From 67595844c8073453dcd5ef5181afeb572f28edc9 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 3 Jul 2026 11:37:41 +0200 Subject: [PATCH] feat(repositories): declare the devantler-tech/aws config-tenant repo Declares the net-new aws repo (Repository CR, maintainers TeamRepository grant, IssueLabels) so the platform's aws tenant (platform#2325) has a declared home for its Crossplane managed resources. The provider's create 422s on the org's required custom properties, so the repo needs the documented one-time admin bootstrap before this CR adopts it. Co-Authored-By: Claude Fable 5 --- deploy/labels/aws.yaml | 22 +++++++++++++ deploy/labels/kustomization.yaml | 1 + deploy/repositories/aws.yaml | 31 +++++++++++++++++++ deploy/repositories/kustomization.yaml | 1 + .../grant-maintainers-on-aws.yaml | 16 ++++++++++ deploy/team-repositories/kustomization.yaml | 1 + 6 files changed, 72 insertions(+) create mode 100644 deploy/labels/aws.yaml create mode 100644 deploy/repositories/aws.yaml create mode 100644 deploy/team-repositories/grant-maintainers-on-aws.yaml diff --git a/deploy/labels/aws.yaml b/deploy/labels/aws.yaml new file mode 100644 index 0000000..ebe30d4 --- /dev/null +++ b/deploy/labels/aws.yaml @@ -0,0 +1,22 @@ +# Issue labels for devantler-tech/aws. The canonical org taxonomy (22 labels) +# is appended to every IssueLabels by the shared patch in kustomization.yaml; this +# file adds only aws's repo-specific extras. See ../README.md. +apiVersion: repo.github.m.upbound.io/v1alpha1 +kind: IssueLabels +metadata: + name: aws + annotations: + crossplane.io/external-name: aws +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: aws + # No repo-specific extras; the shared patch supplies the full canonical set. + label: [] + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/labels/kustomization.yaml b/deploy/labels/kustomization.yaml index cdc70e8..dedde20 100644 --- a/deploy/labels/kustomization.yaml +++ b/deploy/labels/kustomization.yaml @@ -30,6 +30,7 @@ resources: - agent-plugins.yaml - provider-upjet-unifi.yaml - unifi.yaml + - aws.yaml - gitops-tenant-template.yaml - platform-template.yaml - go-template.yaml diff --git a/deploy/repositories/aws.yaml b/deploy/repositories/aws.yaml new file mode 100644 index 0000000..a3ec670 --- /dev/null +++ b/deploy/repositories/aws.yaml @@ -0,0 +1,31 @@ +apiVersion: repo.github.m.upbound.io/v1alpha1 +kind: Repository +metadata: + name: aws + annotations: + # NET-NEW repo (not an adoption). The provider's create POST cannot send the + # org's 5 required custom properties (no CRD field), so it 422s until the + # repo is bootstrapped ONCE by an org admin with `gh api -X POST + # /orgs/devantler-tech/repos` including `custom_properties` (Type= + # Infrastructure + the 4 defaults) — see platform#2325. This CR then + # observes + adopts it and manages it declaratively from there on. + # external-name pinned so the create/observe target is unambiguous. + crossplane.io/external-name: aws +spec: + # Same all-except-Delete policy as every other managed repo (omitting Delete + # guarantees Crossplane can never delete a real GitHub repository). + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + name: aws + description: "Declarative AWS infrastructure for the devantler-tech platform — Crossplane managed resources in deploy/, published as a cosign-signed OCI artifact and reconciled by the platform's aws tenant." + visibility: public + hasIssues: true + # Shared kustomization patch supplies the squash-only merge policy + + # webCommitSignoffRequired; nothing repo-specific needed here. + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repositories/kustomization.yaml b/deploy/repositories/kustomization.yaml index f605fbc..0a8169e 100644 --- a/deploy/repositories/kustomization.yaml +++ b/deploy/repositories/kustomization.yaml @@ -16,6 +16,7 @@ resources: - agent-plugins.yaml - provider-upjet-unifi.yaml - unifi.yaml + - aws.yaml - gitops-tenant-template.yaml - platform-template.yaml - go-template.yaml diff --git a/deploy/team-repositories/grant-maintainers-on-aws.yaml b/deploy/team-repositories/grant-maintainers-on-aws.yaml new file mode 100644 index 0000000..9d4bca9 --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-aws.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant does not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-aws +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: aws + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/kustomization.yaml b/deploy/team-repositories/kustomization.yaml index 25575c8..96eaae6 100644 --- a/deploy/team-repositories/kustomization.yaml +++ b/deploy/team-repositories/kustomization.yaml @@ -20,3 +20,4 @@ resources: - grant-maintainers-on-unifi.yaml - grant-maintainers-on-homebrew-tap.yaml - grant-maintainers-on-provider-upjet-unifi.yaml + - grant-maintainers-on-aws.yaml