feat: add ementas service with Pulumi

.github/actions/prepare-pulumi-project/action.yaml

@@ -0,0 +1,46 @@
+name: "Prepare Pulumi project"
+description: "Installs dependencies and clones the project"
+inputs:
+  node-version:
+    description: "Node version"
+    required: false
+    default: "22"
+  crd2pulumi-version:
+    description: "crd2pulumi version"
+    required: false
+    default: "v1.4.0"
+  yq-version:
+    description: "yq version"
+    required: false
+    default: "v4.40.3"
+runs:
+  using: composite
+  steps:
+
+    - name: Install yq
+      shell: sh
+      run: sudo curl -L https://github.com/mikefarah/yq/releases/download/${{ inputs.yq-version }}/yq_linux_amd64 -o /usr/bin/yq && sudo chmod +x /usr/bin/yq
+
+    - name: Install crd2pulumi
+      shell: sh
+      run: |
+        mkdir -p ./bin/crd2pulumi
+        cd ./bin/crd2pulumi
+        echo "crd2pulumi" > files.txt
+        curl -L https://github.com/pulumi/crd2pulumi/releases/download/${{ inputs.crd2pulumi-version }}/crd2pulumi-${{ inputs.crd2pulumi-version }}-linux-amd64.tar.gz | tar -T files.txt -xvz
+        sudo mv crd2pulumi /usr/bin/crd2pulumi
+        sudo chmod +x /usr/bin/crd2pulumi
+
+    - uses: pnpm/action-setup@v4
+      with:
+        package_json_file: services/pulumi/package.json
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: "pnpm"
+        cache-dependency-path: services/pulumi/pnpm-lock.yaml
+
+    - name: Sync CRDs
+      shell: sh
+      run: ./services/pulumi/sync-crds.sh

.github/workflows/pulumi-linter.yaml

@@ -0,0 +1,30 @@
+name: pulumi-lint
+
+on:
+  pull_request: 
+    branches: [ "main" ]
+    paths: [ "services/pulumi/**" ]
+  push:
+    branches: [ "main" ]
+    paths: [ "services/pulumi/**" ]
+
+jobs:
+  format:
+    name: Prettier
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/prepare-pulumi-project
+      - name: Run prettier
+        working-directory: services/pulumi/niployments
+        run: pnpm run prettier
+
+  lint:
+    name: ESLint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/prepare-pulumi-project
+      - name: Run ESLint
+        working-directory: services/pulumi/niployments
+        run: pnpm run lint

schemas/crds.schema.json

@@ -0,0 +1,108 @@
+{
+    "$schema": "https://json-schema.org/draft-07/schema",
+    "$id": "https://niployments.niaefeup.pt/schemas/crds.schema.json",
+    "title": "CRDs Download Configuration",
+    "description": "Configuration for the download and extraction of CRDs, used for Pulumi-based resources",
+    "type": "object",
+    "required": ["manifests"],
+    "additionalProperties": false,
+    "properties": {
+        "repositories": {
+            "description": "List of repositories to add to the Helm client",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+                "type": "object",
+                "required": ["name", "url"],
+                "additionalProperties": false,
+                "properties": {
+                    "name": {
+                        "type": "string"
+                    },
+                    "url": {
+                        "type": "string"
+                    }
+                }
+            }
+        },
+        "manifests": {
+            "description": "List of manifests to download and extract CRDs from",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+                "type": "object",
+                "oneOf": [
+                    {
+                        "type":"object",
+                        "required": ["type", "chart"],
+                        "additionalProperties": false,
+                        "properties": {
+                            "type": {
+                                "description": "Method for downloading the CRDs",
+                                "type": "string",
+                                "enum": ["helm"]
+                            },
+                            "chart": {
+                                "description": "Name of the Helm chart to download",
+                                "type": "string",
+                                "examples": ["traefik/traefik"]
+                            },
+                            "version": {
+                                "description": "Version of the Helm chart to download",
+                                "type": "string",
+                                "examples": ["28.3.0"]
+                            }
+                        }
+                    },
+                    {
+                        "type":"object",
+                        "required": ["type", "chart"],
+                        "additionalProperties": false,
+                        "properties": {
+                            "type": {
+                                "description": "Method for downloading the CRDs",
+                                "type": "string",
+                                "enum": ["template"]
+                            },
+                            "chart": {
+                                "description": "Name of the Helm chart to download",
+                                "type": "string",
+                                "examples": ["jetstack/cert-manager"]
+                            },
+                            "version": {
+                                "description": "Version of the Helm chart to download",
+                                "type": "string",
+                                "examples": ["v1.14.7"]
+                            },
+                            "options": {
+                                "description": "Options to pass to the Helm template command",
+                                "type": "string"
+                            }
+                        }
+                    },
+                    {
+                        "type":"object",
+                        "required": ["type", "name", "url"],
+                        "additionalProperties": false,
+                        "properties": {
+                            "type": {
+                                "description": "Method for downloading the CRDs",
+                                "type": "string",
+                                "enum": ["curl"]
+                            },
+                            "name": {
+                                "description": "Name of the manifest to download",
+                                "type": "string",
+                                "examples": ["cloudnative-pg/cloudnative-pg"]
+                            },
+                            "url": {
+                                "description": "URL to download the chart from",
+                                "type": "string"
+                            }
+                        }
+                    }
+                ]
+            }
+        }
+    }
+}

services/cert-manager/deploy-dev.sh

@@ -5,6 +5,6 @@ helm repo update
 
 kubectl apply -f $(dirname $0)/00-namespace.yaml
 
-helm upgrade --install -f $(dirname $0)/values.yaml cert-manager jetstack/cert-manager --namespace cert-manager
+helm upgrade --install -f $(dirname $0)/values.yaml cert-manager jetstack/cert-manager --version v1.14.7 --namespace cert-manager
 
 kubectl apply -f $(dirname $0)/01-cluster-issuer-dev.yaml

services/pulumi/.gitignore

@@ -0,0 +1,3 @@
+bin/
+node_modules/
+/crds/

services/pulumi/crds.yaml

@@ -0,0 +1,55 @@
+# yaml-language-server: $schema=../../schemas/crds.schema.json
+repositories:
+  - name: jetstack
+    url: https://charts.jetstack.io
+  # - name: clustersecret
+  #   url: https://charts.clustersecret.io/
+  # mongodb official charts are not needed while temporary fix is in use
+  # - name: mongodb
+  #   url: https://mongodb.github.io/helm-charts
+  - name: mittwald
+    url: https://helm.mittwald.de
+  - name: longhorn
+    url: https://charts.longhorn.io
+  - name: traefik
+    url: https://traefik.github.io/charts
+
+manifests:
+  # cert-manager
+  - type: template
+    chart: jetstack/cert-manager
+    version: v1.14.7
+    options: |
+      --values=../cert-manager/values.yaml
+      --namespace=cert-manager
+  # cilium - no CRDs
+  # cluster-secret
+  # - type: helm
+  #   chart: clustersecret/cluster-secret
+  # databases/mongodb
+  ## [version for official helm charts below]
+  # - type: template
+  #   chart: mongodb/community-operator
+  #   options: |
+  #     --namespace=mongodb
+  ## [version for temporary fix version below]
+  - type: curl
+    name: mongodb/community-operator
+    url: https://raw.githubusercontent.com/limwa/mongodb-kubernetes-operator/master/config/crd/bases/mongodbcommunity.mongodb.com_mongodbcommunity.yaml
+  # databases/postgresql
+  - type: curl
+    name: cloudnative-pg/cloudnative-pg
+    url: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.22/releases/cnpg-1.22.2.yaml
+  # image-registry (harbor) - no CRDs
+  # replicator - no CRDs
+  # storage/longhorn
+  - type: template
+    chart: longhorn/longhorn
+    version: 1.6.1
+    options: |
+      --values=../storage/longhorn/prod-values.yaml
+      --namespace=longhorn
+  # traefik
+  - type: helm
+    chart: traefik/traefik
+    version: 28.3.0

services/pulumi/niployments/.prettierignore

@@ -0,0 +1,7 @@
+# Pnpm files
+/node_modules/
+/bin/
+package.json
+
+# Assets
+/assets/

services/pulumi/niployments/.prettierrc

@@ -0,0 +1,3 @@
+{
+  "tabWidth": 2
+}

services/pulumi/niployments/Pulumi.prod.yaml

@@ -0,0 +1,6 @@
+encryptionsalt: v1:upriG3hjats=:v1:Mjju6ZYDjjKKyVPn:Bn6nuCMHoUCltZWaXycxDl5bvv7ndA==
+config:
+  niployments:mongodb/admin-password:
+    secure: v1:GXCb2z0V4Az3053O:y6EgjlKVYr6BWebVazmAmdC/YCI=
+  niployments:mongodb/nimentas-password:
+    secure: v1:HxF47P+9RXfi4nfc:47vWUGoYJgjmqxaWwT2M8SSCgI0=

services/pulumi/niployments/Pulumi.yaml

@@ -0,0 +1,7 @@
+name: niployments
+runtime: nodejs
+description: Pulumi program to manage the niployments cluster
+config:
+  pulumi:tags:
+    value:
+      pulumi:template: kubernetes-typescript