CONTNM-81: Add cluster-manager service

.github/workflows/build-module.yml

@@ -11,12 +11,15 @@ on:
           - all
           - continuum-api-server
           - continuum-avro-schemas
+          - continuum-cloud-gateway
           - continuum-commons
           - continuum-knime-base
           - continuum-message-bridge
           - continuum-worker-springboot-starter
           - continuum-gradle-plugin
           - continuum-orchestration-service
+          - continuum-cluster-manager
+          - landing-page
       publish_to_maven:
         description: 'Publish artifacts to Maven Central'
         required: true

.github/workflows/on-release.yml

@@ -31,12 +31,21 @@ jobs:
           - module: continuum-api-server
             publish_to_maven: false
             publish_to_docker_hub: true
+          - module: continuum-cloud-gateway
+            publish_to_maven: false
+            publish_to_docker_hub: true
           - module: continuum-orchestration-service
             publish_to_maven: false
             publish_to_docker_hub: true
           - module: continuum-message-bridge
             publish_to_maven: false
             publish_to_docker_hub: true
+          - module: continuum-cluster-manager
+            publish_to_maven: false
+            publish_to_docker_hub: true
+          - module: landing-page
+            publish_to_maven: false
+            publish_to_docker_hub: true
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

.gitignore

@@ -44,6 +44,7 @@ out/
 ### Node.js ###
 **/.turbo/
 **/node_modules/
+**/dist/
 **/continuum-workbench/lib/
 **/continuum-workbench-thin/lib/
 **/workflow-editor-extension/lib/

continuum-api-server/src/main/kotlin/org/projectcontinuum/core/api/server/config/OpenApiConfig.kt

@@ -0,0 +1,16 @@
+package org.projectcontinuum.core.api.server.config
+
+import io.swagger.v3.oas.models.servers.Server
+import org.springdoc.core.customizers.OpenApiCustomizer
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+
+@Configuration
+class OpenApiConfig {
+  @Bean
+  fun relativeServerCustomizer() = OpenApiCustomizer { openApi ->
+    // Use a relative server URL so Swagger UI resolves API calls correctly
+    // whether accessed directly or through the cloud-gateway reverse proxy.
+    openApi.servers = listOf(Server().apply { url = "../" })
+  }
+}

continuum-api-server/src/main/resources/application.yml

@@ -28,3 +28,8 @@ continuum.core:
         endpoint: ${CONTINUUM_MINIO_ENDPOINT:http://localhost:39000}
         access-key: ${CONTINUUM_MINIO_USERNAME:minioadmin}
         secret-key: ${CONTINUUM_MINIO_PASSWORD:minioadmin}
+
+springdoc:
+  swagger-ui:
+    config-url: ../v3/api-docs/swagger-config
+    url: ../v3/api-docs

continuum-cloud-gateway/build.gradle.kts

@@ -0,0 +1,75 @@
+plugins {
+  kotlin("jvm") version "2.1.0"
+  kotlin("plugin.spring") version "1.9.25"
+  id("org.springframework.boot") version "3.4.0"
+  id("io.spring.dependency-management") version "1.1.6"
+  id("com.google.cloud.tools.jib") version "3.4.1"
+}
+
+group = "org.projectcontinuum.core"
+description = "Continuum Cloud Gateway — reverse proxy for workbench instances, scalable independently"
+version = property("platformVersion").toString()
+
+java {
+  toolchain {
+    languageVersion = JavaLanguageVersion.of(21)
+  }
+}
+
+repositories {
+  mavenCentral()
+}
+
+dependencies {
+  implementation("org.springframework.boot:spring-boot-starter")
+  implementation("org.jetbrains.kotlin:kotlin-reflect")
+  implementation("org.springframework.boot:spring-boot-starter-web")
+  implementation("org.springframework.boot:spring-boot-starter-websocket")
+  implementation("org.springframework.boot:spring-boot-starter-actuator")
+
+  // JSON
+  implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
+
+  // Spring Cloud Gateway Server MVC (servlet-based reverse proxy)
+  implementation("org.springframework.cloud:spring-cloud-gateway-server-mvc")
+
+  // Database (read-only access to workbench_instances for endpoint resolution)
+  implementation("org.springframework.boot:spring-boot-starter-data-jdbc")
+  implementation("org.postgresql:postgresql")
+
+  // Test dependencies
+  testImplementation("org.springframework.boot:spring-boot-starter-test")
+  testImplementation("org.jetbrains.kotlin:kotlin-test-junit5")
+  testImplementation("com.h2database:h2")
+  testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+}
+
+dependencyManagement {
+  imports {
+    mavenBom("org.springframework.cloud:spring-cloud-dependencies:2024.0.1")
+  }
+}
+
+kotlin {
+  compilerOptions {
+    freeCompilerArgs.addAll("-Xjsr305=strict")
+  }
+}
+
+tasks.withType<Test> {
+  useJUnitPlatform()
+}
+
+jib {
+  from {
+    image = "eclipse-temurin:21-jre"
+  }
+
+  to {
+    image = "docker.io/projectcontinuum/${project.name.lowercase()}:${project.version}"
+    auth {
+      username = System.getenv("DOCKER_REPO_USERNAME") ?: ""
+      password = System.getenv("DOCKER_REPO_PASSWORD") ?: ""
+    }
+  }
+}

continuum-cloud-gateway/src/main/kotlin/org/projectcontinuum/core/cloud/gateway/App.kt

@@ -0,0 +1,11 @@
+package org.projectcontinuum.core.cloud.gateway
+
+import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.boot.runApplication
+
+@SpringBootApplication
+class App
+
+fun main(args: Array<String>) {
+  runApplication<App>(*args)
+}

continuum-cloud-gateway/src/main/kotlin/org/projectcontinuum/core/cloud/gateway/config/CorsConfig.kt

@@ -0,0 +1,21 @@
+package org.projectcontinuum.core.cloud.gateway.config
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.web.servlet.config.annotation.CorsRegistry
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer
+
+@Configuration
+class CorsConfig {
+  @Bean
+  fun corsConfigurer(): WebMvcConfigurer {
+    return object : WebMvcConfigurer {
+      override fun addCorsMappings(registry: CorsRegistry) {
+        registry.addMapping("/**")
+          .allowedOrigins("*")
+          .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
+          .allowedHeaders("*")
+      }
+    }
+  }
+}

continuum-cloud-gateway/src/main/kotlin/org/projectcontinuum/core/cloud/gateway/config/GatewayConfig.kt

@@ -0,0 +1,113 @@
+package org.projectcontinuum.core.cloud.gateway.config
+
+import jakarta.servlet.http.HttpServletRequest
+import org.slf4j.LoggerFactory
+import org.springframework.beans.factory.annotation.Value
+import org.springframework.cloud.gateway.server.mvc.handler.GatewayRouterFunctions.route
+import org.springframework.cloud.gateway.server.mvc.predicate.GatewayRequestPredicates.path
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.web.servlet.function.RouterFunction
+import org.springframework.web.servlet.function.ServerRequest
+import org.springframework.web.servlet.function.ServerResponse
+import java.net.URI
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.time.Duration
+
+// Spring Cloud Gateway Server MVC configuration.
+//
+// Uses a custom proxy handler instead of HandlerFunctions.http() to work around
+// a Spring Cloud Gateway Server MVC bug where percent-encoded query parameters
+// are decoded before proxying (e.g., %26 becomes &), which corrupts parameters
+// containing special characters like "Aggregation & Grouping".
+// See: https://github.com/spring-cloud/spring-cloud-gateway/issues/3082
+//
+// The custom proxy() function reads the raw URI and query string directly from the
+// servlet request (which preserves percent-encoding) and forwards them as-is to
+// the backend using Java's HttpClient.
+//
+// The dynamic workbench proxy routing (/workbench/{instanceName}/open)
+// is handled by WorkbenchProxyController and WorkbenchWebSocketProxyHandler.
+@Configuration
+class GatewayConfig(
+  @Value("\${CONTINUUM_API_SERVER_URL:http://localhost:8081}")
+  private val apiServerUrl: String,
+
+  @Value("\${CONTINUUM_CLUSTER_MANAGER_URL:http://localhost:8082}")
+  private val clusterManagerUrl: String,
+) {
+
+  private val logger = LoggerFactory.getLogger(GatewayConfig::class.java)
+
+  private val httpClient: HttpClient = HttpClient.newBuilder()
+    .version(HttpClient.Version.HTTP_1_1)
+    .connectTimeout(Duration.ofSeconds(30))
+    .followRedirects(HttpClient.Redirect.NEVER)
+    .build()
+
+  private val HOP_BY_HOP_HEADERS = setOf(
+    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
+    "te", "trailers", "transfer-encoding", "upgrade", "host", "content-length"
+  )
+
+  @Bean
+  fun apiServerRoute(): RouterFunction<ServerResponse> =
+    route("api-server")
+      .route(path("/api-server/**")) { request -> proxy(request, apiServerUrl, "/api-server") }
+      .build()
+
+  @Bean
+  fun clusterManagerRoute(): RouterFunction<ServerResponse> =
+    route("cluster-manager")
+      .route(path("/cluster-manager/**")) { request -> proxy(request, clusterManagerUrl, "/cluster-manager") }
+      .build()
+
+  private fun proxy(request: ServerRequest, backendUrl: String, prefixToStrip: String): ServerResponse {
+    val servletRequest: HttpServletRequest = request.servletRequest()
+
+    // Strip the prefix from the raw request URI to preserve percent-encoding
+    val rawUri = servletRequest.requestURI
+    val remainingPath = rawUri.removePrefix(prefixToStrip).ifEmpty { "/" }
+    val rawQuery = servletRequest.queryString?.let { "?$it" } ?: ""
+    val targetUrl = "$backendUrl$remainingPath$rawQuery"
+
+    logger.debug("Proxying {} {} -> {}", servletRequest.method, rawUri, targetUrl)
+
+    // Build the proxy request
+    val proxyBuilder = HttpRequest.newBuilder()
+      .uri(URI(targetUrl))
+      .timeout(Duration.ofMinutes(5))
+
+    // Forward headers
+    val headerNames = servletRequest.headerNames
+    while (headerNames.hasMoreElements()) {
+      val name = headerNames.nextElement()
+      if (name.lowercase() in HOP_BY_HOP_HEADERS) continue
+      val values = servletRequest.getHeaders(name)
+      while (values.hasMoreElements()) {
+        proxyBuilder.header(name, values.nextElement())
+      }
+    }
+
+    // Set method and body
+    val bodyPublisher = when (servletRequest.method.uppercase()) {
+      "GET", "HEAD", "OPTIONS", "TRACE" -> HttpRequest.BodyPublishers.noBody()
+      else -> HttpRequest.BodyPublishers.ofByteArray(servletRequest.inputStream.readAllBytes())
+    }
+    proxyBuilder.method(servletRequest.method.uppercase(), bodyPublisher)
+
+    // Execute
+    val proxyResponse = httpClient.send(proxyBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+
+    // Build the response
+    val responseBuilder = ServerResponse.status(proxyResponse.statusCode())
+    proxyResponse.headers().map().forEach { (name, values) ->
+      if (name.lowercase() !in HOP_BY_HOP_HEADERS) {
+        values.forEach { value -> responseBuilder.header(name, value) }
+      }
+    }
+    return responseBuilder.body(proxyResponse.body())
+  }
+}

continuum-cloud-gateway/src/main/kotlin/org/projectcontinuum/core/cloud/gateway/config/WebSocketProxyConfig.kt

@@ -0,0 +1,20 @@
+package org.projectcontinuum.core.cloud.gateway.config
+
+import org.projectcontinuum.core.cloud.gateway.service.WorkbenchWebSocketProxyHandler
+import org.springframework.context.annotation.Configuration
+import org.springframework.web.socket.config.annotation.EnableWebSocket
+import org.springframework.web.socket.config.annotation.WebSocketConfigurer
+import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry
+
+@Configuration
+@EnableWebSocket
+class WebSocketProxyConfig(
+  private val webSocketProxyHandler: WorkbenchWebSocketProxyHandler
+) : WebSocketConfigurer {
+
+  override fun registerWebSocketHandlers(registry: WebSocketHandlerRegistry) {
+    registry
+      .addHandler(webSocketProxyHandler, "/workbench/*/open/**")
+      .setAllowedOrigins("*")
+  }
+}

continuum-cloud-gateway/src/main/kotlin/org/projectcontinuum/core/cloud/gateway/controller/WorkbenchProxyController.kt

@@ -0,0 +1,37 @@
+package org.projectcontinuum.core.cloud.gateway.controller
+
+import jakarta.servlet.http.HttpServletRequest
+import jakarta.servlet.http.HttpServletResponse
+import org.projectcontinuum.core.cloud.gateway.service.WorkbenchProxyService
+import org.slf4j.LoggerFactory
+import org.springframework.web.bind.annotation.*
+
+// Reverse proxy controller that routes requests from
+// /workbench/{instanceName}/open to the actual workbench service endpoint.
+//
+// This controller:
+// - Resolves the workbench instance's K8s service endpoint from the database
+// - Validates the requesting user owns the workbench instance
+// - Proxies HTTP requests (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS)
+// - Strips the /workbench/{instanceName}/open prefix from the path
+//
+// WebSocket connections are handled separately by WorkbenchWebSocketProxyHandler.
+@RestController
+@RequestMapping("/workbench/{instanceName}/open")
+class WorkbenchProxyController(
+  private val workbenchProxyService: WorkbenchProxyService
+) {
+
+  private val logger = LoggerFactory.getLogger(WorkbenchProxyController::class.java)
+
+  // Catch-all handler for all HTTP methods on /workbench/{instanceName}/open
+  @RequestMapping(value = ["", "/**"])
+  fun proxyRequest(
+    @PathVariable instanceName: String,
+    @RequestHeader("x-continuum-user-id", required = false, defaultValue = "anonymous") userId: String,
+    request: HttpServletRequest,
+    response: HttpServletResponse
+  ) {
+    workbenchProxyService.proxyRequest(instanceName, userId, request, response)
+  }
+}