feat: implentation to use a preinstalled cluster issuer to create a certificate

examples/application_monitoring_with_tenant/src/main.rs

@@ -27,7 +27,6 @@ async fn main() {
     };
     let application = Arc::new(RustWebapp {
         name: "example-monitoring".to_string(),
-        dns: "example-monitoring.harmony.mcd".to_string(),
         project_root: PathBuf::from("./examples/rust/webapp"),
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/rhob_application_monitoring/src/main.rs

@@ -16,7 +16,6 @@ use harmony_types::net::Url;
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "test-rhob-monitoring".to_string(),
-        dns: "test-rhob-monitoring.harmony.mcd".to_string(),
         project_root: PathBuf::from("./webapp"), // Relative from 'harmony-path' param
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/rust/src/main.rs

@@ -19,7 +19,6 @@ use harmony_macros::hurl;
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "harmony-example-rust-webapp".to_string(),
-        dns: "harmony-example-rust-webapp.harmony.mcd".to_string(),
         project_root: PathBuf::from("./webapp"),
         framework: Some(RustWebFramework::Leptos),
         service_port: 3000,

examples/try_rust_webapp/files_to_add/main.rs

@@ -2,11 +2,12 @@ use harmony::{
     inventory::Inventory,
     modules::{
         application::{
-            features::{rhob_monitoring::Monitoring, PackagingDeployment}, ApplicationScore, RustWebFramework, RustWebapp
+            ApplicationScore, RustWebFramework, RustWebapp,
+            features::{PackagingDeployment, rhob_monitoring::Monitoring},
         },
         monitoring::alert_channel::discord_alert_channel::DiscordWebhook,
     },
-    topology::{K8sAnywhereTopology, LocalhostTopology},
+    topology::K8sAnywhereTopology,
 };
 use harmony_macros::hurl;
 use std::{path::PathBuf, sync::Arc};
@@ -21,8 +22,8 @@ async fn main() {
     });
 
     let discord_webhook = DiscordWebhook {
-        name: "harmony-demo".to_string(),
-        url: hurl!("https://discord.com/api/webhooks/1415391405681021050/V6KzV41vQ7yvbn7BchejRu9C8OANxy0i2ESZOz2nvCxG8xAY3-2i3s5MS38k568JKTzH"),
+        name: "harmony_demo".to_string(),
+        url: hurl!("http://not_a_url.com"),
     };
 
     let app = ApplicationScore {

examples/try_rust_webapp/src/main.rs

@@ -16,7 +16,6 @@ use std::{path::PathBuf, sync::Arc};
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "harmony-example-tryrust".to_string(),
-        dns: "tryrust.example.harmony.mcd".to_string(),
         project_root: PathBuf::from("./tryrust.org"), // <== Project root, in this case it is a
         // submodule
         framework: Some(RustWebFramework::Leptos),

harmony/src/domain/interpret/mod.rs

@@ -194,3 +194,11 @@ impl From<String> for InterpretError {
         }
     }
 }
+
+impl From<serde_yaml::Error> for InterpretError {
+    fn from(value: serde_yaml::Error) -> Self {
+        Self {
+            msg: format!("InterpretError : {value}"),
+        }
+    }
+}

harmony/src/domain/topology/k8s.rs

@@ -1,18 +1,13 @@
-use std::{collections::HashMap, time::Duration};
-
 use derive_new::new;
 use k8s_openapi::{
     ClusterResourceScope, NamespaceResourceScope,
     api::{apps::v1::Deployment, core::v1::Pod},
-    apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition,
-    apimachinery::pkg::version::Info,
 };
 use kube::{
-    Client, Config, Discovery, Error, Resource,
+    Client, Config, Error, Resource,
     api::{Api, AttachParams, DeleteParams, ListParams, Patch, PatchParams, ResourceExt},
     config::{KubeConfigOptions, Kubeconfig},
     core::ErrorResponse,
-    error::DiscoveryError,
     runtime::reflector::Lookup,
 };
 use kube::{api::DynamicObject, runtime::conditions};
@@ -22,9 +17,9 @@ use kube::{
 };
 use log::{debug, error, trace};
 use serde::{Serialize, de::DeserializeOwned};
-use serde_json::{json, Value};
+use serde_json::{Value, json};
 use similar::TextDiff;
-use tokio::{io::AsyncReadExt, time::sleep};
+use tokio::io::AsyncReadExt;
 
 #[derive(new, Clone)]
 pub struct K8sClient {
@@ -58,159 +53,6 @@ impl K8sClient {
         })
     }
 
-     // Returns true if any deployment in the given namespace matching the label selector
-    // has status.availableReplicas > 0 (or condition Available=True).
-    pub async fn has_healthy_deployment_with_label(
-        &self,
-        namespace: &str,
-        label_selector: &str,
-    ) -> Result<bool, Error> {
-        let api: Api<Deployment> = Api::namespaced(self.client.clone(), namespace);
-        let lp = ListParams::default().labels(label_selector);
-        let list = api.list(&lp).await?;
-        for d in list.items {
-            // Check AvailableReplicas > 0 or Available condition
-            let available = d
-                .status
-                .as_ref()
-                .and_then(|s| s.available_replicas)
-                .unwrap_or(0);
-            if available > 0 {
-                return Ok(true);
-            }
-            // Fallback: scan conditions
-            if let Some(conds) = d.status.as_ref().and_then(|s| s.conditions.as_ref()) {
-                if conds.iter().any(|c| {
-                    c.type_ == "Available"
-                        && c.status == "True"
-                }) {
-                    return Ok(true);
-                }
-            }
-        }
-        Ok(false)
-    }
-
-    // Cluster-wide: returns namespaces that have at least one healthy deployment
-    // matching the label selector (equivalent to kubectl -A -l ...).
-    pub async fn list_namespaces_with_healthy_deployments(
-        &self,
-        label_selector: &str,
-    ) -> Result<Vec<String>, Error> {
-        let api: Api<Deployment> = Api::all(self.client.clone());
-        let lp = ListParams::default().labels(label_selector);
-        let list = api.list(&lp).await?;
-
-        let mut healthy_ns: HashMap<String, bool> = HashMap::new();
-        for d in list.items {
-            let ns = match d.metadata.namespace.clone() {
-                Some(n) => n,
-                None => continue,
-            };
-            let available = d
-                .status
-                .as_ref()
-                .and_then(|s| s.available_replicas)
-                .unwrap_or(0);
-            let is_healthy = if available > 0 {
-                true
-            } else {
-                d.status
-                    .as_ref()
-                    .and_then(|s| s.conditions.as_ref())
-                    .map(|conds| {
-                        conds.iter().any(|c| {
-                            c.type_ == "Available"
-                                && c.status == "True"
-                        })
-                    })
-                    .unwrap_or(false)
-            };
-            if is_healthy {
-                healthy_ns.insert(ns, true);
-            }
-        }
-
-        Ok(healthy_ns.into_keys().collect())
-    }
-
-    // Get the application-controller ServiceAccount name (fallback to default)
-    pub async fn get_argocd_controller_sa_name(&self, ns: &str) -> Result<String, Error> {
-        let api: Api<Deployment> = Api::namespaced(self.client.clone(), ns);
-        let lp = ListParams::default().labels("app.kubernetes.io/component=controller");
-        let list = api.list(&lp).await?;
-        if let Some(dep) = list.items.get(0) {
-            if let Some(sa) = dep
-                .spec
-                .as_ref()
-                .and_then(|ds| ds.template.spec.as_ref())
-                .and_then(|ps| ps.service_account_name.clone())
-            {
-                return Ok(sa);
-            }
-        }
-        Ok("argocd-application-controller".to_string())
-    }
-
-    // List ClusterRoleBindings dynamically and return as JSON values
-    pub async fn list_clusterrolebindings_json(&self) -> Result<Vec<Value>, Error> {
-        let gvk = kube::api::GroupVersionKind::gvk(
-            "rbac.authorization.k8s.io",
-            "v1",
-            "ClusterRoleBinding",
-        );
-        let ar = kube::api::ApiResource::from_gvk(&gvk);
-        let api: Api<kube::api::DynamicObject> = Api::all_with(self.client.clone(), &ar);
-        let crbs = api.list(&ListParams::default()).await?;
-        let mut out = Vec::new();
-        for o in crbs {
-            let v = serde_json::to_value(&o).unwrap_or(Value::Null);
-            out.push(v);
-        }
-        Ok(out)
-    }
-
-    // Determine if Argo controller in ns has cluster-wide permissions via CRBs
-    // TODO This does not belong in the generic k8s client, should be refactored at some point
-    pub async fn is_argocd_cluster_wide(&self, ns: &str) -> Result<bool, Error> {
-        let sa = self.get_argocd_controller_sa_name(ns).await?;
-        let crbs = self.list_clusterrolebindings_json().await?;
-        let sa_user = format!("system:serviceaccount:{}:{}", ns, sa);
-        for crb in crbs {
-            if let Some(subjects) = crb.get("subjects").and_then(|s| s.as_array()) {
-                for subj in subjects {
-                    let kind = subj.get("kind").and_then(|v| v.as_str()).unwrap_or("");
-                    let name = subj.get("name").and_then(|v| v.as_str()).unwrap_or("");
-                    let subj_ns = subj.get("namespace").and_then(|v| v.as_str()).unwrap_or("");
-                    if (kind == "ServiceAccount" && name == sa && subj_ns == ns)
-                        || (kind == "User" && name == sa_user)
-                    {
-                        return Ok(true);
-                    }
-                }
-            }
-        }
-        Ok(false)
-    }
-
-    pub async fn has_crd(&self, name: &str) -> Result<bool, Error> {
-        let api: Api<CustomResourceDefinition> = Api::all(self.client.clone());
-        let lp = ListParams::default().fields(&format!("metadata.name={}", name));
-        let crds = api.list(&lp).await?;
-        Ok(!crds.items.is_empty())
-    }
-
-    pub async fn get_apiserver_version(&self) -> Result<Info, Error> {
-        let client: Client = self.client.clone();
-        let version_info: Info = client.apiserver_version().await?;
-        Ok(version_info)
-    }
-
-    pub async fn discovery(&self) -> Result<Discovery, Error> {
-        let discovery: Discovery = Discovery::new(self.client.clone()).run().await?;
-        Ok(discovery)
-    }
-
     pub async fn get_resource_json_value(
         &self,
         name: &str,
@@ -311,41 +153,6 @@ impl K8sClient {
         }
     }
 
-    pub async fn wait_for_pod_ready(
-        &self,
-        pod_name: &str,
-        namespace: Option<&str>,
-    ) -> Result<(), Error> {
-        let mut elapsed = 0;
-        let interval = 5; // seconds between checks
-        let timeout_secs = 120;
-        loop {
-            let pod = self.get_pod(pod_name, namespace).await?;
-
-            if let Some(p) = pod {
-                if let Some(status) = p.status {
-                    if let Some(phase) = status.phase {
-                        if phase.to_lowercase() == "running" {
-                            return Ok(());
-                        }
-                    }
-                }
-            }
-
-            if elapsed >= timeout_secs {
-                return Err(Error::Discovery(DiscoveryError::MissingResource(format!(
-                    "'{}' in ns '{}' did not become ready within {}s",
-                    pod_name,
-                    namespace.unwrap(),
-                    timeout_secs
-                ))));
-            }
-
-            sleep(Duration::from_secs(interval)).await;
-            elapsed += interval;
-        }
-    }
-
     /// Will execute a commond in the first pod found that matches the specified label
     /// '{label}={name}'
     pub async fn exec_app_capture_output(
@@ -612,12 +419,9 @@ impl K8sClient {
             .as_str()
             .expect("couldn't get kind as str");
 
-        let mut it = api_version.splitn(2, '/');
-        let first = it.next().unwrap();
-        let (g, v) = match it.next() {
-            Some(second) => (first, second),
-            None => ("", first),
-        };
+        let split: Vec<&str> = api_version.splitn(2, "/").collect();
+        let g = split[0];
+        let v = split[1];
 
         let gvk = GroupVersionKind::gvk(g, v, kind);
         let api_resource = ApiResource::from_gvk(&gvk);

harmony/src/domain/topology/k8s_anywhere.rs

@@ -2,7 +2,7 @@ use std::{process::Command, sync::Arc};
 
 use async_trait::async_trait;
 use kube::api::GroupVersionKind;
-use log::{debug, info, trace, warn};
+use log::{debug, info, warn};
 use serde::Serialize;
 use tokio::sync::OnceCell;
 
@@ -47,13 +47,6 @@ struct K8sState {
     message: String,
 }
 
-#[derive(Debug, Clone)]
-pub enum KubernetesDistribution {
-    OpenshiftFamily,
-    K3sFamily,
-    Default,
-}
-
 #[derive(Debug, Clone)]
 enum K8sSource {
     LocalK3d,
@@ -64,14 +57,12 @@ enum K8sSource {
 pub struct K8sAnywhereTopology {
     k8s_state: Arc<OnceCell<Option<K8sState>>>,
     tenant_manager: Arc<OnceCell<K8sTenantManager>>,
-    flavour: Arc<OnceCell<KubernetesDistribution>>,
     config: Arc<K8sAnywhereConfig>,
 }
 
 #[async_trait]
 impl K8sclient for K8sAnywhereTopology {
     async fn k8s_client(&self) -> Result<Arc<K8sClient>, String> {
-        trace!("getting k8s client");
         let state = match self.k8s_state.get() {
             Some(state) => state,
             None => return Err("K8s state not initialized yet".to_string()),
@@ -171,7 +162,6 @@ impl K8sAnywhereTopology {
         Self {
             k8s_state: Arc::new(OnceCell::new()),
             tenant_manager: Arc::new(OnceCell::new()),
-            flavour: Arc::new(OnceCell::new()),
             config: Arc::new(K8sAnywhereConfig::from_env()),
         }
     }
@@ -180,42 +170,10 @@ impl K8sAnywhereTopology {
         Self {
             k8s_state: Arc::new(OnceCell::new()),
             tenant_manager: Arc::new(OnceCell::new()),
-            flavour: Arc::new(OnceCell::new()),
             config: Arc::new(config),
         }
     }
 
-    pub async fn get_k8s_distribution(&self) -> Result<&KubernetesDistribution, PreparationError> {
-        self.flavour
-            .get_or_try_init(async || {
-                let client = self.k8s_client().await.unwrap();
-
-                let discovery = client.discovery().await.map_err(|e| {
-                    PreparationError::new(format!("Could not discover API groups: {}", e))
-                })?;
-
-                let version = client.get_apiserver_version().await.map_err(|e| {
-                    PreparationError::new(format!("Could not get server version: {}", e))
-                })?;
-
-                // OpenShift / OKD
-                if discovery
-                    .groups()
-                    .any(|g| g.name() == "project.openshift.io")
-                {
-                    return Ok(KubernetesDistribution::OpenshiftFamily);
-                }
-
-                // K3d / K3s
-                if version.git_version.contains("k3s") {
-                    return Ok(KubernetesDistribution::K3sFamily);
-                }
-
-                return Ok(KubernetesDistribution::Default);
-            })
-            .await
-    }
-
     async fn get_cluster_observability_operator_prometheus_application_score(
         &self,
         sender: RHOBObservability,
@@ -621,56 +579,36 @@ impl TenantManager for K8sAnywhereTopology {
 
 #[async_trait]
 impl Ingress for K8sAnywhereTopology {
+    //TODO this is specifically for openshift/okd which violates the k8sanywhere idea
     async fn get_domain(&self, service: &str) -> Result<String, PreparationError> {
-        use log::{trace, debug, warn};
-
         let client = self.k8s_client().await?;
 
         if let Some(Some(k8s_state)) = self.k8s_state.get() {
             match k8s_state.source {
-                K8sSource::LocalK3d => {
-                    // Local developer UX
-                    return Ok(format!("{service}.local.k3d"));
-                }
+                K8sSource::LocalK3d => Ok(format!("{service}.local.k3d")),
                 K8sSource::Kubeconfig => {
-                    trace!("K8sSource is kubeconfig; attempting to detect domain");
+                    self.openshift_ingress_operator_available().await?;
 
-                    // 1) Try OpenShift IngressController domain (backward compatible)
-                    if self.openshift_ingress_operator_available().await.is_ok() {
-                        trace!("OpenShift ingress operator detected; using IngressController");
-                        let gvk = GroupVersionKind {
-                            group: "operator.openshift.io".into(),
-                            version: "v1".into(),
-                            kind: "IngressController".into(),
-                        };
-                        let ic = client
-                            .get_resource_json_value("default", Some("openshift-ingress-operator"), &gvk)
-                            .await
-                            .map_err(|_| PreparationError::new("Failed to fetch IngressController".to_string()))?;
+                    let gvk = GroupVersionKind {
+                        group: "operator.openshift.io".into(),
+                        version: "v1".into(),
+                        kind: "IngressController".into(),
+                    };
+                    let ic = client
+                        .get_resource_json_value(
+                            "default",
+                            Some("openshift-ingress-operator"),
+                            &gvk,
+                        )
+                        .await
+                        .map_err(|_| {
+                            PreparationError::new("Failed to fetch IngressController".to_string())
+                        })?;
 
-                        if let Some(domain) = ic.data["status"]["domain"].as_str() {
-                            return Ok(format!("{service}.{domain}"));
-                        } else {
-                            warn!("OpenShift IngressController present but no status.domain set");
-                        }
-                    } else {
-                        trace!("OpenShift ingress operator not detected; trying generic Kubernetes");
+                    match ic.data["status"]["domain"].as_str() {
+                        Some(domain) => Ok(format!("{service}.{domain}")),
+                        None => Err(PreparationError::new("Could not find domain".to_string())),
                     }
-
-                    // 2) Try NGINX Ingress Controller common setups
-                    // 2.a) Well-known namespace/name for the controller Service
-                    //      - upstream default: namespace "ingress-nginx", service "ingress-nginx-controller"
-                    //      - some distros: "ingress-nginx-controller" svc in "ingress-nginx" ns
-                    // If found with LoadBalancer ingress hostname, use its base domain.
-                    if let Some(domain) = try_nginx_lb_domain(&client).await? {
-                        return Ok(format!("{service}.{domain}"));
-                    }
-
-                    // 3) Fallback: internal cluster DNS suffix (service.namespace.svc.cluster.local)
-                    // We don't have tenant namespace here, so we fallback to 'default' with a warning.
-                    warn!("Could not determine external ingress domain; falling back to internal-only DNS");
-                    let internal = format!("{service}.default.svc.cluster.local");
-                    Ok(internal)
                 }
             }
         } else {
@@ -680,57 +618,3 @@ impl Ingress for K8sAnywhereTopology {
         }
     }
 }
-
-async fn try_nginx_lb_domain(client: &K8sClient) -> Result<Option<String>, PreparationError> {
-    use log::{trace, debug};
-
-    // Try common service path: svc/ingress-nginx-controller in ns/ingress-nginx
-    let svc_gvk = GroupVersionKind {
-        group: "".into(), // core
-        version: "v1".into(),
-        kind: "Service".into(),
-    };
-
-    let candidates = [
-        ("ingress-nginx", "ingress-nginx-controller"),
-        ("ingress-nginx", "ingress-nginx-controller-internal"),
-        ("ingress-nginx", "ingress-nginx"), // some charts name the svc like this
-        ("kube-system", "ingress-nginx-controller"), // less common but seen
-    ];
-
-    for (ns, name) in candidates {
-        trace!("Checking NGINX Service {ns}/{name} for LoadBalancer hostname");
-        if let Ok(svc) = client.get_resource_json_value(ns, Some(name), &svc_gvk).await {
-            let lb_hosts = svc.data["status"]["loadBalancer"]["ingress"].as_array().cloned().unwrap_or_default();
-            for entry in lb_hosts {
-                if let Some(host) = entry.get("hostname").and_then(|v| v.as_str()) {
-                    debug!("Found NGINX LB hostname: {host}");
-                    if let Some(domain) = extract_base_domain(host) {
-                        return Ok(Some(domain.to_string()));
-                    } else {
-                        return Ok(Some(host.to_string())); // already a domain
-                    }
-                }
-                if let Some(ip) = entry.get("ip").and_then(|v| v.as_str()) {
-                    // If only an IP is exposed, we can't create a hostname; return None to keep searching
-                    debug!("NGINX LB exposes IP {ip} (no hostname); skipping");
-                }
-            }
-        }
-    }
-
-    Ok(None)
-}
-
-fn extract_base_domain(host: &str) -> Option<String> {
-    // For a host like a1b2c3d4e5f6abcdef.elb.amazonaws.com -> base domain elb.amazonaws.com
-    // For a managed DNS like xyz.example.com -> base domain example.com (keep 2+ labels)
-    // Heuristic: keep last 2 labels by default; special-case known multi-label TLDs if needed.
-    let parts: Vec<&str> = host.split('.').collect();
-    if parts.len() >= 2 {
-        // Very conservative: last 2 labels
-        Some(parts[parts.len() - 2..].join("."))
-    } else {
-        None
-    }
-}

harmony/src/domain/topology/mod.rs

@@ -186,7 +186,7 @@ impl TopologyState {
     }
 }
 
-#[derive(Debug, PartialEq)]
+#[derive(Debug)]
 pub enum DeploymentTarget {
     LocalDev,
     Staging,

harmony/src/infra/opnsense/dns.rs

@@ -10,7 +10,7 @@ use super::OPNSenseFirewall;
 
 #[async_trait]
 impl DnsServer for OPNSenseFirewall {
-    async fn register_hosts(&self, _hosts: Vec<DnsRecord>) -> Result<(), ExecutorError> {
+    async fn register_hosts(&self, hosts: Vec<DnsRecord>) -> Result<(), ExecutorError> {
         todo!("Refactor this to use dnsmasq")
         // let mut writable_opnsense = self.opnsense_config.write().await;
         // let mut dns = writable_opnsense.dns();
@@ -68,7 +68,7 @@ impl DnsServer for OPNSenseFirewall {
         self.host.clone()
     }
 
-    async fn register_dhcp_leases(&self, _register: bool) -> Result<(), ExecutorError> {
+    async fn register_dhcp_leases(&self, register: bool) -> Result<(), ExecutorError> {
         todo!("Refactor this to use dnsmasq")
         // let mut writable_opnsense = self.opnsense_config.write().await;
         // let mut dns = writable_opnsense.dns();

harmony/src/modules/application/features/argo_types.rs

@@ -21,7 +21,7 @@ pub struct Helm {
     pub skip_schema_validation: Option<bool>,
     pub version: Option<String>,
     pub kube_version: Option<String>,
-    // pub api_versions: Vec<String>,
+    pub api_versions: Vec<String>,
     pub namespace: Option<String>,
 }
 
@@ -105,7 +105,7 @@ impl Default for ArgoApplication {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    // api_versions: vec![],
+                    api_versions: vec![],
                     namespace: None,
                 },
                 path: "".to_string(),
@@ -155,7 +155,7 @@ impl From<CDApplicationConfig> for ArgoApplication {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    // api_versions: vec![],
+                    api_versions: vec![],
                     namespace: None,
                 },
             },
@@ -181,11 +181,13 @@ impl From<CDApplicationConfig> for ArgoApplication {
 }
 
 impl ArgoApplication {
-    pub fn to_yaml(&self, target_namespace: Option<&str>) -> serde_yaml::Value {
+    pub fn to_yaml(&self) -> serde_yaml::Value {
         let name = &self.name;
-        let default_ns = "argocd".to_string();
-        let namespace: &str =
-            target_namespace.unwrap_or(self.namespace.as_ref().unwrap_or(&default_ns));
+        let namespace = if let Some(ns) = self.namespace.as_ref() {
+            ns
+        } else {
+            "argocd"
+        };
         let project = &self.project;
 
         let yaml_str = format!(
@@ -283,7 +285,7 @@ mod tests {
                     skip_schema_validation: None,
                     version: None,
                     kube_version: None,
-                    // api_versions: vec![],
+                    api_versions: vec![],
                     namespace: None,
                 },
                 path: "".to_string(),
@@ -343,7 +345,7 @@ spec:
 
         assert_eq!(
             expected_yaml_output.trim(),
-            serde_yaml::to_string(&app.clone().to_yaml(None))
+            serde_yaml::to_string(&app.clone().to_yaml())
                 .unwrap()
                 .trim()
         );

harmony/src/modules/application/features/helm_argocd_score.rs

@@ -1,19 +1,21 @@
 use async_trait::async_trait;
-use log::{debug, info, trace, warn};
+use kube::{Api, api::GroupVersionKind};
+use log::{debug, warn};
 use non_blank_string_rs::NonBlankString;
 use serde::Serialize;
-use std::{str::FromStr, sync::Arc};
+use serde::de::DeserializeOwned;
+use std::{process::Command, str::FromStr, sync::Arc};
 
 use crate::{
     data::Version,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
-    modules::{
-        argocd::{ArgoDeploymentType, detect_argo_deployment_type},
-        helm::chart::{HelmChartScore, HelmRepository},
-    },
+    modules::helm::chart::{HelmChartScore, HelmRepository},
     score::Score,
-    topology::{HelmCommand, K8sclient, Topology, ingress::Ingress, k8s::K8sClient},
+    topology::{
+        HelmCommand, K8sclient, PreparationError, PreparationOutcome, Topology, ingress::Ingress,
+        k8s::K8sClient,
+    },
 };
 use harmony_types::id::Id;
 
@@ -22,7 +24,6 @@ use super::ArgoApplication;
 #[derive(Debug, Serialize, Clone)]
 pub struct ArgoHelmScore {
     pub namespace: String,
-    // TODO: remove and rely on topology (it now knows the flavor)
     pub openshift: bool,
     pub argo_apps: Vec<ArgoApplication>,
 }
@@ -53,101 +54,29 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
         inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
-        trace!("Starting ArgoInterpret execution {self:?}");
-        let k8s_client: Arc<K8sClient> = topology.k8s_client().await?;
-        trace!("Got k8s client");
-        let desired_ns = self.score.namespace.clone();
-
-        debug!("ArgoInterpret detecting cluster configuration");
-        let svc = format!("argo-{}", desired_ns);
+        let k8s_client = topology.k8s_client().await?;
+        let svc = format!("argo-{}", self.score.namespace.clone());
         let domain = topology.get_domain(&svc).await?;
-        debug!("Resolved Argo service domain for '{}': {}", svc, domain);
+        let helm_score =
+            argo_helm_chart_score(&self.score.namespace, self.score.openshift, &domain);
 
-        // Detect current Argo deployment type
-        let current = detect_argo_deployment_type(&k8s_client, &desired_ns).await?;
-        info!("Detected Argo deployment type: {:?}", current);
+        helm_score.interpret(inventory, topology).await?;
 
-        // Decide control namespace and whether we must install
-        let (control_ns, must_install) = match current.clone() {
-            ArgoDeploymentType::NotInstalled => {
-                info!(
-                    "Argo CD not installed. Will install via Helm into namespace '{}'.",
-                    desired_ns
-                );
-                (desired_ns.clone(), true)
-            }
-            ArgoDeploymentType::AvailableInDesiredNamespace(ns) => {
-                info!(
-                    "Argo CD already installed by Harmony in '{}'. Skipping install.",
-                    ns
-                );
-                (ns, false)
-            }
-            ArgoDeploymentType::InstalledClusterWide(ns) => {
-                info!(
-                    "Argo CD installed cluster-wide in namespace '{}'.",
-                    ns
-                );
-                (ns, false)
-            }
-            ArgoDeploymentType::InstalledNamespaceScoped(ns) => {
-                // TODO we could support this use case by installing a new argo instance. But that
-                // means handling a few cases that are out of scope for now :
-                // - Wether argo operator is installed
-                // - Managing CRD versions compatibility
-                // - Potentially handling the various k8s flavors and setups we might encounter
-                //
-                // There is a possibility that the helm chart already handles most or even all of these use cases but they are out of scope for now.
-                let msg = format!(
-                    "Argo CD found in '{}' but it is namespace-scoped and not supported for attachment yet.",
-                    ns
-                );
-                warn!("{}", msg);
-                return Err(InterpretError::new(msg));
-            }
-        };
-
-        info!("ArgoCD will be installed : {must_install} . Current argocd status : {current:?} ");
-
-        if must_install {
-            let helm_score = argo_helm_chart_score(&desired_ns, self.score.openshift, &domain);
-            info!(
-                "Installing Argo CD via Helm into namespace '{}' ...",
-                desired_ns
-            );
-            helm_score.interpret(inventory, topology).await?;
-            info!("Argo CD install complete in '{}'.", desired_ns);
-        }
-
-        let yamls: Vec<serde_yaml::Value> = self
-            .argo_apps
-            .iter()
-            .map(|a| a.to_yaml(Some(&control_ns)))
-            .collect();
-        info!(
-            "Applying {} Argo application object(s) into control namespace '{}'.",
-            yamls.len(),
-            control_ns
-        );
         k8s_client
-            .apply_yaml_many(&yamls, Some(control_ns.as_str()))
+            .apply_yaml_many(&self.argo_apps.iter().map(|a| a.to_yaml()).collect(), None)
             .await
-            .map_err(|e| InterpretError::new(format!("Failed applying Argo CRs: {e}")))?;
+            .unwrap();
 
         Ok(Outcome::success_with_details(
             format!(
                 "ArgoCD {} {}",
                 self.argo_apps.len(),
-                if self.argo_apps.len() == 1 {
-                    "application"
-                } else {
-                    "applications"
+                match self.argo_apps.len() {
+                    1 => "application",
+                    _ => "applications",
                 }
             ),
-            vec![
-                format!("control_namespace={}", control_ns),
-                format!("argo ui: http://{}", domain),
-            ],
+            vec![format!("argo application: http://{}", domain)],
         ))
     }
 
@@ -156,7 +85,7 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
     }
 
     fn get_version(&self) -> Version {
-        Version::from("0.1.0").unwrap()
+        todo!()
     }
 
     fn get_status(&self) -> InterpretStatus {
@@ -164,7 +93,39 @@ impl<T: Topology + K8sclient + HelmCommand + Ingress> Interpret<T> for ArgoInter
     }
 
     fn get_children(&self) -> Vec<Id> {
-        vec![]
+        todo!()
+    }
+}
+
+impl ArgoInterpret {
+    pub async fn get_host_domain(
+        &self,
+        client: Arc<K8sClient>,
+        openshift: bool,
+    ) -> Result<String, InterpretError> {
+        //This should be the job of the topology to determine if we are in
+        //openshift, potentially we need on openshift topology the same way we create a
+        //localhosttopology
+        match openshift {
+            true => {
+                let gvk = GroupVersionKind {
+                    group: "operator.openshift.io".into(),
+                    version: "v1".into(),
+                    kind: "IngressController".into(),
+                };
+                let ic = client
+                    .get_resource_json_value("default", Some("openshift-ingress-operator"), &gvk)
+                    .await?;
+
+                match ic.data["status"]["domain"].as_str() {
+                    Some(domain) => return Ok(domain.to_string()),
+                    None => return Err(InterpretError::new("Could not find domain".to_string())),
+                }
+            }
+            false => {
+                todo!()
+            }
+        };
     }
 }
 

harmony/src/modules/application/features/packaging_deployment.rs

@@ -10,11 +10,12 @@ use crate::{
     data::Version,
     inventory::Inventory,
     modules::application::{
-        features::{ArgoApplication, ArgoHelmScore}, webapp::Webapp, ApplicationFeature, HelmPackage, InstallationError, InstallationOutcome, OCICompliant
+        ApplicationFeature, HelmPackage, InstallationError, InstallationOutcome, OCICompliant,
+        features::{ArgoApplication, ArgoHelmScore},
     },
     score::Score,
     topology::{
-        ingress::Ingress, DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, Topology
+        DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, Topology, ingress::Ingress,
     },
 };
 
@@ -46,11 +47,11 @@ use crate::{
 /// - ArgoCD to install/upgrade/rollback/inspect k8s resources
 /// - Kubernetes for runtime orchestration
 #[derive(Debug, Default, Clone)]
-pub struct PackagingDeployment<A: OCICompliant + HelmPackage + Webapp> {
+pub struct PackagingDeployment<A: OCICompliant + HelmPackage> {
     pub application: Arc<A>,
 }
 
-impl<A: OCICompliant + HelmPackage + Webapp> PackagingDeployment<A> {
+impl<A: OCICompliant + HelmPackage> PackagingDeployment<A> {
     async fn deploy_to_local_k3d(
         &self,
         app_name: String,
@@ -136,7 +137,7 @@ impl<A: OCICompliant + HelmPackage + Webapp> PackagingDeployment<A> {
 
 #[async_trait]
 impl<
-    A: OCICompliant + HelmPackage + Webapp + Clone + 'static,
+    A: OCICompliant + HelmPackage + Clone + 'static,
     T: Topology + HelmCommand + MultiTargetTopology + K8sclient + Ingress + 'static,
 > ApplicationFeature<T> for PackagingDeployment<A>
 {
@@ -145,15 +146,10 @@ impl<
         topology: &T,
     ) -> Result<InstallationOutcome, InstallationError> {
         let image = self.application.image_name();
-
-        let domain = if topology.current_target() == DeploymentTarget::Production {
-            self.application.dns()
-        } else {
- topology
+        let domain = topology
             .get_domain(&self.application.name())
             .await
-            .map_err(|e| e.to_string())?
-        };
+            .map_err(|e| e.to_string())?;
 
         // TODO Write CI/CD workflow files
         // we can autotedect the CI type using the remote url (default to github action for github
@@ -198,7 +194,7 @@ impl<
                     openshift: true,
                     argo_apps: vec![ArgoApplication::from(CDApplicationConfig {
                         // helm pull oci://hub.nationtech.io/harmony/harmony-example-rust-webapp-chart --version 0.1.0
-                        version: Version::from("0.2.1").unwrap(),
+                        version: Version::from("0.1.0").unwrap(),
                         helm_chart_repo_url: "hub.nationtech.io/harmony".to_string(),
                         helm_chart_name: format!("{}-chart", self.application.name()),
                         values_overrides: None,

harmony/src/modules/application/features/rhob_monitoring.rs

@@ -3,6 +3,7 @@ use std::sync::Arc;
 use crate::modules::application::{
     Application, ApplicationFeature, InstallationError, InstallationOutcome,
 };
+use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
 use crate::modules::monitoring::application_monitoring::rhobs_application_monitoring_score::ApplicationRHOBMonitoringScore;
 
 use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::RHOBObservability;

harmony/src/modules/application/mod.rs

@@ -2,7 +2,6 @@ mod feature;
 pub mod features;
 pub mod oci;
 mod rust;
-mod webapp;
 use std::sync::Arc;
 
 pub use feature::*;

harmony/src/modules/application/rust.rs

@@ -16,7 +16,6 @@ use tar::{Builder, Header};
 use walkdir::WalkDir;
 
 use crate::config::{REGISTRY_PROJECT, REGISTRY_URL};
-use crate::modules::application::webapp::Webapp;
 use crate::{score::Score, topology::Topology};
 
 use super::{Application, ApplicationFeature, ApplicationInterpret, HelmPackage, OCICompliant};
@@ -61,10 +60,6 @@ pub struct RustWebapp {
     pub project_root: PathBuf,
     pub service_port: u32,
     pub framework: Option<RustWebFramework>,
-    /// Host name that will be used in production environment.
-    ///
-    /// This is the place to put the public host name if this is a public facing webapp.
-    pub dns: String,
 }
 
 impl Application for RustWebapp {
@@ -73,12 +68,6 @@ impl Application for RustWebapp {
     }
 }
 
-impl Webapp for RustWebapp {
-    fn dns(&self) -> String {
-        self.dns.clone()
-    }
-}
-
 #[async_trait]
 impl HelmPackage for RustWebapp {
     async fn build_push_helm_package(
@@ -205,10 +194,10 @@ impl RustWebapp {
                     Some(body_full(tar_data.into())),
                 );
 
-                while let Some(msg) = image_build_stream.next().await {
+                while let Some(mut msg) = image_build_stream.next().await {
                     trace!("Got bollard msg {msg:?}");
                     match msg {
-                        Ok(msg) => {
+                        Ok(mut msg) => {
                             if let Some(progress) = msg.progress_detail {
                                 info!(
                                     "Build progress {}/{}",
@@ -268,6 +257,7 @@ impl RustWebapp {
                 ".harmony_generated",
                 "harmony",
                 "node_modules",
+                "Dockerfile.harmony",
             ];
             let mut entries: Vec<_> = WalkDir::new(project_root)
                 .into_iter()
@@ -471,53 +461,52 @@ impl RustWebapp {
 
         let (image_repo, image_tag) = image_url.rsplit_once(':').unwrap_or((image_url, "latest"));
 
-        let app_name = &self.name;
-        let service_port = self.service_port;
         // Create Chart.yaml
         let chart_yaml = format!(
             r#"
 apiVersion: v2
-name: {chart_name}
-description: A Helm chart for the {app_name} web application.
+name: {}
+description: A Helm chart for the {} web application.
 type: application
-version: 0.2.1
-appVersion: "{image_tag}"
+version: 0.1.0
+appVersion: "{}"
 "#,
+            chart_name, self.name, image_tag
         );
         fs::write(chart_dir.join("Chart.yaml"), chart_yaml)?;
 
         // Create values.yaml
         let values_yaml = format!(
             r#"
-# Default values for {chart_name}.
+# Default values for {}.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
 replicaCount: 1
 
 image:
-  repository: {image_repo}
+  repository: {}
   pullPolicy: IfNotPresent
   # Overridden by the chart's appVersion
-  tag: "{image_tag}"
+  tag: "{}"
 
 service:
   type: ClusterIP
-  port: {service_port}
+  port: {}
 
 ingress:
   enabled: true
-  tls: true
   # Annotations for cert-manager to handle SSL.
   annotations:
     # Add other annotations like nginx ingress class if needed
     # kubernetes.io/ingress.class: nginx
   hosts:
-    - host: {domain}
+    - host: {}
       paths:
         - path: /
           pathType: ImplementationSpecific
 "#,
+            chart_name, image_repo, image_tag, self.service_port, domain,
         );
         fs::write(chart_dir.join("values.yaml"), values_yaml)?;
 
@@ -594,11 +583,7 @@ spec:
         );
         fs::write(templates_dir.join("deployment.yaml"), deployment_yaml)?;
 
-        let service_port = self.service_port;
-
         // Create templates/ingress.yaml
-        // TODO get issuer name and tls config from topology as it may be different from one
-        // cluster to another, also from one version to another
         let ingress_yaml = format!(
             r#"
 {{{{- if $.Values.ingress.enabled -}}}}
@@ -611,11 +596,13 @@ metadata:
 spec:
   {{{{- if $.Values.ingress.tls }}}}
   tls:
-    - secretName: {{{{ include "chart.fullname" . }}}}-tls
-      hosts:
-        {{{{- range $.Values.ingress.hosts }}}}
-        - {{{{ .host | quote }}}}
+    {{{{- range $.Values.ingress.tls }}}}
+    - hosts:
+        {{{{- range .hosts }}}}
+        - {{{{ . | quote }}}}
         {{{{- end }}}}
+      secretName: {{{{ .secretName }}}}
+    {{{{- end }}}}
   {{{{- end }}}}
   rules:
     {{{{- range $.Values.ingress.hosts }}}}
@@ -629,11 +616,12 @@ spec:
               service:
                 name: {{{{ include "chart.fullname" $ }}}}
                 port:
-                  number: {{{{ $.Values.service.port | default {service_port} }}}}
+                  number: {{{{ $.Values.service.port | default {} }}}}
           {{{{- end }}}}
     {{{{- end }}}}
 {{{{- end }}}}
 "#,
+            self.service_port
         );
         fs::write(templates_dir.join("ingress.yaml"), ingress_yaml)?;
 

harmony/src/modules/application/webapp.rs

@@ -1,7 +0,0 @@
-use super::Application;
-use async_trait::async_trait;
-
-#[async_trait]
-pub trait Webapp: Application {
-    fn dns(&self) -> String;
-}

harmony/src/modules/argocd/mod.rs

@@ -1,203 +0,0 @@
-use std::sync::Arc;
-
-use log::{debug, info};
-
-use crate::{interpret::InterpretError, topology::k8s::K8sClient};
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum ArgoScope {
-    ClusterWide(String),
-    NamespaceScoped(String),
-}
-
-#[derive(Clone, Debug)]
-pub struct DiscoveredArgo {
-    pub control_namespace: String,
-    pub scope: ArgoScope,
-    pub has_crds: bool,
-    pub has_applicationset: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum ArgoDeploymentType {
-    NotInstalled,
-    AvailableInDesiredNamespace(String),
-    InstalledClusterWide(String),
-    InstalledNamespaceScoped(String),
-}
-
-pub async fn discover_argo_all(
-    k8s: &Arc<K8sClient>,
-) -> Result<Vec<DiscoveredArgo>, InterpretError> {
-    use log::{debug, info, trace, warn};
-
-    trace!("Starting Argo discovery");
-
-    // CRDs
-    let mut has_crds = true;
-    let required_crds = vec!["applications.argoproj.io", "appprojects.argoproj.io"];
-    trace!("Checking required Argo CRDs: {:?}", required_crds);
-
-    for crd in required_crds {
-        trace!("Verifying CRD presence: {crd}");
-        let crd_exists = k8s.has_crd(crd).await.map_err(|e| {
-            InterpretError::new(format!("Failed to verify existence of CRD {crd}: {e}"))
-        })?;
-
-        debug!("CRD {crd} exists: {crd_exists}");
-        if !crd_exists {
-            info!(
-                "Missing Argo CRD {crd}, looks like Argo CD is not installed (or partially installed)"
-            );
-            has_crds = false;
-            break;
-        }
-    }
-
-    trace!(
-        "Listing namespaces with healthy Argo CD deployments using selector app.kubernetes.io/part-of=argocd"
-    );
-    let mut candidate_namespaces = k8s
-        .list_namespaces_with_healthy_deployments("app.kubernetes.io/part-of=argocd")
-        .await
-        .map_err(|e| InterpretError::new(format!("List healthy argocd deployments: {e}")))?;
-    trace!(
-        "Listing namespaces with healthy Argo CD deployments using selector app.kubernetes.io/name=argo-cd"
-    );
-    candidate_namespaces.append(
-        &mut k8s
-            .list_namespaces_with_healthy_deployments("app.kubernetes.io/name=argo-cd")
-            .await
-            .map_err(|e| InterpretError::new(format!("List healthy argocd deployments: {e}")))?,
-    );
-
-    debug!(
-        "Discovered {} candidate namespace(s) for Argo CD: {:?}",
-        candidate_namespaces.len(),
-        candidate_namespaces
-    );
-
-    let mut found = Vec::new();
-    for ns in candidate_namespaces {
-        trace!("Evaluating namespace '{ns}' for Argo CD instance");
-
-        // Require the application-controller to be healthy (sanity check)
-        trace!(
-            "Checking healthy deployment with label app.kubernetes.io/name=argocd-application-controller in namespace '{ns}'"
-        );
-        let controller_ok = k8s
-            .has_healthy_deployment_with_label(
-                &ns,
-                "app.kubernetes.io/name=argocd-application-controller",
-            )
-            .await
-            .unwrap_or_else(|e| {
-                warn!(
-                    "Error while checking application-controller health in namespace '{ns}': {e}"
-                );
-                false
-            }) || k8s
-            .has_healthy_deployment_with_label(
-                &ns,
-                "app.kubernetes.io/component=controller",
-            )
-            .await
-            .unwrap_or_else(|e| {
-                warn!(
-                    "Error while checking application-controller health in namespace '{ns}': {e}"
-                );
-                false
-            });
-        debug!("Namespace '{ns}': application-controller healthy = {controller_ok}");
-
-        if !controller_ok {
-            trace!("Skipping namespace '{ns}' because application-controller is not healthy");
-            continue;
-        }
-
-        trace!("Determining Argo CD scope for namespace '{ns}' (cluster-wide vs namespace-scoped)");
-        let scope = match k8s.is_argocd_cluster_wide(&ns).await {
-            Ok(true) => {
-                debug!("Namespace '{ns}' identified as cluster-wide Argo CD control plane");
-                ArgoScope::ClusterWide(ns.to_string())
-            }
-            Ok(false) => {
-                debug!("Namespace '{ns}' identified as namespace-scoped Argo CD control plane");
-                ArgoScope::NamespaceScoped(ns.to_string())
-            }
-            Err(e) => {
-                warn!(
-                    "Failed to determine Argo CD scope for namespace '{ns}': {e}. Assuming namespace-scoped."
-                );
-                ArgoScope::NamespaceScoped(ns.to_string())
-            }
-        };
-
-        trace!("Checking optional ApplicationSet CRD (applicationsets.argoproj.io)");
-        let has_applicationset = match k8s.has_crd("applicationsets.argoproj.io").await {
-            Ok(v) => {
-                debug!("applicationsets.argoproj.io present: {v}");
-                v
-            }
-            Err(e) => {
-                warn!("Failed to check applicationsets.argoproj.io CRD: {e}. Assuming absent.");
-                false
-            }
-        };
-
-        let argo = DiscoveredArgo {
-            control_namespace: ns.clone(),
-            scope,
-            has_crds,
-            has_applicationset,
-        };
-
-        debug!("Discovered Argo instance in '{ns}': {argo:?}");
-        found.push(argo);
-    }
-
-    if found.is_empty() {
-        info!("No Argo CD installations discovered");
-    } else {
-        info!(
-            "Argo CD discovery complete: {} instance(s) found",
-            found.len()
-        );
-    }
-
-    Ok(found)
-}
-
-pub async fn detect_argo_deployment_type(
-    k8s: &Arc<K8sClient>,
-    desired_namespace: &str,
-) -> Result<ArgoDeploymentType, InterpretError> {
-    let discovered = discover_argo_all(k8s).await?;
-    debug!("Discovered argo instances {discovered:?}");
-
-    if discovered.is_empty() {
-        return Ok(ArgoDeploymentType::NotInstalled);
-    }
-
-    if let Some(d) = discovered
-        .iter()
-        .find(|d| d.control_namespace == desired_namespace)
-    {
-        return Ok(ArgoDeploymentType::AvailableInDesiredNamespace(
-            d.control_namespace.clone(),
-        ));
-    }
-
-    if let Some(d) = discovered
-        .iter()
-        .find(|d| matches!(d.scope, ArgoScope::ClusterWide(_)))
-    {
-        return Ok(ArgoDeploymentType::InstalledClusterWide(
-            d.control_namespace.clone(),
-        ));
-    }
-
-    Ok(ArgoDeploymentType::InstalledNamespaceScoped(
-        discovered[0].control_namespace.clone(),
-    ))
-}

harmony/src/modules/cert_manager/gen_ca_cert.rs

@@ -0,0 +1,106 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use harmony_types::id::Id;
+use serde::Serialize;
+
+use crate::{
+    data::Version,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
+    score::Score,
+    topology::{K8sclient, Topology, k8s::K8sClient},
+};
+
+#[derive(Clone, Serialize, Debug)]
+pub struct GenerateCaCertScore {
+    cluster_issuer_name: String,
+    dns_names: String,
+    operator_namespace: String,
+}
+
+impl<T: Topology + K8sclient> Score<T> for GenerateCaCertScore {
+    fn name(&self) -> String {
+        "GenerateCaCertScore".to_string()
+    }
+
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        Box::new(GenerateCaCertIntepret {
+            score: self.clone(),
+        })
+    }
+}
+
+#[derive(Clone, Serialize, Debug)]
+pub struct GenerateCaCertIntepret {
+    score: GenerateCaCertScore,
+}
+
+#[async_trait]
+impl<T: Topology + K8sclient> Interpret<T> for GenerateCaCertIntepret {
+    async fn execute(
+        &self,
+        _inventory: &Inventory,
+        topology: &T,
+    ) -> Result<Outcome, InterpretError> {
+        let client = topology.k8s_client().await.unwrap();
+        let cert_yaml = self
+            .build_cert_request_yaml(&self.score.cluster_issuer_name, &self.score.dns_names)
+            .unwrap();
+        self.apply_cert_request(&client, cert_yaml, &self.score.operator_namespace)
+            .await?;
+        Ok(Outcome::success("created ca cert".to_string()))
+    }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("GenerateCaCertInterpret")
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}
+
+impl GenerateCaCertIntepret {
+    pub fn build_cert_request_yaml(
+        &self,
+        cluster_issuer_name: &str,
+        dns_names: &str,
+    ) -> Result<serde_yaml::Value, InterpretError> {
+        let cert_yaml = format!(
+            r#"
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ingress-cert
+  namespace: openshift-ingress
+spec:
+  secretName: ingress-cert-tls
+  issuerRef:
+    name: {cluster_issuer_name}
+    kind: ClusterIssuer
+  dnsNames:
+  - "*.{dns_names}"
+        "#
+        );
+        Ok(serde_yaml::to_value(cert_yaml)?)
+    }
+    pub async fn apply_cert_request(
+        &self,
+        client: &Arc<K8sClient>,
+        cert_yaml: serde_yaml::Value,
+        operator_namespace: &str,
+    ) -> Result<(), InterpretError> {
+        Ok(client
+            .apply_yaml(&cert_yaml, Some(operator_namespace))
+            .await?)
+    }
+}

harmony/src/modules/cert_manager/mod.rs

@@ -1,2 +1,3 @@
+mod gen_ca_cert;
 mod helm;
 pub use helm::*;

harmony/src/modules/inventory/mod.rs

@@ -90,12 +90,12 @@ impl<T: Topology> Interpret<T> for DiscoverInventoryAgentInterpret {
                             // refactoring to do it now
                             let harmony_inventory_agent::hwinfo::PhysicalHost {
                                 storage_drives,
-                                storage_controller: _,
+                                storage_controller,
                                 memory_modules,
                                 cpus,
-                                chipset: _,
+                                chipset,
                                 network_interfaces,
-                                management_interface: _,
+                                management_interface,
                                 host_uuid,
                             } = host;
 

harmony/src/modules/mod.rs

@@ -17,4 +17,3 @@ pub mod prometheus;
 pub mod storage;
 pub mod tenant;
 pub mod tftp;
-pub mod argocd;

harmony/src/modules/monitoring/kube_prometheus/crd/rhob_monitoring_stack.rs

@@ -1,8 +1,12 @@
+use std::collections::BTreeMap;
+
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::LabelSelector;
+use crate::modules::monitoring::kube_prometheus::crd::rhob_prometheuses::{
+    LabelSelector, PrometheusSpec,
+};
 
 /// MonitoringStack CRD for monitoring.rhobs/v1alpha1
 #[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]

harmony/src/modules/monitoring/mod.rs

@@ -4,5 +4,4 @@ pub mod application_monitoring;
 pub mod grafana;
 pub mod kube_prometheus;
 pub mod ntfy;
-pub mod okd;
 pub mod prometheus;

harmony/src/modules/monitoring/okd/enable_user_workload.rs

@@ -1,149 +0,0 @@
-use std::{collections::BTreeMap, sync::Arc};
-
-use crate::{
-    data::Version,
-    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
-    inventory::Inventory,
-    score::Score,
-    topology::{K8sclient, Topology, k8s::K8sClient},
-};
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use k8s_openapi::api::core::v1::ConfigMap;
-use kube::api::ObjectMeta;
-use serde::Serialize;
-
-#[derive(Clone, Debug, Serialize)]
-pub struct OpenshiftUserWorkloadMonitoring {}
-
-impl<T: Topology + K8sclient> Score<T> for OpenshiftUserWorkloadMonitoring {
-    fn name(&self) -> String {
-        "OpenshiftUserWorkloadMonitoringScore".to_string()
-    }
-
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(OpenshiftUserWorkloadMonitoringInterpret {})
-    }
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct OpenshiftUserWorkloadMonitoringInterpret {}
-
-#[async_trait]
-impl<T: Topology + K8sclient> Interpret<T> for OpenshiftUserWorkloadMonitoringInterpret {
-    async fn execute(
-        &self,
-        _inventory: &Inventory,
-        topology: &T,
-    ) -> Result<Outcome, InterpretError> {
-        let client = topology.k8s_client().await.unwrap();
-        self.update_cluster_monitoring_config_cm(&client).await?;
-        self.update_user_workload_monitoring_config_cm(&client)
-            .await?;
-        self.verify_user_workload(&client).await?;
-        Ok(Outcome::success(
-            "successfully enabled user-workload-monitoring".to_string(),
-        ))
-    }
-
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("OpenshiftUserWorkloadMonitoring")
-    }
-
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-}
-
-impl OpenshiftUserWorkloadMonitoringInterpret {
-    pub async fn update_cluster_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-enableUserWorkload: true
-alertmanagerMain:
-  enableUserAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("cluster-monitoring-config".to_string()),
-                namespace: Some("openshift-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client.apply(&cm, Some("openshift-monitoring")).await?;
-
-        Ok(Outcome::success(
-            "updated cluster-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn update_user_workload_monitoring_config_cm(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let mut data = BTreeMap::new();
-        data.insert(
-            "config.yaml".to_string(),
-            r#"
-alertmanager: 
-  enabled: true
-  enableAlertmanagerConfig: true
-"#
-            .to_string(),
-        );
-        let cm = ConfigMap {
-            metadata: ObjectMeta {
-                name: Some("user-workload-monitoring-config".to_string()),
-                namespace: Some("openshift-user-workload-monitoring".to_string()),
-                ..Default::default()
-            },
-            data: Some(data),
-            ..Default::default()
-        };
-        client
-            .apply(&cm, Some("openshift-user-workload-monitoring"))
-            .await?;
-
-        Ok(Outcome::success(
-            "updated openshift-user-monitoring-config-map".to_string(),
-        ))
-    }
-
-    pub async fn verify_user_workload(
-        &self,
-        client: &Arc<K8sClient>,
-    ) -> Result<Outcome, InterpretError> {
-        let namespace = "openshift-user-workload-monitoring";
-        let alertmanager_name = "alertmanager-user-workload-0";
-        let prometheus_name = "prometheus-user-workload-0";
-        client
-            .wait_for_pod_ready(alertmanager_name, Some(namespace))
-            .await?;
-        client
-            .wait_for_pod_ready(prometheus_name, Some(namespace))
-            .await?;
-
-        Ok(Outcome::success(format!(
-            "pods: {}, {} ready in ns: {}",
-            alertmanager_name, prometheus_name, namespace
-        )))
-    }
-}

harmony/src/modules/monitoring/okd/mod.rs

@@ -1 +0,0 @@
-pub mod enable_user_workload;