Cartographer Supply Chains

Warning The Cartographer upstream project is not actively developed anymore. As a consequence, this package has been archived. Check out the https://github.com/kadras-io/supply-chains package from the Kadras Engineering Platform as an alternative.

A Carvel package configuring a set of reusable supply chains, templates and pipelines to provide Kubernetes-native paved paths to production using Cartographer.

It handles several activities like source code watching, testing, building, scanning, configuring, delivering, and deploying.

🚀  Getting Started

Prerequisites

• Kubernetes 1.27+

• Carvel kctrl CLI.

• Carvel kapp-controller deployed in your Kubernetes cluster. You can install it with Carvel kapp (recommended choice) or kubectl.

  kapp deploy -a kapp-controller -y \
    -f https://github.com/carvel-dev/kapp-controller/releases/latest/download/release.yml

Dependencies

Cartographer Supply Chains requires the Cartographer and Tekton Pipelines packages. You can install them from the Kadras package repository.

Installation

Add the Kadras package repository to your Kubernetes cluster:

kctrl package repository add -r kadras-packages \
  --url ghcr.io/kadras-io/kadras-packages \
  -n kadras-packages --create-namespace

Installation without package repository

The recommended way of installing the Cartographer Supply Chains package is via the Kadras package repository. If you prefer not using the repository, you can add the package definition directly using kapp or kubectl.

kubectl create namespace kadras-packages
kapp deploy -a cartographer-supply-chains-package -n kadras-packages -y \
  -f https://github.com/kadras-io/cartographer-supply-chains/releases/latest/download/metadata.yml \
  -f https://github.com/kadras-io/cartographer-supply-chains/releases/latest/download/package.yml

Install the Cartographer Supply Chains package:

kctrl package install -i cartographer-supply-chains \
  -p cartographer-supply-chains.packages.kadras.io \
  -v ${VERSION} \
  -n kadras-packages

Note You can find the ${VERSION} value by retrieving the list of package versions available in the Kadras package repository installed on your cluster.

kctrl package available list -p cartographer-supply-chains.packages.kadras.io -n kadras-packages

Verify the installed packages and their status:

kctrl package installed list -n kadras-packages

📙  Documentation

Documentation, tutorials and examples for this package are available in the docs folder. For documentation specific to Cartographer, check out cartographer.sh.

🎯  Configuration

The Cartographer Supply Chains package can be customized via a values.yml file.

registry:
  server: ghcr.io
  repository: thomasvitale/carto

Reference the values.yml file from the kctrl command when installing or upgrading the package.

kctrl package install -i cartographer-supply-chains \
  -p cartographer-supply-chains.packages.kadras.io \
  -v ${VERSION} \
  -n kadras-packages \
  --values-file values.yml

Values

The Cartographer Supply Chains package has the following configurable properties.

Configurable properties

Config	Default	Description
supply_chain	basic	The type of supply chains to deploy. Options: basic, advanced.
service_account	supply-chain	The default ServiceAccount used by the supply chain.
ca_cert_data	""	PEM-encoded certificate data to trust TLS connections with a custom CA.
cluster_builder	default	The default ClusterBuilder used by kpack.
external_delivery	false	Whether the application should delivered and deployed automatically on the current Kubernetes cluster or manually to an external cluster.
git_credentials_secret	""	The Secret containing authentication credentials for Git repositories.
registry_credentials_secret	""	The Secret containing authentication credentials for the OCI registry.
registry.server	""	The server of the OCI Registry where the supply chain will publish and consume OCI images.
registry.repository	""	The repository in the OCI Registry where the supply chain will publish and consume OCI images.
excluded_blueprints	[]	A list of blueprints (supply chains or templates) to esclude from being created in the cluster.

Settings for using a GitOps strategy with the supply chains.

Config	Default	Description
gitops.strategy	none	Whether to commit configuration changes to Git directly (direct) or via a pull request (pull_request). If none, no GitOps strategy is applied.
gitops.user.name	cartographer	The name of the user interacting with the Git repository.
gitops.user.email	cartographer@kadras.io	The email of the user interacting with the Git repository.
gitops.commit.message	Update from Cartographer	The commit message to use when pushing configuration changes to Git.
gitops.server_address	https://github.com	The location of the server hosting the specified Git repository.
gitops.target_branch	main	The target branch where to push configuration changes.
gitops.repository.owner	""	The owner of the Git repository.
gitops.repository.name	""	The name of the Git repository.
gitops.pull_request.server_kind	github	The type of Git server where to open the pull request.
gitops.pull_request.commit_branch	""	The branch to use to open a pull request. If empty, a random name is generated.
gitops.pull_request.title	Update from Cartographer	The title of the pull request.
gitops.pull_request.body	Generated from Cartographer	The message body of the pull request.

🛡️  Security

The security process for reporting vulnerabilities is described in SECURITY.md.

🖊️  License

This project is licensed under the Apache License 2.0. See LICENSE for more information.

🙏  Acknowledgments

This package is inspired by:

• the original cartographer-catalog package used in Tanzu Community Edition before its retirement;
• the set of supply chains developed by Scott Rosenberg in an example of Tanzu Application Platform OSS stack;
• the set of supply chains included in the playground for Tanzu Application Platform.