init: registry server + operator from VM

operator/manifests/00-namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: terra
+  labels:
+    name: terra

operator/manifests/00-rbac.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-operator
+  namespace: terra
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: terraform-operator
+  namespace: terra
+rules:
+- apiGroups: ["terra.core.nubes.ru"]
+  resources: ["providerreleases", "providerreleases/status"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["create", "get", "list", "watch", "delete"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: terraform-operator
+  namespace: terra
+subjects:
+- kind: ServiceAccount
+  name: terraform-operator
+  namespace: terra
+roleRef:
+  kind: Role
+  name: terraform-operator
+  apiGroup: rbac.authorization.k8s.io

operator/manifests/02-crd.yaml

@@ -0,0 +1,77 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: providerreleases.terra.core.nubes.ru
+spec:
+  group: terra.core.nubes.ru
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              required:
+                - providerName
+                - version
+                - gitRepo
+                - gitRef
+              properties:
+                providerName:
+                  type: string
+                  description: "Name of the provider (e.g. 'mycloud')"
+                namespace:
+                  type: string
+                  default: "mycloud"
+                  description: "Terraform registry namespace (e.g. 'nubes')"
+                version:
+                  type: string
+                  description: "Semantic version without v (e.g. '1.0.1')"
+                gitRepo:
+                  type: string
+                  description: "Git repository URL to clone"
+                gitRef:
+                  type: string
+                  description: "Git tag, commit SHA or branch"
+                platforms:
+                  type: array
+                  items:
+                    type: string
+                  default: ["linux_amd64", "windows_amd64"]
+                  description: "Target platforms for build"
+            status:
+              type: object
+              properties:
+                phase:
+                  type: string
+                  description: "Current phase: Pending, Building, Publishing, Ready, Failed"
+                downloadUrl:
+                  type: string
+                conditions:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      type:
+                        type: string
+                      status:
+                        type: string
+                      lastTransitionTime:
+                        type: string
+                        format: date-time
+                      reason:
+                        type: string
+                      message:
+                        type: string
+  scope: Namespaced
+  names:
+    plural: providerreleases
+    singular: providerrelease
+    kind: TerraformProviderRelease
+    shortNames:
+      - tpr

operator/manifests/03-build-script.yaml

@@ -0,0 +1,75 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: builder-script
+  namespace: terra
+data:
+  build.sh: |
+    #!/bin/sh
+    set -e
+
+    echo ">>> Starting Build for $PROVIDER_NAME $VERSION"
+    
+    # 1. Setup Environment
+    # Inputs: GIT_REPO, GIT_REF, PROVIDER_NAME, VERSION
+    WORK_DIR="/workspace"
+    ARTIFACTS_DIR="/artifacts"
+    mkdir -p $WORK_DIR $ARTIFACTS_DIR
+
+    # 2. Clone Repository
+    echo ">>> Cloning $GIT_REPO ($GIT_REF)..."
+    git clone $GIT_REPO $WORK_DIR/src
+    cd $WORK_DIR/src
+    git checkout $GIT_REF
+
+    # 3. Build for Platforms
+    # Hardcoded platforms for MVP: linux/amd64, windows/amd64
+    # Naming convention: terraform-provider-NAME_vVERSION_OS_ARCH.zip
+    
+    echo ">>> Building binaries..."
+    
+    # Linux amd64
+    echo "--> linux/amd64"
+    GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o terraform-provider-${PROVIDER_NAME}_v${VERSION}
+    zip ${ARTIFACTS_DIR}/terraform-provider-${PROVIDER_NAME}_${VERSION}_linux_amd64.zip terraform-provider-${PROVIDER_NAME}_v${VERSION}
+    rm terraform-provider-${PROVIDER_NAME}_v${VERSION}
+
+    # Windows amd64
+    echo "--> windows/amd64"
+    GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o terraform-provider-${PROVIDER_NAME}_v${VERSION}.exe
+    zip ${ARTIFACTS_DIR}/terraform-provider-${PROVIDER_NAME}_${VERSION}_windows_amd64.zip terraform-provider-${PROVIDER_NAME}_v${VERSION}.exe
+    rm terraform-provider-${PROVIDER_NAME}_v${VERSION}.exe
+
+    # 4. Checksums
+    cd $ARTIFACTS_DIR
+    sha256sum *.zip > terraform-provider-${PROVIDER_NAME}_${VERSION}_SHA256SUMS
+    
+    # 5. GPG Sign (Mock for MVP - empty sig or skip if client allows, but Terraform strict. 
+    # For now we will generate a dummy signature to satisfy file existence, real signing requires GPG private key in env)
+    # Ideally: gpg --detach-sign --armor terraform-provider-..._SHA256SUMS
+    touch terraform-provider-${PROVIDER_NAME}_${VERSION}_SHA256SUMS.sig
+
+    # 6. Upload to S3
+    # Layout: /terraform-providers/hostname/namespace/name/version/
+    # We will use 'REGISTRY_HOSTNAME' env var if set, else default.
+    
+    if [ -z "$REGISTRY_HOSTNAME" ]; then
+      REGISTRY_HOSTNAME="terra.k8c.ru"
+    fi
+    
+    TARGET_PATH="terraform-providers/$REGISTRY_HOSTNAME/${NAMESPACE}/${PROVIDER_NAME}/${VERSION}"
+    
+    echo ">>> Uploading to S3 path: $TARGET_PATH"
+    
+    # Configure mc using S3 credentials (S3_ENDPOINT, S3_ACCESS_KEY, S3_SECRET_KEY)
+    mc alias set nubes_s3 https://$S3_ENDPOINT $S3_ACCESS_KEY $S3_SECRET_KEY
+    
+    # Upload files
+    mc cp --recursive $ARTIFACTS_DIR/ nubes_s3/$TARGET_PATH/
+
+    # 7. Generate shasums file for download (Terraform download protocol requires a checksums.txt usually or just the sums file)
+    # We are following the provider registry protocol loosely. 
+    # The most important part for discovery is the 'index.json' or 'versions' endpoint, but we are static hosting.
+    # We rely on the directory structure.
+    
+    echo ">>> Build Complete!"

operator/manifests/04-operator-deployment.yaml

@@ -0,0 +1,27 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: terraform-operator
+  namespace: terra
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: terraform-operator
+  template:
+    metadata:
+      labels:
+        app: terraform-operator
+    spec:
+      serviceAccountName: terraform-operator
+      containers:
+      - name: operator
+        image: naeel/terraform-registry-operator:latest
+        imagePullPolicy: Always
+        env:
+        - name: REGISTRY_HOSTNAME
+          value: "terra.k8c.ru"
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"

operator/manifests/05-registry-server.yaml

@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: registry-server
+  namespace: terra
+  labels:
+    app: registry-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: registry-server
+  template:
+    metadata:
+      labels:
+        app: registry-server
+    spec:
+      containers:
+      - name: registry-server
+        image: naeel/terraform-registry-server:gpg-key-20260208
+        imagePullPolicy: Always
+        env:
+        - name: REGISTRY_HOSTNAME
+          value: "terra.k8c.ru"
+        - name: S3_ENDPOINT
+          value: "s3.msk-1.ngcloud.ru"
+        - name: S3_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access-key
+              name: s3-credentials
+        - name: S3_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: secret-key
+              name: s3-credentials
+        - name: S3_BUCKET
+          value: "terraform-registry"
+        - name: S3_USE_SSL
+          value: "true"
+        ports:
+        - containerPort: 8080
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: registry-server
+  namespace: terra
+spec:
+  selector:
+    app: registry-server
+  ports:
+  - port: 80
+    targetPort: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: registry-ingress
+  namespace: terra
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - terra.k8c.ru
+    secretName: registry-tls
+  rules:
+  - host: terra.k8c.ru
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: registry-server
+            port:
+              number: 80

operator/manifests/06-registry-server-docs.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: registry-server
+  namespace: terra
+  labels:
+    app: registry-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: registry-server
+  template:
+    metadata:
+      labels:
+        app: registry-server
+    spec:
+      containers:
+      - name: registry-server
+        image: naeel/terraform-registry-server:docs-dev-fixed
+        imagePullPolicy: Always
+        env:
+        - name: REGISTRY_HOSTNAME
+          value: "terra.k8c.ru"
+        - name: S3_ENDPOINT
+          value: "s3.msk-1.ngcloud.ru"
+        - name: S3_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access-key
+              name: s3-credentials
+        - name: S3_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: secret-key
+              name: s3-credentials
+        - name: S3_BUCKET
+          value: "terraform-registry"
+        - name: S3_USE_SSL
+          value: "true"
+        ports:
+        - containerPort: 8080