
+	SecretName string `json:"secretName"`
+	// CASecretKey is the key containing the CA certificate.
+	// +optional
+	// +kubebuilder:default:="ca.crt"
+	CASecretKey string `json:"caSecretKey,omitempty"`
+	// ServerName is used for backend certificate verification.
+	// +kubebuilder:validation:MinLength=1
+	ServerName string `json:"serverName"`
+}
+
+// GatewayBackendRef selects the Kubernetes Service used by a Gateway route.
+// When omitted, Gateway keeps using the module's historical Service.
+type GatewayBackendRef struct {
+	// Name is the backend Service name in the Stack namespace.
+	// +kubebuilder:validation:MinLength=1
+	Name string `json:"name"`
+	// Port is the backend Service port.
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
+	Port int32 `json:"port"`
+	// TLS enables a verified TLS connection to the backend.
+	// +optional
+	TLS *GatewayBackendTLS `json:"tls,omitempty"`
+}

api/formance.com/v1beta1/gatewaygrpcapi_types.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type GatewayGRPCAPISpec struct {
+	StackDependency `json:",inline"`
+	// Name indicates the module name (e.g. "ledger")
+	Name string `json:"name"`
+	// GRPCServices is the list of fully-qualified gRPC service names
+	// exposed by this module (e.g. "formance.ledger.v1.LedgerService")
+	GRPCServices []string `json:"grpcServices"`
+	// Port is the gRPC port on the backend service
+	//+optional
+	//+kubebuilder:default:=8081
+	Port int32 `json:"port,omitempty"`
+	// BackendRef overrides the historical <name>-grpc Service.
+	// +optional
+	BackendRef *GatewayBackendRef `json:"backendRef,omitempty"`
+}
+
+type GatewayGRPCAPIStatus struct {
+	Status `json:",inline"`
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:resource:scope=Cluster
+//+kubebuilder:printcolumn:name="Stack",type=string,JSONPath=".spec.stack",description="Stack"
+//+kubebuilder:printcolumn:name="Ready",type=string,JSONPath=".status.ready",description="Ready"
+
+// GatewayGRPCAPI is the Schema for the GRPCAPIs API
+type GatewayGRPCAPI struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   GatewayGRPCAPISpec   `json:"spec,omitempty"`
+	Status GatewayGRPCAPIStatus `json:"status,omitempty"`
+}
+
+func (in *GatewayGRPCAPI) SetReady(b bool) {
+	in.Status.Ready = b
+}
+
+func (in *GatewayGRPCAPI) IsReady() bool {
+	return in.Status.Ready
+}
+
+func (in *GatewayGRPCAPI) SetError(s string) {
+	in.Status.Info = s
+}
+
+func (a GatewayGRPCAPI) GetStack() string {
+	return a.Spec.Stack
+}
+
+func (in *GatewayGRPCAPI) GetConditions() *Conditions {
+	return &in.Status.Conditions
+}
+
+//+kubebuilder:object:root=true
+
+// GatewayGRPCAPIList contains a list of GatewayGRPCAPI
+type GatewayGRPCAPIList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []GatewayGRPCAPI `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&GatewayGRPCAPI{}, &GatewayGRPCAPIList{})
+}

api/formance.com/v1beta1/gatewayhttpapi_types.go

@@ -27,6 +27,9 @@ type GatewayHTTPAPIRule struct {
 	//+optional
 	//+kubebuilder:default:=false
 	Secured bool `json:"secured"`
+	// BackendRef overrides the historical module Service for this rule.
+	// +optional
+	BackendRef *GatewayBackendRef `json:"backendRef,omitempty"`
 }
 
 type GatewayHTTPAPISpec struct {
@@ -41,8 +44,6 @@ type GatewayHTTPAPISpec struct {
 
 type GatewayHTTPAPIStatus struct {
 	Status `json:",inline"`
-	//+optional
-	Ready bool `json:"ready,omitempty"`
 }
 
 //+kubebuilder:object:root=true

api/formance.com/v1beta1/ledger_types.go

@@ -20,6 +20,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+const LedgerV3Label = "formance.com/ledger-v3"
+
 type LedgerSpec struct {
 	ModuleProperties `json:",inline"`
 	StackDependency  `json:",inline"`

api/formance.com/v1beta1/ledgerconfiguration_types.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	ledgerv1alpha1 "github.com/formancehq/ledger/misc/operator/api/v1alpha1"
+)
+
+const DefaultLedgerConfigurationName = "default"
+
+type LedgerConfigurationSpec struct {
+	// Stacks on which the configuration is applied. Can contain `*` to
+	// indicate a wildcard, following the same convention as Settings.
+	// +optional
+	// +kubebuilder:validation:XValidation:rule="size(self) == 1 || !self.exists(stack, stack == '*')",message="the wildcard stack selector '*' cannot be combined with explicit stack names"
+	Stacks []string `json:"stacks,omitempty"`
+
+	// Cluster is the base Ledger v3 Cluster specification. Stack-specific
+	// Settings and values owned by the Operator are applied on top of it.
+	// +optional
+	Cluster ledgerv1alpha1.ClusterSpec `json:"cluster,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Cluster
+// LedgerConfiguration defines the base specification applied to every Ledger v3
+// Cluster targeted by spec.stacks. A configuration targeting a stack by name
+// takes priority over a configuration targeting all stacks with `*`.
+type LedgerConfiguration struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec LedgerConfigurationSpec `json:"spec,omitempty"`
+}
+
+func (in *LedgerConfiguration) GetStacks() []string {
+	return in.Spec.Stacks
+}
+
+func (in *LedgerConfiguration) IsWildcard() bool {
+	return len(in.Spec.Stacks) == 1 && in.Spec.Stacks[0] == "*"
+}
+
+// +kubebuilder:object:root=true
+
+// LedgerConfigurationList contains a list of LedgerConfiguration
+type LedgerConfigurationList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []LedgerConfiguration `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&LedgerConfiguration{}, &LedgerConfigurationList{})
+}