[LFXV2-2] Initial implementation of project service

[andrest50]

Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-2

This PR adds the initial codebase for the project service. The service has a REST API for performing CRUD operations on projects and also has an open NATS connection that is for listening to message subjects for getting a project name by ID and getting a project ID by slug. There are still missing pieces to the implementation, such as the use of heimdall for access control, but those can be added in further PRs.

--

This pull request introduces several key updates to the repository, including the addition of workflows for CI/CD, configuration for linter and license checks, and updates to licensing and ownership files. These changes aim to improve code quality, enforce licensing standards, and streamline development processes.

CI/CD Workflows

• Added a License Header Check workflow to validate license headers in pull requests. (.github/workflows/license-header-check.yml)
• Introduced a MegaLinter workflow to ensure code quality and enforce linting rules across the repository. (.github/workflows/mega-linter.yml)
• Added a Project API Build workflow for building, testing, and managing dependencies for the project API. (.github/workflows/project-api-build.yml)

Licensing and Ownership

• Added a LICENSE file with the MIT license for the repository. (LICENSE)
• Added a LICENSE-docs file for documentation under the Creative Commons Attribution 4.0 International License. (LICENSE-docs)
• Updated the CODEOWNERS file to assign ownership of the repository to the @linuxfoundation/lfx-platform team. (CODEOWNERS)

Configuration and Dockerization

• Added a .yamllint configuration file to enforce YAML style guidelines, including ignoring specific directories and setting a line-length warning. (.yamllint)
• Created a Dockerfile to build and run the project API service, including multi-stage builds with Chainguard images and cross-compilation support. (Dockerfile)

[emsearcy]

great work on the codebase. some comments on resources

[emsearcy]

please use Go flavor. Hash will be the same.

You can also remove any references to Vale and proselint as those won't be in the Go flavor.

[emsearcy]

Suggestion to use native Gateway API instead of Ingress Route CRD

[andrest50]

For this request, I am commenting a TODO in the code to make the change. I'll need to look more into it to get it configured properly, so for now I'll put it aside.

[jordane]

Created LFXV2-49 for this.

[emsearcy]

Suggestion: create a flag for enabling/disabling via the values file, so that the chart can be used standalone or as part of the umbrella chart. Even the inclusion of the ingress-route (or gateway API http route) could/should be configurable IMO

[emsearcy]

again, I'd wrap this entire resource in a values conditional

[emsearcy]

I'd also suggest making these configurable with defaults (or file a backlog ticket for this)

[bramwelt]

/livez and /readyz don't need to be routed to as they're used internally by Kubernetes.

[andrest50]

I'm not sure if it's for another reason, but whenever I removed the paths from here I was getting a 404. It worked when I re-added it. So we can address this later once we've figured that out.

[bramwelt]

The Traefik Gateway API provider utilizes HTTPRoute instead of Traefik's custom IngressRoute. Here's a example of what this might look like as an HTTPRoute

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: lfx-v2-project-service
  namespace: lfx
spec:
  parentRefs:
      # Name of the Gateway resource
    - name: {{ .Values.ingress.gateway.name }}
      # Note: using websecure not requires having SSL certificate setup and declaring 'certificateRefs' in the Gateway config
      sectionName: {{ .Values.ingress.gateway.section | default 'web' }}
      namespace: lfx
  hostnames:
    - '{{ .Values.ingress.hostname }}'
  rules:
    - match:
        - path:
           value: "/projects"
      {{- if .Values.heimdall.enabled }}
      filters:
        - type: ExtensionRef
          extensionRef:
            group: traefik.io
            kind: Middleware
            name: heimdall
      {{ - end }}
      backendRefs:
        - name: lfx-v2-project-service
          namespace: lfx
          port: 8080

I'd recommend this file be renamed to match the type as well: httproute.yaml

[andrest50]

Isn't a Gateway resource also needed? Please let me know once you made updates to https://github.com/linuxfoundation/lfx-v2-helm to support the Gateway API and then I can make the corresponding changes here.

[bramwelt]

Yes, I have the Gateway change up here: https://github.com/linuxfoundation/lfx-v2-helm/pull/11/files. I'd suggest updating values with something like:

traefik:
  ingressroute:
    enabled: true
    entrypoints:
      - web
      - websecure
  gateway:
    enabled: false
    entrypoint: web

and adding this example as an additional resource wrapped in a check for traefik.gateway.enabled.

[andrest50]

Thanks. I'll make note of this and then have the resource change implemented as part of a separate PR after this is merged.

[bramwelt]

I don't think this should be duplicating the heimdall config in lfx-v2-helm, just defining the required values needed:

heimdall:
  enabled: true
  url: http://heimdall:4456/

[andrest50]

I'll remove the heimdall config other than enabling the middleware and setting the URL. However, the LFX platform heimdall service from lfx-v2-helm is not working from my testing locally so I'm still using the PoC deployment of heimdall. I assume it will be working once https://linuxfoundation.atlassian.net/browse/LFXV2-13 is done? That's where I had gotten the configuration of, but it's true that I shouldn't have that in the individual service repo.

[prabodhcs]

Can we please run this in parallel? I mean, both (indexing and access) are independent. What do you think? We might extract them in a separate method and execute them in the go routine, as I see they are being used for create/update/delete.

[andrest50]

That's a good point. Both messages can be published in parallel and I can break up that code into its own function so its reused across all endpoints.

[prabodhcs]

Can we create a helper function for error response? what do you think?

[andrest50]

That seems like a good idea to me. I'll make a function that takes in the code and message, so with that I can reuse the function across all the endpoints.

[prabodhcs]

I think we can refactor the main function into small functions -- what do you think?

func parseFlagsAndEnv() (port, bind string, debug bool, lfxEnv constants.LFXEnvironment, natsURL string)
func setupHTTPServer(logger *slog.Logger, svc *ProjectsService) *http.Server
func setupNATS(ctx context.Context, logger *slog.Logger, svc *ProjectsService, wg *sync.WaitGroup) (*nats.Conn, error)
func gracefulShutdownHandler(httpServer *http.Server, natsConn *nats.Conn, wg *sync.WaitGroup, logger *slog.Logger)

[andrest50]

That's fine with me. I think that should make it easier to maintain since right now the main function is quite large.

[prabodhcs]

I think we will need this, as the indexer service needs to set the permission values and push the data to the open search. Below are logs from the indexer service. The end-to-end flow will not work.

{"time":"2025-07-22T17:49:04.541839+05:30","level":"ERROR","msg":"V2 header validation failed: missing authorization","component":"indexer","error":"authorization header is required for V2 transactions","transaction_id":"txn_project_created_1753186744541807000","validation_step":"authorization_header","has_auth_header":false}
{"time":"2025-07-22T17:49:04.541842+05:30","level":"ERROR","msg":"Transaction enrichment failed: header validation","component":"nats","request_id":"0af6b7dccf3dafcf","error":"authorization header is required for V2 transactions","transaction_id":"txn_project_created_1753186744541807000","step":"validate_headers"}
{"time":"2025-07-22T17:49:04.541852+05:30","level":"ERROR","msg":"Failed to enrich transaction","component":"nats","request_id":"0af6b7dccf3dafcf","error":"invalid transaction headers: authorization header is required for V2 transactions","transaction_id":"txn_project_created_1753186744541807000","step":"enrichment"}

[andrest50]

Yeah no problem. I'm not sure why it was commented, but I'll uncomment it and check your implementation to make sure I am passing the expected headers.

[jordane]

created LFXV2-49 for tracking TODO item.

[jordane]

Created LFXV2-49 for this.

Changes addressed, and other changes will be added in later PRs.