refactor(cluster): migrate module from server

apps/server-nestjs/src/main.module.ts

@@ -4,8 +4,8 @@ import { ScheduleModule } from '@nestjs/schedule'
 import { TerminusModule } from '@nestjs/terminus'
 import { baseConfigFactory } from './config/base.config'
 import { AdminRoleModule } from './modules/admin-role/admin-role.module'
-import { AdminTokenModule } from './modules/admin-token/admin-token.module'
 import { AuthModule } from './modules/auth/auth.module'
+import { ClusterModule } from './modules/cluster/cluster.module'
 import { DeploymentModule } from './modules/deployment/deployment.module'
 import { EnvironmentModule } from './modules/environment/environment.module'
 import { HealthzModule } from './modules/healthz/healthz.module'
@@ -38,8 +38,8 @@ import { getDotenvPaths } from './utils/dotenv.utils'
     }),
     TerminusModule.forRoot(),
     AdminRoleModule,
-    AdminTokenModule,
     AuthModule,
+    ClusterModule,
     DeploymentModule,
     EnvironmentModule,
     HealthzModule,

apps/server-nestjs/src/modules/argocd/argocd-datastore.service.ts

@@ -112,6 +112,27 @@ export type ProjectWithDetails = Prisma.ProjectGetPayload<{
   select: typeof projectSelect
 }>
 
+export const clusterSelect = {
+  label: true,
+  clusterResources: true,
+  kubeconfig: {
+    select: {
+      cluster: true,
+      user: true,
+    },
+  },
+  zone: {
+    select: {
+      id: true,
+      slug: true,
+    },
+  },
+} satisfies Prisma.ClusterSelect
+
+export type ClusterWithZone = Prisma.ClusterGetPayload<{
+  select: typeof clusterSelect
+}>
+
 @Injectable()
 export class ArgoCDDatastoreService {
   constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
@@ -128,4 +149,27 @@ export class ArgoCDDatastoreService {
     })
     return zones.map(zone => zone.slug)
   }
+
+  async getCluster(clusterId: string): Promise<ClusterWithZone | null> {
+    return this.prisma.cluster.findUnique({
+      where: { id: clusterId },
+      select: clusterSelect,
+    })
+  }
+
+  async getZoneClusterNames(zoneId: string): Promise<string[]> {
+    const zones = await this.prisma.zone.findUnique({
+      where: { id: zoneId },
+      select: { clusters: { select: { label: true } } },
+    })
+    return zones?.clusters.map(({ label }) => label) ?? []
+  }
+
+  async getZoneSlug(zoneId: string): Promise<string | null> {
+    const zone = await this.prisma.zone.findUnique({
+      where: { id: zoneId },
+      select: { slug: true },
+    })
+    return zone?.slug ?? null
+  }
 }

apps/server-nestjs/src/modules/argocd/argocd.service.ts

@@ -1,9 +1,10 @@
 import type { CommitAction, CondensedProjectSchema, ProjectSchema, SimpleProjectSchema } from '@gitbeaker/core'
 import type { ConfigType } from '@nestjs/config'
+import type { ClusterEventPayload } from '../events/app-events.service'
 import type { RequiredPluginResult } from '../plugin/plugin.utils'
 import type { ProjectWithDetails } from './argocd-datastore.service'
 import { createHmac } from 'node:crypto'
-import { generateNamespaceName, inClusterLabel } from '@cpn-console/shared'
+import { generateNamespaceName, inClusterLabel, KubeconfigSchema } from '@cpn-console/shared'
 import { Inject, Injectable, Logger } from '@nestjs/common'
 import { OnEvent } from '@nestjs/event-emitter'
 import { trace } from '@opentelemetry/api'
@@ -27,6 +28,7 @@ import {
   PROJECT_READONLY_GROUP_PATH_SUFFIX,
   PROJECT_SECURITY_GROUP_PATH_SUFFIX,
 } from './argocd.constants'
+import { generateClusterSecretData, generateZoneVaultValues } from './argocd.utils'
 
 @Injectable()
 export class ArgoCDService {
@@ -68,6 +70,83 @@ export class ArgoCDService {
     return capturePluginResult('argocd', () => this.cleanupProject(project))
   }
 
+  @OnEvent('cluster.upsert')
+  async handleClusterUpsert(payload: ClusterEventPayload): Promise<RequiredPluginResult<'argocd'>> {
+    return capturePluginResult('argocd', () => this.syncCluster(payload))
+  }
+
+  @StartActiveSpan()
+  private async syncCluster(payload: ClusterEventPayload) {
+    const cluster = await this.datastore.getCluster(payload.clusterId)
+    if (!cluster) throw new Error(`Cluster not found for event (clusterId=${payload.clusterId})`)
+    const span = trace.getActiveSpan()
+    span?.setAttribute('cluster.label', cluster.label)
+    span?.setAttribute('zone.slug', cluster.zone.slug)
+    this.logger.log(`Handling a cluster upsert event for ${cluster.label}`)
+    const kubeconfig = KubeconfigSchema.parse(cluster.kubeconfig)
+    await this.vault.upsertKvData(
+      `zone-${cluster.zone.slug}`,
+      `clusters/cluster-${cluster.label}/argocd-cluster-secret`,
+      { data: generateClusterSecretData(cluster, kubeconfig) },
+    )
+    await this.commitZoneValues(cluster.zone.slug)
+    if (payload.zoneId && payload.zoneId !== cluster.zone.id) {
+      const previousZoneSlug = await this.datastore.getZoneSlug(payload.zoneId)
+      if (previousZoneSlug) await this.commitZoneValues(previousZoneSlug)
+    }
+    this.logger.log(`ArgoCD cluster sync completed for ${cluster.label}`)
+  }
+
+  @OnEvent('cluster.delete')
+  async handleClusterDelete(payload: ClusterEventPayload): Promise<RequiredPluginResult<'argocd'>> {
+    return capturePluginResult('argocd', () => this.cleanupCluster(payload))
+  }
+
+  @StartActiveSpan()
+  private async cleanupCluster(payload: ClusterEventPayload) {
+    const cluster = await this.datastore.getCluster(payload.clusterId)
+    if (!cluster) throw new Error(`Cluster not found for event (clusterId=${payload.clusterId})`)
+    const span = trace.getActiveSpan()
+    span?.setAttribute('cluster.label', cluster.label)
+    span?.setAttribute('zone.slug', cluster.zone.slug)
+    this.logger.log(`Handling a cluster delete event for ${cluster.label}`)
+    await this.vault.deleteKvMetadata(
+      `zone-${cluster.zone.slug}`,
+      `clusters/cluster-${cluster.label}/argocd-cluster-secret`,
+    )
+    await this.commitZoneValues(cluster.zone.slug)
+    this.logger.log(`ArgoCD cluster cleanup completed for ${cluster.label}`)
+  }
+
+  private async commitZoneValues(zoneSlug: string) {
+    const infraProject = await this.gitlab.getOrCreateInfraGroupRepo(zoneSlug)
+    const clusters = await this.datastore.getZoneClusterNames(zoneSlug)
+    const vaultValues = await this.generateZoneVaultValues(zoneSlug)
+    const action = await this.gitlab.generateCreateOrUpdateAction(
+      infraProject,
+      'main',
+      'argocd-values.yaml',
+      stringify({ vault: vaultValues, clusters }),
+    )
+    if (!action) {
+      this.logger.verbose(`Zone argocd-values.yaml is up to date (zone=${zoneSlug})`)
+      return
+    }
+    await this.gitlab.maybeCreateCommit(infraProject, `ci: :robot_face: Update zone ${zoneSlug}`, [action])
+  }
+
+  private async generateZoneVaultValues(zoneSlug: string) {
+    const roleId = await this.vault.getAuthApproleRoleRoleId(`zone-${zoneSlug}`).catch(() => {
+      this.logger.warn(`Couldn't find zone app role (zone=${zoneSlug})`)
+      return undefined
+    })
+    const secretId = await this.vault.ensureAuthApproleRoleSecretId(`zone-${zoneSlug}`).catch(() => {
+      this.logger.warn(`Couldn't generate zone app role secret (zone=${zoneSlug})`)
+      return undefined
+    })
+    return generateZoneVaultValues(this.vaultConfig.url, zoneSlug, roleId, secretId)
+  }
+
   @StartActiveSpan()
   private async cleanupProject(project: ProjectWithDetails) {
     const span = trace.getActiveSpan()

apps/server-nestjs/src/modules/argocd/argocd.utils.ts

@@ -0,0 +1,35 @@
+import type { Kubeconfig } from '@cpn-console/shared'
+import { stringify } from 'yaml'
+
+export function generateClusterTlsClientConfig(kubeconfig: Kubeconfig) {
+  return {
+    ...kubeconfig.user.username && { username: kubeconfig.user.username },
+    ...kubeconfig.user.password && { password: kubeconfig.user.password },
+    ...kubeconfig.user.token && { bearerToken: kubeconfig.user.token },
+    tlsClientConfig: {
+      ...kubeconfig.user.keyData && { keyData: kubeconfig.user.keyData },
+      ...kubeconfig.user.certData && { certData: kubeconfig.user.certData },
+      ...kubeconfig.cluster.caData && !kubeconfig.cluster.skipTLSVerify && { caData: kubeconfig.cluster.caData },
+      ...kubeconfig.cluster.skipTLSVerify && { insecure: kubeconfig.cluster.skipTLSVerify },
+      serverName: kubeconfig.cluster.tlsServerName,
+    },
+  }
+}
+
+export function generateZoneVaultValues(vaultUrl: string, zoneSlug: string, roleId: string | undefined, secretId: string | undefined) {
+  return {
+    url: vaultUrl,
+    kvName: `zone-${zoneSlug}`,
+    roleId: roleId ?? 'none',
+    secretId: secretId ?? 'none',
+  }
+}
+
+export function generateClusterSecretData(cluster: { label: string, clusterResources: boolean }, kubeconfig: Kubeconfig) {
+  return {
+    name: cluster.label,
+    clusterResources: String(cluster.clusterResources),
+    server: kubeconfig.cluster.server,
+    config: stringify(generateClusterTlsClientConfig(kubeconfig)),
+  }
+}