Squashed 'acm-hub-bootstrap/' content from commit 4b79b1a0

git-subtree-dir: acm-hub-bootstrap git-subtree-split: 4b79b1a0be6da2a9efc9ace8871b4762342da70b
2025-04-14 23:43:59 -05:00
commit 939177be6b
80 changed files with 3126 additions and 0 deletions
--- a/common/scripts/deploy-pattern.sh
+++ b/common/scripts/deploy-pattern.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+set -o pipefail
+
+RUNS=10
+WAIT=15
+# Retry five times because the CRD might not be fully installed yet
+echo -n "Installing pattern: "
+for i in $(seq 1 ${RUNS}); do \
+    exec 3>&1 4>&2
+    OUT=$( { helm template --include-crds --name-template $* 2>&4 | oc apply -f- 2>&4 1>&3; } 4>&1 3>&1)
+    ret=$?
+    exec 3>&- 4>&-
+    if [ ${ret} -eq 0 ]; then
+        break;
+    else
+        echo -n "."
+        sleep "${WAIT}"
+    fi
+done
+
+# All the runs failed
+if [ ${i} -eq ${RUNS} ]; then
+    echo "Installation failed [${i}/${RUNS}]. Error:"
+    echo "${OUT}"
+    exit 1
+fi
+echo "Done"
--- a/common/scripts/determine-main-clustergroup.sh
+++ b/common/scripts/determine-main-clustergroup.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+PATTERN_DIR="$1"
+
+if [ -z "$PATTERN_DIR" ]; then
+    PATTERN_DIR="."
+fi
+
+CGNAME=$(yq '.main.clusterGroupName' "$PATTERN_DIR/values-global.yaml")
+
+if [ -z "$CGNAME" ] || [ "$CGNAME" == "null" ]; then
+    echo "Error - cannot detrmine clusterGroupName"
+    exit 1
+fi
+
+echo "$CGNAME"
--- a/common/scripts/determine-pattern-name.sh
+++ b/common/scripts/determine-pattern-name.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+PATTERN_DIR="$1"
+
+if [ -z "$PATTERN_DIR" ]; then
+    PATTERN_DIR="."
+fi
+
+PATNAME=$(yq '.global.pattern' "$PATTERN_DIR/values-global.yaml" 2>/dev/null)
+
+if [ -z "$PATNAME" ] || [ "$PATNAME" == "null" ]; then
+    PATNAME="$(basename "$PWD")"
+fi
+
+echo "$PATNAME"
--- a/common/scripts/determine-secretstore-backend.sh
+++ b/common/scripts/determine-secretstore-backend.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+PATTERN_DIR="$1"
+
+if [ -z "$PATTERN_DIR" ]; then
+    PATTERN_DIR="."
+fi
+
+BACKEND=$(yq '.global.secretStore.backend' "$PATTERN_DIR/values-global.yaml" 2>/dev/null)
+
+if [ -z "$BACKEND" -o "$BACKEND" == "null" ]; then
+    BACKEND="vault"
+fi
+
+echo "$BACKEND"
--- a/common/scripts/display-secrets-info.sh
+++ b/common/scripts/display-secrets-info.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -eu
+
+get_abs_filename() {
+  # $1 : relative filename
+  echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
+}
+
+SCRIPT=$(get_abs_filename "$0")
+SCRIPTPATH=$(dirname "${SCRIPT}")
+COMMONPATH=$(dirname "${SCRIPTPATH}")
+PATTERNPATH=$(dirname "${COMMONPATH}")
+
+if [ "$#" -ge 1 ]; then
+    export VALUES_SECRET=$(get_abs_filename "${1}")
+fi
+
+if [[ "$#" == 2 ]]; then
+    SECRETS_BACKING_STORE="$2"
+else
+    SECRETS_BACKING_STORE="$($SCRIPTPATH/determine-secretstore-backend.sh)"
+fi
+
+PATTERN_NAME=$(basename "`pwd`")
+
+EXTRA_PLAYBOOK_OPTS="${EXTRA_PLAYBOOK_OPTS:-}"
+
+ansible-playbook -e pattern_name="${PATTERN_NAME}" -e pattern_dir="${PATTERNPATH}" -e secrets_backing_store="${SECRETS_BACKING_STORE}" -e hide_sensitive_output=false ${EXTRA_PLAYBOOK_OPTS} "rhvp.cluster_utils.display_secrets_info"
--- a/common/scripts/load-k8s-secrets.sh
+++ b/common/scripts/load-k8s-secrets.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -eu
+
+get_abs_filename() {
+  # $1 : relative filename
+  echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
+}
+
+SCRIPT=$(get_abs_filename "$0")
+SCRIPTPATH=$(dirname "${SCRIPT}")
+COMMONPATH=$(dirname "${SCRIPTPATH}")
+PATTERNPATH=$(dirname "${COMMONPATH}")
+
+PATTERN_NAME=${1:-$(basename "`pwd`")}
+
+EXTRA_PLAYBOOK_OPTS="${EXTRA_PLAYBOOK_OPTS:-}"
+
+ansible-playbook -e pattern_name="${PATTERN_NAME}" -e pattern_dir="${PATTERNPATH}" ${EXTRA_PLAYBOOK_OPTS} "rhvp.cluster_utils.k8s_secrets"
--- a/common/scripts/make-common-subtree.sh
+++ b/common/scripts/make-common-subtree.sh
@@ -0,0 +1,76 @@
+#!/bin/sh
+
+if [ "$1" = "-h" ]; then
+	echo "This script will convert common into a subtree and add a remote to help manage it."
+	echo "The script takes three positional arguments, as follows:"
+	echo
+	echo "$0 <subtree_repo> <subtree_branch> <subtree_remote_name>"
+	echo
+	echo "Run without arguments, the script would run as if these arguments had been passed:"
+	echo "$0 https://github.com/validatedpatterns/common.git main common-upstream"
+	echo
+	echo "Please ensure the git subtree command is available. On RHEL/Fedora, the git subtree command"
+	echo "is in a separate package called git-subtree"
+	exit 1
+fi
+
+if [ -f '/etc/redhat-release' ]; then
+  rpm -qa | grep git-subtree 2>&1
+  if [ ! $? = 0 ]; then
+    echo "you need to install git-subtree"
+    echo "would you like to install it now?"
+    select ANS in yes no
+    do
+      case $ANS in
+        yes)
+          sudo dnf install git-subtree -y
+          break
+          ;;
+        no)
+          exit
+          break
+          ;;
+        *)
+          echo "You must enter yes or no"
+          ;;
+      esac
+    done
+  fi
+fi
+
+if [ "$1" ]; then
+	subtree_repo=$1
+else
+	subtree_repo=https://github.com/validatedpatterns/common.git
+fi
+
+if [ "$2" ]; then
+	subtree_branch=$2
+else
+	subtree_branch=main
+fi
+
+if [ "$3" ]; then
+	subtree_remote=$3
+else
+	subtree_remote=common-upstream
+fi
+
+git diff --quiet || (echo "This script must be run on a clean working tree" && exit 1)
+
+echo "Changing directory to project root"
+cd `git rev-parse --show-toplevel`
+
+echo "Removing existing common and replacing it with subtree from $subtree_repo $subtree_remote"
+rm -rf common
+
+echo "Committing removal of common"
+(git add -A :/ && git commit -m "Removed previous version of common to convert to subtree from $subtree_repo $subtree_branch") || exit 1
+
+echo "Adding (possibly replacing) subtree remote $subtree_remote"
+git remote rm "$subtree_remote"
+git remote add -f "$subtree_remote" "$subtree_repo" || exit 1
+git subtree add --prefix=common "$subtree_remote" "$subtree_branch" || exit 1
+
+echo "Complete.  You may now push these results if you are satisfied"
+exit 0
--- a/common/scripts/manage-secret-app.sh
+++ b/common/scripts/manage-secret-app.sh
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+APP=$1
+STATE=$2
+
+MAIN_CLUSTERGROUP_FILE="./values-$(common/scripts/determine-main-clustergroup.sh).yaml"
+MAIN_CLUSTERGROUP_PROJECT="$(common/scripts/determine-main-clustergroup.sh)"
+
+case "$APP" in
+    "vault")
+        APP_NAME="vault"
+        NAMESPACE="vault"
+        PROJECT="$MAIN_CLUSTERGROUP_PROJECT"
+        CHART_NAME="hashicorp-vault"
+        CHART_VERSION=0.1.*
+
+    ;;
+    "golang-external-secrets")
+        APP_NAME="golang-external-secrets"
+        NAMESPACE="golang-external-secrets"
+        PROJECT="$MAIN_CLUSTERGROUP_PROJECT"
+        CHART_NAME="golang-external-secrets"
+        CHART_VERSION=0.1.*
+
+    ;;
+    *)
+        echo "Error - cannot manage $APP can only manage vault and golang-external-secrets"
+        exit 1
+    ;;
+esac
+
+case "$STATE" in
+    "present")
+        common/scripts/manage-secret-namespace.sh "$NAMESPACE" "$STATE"
+
+        RES=$(yq ".clusterGroup.applications[] | select(.path == \"$CHART_LOCATION\")" "$MAIN_CLUSTERGROUP_FILE" 2>/dev/null)
+        if [ -z "$RES" ]; then
+            echo "Application with chart location $CHART_LOCATION not found, adding"
+            yq -i ".clusterGroup.applications.$APP_NAME = { \"name\": \"$APP_NAME\", \"namespace\": \"$NAMESPACE\", \"project\": \"$PROJECT\", \"chart\": \"$CHART_NAME\",  \"chartVersion\": \"$CHART_VERSION\"}" "$MAIN_CLUSTERGROUP_FILE"
+        fi
+    ;;
+    "absent")
+        common/scripts/manage-secret-namespace.sh "$NAMESPACE" "$STATE"
+        echo "Removing application wth chart location $CHART_LOCATION"
+        yq -i "del(.clusterGroup.applications[] | select(.chart == \"$CHART_NAME\"))" "$MAIN_CLUSTERGROUP_FILE"
+    ;;
+    *)
+        echo "$STATE not supported"
+        exit 1
+    ;;
+esac
+
+exit 0
--- a/common/scripts/manage-secret-namespace.sh
+++ b/common/scripts/manage-secret-namespace.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+NAMESPACE=$1
+STATE=$2
+
+MAIN_CLUSTERGROUP_FILE="./values-$(common/scripts/determine-main-clustergroup.sh).yaml"
+MAIN_CLUSTERGROUP_PROJECT="$(common/scripts/determine-main-clustergroup.sh)"
+
+case "$STATE" in
+    "present")
+
+        RES=$(yq ".clusterGroup.namespaces[] | select(. == \"$NAMESPACE\")" "$MAIN_CLUSTERGROUP_FILE" 2>/dev/null)
+        if [ -z "$RES" ]; then
+            echo "Namespace $NAMESPACE not found, adding"
+            yq -i ".clusterGroup.namespaces += [ \"$NAMESPACE\" ]" "$MAIN_CLUSTERGROUP_FILE"
+        fi
+    ;;
+    "absent")
+        echo "Removing namespace $NAMESPACE"
+        yq -i "del(.clusterGroup.namespaces[] | select(. == \"$NAMESPACE\"))" "$MAIN_CLUSTERGROUP_FILE"
+    ;;
+    *)
+        echo "$STATE not supported"
+        exit 1
+    ;;
+esac
+
+exit 0
--- a/common/scripts/pattern-util.sh
+++ b/common/scripts/pattern-util.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+
+function is_available {
+  command -v $1 >/dev/null 2>&1 || { echo >&2 "$1 is required but it's not installed. Aborting."; exit 1; }
+}
+
+function version {
+    echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'
+}
+
+if [ -z "$PATTERN_UTILITY_CONTAINER" ]; then
+	PATTERN_UTILITY_CONTAINER="quay.io/hybridcloudpatterns/utility-container"
+fi
+# If PATTERN_DISCONNECTED_HOME is set it will be used to populate both PATTERN_UTILITY_CONTAINER
+# and PATTERN_INSTALL_CHART automatically
+if [ -n "${PATTERN_DISCONNECTED_HOME}" ]; then
+    PATTERN_UTILITY_CONTAINER="${PATTERN_DISCONNECTED_HOME}/utility-container"
+    PATTERN_INSTALL_CHART="oci://${PATTERN_DISCONNECTED_HOME}/pattern-install"
+    echo "PATTERN_DISCONNECTED_HOME is set to ${PATTERN_DISCONNECTED_HOME}"
+    echo "Setting the following variables:"
+    echo "  PATTERN_UTILITY_CONTAINER: ${PATTERN_UTILITY_CONTAINER}"
+    echo "  PATTERN_INSTALL_CHART: ${PATTERN_INSTALL_CHART}"
+fi
+
+readonly commands=(podman)
+for cmd in ${commands[@]}; do is_available "$cmd"; done
+
+UNSUPPORTED_PODMAN_VERSIONS="1.6 1.5"
+PODMAN_VERSION_STR=$(podman --version)
+for i in ${UNSUPPORTED_PODMAN_VERSIONS}; do
+	# We add a space
+	if echo "${PODMAN_VERSION_STR}" | grep -q -E "\b${i}"; then
+		echo "Unsupported podman version. We recommend > 4.3.0"
+		podman --version
+		exit 1
+	fi
+done
+
+# podman --version outputs:
+# podman version 4.8.2
+PODMAN_VERSION=$(echo "${PODMAN_VERSION_STR}" | awk '{ print $NF }')
+
+# podman < 4.3.0 do not support keep-id:uid=...
+if [ $(version "${PODMAN_VERSION}") -lt $(version "4.3.0") ]; then
+    PODMAN_ARGS="-v ${HOME}:/root"
+else
+    # We do not rely on bash's $UID and $GID because on MacOSX $GID is not set
+    MYNAME=$(id -n -u)
+    MYUID=$(id -u)
+    MYGID=$(id -g)
+    PODMAN_ARGS="--passwd-entry ${MYNAME}:x:${MYUID}:${MYGID}::/pattern-home:/bin/bash --user ${MYUID}:${MYGID} --userns keep-id:uid=${MYUID},gid=${MYGID}"
+
+fi
+
+if [ -n "$KUBECONFIG" ]; then
+    if [[ ! "${KUBECONFIG}" =~ ^$HOME* ]]; then
+        echo "${KUBECONFIG} is pointing outside of the HOME folder, this will make it unavailable from the container."
+        echo "Please move it somewhere inside your $HOME folder, as that is what gets bind-mounted inside the container"
+        exit 1
+    fi
+fi
+
+# Detect if we use podman machine. If we do not then we bind mount local host ssl folders
+# if we are using podman machine then we do not bind mount anything (for now!)
+REMOTE_PODMAN=$(podman system connection list -q | wc -l)
+if [ $REMOTE_PODMAN -eq 0 ]; then # If we are not using podman machine we check the hosts folders
+    # We check /etc/pki/tls because on ubuntu /etc/pki/fwupd sometimes
+    # exists but not /etc/pki/tls and we do not want to bind mount in such a case
+    # as it would find no certificates at all.
+    if [ -d /etc/pki/tls ]; then
+        PKI_HOST_MOUNT_ARGS="-v /etc/pki:/etc/pki:ro"
+    elif [ -d /etc/ssl ]; then
+        PKI_HOST_MOUNT_ARGS="-v /etc/ssl:/etc/ssl:ro"
+    else
+        PKI_HOST_MOUNT_ARGS="-v /usr/share/ca-certificates:/usr/share/ca-certificates:ro"
+    fi
+else
+    PKI_HOST_MOUNT_ARGS=""
+fi
+
+# Copy Kubeconfig from current environment. The utilities will pick up ~/.kube/config if set so it's not mandatory
+# $HOME is mounted as itself for any files that are referenced with absolute paths
+# $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials
+
+podman run -it --rm --pull=newer \
+    --security-opt label=disable \
+    -e EXTRA_HELM_OPTS \
+    -e EXTRA_PLAYBOOK_OPTS \
+    -e TARGET_ORIGIN \
+    -e TARGET_SITE \
+    -e TARGET_BRANCH \
+    -e NAME \
+    -e TOKEN_SECRET \
+    -e TOKEN_NAMESPACE \
+    -e VALUES_SECRET \
+    -e KUBECONFIG \
+    -e PATTERN_INSTALL_CHART \
+    -e PATTERN_DISCONNECTED_HOME \
+    -e K8S_AUTH_HOST \
+    -e K8S_AUTH_VERIFY_SSL \
+    -e K8S_AUTH_SSL_CA_CERT \
+    -e K8S_AUTH_USERNAME \
+    -e K8S_AUTH_PASSWORD \
+    -e K8S_AUTH_TOKEN \
+    ${PKI_HOST_MOUNT_ARGS} \
+    -v "${HOME}":"${HOME}" \
+    -v "${HOME}":/pattern-home \
+    ${PODMAN_ARGS} \
+    ${EXTRA_ARGS} \
+    -w "$(pwd)" \
+    "$PATTERN_UTILITY_CONTAINER" \
+    $@
--- a/common/scripts/preview-all.sh
+++ b/common/scripts/preview-all.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+REPO=$1; shift;
+TARGET_BRANCH=$1; shift
+
+HUB=$( yq ".main.clusterGroupName" values-global.yaml )
+MANAGED_CLUSTERS=$( yq ".clusterGroup.managedClusterGroups.[].name" values-$HUB.yaml )
+ALL_CLUSTERS=( $HUB $MANAGED_CLUSTERS )
+
+CLUSTER_INFO_OUT=$(oc cluster-info 2>&1)
+CLUSTER_INFO_RET=$?
+if [ $CLUSTER_INFO_RET -ne 0 ]; then
+    echo "Could not access the cluster:"
+    echo "${CLUSTER_INFO_OUT}"
+    exit 1
+fi
+
+for cluster in ${ALL_CLUSTERS[@]}; do
+    # We always add clustergroup as it is the entry point and it gets special cased in preview.sh.
+    APPS="clustergroup $( yq ".clusterGroup.applications.[].name" values-$cluster.yaml )"
+    for app in $APPS; do
+        printf "# Parsing application $app from cluster $cluster\n"
+        common/scripts/preview.sh $cluster $app $REPO $TARGET_BRANCH
+    done
+done
--- a/common/scripts/preview.sh
+++ b/common/scripts/preview.sh
@@ -0,0 +1,118 @@
+#!/bin/bash
+
+# DISCLAIMER
+# 
+# - Parsing of applications needs to be more clever.
+# - There is currently not a mechanism to actually preview against multiple clusters 
+# (i.e. a hub and a remote). All previews will be done against the current.
+# - Make output can be included in the YAML.
+
+SITE=$1; shift
+APPNAME=$1; shift
+GIT_REPO=$1; shift
+GIT_BRANCH=$1; shift
+
+if [ "${APPNAME}" != "clustergroup" ]; then
+  # This covers the following case:
+  # foobar:
+  #   name: foo
+  #   namespace: foo
+  #   project: foo
+  #   path: charts/all/foo
+  # So we retrieve the actual index ("foobar") given the name attribute of the application
+  APP=$(yq ".clusterGroup.applications | with_entries(select(.value.name == \"$APPNAME\")) | keys | .[0]" values-$SITE.yaml)
+  isLocalHelmChart=$(yq ".clusterGroup.applications.$APP.path" values-$SITE.yaml)
+  if [ $isLocalHelmChart != "null" ]; then
+    chart=$(yq ".clusterGroup.applications.$APP.path" values-$SITE.yaml)
+  else
+    helmrepo=$(yq ".clusterGroup.applications.$APP.repoURL" values-$SITE.yaml)
+    helmrepo="${helmrepo:+oci://quay.io/hybridcloudpatterns}"
+    chartversion=$(yq ".clusterGroup.applications.$APP.chartVersion" values-$SITE.yaml)
+    chartname=$(yq ".clusterGroup.applications.$APP.chart" values-$SITE.yaml)
+    chart="${helmrepo}/${chartname} --version ${chartversion}"
+  fi
+  namespace=$(yq ".clusterGroup.applications.$APP.namespace" values-$SITE.yaml)
+else
+  APP=$APPNAME
+  clusterGroupChartVersion=$(yq ".main.multiSourceConfig.clusterGroupChartVersion" values-global.yaml)
+  helmrepo="oci://quay.io/hybridcloudpatterns"
+  chart="${helmrepo}/clustergroup --version ${clusterGroupChartVersion}"
+  namespace="openshift-operators"
+fi
+pattern=$(yq ".global.pattern" values-global.yaml)
+
+# You can override the default lookups by using OCP_{PLATFORM,VERSION,DOMAIN}
+# Note that when using the utility container you need to pass in the above variables
+# by export EXTRA_ARGS="-e OCP_PLATFORM -e OCP_VERSION -e OCP_DOMAIN" before
+# invoking pattern-util.sh
+platform=${OCP_PLATFORM:-$(oc get Infrastructure.config.openshift.io/cluster  -o jsonpath='{.spec.platformSpec.type}')}
+ocpversion=${OCP_VERSION:-$(oc get clusterversion/version -o jsonpath='{.status.desired.version}' | awk -F. '{print $1"."$2}')}
+domain=${OCP_DOMAIN:-$(oc get Ingress.config.openshift.io/cluster -o jsonpath='{.spec.domain}' | sed 's/^apps.//')}
+
+function replaceGlobals() {
+    output=$( echo $1 | sed -e 's/ //g' -e 's/\$//g' -e s@^-@@g  -e s@\'@@g )
+
+    output=$(echo $output | sed "s@{{.Values.global.clusterPlatform}}@${platform}@g")
+    output=$(echo $output | sed "s@{{.Values.global.clusterVersion}}@${ocpversion}@g")
+    output=$(echo $output | sed "s@{{.Values.global.clusterDomain}}@${domain}@g")
+
+    echo $output
+}
+
+function getOverrides() {
+    overrides=''
+    overrides=$( yq ".clusterGroup.applications.$APP.overrides[]" "values-$SITE.yaml" )
+    overrides=$( echo "$overrides" | tr -d '\n' )
+    overrides=$( echo "$overrides" | sed -e 's/name:/ --set/g; s/value: /=/g' )
+    if [ -n "$overrides" ]; then
+        echo "$overrides"
+    fi
+}
+
+
+CLUSTER_OPTS=""
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.pattern=$pattern"
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.repoURL=$GIT_REPO"
+CLUSTER_OPTS="$CLUSTER_OPTS --set main.git.repoURL=$GIT_REPO"
+CLUSTER_OPTS="$CLUSTER_OPTS --set main.git.revision=$GIT_BRANCH"
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.namespace=$namespace"
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.hubClusterDomain=apps.$domain"
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.localClusterDomain=apps.$domain"
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.clusterDomain=$domain"
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.clusterVersion=$ocpversion"
+CLUSTER_OPTS="$CLUSTER_OPTS --set global.clusterPlatform=$platform"
+
+
+sharedValueFiles=$(yq ".clusterGroup.sharedValueFiles" values-$SITE.yaml)
+appValueFiles=$(yq ".clusterGroup.applications.$APP.extraValueFiles" values-$SITE.yaml)
+isKustomize=$(yq ".clusterGroup.applications.$APP.kustomize" values-$SITE.yaml)
+OVERRIDES=$( getOverrides )
+
+VALUE_FILES="-f values-global.yaml -f values-$SITE.yaml"
+IFS=$'\n'
+for line in $sharedValueFiles; do
+    if [ $line != "null" ] && [ -f $line ]; then
+	    file=$(replaceGlobals $line)
+	    VALUE_FILES="$VALUE_FILES -f $PWD$file"
+    fi
+done
+
+for line in $appValueFiles; do
+    if [ $line != "null" ] && [ -f $line ]; then
+	    file=$(replaceGlobals $line)
+	    VALUE_FILES="$VALUE_FILES -f $PWD$file"
+    fi
+done
+
+if [ $isKustomize == "true" ]; then
+    kustomizePath=$(yq ".clusterGroup.applications.$APP.path" values-$SITE.yaml)
+    repoURL=$(yq ".clusterGroup.applications.$APP.repoURL" values-$SITE.yaml)
+    if [[ $repoURL == http* ]] || [[ $repoURL == git@ ]]; then
+         kustomizePath="${repoURL}/${kustomizePath}"
+    fi
+    cmd="oc kustomize ${kustomizePath}"
+    eval "$cmd"
+else
+    cmd="helm template $chart --name-template ${APP} -n ${namespace} ${VALUE_FILES} ${OVERRIDES} ${CLUSTER_OPTS}"
+    eval "$cmd"
+fi
--- a/common/scripts/process-secrets.sh
+++ b/common/scripts/process-secrets.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -eu
+
+get_abs_filename() {
+  # $1 : relative filename
+  echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
+}
+
+SCRIPT=$(get_abs_filename "$0")
+SCRIPTPATH=$(dirname "${SCRIPT}")
+COMMONPATH=$(dirname "${SCRIPTPATH}")
+PATTERNPATH=$(dirname "${COMMONPATH}")
+
+PATTERN_NAME=${1:-$(basename "`pwd`")}
+SECRETS_BACKING_STORE="$($SCRIPTPATH/determine-secretstore-backend.sh)"
+
+EXTRA_PLAYBOOK_OPTS="${EXTRA_PLAYBOOK_OPTS:-}"
+
+ansible-playbook -e pattern_name="${PATTERN_NAME}" -e pattern_dir="${PATTERNPATH}" -e secrets_backing_store="${SECRETS_BACKING_STORE}" ${EXTRA_PLAYBOOK_OPTS} "rhvp.cluster_utils.process_secrets"
--- a/common/scripts/set-secret-backend.sh
+++ b/common/scripts/set-secret-backend.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+BACKEND=$1
+
+yq -i ".global.secretStore.backend = \"$BACKEND\"" values-global.yaml
--- a/common/scripts/vault-utils.sh
+++ b/common/scripts/vault-utils.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -eu
+
+get_abs_filename() {
+  # $1 : relative filename
+  echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
+}
+
+SCRIPT=$(get_abs_filename "$0")
+SCRIPTPATH=$(dirname "${SCRIPT}")
+COMMONPATH=$(dirname "${SCRIPTPATH}")
+PATTERNPATH=$(dirname "${COMMONPATH}")
+
+# Parse arguments
+if [ $# -lt 1 ]; then
+  echo "Specify at least the command ($#): $*"
+  exit 1
+fi
+
+TASK="${1}"
+PATTERN_NAME=${2:-$(basename "`pwd`")}
+
+if [ -z ${TASK} ]; then
+	echo "Task is unset"
+	exit 1
+fi
+
+EXTRA_PLAYBOOK_OPTS="${EXTRA_PLAYBOOK_OPTS:-}"
+
+ansible-playbook -t "${TASK}" -e pattern_name="${PATTERN_NAME}" -e pattern_dir="${PATTERNPATH}" ${EXTRA_PLAYBOOK_OPTS} "rhvp.cluster_utils.vault"
--- a/common/scripts/write-token-kubeconfig.sh
+++ b/common/scripts/write-token-kubeconfig.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -eu
+
+OUTPUTFILE=${1:-"~/.kube/config"}
+
+get_abs_filename() {
+  # $1 : relative filename
+  echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
+}
+
+SCRIPT=$(get_abs_filename "$0")
+SCRIPTPATH=$(dirname "${SCRIPT}")
+COMMONPATH=$(dirname "${SCRIPTPATH}")
+PATTERNPATH=$(dirname "${COMMONPATH}")
+
+EXTRA_PLAYBOOK_OPTS="${EXTRA_PLAYBOOK_OPTS:-}"
+
+ansible-playbook -e pattern_dir="${PATTERNPATH}" -e kubeconfig_file="${OUTPUTFILE}" ${EXTRA_PLAYBOOK_OPTS} "rhvp.cluster_utils.write-token-kubeconfig"