openmcp-project · wchomik · Apr 11, 2025 · Apr 11, 2025 · Apr 14, 2025 · Apr 14, 2025
diff --git a/.github/workflows/git-pr-status-checks.yml b/.github/workflows/git-pr-status-checks.yml
@@ -4,7 +4,7 @@ on:
   workflow_call: {}
 
 concurrency:
-  group: building-blocks-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:

diff --git a/.github/workflows/git-release-create.yml b/.github/workflows/git-release-create.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   git-release-create:
     name: Helm Chart Release Tag
-    runs-on: [solinas]
+    runs-on: ubuntu-latest
     steps:
       - name: Login to GitHub Enterprise with token
         run: |

diff --git a/.github/workflows/git-tag-modified-helm-chart.yml b/.github/workflows/git-tag-modified-helm-chart.yml
@@ -10,6 +10,6 @@ permissions:
 jobs:
   git-tag-modified-helm-chart:
     name: Tag modified Helm Chart
-    runs-on: [solinas]    
+    runs-on: ubuntu-latest    
     steps:
     - uses: openmcp-project/blueprint-building-blocks/.github/actions/git-tag-modified-helm-chart@main      
diff --git a/.github/workflows/gh-pages-release.yml → ...rkflows/helm-charts-release-to-gh-oci.yml b/.github/workflows/gh-pages-release.yml → ...rkflows/helm-charts-release-to-gh-oci.yml
@@ -1,9 +1,8 @@
 name: Release Charts
 
 on:
-  push:
-    branches:
-      - main
+  workflow_call: {}
+  workflow_dispatch: {}
 
 jobs:
   release:
@@ -27,6 +26,7 @@ jobs:
         with:
           charts_dir: helm/charts
         env:
+          CR_GENERATE_RELEASE_NOTES: true
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Upload to OCI-based registry

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,12 +17,13 @@ jobs:
     secrets: inherit
   release:
     name: Release
-    runs-on: [solinas]    
+    runs-on: ubuntu-latest    
     permissions:
       contents: write # to be able to publish a GitHub release
       issues: write # to be able to comment on released issues
       pull-requests: write # to be able to comment on released pull requests
       id-token: write # to enable use of OIDC for npm provenance
+      packages: write # to be able to publish a GitHub Packages
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -47,7 +48,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.CO_GOLDEN_PATH_SERVICEUSER_GH_TOKEN }}
         run: npx semantic-release
   git-release-create:    
-    uses: "openmcp-project/blueprint-building-blocks/.github/workflows/git-release-create.yml@main"
+    uses: "openmcp-project/blueprint-building-blocks/.github/workflows/gh-pages-release.yml@main"
     name: Helm Chart Github Releases
     needs: release
     secrets: inherit    

diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml
@@ -23,9 +23,17 @@ env:
   MESSAGE_HEADER: "Shell Check"
   MESSAGE: ""
 
+permissions:
+  pull-requests: write
+  contents: write
+  packages: read
+  actions: write
+  checks: write
+  statuses: write
+
 jobs:
   shellcheck:
-    runs-on: [solinas]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4

diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml
@@ -7,7 +7,7 @@ on:
   # Triggers the workflow on push or pull request events but only for the "main" branch
   pull_request:
     branches:
-      - "main-not-activated-yet"
+      - "main-branch-not-activated-yet"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -22,7 +22,7 @@ env:
 
 jobs:
   yamllint:
-    runs-on: [solinas]    
+    runs-on: ubuntu-latest    
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
@@ -117,4 +117,4 @@ jobs:
           echo "::group:: human readable validation result"
           echo -e "${{ env.MESSAGE }}"
           echo "::endgroup::"
-          exit 1
+          exit 1
diff --git a/.gitignore b/.gitignore
@@ -36,5 +36,4 @@ bin/
 ### Mac OS ###
 .DS_Store
 /.idea/
-/ketos-co-helm-charts.iml
 **/*/values-credentials.yaml
diff --git a/.reuse/dep5 b/.reuse/dep5
@@ -0,0 +1,29 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: blueprint-building-blocks
+Upstream-Contact: [email protected]
+Source: https://github.com/openmcp-project/blueprint-building-blocks
+Disclaimer: The code in this project may include calls to APIs ("API Calls") of
+ SAP or third-party products or services developed outside of this project
+ ("External Products").
+ "APIs" means application programming interfaces, as well as their respective
+ specifications and implementing code that allows software to communicate with
+ other software.
+ API Calls to External Products are not licensed under the open source license
+ that governs this project. The use of such API Calls and related External
+ Products are subject to applicable additional agreements with the relevant
+ provider of the External Products. In no event shall the open source license
+ that governs this project grant any rights in or to any External Products,or
+ alter, expand or supersede any terms of the applicable additional agreements.
+ If you have a valid license agreement with SAP for the use of a particular SAP
+ External Product, then you may make use of any API Calls included in this
+ project's code for that SAP External Product, subject to the terms of such
+ license agreement. If you do not have a valid license agreement for the use of
+ a particular SAP External Product, then you may only make use of any API Calls
+ in this project for that SAP External Product for your internal, non-productive
+ and non-commercial test and evaluation of such API Calls. Nothing herein grants
+ you any rights to use or access any SAP External Product, or provide any third
+ parties the right to use of access any SAP External Product, through API Calls.
+
+Files: *
+Copyright:  2025 SAP SE or an SAP affiliate company and blueprint-building-blocks contributors
+License: Apache-2.0
diff --git a/README.md b/README.md
@@ -4,11 +4,139 @@
 
 ## About this project
 
-Helm chart building blocks for Cloud Orchestrator MCP Blueprints
+This repositry contains [sub helm charts](https://helm.sh/docs/chart_template_guide/subcharts_and_globals/) of the [OpenMCP](https://github.com/openmcp-project) which are the building blocks for the OpenMCP Blueprints. To start your [Infrastructure as Data]() Cloud Journey with the OpenMCP Blueprint, visit this [repository](https://github.com/openmcp-project/blueprints) and follow `Getting Started` section.
 
 ## Requirements and Setup
 
-*Insert a short description what is required to get your project running...*
+### Helm Charts
+[Helm Charts](http://helm.sh) located at [`./helm/charts`](./helm/charts) are build with various purpose in mind. Please consult `README.md` file of each Helm Chart to discover its purpose, `values.yaml` structure and intended puropse.
+
+### Continous Delivery
+All [Helm Charts](http://helm.sh) located in this repository will be [automatically versioned](https://github.com/openmcp-project/blueprint-workflows/tree/main/.github/actions/helm-chart/version-bump) and [pushed](.github/workflows/gh-pages-release.yml) into [Projects OCI registry](https://github.com/orgs/openmcp-project/packages?repo_name=blueprint-building-blocks) and Helm Repositry [cloud-orchestrator-mcp-blueprint-building-blocks](https://openmcp-project.github.io/blueprint-building-blocks).
+
+
+### [Github Workflows](#github-workflows)
+#### [`PR Status Checks`](#github-workflow-git-pr-status-checks)
+More details see Github Workflow [`.github/workflows/git-pr-status-checks.yml`](https://github.com/openmcp-project/blueprint-workflows/tree/main/.github/workflows/git-pr-status-checks.yml) of [blueprint-workflows](https://github.com/openmcp-project/blueprint-workflows/tree/main/)
+
+#### [`.ci.config.yaml`](#github-workflow-ci-config-yaml)
+
+File `chart-abc/.ci.config.yaml` is optional for every Helm Chart and influences execution of [`.github/workflows/git-pr-status-checks.yml`](.github/workflows/git-pr-status-checks.yml).
+
+You can enable or disable processing of certain Github Workflows for certain Helm Charts via [`.ci.config.yaml`](helm/charts/test-custom-chart/.ci.config.yaml)!
+
+```yaml  
+helm-chart-dependency-update: 
+  enable: true # default is true, even if you do NOT declare this in .ci.config.yaml!
+helm-chart-linting:
+  enable: true # default is true, even if you do NOT declare this in .ci.config.yaml!
+  options:
+    --strict: true # fail on lint warnings (default true)
+    --with-subcharts: false # lint dependent charts (default false)
+helm-chart-validation:
+  enable: true # default is true, even if you do NOT declare this in .ci.config.yaml!
+  options:
+    --skip-crds: false # if set true, no CRDs will be templated. By default, CRDs are templated (default false)
+    --skip-tests: false # skip tests from templated output (default false)
+    --include-crds: false # include CRDs in the templated output (default false)
+    --debug: false # enable verbose output (default false)
+    --dependency-update: true # update dependencies if they are missing before installing the chart (default true)
+helm-docs:
+  enable: true # default is true, even if you do NOT declare this in .ci.config.yaml!
+  options:
+    --badge-style: "flat-square" # badge style to use for charts (default "flat-square")
+    --document-dependency-values: true # For charts with dependencies, include the dependency values in the chart values documentation
+    --documentation-strict-mode: false # Fail the generation of docs if there are undocumented values
+    --skip-version-footer: false # if true the helm-docs version footer will not be shown in the default README template
+    --sort-values-order: "file" # order in which to sort the values table ("alphanum" or "file") (default "alphanum")
+    --output-file: "README.md" #  markdown file path relative to each chart directory to which rendered documentation will be written (default "README.md")
+helm-chart-version-bump:
+  enable: true # default is true, even if you do NOT declare this in .ci.config.yaml!
+k8s-manifest-templating:
+  enable: true # default is true, even if you do NOT declare this in .ci.config.yaml!
+  options:
+    --skip-crds: false # if set true, no CRDs will be templated. By default, CRDs are templated (default false)
+```
+
+:bangbang: It is **HIGHLY** recommended **NOT** to `enabled: false`for `helm-chart-linting-manifest-validation.sh` :bangbang:
+
+### [Deletion Dependency Graph](#helm-chart-dependencies-deletion-dependency-graph)
+:bangbang: **DO NOT DELETE** / **DISABLE** your [Umbrella Helm Chart](https://github.com/openmcp-project/blueprints) Dependencies all at ONCE :bangbang:
+If you want to clean-up / deprovision / delete SAP & Hyperscaler Resources, you need to follow a certain order!
+
+We recommend to delete / disable the Helm Chart Dependencies in the following order: *read from right to left*
+```
+flux-config
+└── crossplane-provider-pkgs
+    └── external-secrets-config
+        ├── crossplane-provider-configs
+        └── crossplane-provider-apiextensions-composition
+            ├── crossplane-gardener-shoot-clusters
+            │   ├── crossplane-provider-helm
+            │   └── crossplane-provider-kubernetes
+            ├── crossplane-gardener-shoot-kubeconfigs
+            │   ├── crossplane-provider-helm
+            │   └── crossplane-provider-kubernetes
+            ├── crossplane-provider-aws-*
+            ├── crossplane-provider-btp-accounts
+            └── crossplane-provider-dynatrace
+```
+E.g.: The `flux-config` dependency shall be deleted / disabled as last. 
+
+#### Example
+Lets have a look at the [`Chart.yaml`](https://github.com/openmcp-project/blueprints/blob/main/helm/umbrella/blueprints/provider-gardener.abc.shoot.live.k8s-hana.ondemand.com/Chart.yaml) of the template [`provider-gardener.abc.shoot.live.k8s-hana.ondemand.com`](https://github.com/openmcp-project/blueprints/blob/main/helm/umbrella/blueprints/provider-gardener.abc.shoot.live.k8s-hana.ondemand.com).
+
+```yaml
+dependencies:
+  - name: crossplane-provider-configs
+    alias: crossplane-provider-configs
+    version: ....
+    repository: "oci://ghcr.io/openmcp-project"
+    tags:
+      - crossplane-provider-configs
+  - name: external-secrets-config
+    alias: external-secrets-config
+    version: ...
+    repository: "oci://ghcr.io/openmcp-project"
+    tags:
+      - external-secrets-config
+  - name: crossplane-gardener-shoot-clusters
+    alias: crossplane-gardener-shoot-clusters
+    version: ...
+    repository: "oci://ghcr.io/openmcp-project"
+    tags:
+      - crossplane-gardener-shoot-clusters
+  - name: crossplane-provider-helm
+    alias: crossplane-provider-helm
+    version: ...
+    repository: "oci://ghcr.io/openmcp-project"
+    tags:
+      - crossplane-provider-helm
+```
+
+```yaml
+# values.yaml
+tags:
+  external-secrets-config: true
+  crossplane-provider-configs: true
+  crossplane-gardener-shoot-clusters: true
+  crossplane-provider-helm: true
+```
+According to the `Deletion Dependency Graph` section, the order of **deletion / disabling** the Helm Chart dependency is:
+1. crossplane-provider-helm
+2. crossplane-gardener-shoot-clusters
+3. crossplane-provider-configs
+4. external-secrets-config
+
+**Why in this order**?
+1. crossplane-provider-helm
+> This Helm Chart is used to orchestrate the k8s stack on your Gardener / Kyma Cluster.
+2. crossplane-gardener-shoot-clusters
+> This Helm Chart is used to orchestrate Gardener Shoot Clusters.
+3. crossplane-provider-configs
+> This Helm Chart is used to create `crossplane` k8s manifests `kind: ProviderConfig` (e.g. `apiVersion: account.btp.sap.crossplane.io/v1alpha1`) for `crossplane providers` in order to orchestrate (cloud) service providers (e.g. BTP Accounts)
+4. external-secrets-config
+> This Helm Chart is used to establish a connection to SAP HashiCorp Vault in order to pull/push credentials of (cloud) service providers.
 
 ## Support, Feedback, Contributing
 

diff --git a/REUSE.toml b/REUSE.toml
diff --git a/helm/charts/mcp/crossplane-gardener-core-cloud/Chart.yaml b/helm/charts/mcp/crossplane-gardener-core-cloud/Chart.yaml
@@ -16,7 +16,7 @@ icon: "https://gardener.cloud/images/lp/gardener-logo.svg"
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.0.2
+version: 0.0.3
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
@@ -25,4 +25,4 @@ appVersion: "0.1.0"
 home: "https://gardener.cloud/docs/gardener/api-reference/core/#core.gardener.cloud/v1beta1"
 # A list of URLs to source code for this project (optional)
 sources:
-  - https://github.com/openmcp-project/blueprint-building-blocks
+  - https://github.com/openmcp-project/blueprint-building-blocks
diff --git a/helm/charts/mcp/crossplane-gardener-core-cloud/README.md b/helm/charts/mcp/crossplane-gardener-core-cloud/README.md
@@ -2,12 +2,15 @@
 
 # crossplane-gardener-core-cloud
 
-![Version: 0.0.2](https://img.shields.io/badge/Version-0.0.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
+![Version: 0.0.3](https://img.shields.io/badge/Version-0.0.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
 
 A Helm chart to template crossplane manifests to manage core.gardener.cloud resources.
 
 **Homepage:** <https://gardener.cloud/docs/gardener/api-reference/core/#core.gardener.cloud/v1beta1>
 
+## Source Code
+
+* <https://github.com/openmcp-project/blueprint-building-blocks>
 
 ## Values
 
@@ -18,7 +21,7 @@ A Helm chart to template crossplane manifests to manage core.gardener.cloud reso
 | secretBindings[0].kubernetesCrossplaneProviderConfigRefName | string | `""` | kubernetesCrossplaneProviderConfigRefName needs to match crossplane provider configuration reference name (identifier) of SAP garden cluster control plane! (.shootClusters[*].kubernetesCrossplaneProviderConfigRefName) |
 | secretBindings[0].labels | list | `[]` | [labels](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#objectmeta-v1-meta) Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels |
 | secretBindings[0].name | string | `""` | name defines technical gardener shoot cluster. Max length 15 and must only be lowercase letters, numbers and hyphens! |
-| secretBindings[0].projectNamespace | string | `""` | gardener project name. Starts with "garden..." e.g. "garden-aas-dt" |
+| secretBindings[0].projectnamespace | string | `"ns1"` | gardener project name. Starts with "garden..." e.g. "garden-aas-dt" |
 | secretBindings[0].quotas | object | `{}` | *(Optional)* [quotas](https://gardener.cloud/docs/gardener/api-reference/core/#core.gardener.cloud/v1beta1.SecretBinding)  is a list of references to Quota objects in the same or another namespace. This field is immutable. |
 | secretBindings[0].secretBindingName | string | `""` | secretBindingName defines the technical name of [infrastructure secret](https://gardener.cloud/docs/gardener/development/secrets_management/) binding on gardener control plane cluster. e.g. [Secrets of AAS-DT](https://dashboard.garden.canary.k8s.ondemand.com/namespace/garden-aas-dt/secrets) |
 | secretBindings[0].secretRef | list | `[]` | [secretRef](https://gardener.cloud/docs/gardener/api-reference/core/#core.gardener.cloud/v1beta1.SecretBinding) is a reference to a secret object in the same or another namespace. This field is immutable. |

diff --git a/helm/charts/mcp/crossplane-gardener-core-cloud/values.yaml b/helm/charts/mcp/crossplane-gardener-core-cloud/values.yaml
@@ -6,7 +6,7 @@ secretBindings:
   # secretBindings[0].name -- name defines technical gardener shoot cluster. Max length 15 and must only be lowercase letters, numbers and hyphens!
   - name: ""
     # -- gardener project name. Starts with "garden..." e.g. "garden-aas-dt"
-    projectNamespace: ""
+    projectnamespace: "ns1"
     # -- kubernetesCrossplaneProviderConfigRefName needs to match crossplane provider configuration reference name (identifier) of SAP garden cluster control plane! (.shootClusters[*].kubernetesCrossplaneProviderConfigRefName)
     kubernetesCrossplaneProviderConfigRefName: ""
     # -- secretBindingName defines the technical name of [infrastructure secret](https://gardener.cloud/docs/gardener/development/secrets_management/) binding on gardener control plane cluster. e.g. [Secrets of AAS-DT](https://dashboard.garden.canary.k8s.ondemand.com/namespace/garden-aas-dt/secrets)