Service Foundry Builder as Kubernetes Job

# Enable BuildKit support
# docker buildx build --platform linux/amd64,linux/arm64 -t your-image-name .

FROM debian:bullseye-slim

ARG TARGETARCH
ENV DEBIAN_FRONTEND=noninteractive


# Install core dependencies (excluding nodejs and npm)
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl unzip wget git jq \
    ca-certificates software-properties-common \
    python3 python3-pip lsb-release apt-transport-https \
    openssh-client xz-utils \
    && rm -rf /var/lib/apt/lists/*

# Define version
ENV NODE_VERSION=22.9.0
ENV NPM_VERSION=11.2.0

# Install Node.js and npm
RUN if [ "${TARGETARCH}" = "amd64" ]; then \
      curl -fsSL https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz -o node.tar.xz ; \
    else \
      curl -fsSL https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-arm64.tar.xz -o node.tar.xz ; \
    fi \
    && tar -xJf node.tar.xz -C /usr/local --strip-components=1 \
    && rm node.tar.xz \
    && ln -sf /usr/local/bin/node /usr/bin/node \
    && ln -sf /usr/local/bin/npm /usr/bin/npm \
    && npm install -g npm@${NPM_VERSION}



# Install kubectl
RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${TARGETARCH}/kubectl" && \
    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl && \
    rm kubectl

# Install Helm
RUN curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# Install Yeoman
RUN npm install -g yo

# Install yq (Mike Farah's Go version)
RUN YQ_VERSION="v4.44.1" && \
    curl -L https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${TARGETARCH} -o /usr/local/bin/yq && \
    chmod +x /usr/local/bin/yq

# Install Terraform
RUN TERRAFORM_VERSION="1.8.4" && \
    wget https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${TARGETARCH}.zip && \
    unzip terraform_${TERRAFORM_VERSION}_linux_${TARGETARCH}.zip && \
    mv terraform /usr/local/bin/ && \
    rm terraform_${TERRAFORM_VERSION}_linux_${TARGETARCH}.zip

# Install AWS CLI (v2 supports only x86_64 officially, workaround needed for arm64)
RUN if [ "${TARGETARCH}" = "amd64" ]; then \
      curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"; \
    else \
      curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"; \
    fi && \
    unzip awscliv2.zip && ./aws/install && \
    rm -rf aws awscliv2.zip

# Install Azure CLI
RUN curl -sL https://aka.ms/InstallAzureCLIDeb | bash


# Create a script that will run the clone using the SSH key

RUN groupadd --gid 1000 servicefoundry && \
    useradd --uid 1000 --gid servicefoundry --create-home servicefoundry

# Set ownership of directories needed later
RUN mkdir -p /opt/nsa2/service-foundry \
    && chown -R servicefoundry:servicefoundry /opt/nsa2/service-foundry

USER servicefoundry

WORKDIR /opt/nsa2/service-foundry

ENV SF_WORKSPACE_DIR=/opt/nsa2/service-foundry/workspace

# Copy install-generator script file
COPY --chown=servicefoundry:servicefoundry install-generator.sh .
RUN chmod +x install-generator.sh

# Copy entrypoint script file
COPY --chown=servicefoundry:servicefoundry entrypoint.sh .
RUN chmod +x entrypoint.sh

ENTRYPOINT ["/opt/nsa2/service-foundry/entrypoint.sh"]

$ docker buildx create --use
# $ docker buildx build --platform linux/amd64,linux/arm64 -t service-foundry-builder --load docker/
$ docker buildx build --platform linux/arm64 -t service-foundry-builder --load docker/

$ docker run -it --rm service-foundry-builder

$ kubectl create namespace service-foundry

$ mkdir helm-charts
$ cd helm-charts
$ helm create service-foundry-builder

$ tree service-foundry-builder

service-foundry-builder
├── Chart.yaml
├── charts
├── templates
│   ├── NOTES.txt
│   ├── _helpers.tpl
│   ├── hpa.yaml
│   ├── ingress.yaml
│   ├── job.yaml
│   ├── rbac.yaml
│   ├── service.yaml
│   ├── serviceaccount.yaml
│   └── tests
│       └── test-connection.yaml
└── values.yaml

volumes:
  - name: service-foundry-github-ssh
    secret:
      secretName: service-foundry-github-ssh
      optional: false
  - name: service-foundry-config-files
    secret:
      secretName: service-foundry-config-files
      optional: false

volumeMounts:
  - name: service-foundry-github-ssh
    mountPath: /opt/nsa2/github-ssh
    readOnly: true
  - name: service-foundry-config-files
    mountPath: /opt/nsa2/service-foundry/config-files
    readOnly: true


envFrom:
  - secretRef:
      name: aws-secret

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: service-foundry-builder-role
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: service-foundry-builder-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: service-foundry-builder-role
subjects:
  - kind: ServiceAccount
    name: service-foundry-builder
    namespace: {{ .Release.Namespace }}

#!/bin/bash
set -e

echo "======================================"
echo " Service Foundry Builder Started (v1.0)"
echo "======================================"

echo "🔧 Versions:"
echo "- kubectl: $(kubectl version --client || echo 'Not installed')"
echo "- helm: $(helm version --short || echo 'Not installed')"
echo "- terraform: $(terraform version | head -n 1 || echo 'Not installed')"
echo "- Node version: $(node --version || echo 'Not installed')"
echo "- npm version: $(npm --version || echo 'Not installed')"
echo "- yo (Yeoman): $(yo --version || echo 'Not installed')"
echo "- yq: $(yq --version || echo 'Not installed')"
echo "- jq: $(jq --version || echo 'Not installed')"
echo "- aws: $(aws --version || echo 'Not installed')"
echo "- az: $(az version | grep azure-cli || echo 'Not installed')"

echo ""
echo "Current directory: $(pwd)"
echo "Ready to run your commands!"

CWD=$(pwd)

if [ -n "$GENERATOR_NSA2_SSH_KEY_PATH" ]; then
  ./install-generator.sh
else
  echo "No SSH key provided. Skipping generator-nsa2 clone."
  exit 1
fi

echo "Service Foundry Config Files"
echo "======================================"
ls -l /opt/nsa2/service-foundry/config-files
echo "======================================"


# use infra-foundry-config.yaml
if [ -f /opt/nsa2/service-foundry/config-files/infra-foundry-config.yaml ]; then
  echo "Using /opt/nsa2/service-foundry/config-files/infra-foundry-config.yaml"

  mkdir -p "$CWD/workspace/infra"


  cp /opt/nsa2/service-foundry/config-files/infra-foundry-config.yaml "$CWD/workspace/infra/infra-foundry-config.yaml"

  cd "$CWD/workspace/infra"
  # run the generator
  echo "Running yo nsa2:infra-foundry generate --force"
  yo nsa2:infra-foundry generate --force

  echo "Running yo nsa2:infra-foundry build --force"
  yo nsa2:infra-foundry build --force

  echo "Running yo nsa2:infra-foundry deploy --force"
  yo nsa2:infra-foundry deploy --force

  ls -l "$CWD/workspace/infra"

  cd $CWD
else
  echo "No /opt/nsa2/service-foundry/config-files/infra-foundry-config.json found. Skipping infra-foundry generation."
fi

# use o11y-foundry-config.yaml
if [ -f /opt/nsa2/service-foundry/config-files/o11y-foundry-config.yaml ]; then
  echo "Using /opt/nsa2/service-foundry/config-files/o11y-foundry-config.yaml"

  mkdir -p "$CWD/workspace/o11y"
  cp /opt/nsa2/service-foundry/config-files/o11y-foundry-config.yaml "$CWD/workspace/o11y/o11y-foundry-config.yaml"
  cd "$CWD/workspace/o11y"
  # run the generator
  echo "Running yo nsa2:o11y-foundry generate --force"
  yo nsa2:o11y-foundry generate --force

  echo "Running yo nsa2:o11y-foundry build --force"
  yo nsa2:o11y-foundry build --force

  echo "Running yo nsa2:o11y-foundry deploy --force"
  yo nsa2:o11y-foundry deploy --force

  ls -l "$CWD/workspace/o11y"

  cd $CWD
else
  echo "No /opt/nsa2/service-foundry/config-files/o11y-foundry-config.yaml found. Skipping o11y-foundry generation."
fi

# if /opt/nsa2/service-foundry/config-files/sso-foundry-config.yaml exists, use it

if [ -f /opt/nsa2/service-foundry/config-files/sso-foundry-config.yaml ]; then
  echo "Using /opt/nsa2/service-foundry/config-files/sso-foundry-config.yaml"

  mkdir -p "$CWD/workspace/sso"
  cp /opt/nsa2/service-foundry/config-files/sso-foundry-config.yaml "$CWD/workspace/sso/sso-foundry-config.yaml"
  cd "$CWD/workspace/sso"
  # run the generator
  echo "Running yo nsa2:sso-foundry generate --force"
  yo nsa2:sso-foundry generate --force

  echo "Running yo nsa2:sso-foundry build --force"
  yo nsa2:sso-foundry build --force

  echo "Running yo nsa2:sso-foundry deploy --force"
  yo nsa2:sso-foundry deploy --force

  ls -l "$CWD/workspace/sso"

  cd $CWD
else
  echo "No /opt/nsa2/service-foundry/config-files/sso-foundry-config.yaml found. Skipping sso-foundry generation."
fi

echo "Service Foundry Builder completed successfully."

$ cd helm-charts
$ helm install service-foundry-builder ./service-foundry-builder \
  -n service-foundry --create-namespace

$ kubectl create namespace service-foundry

kubectl -n service-foundry create secret generic aws-secret \
  --from-literal=AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
  --from-literal=AWS_ACCOUNT_ID=$AWS_ACCOUNT_ID \
  --from-literal=AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \
  --from-literal=AWS_REGION=$AWS_REGION

$ cd ssh
$ kubectl -n service-foundry create secret generic service-foundry-github-ssh --from-file=./id_rsa --from-file=./id_rsa.pub

$ cd service-foundry-config
$ kubectl create secret generic service-foundry-config-files \
  --from-file=infra-foundry-config.yaml \
  --from-file=o11y-foundry-config.yaml \
  --from-file=sso-foundry-config.yaml \
  -n service-foundry

$ cd helm-charts
$ helm install service-foundry-builder ./service-foundry-builder \
  -n service-foundry --create-namespace