feat(shared): unified auth for shared v3 apps (external + in-cluster strong identity)

.gitattributes

@@ -0,0 +1 @@
+framework/app-gateway/upstream-charts/** linguist-vendored

.github/workflows/check.yaml

@@ -67,7 +67,7 @@ jobs:
           bash build/package.sh
 
       - name: Run chart-testing (lint)
-        run: ct lint --chart-dirs .dist/wizard/config,.dist/wizard/config/apps,.dist/wizard/config/gpu --check-version-increment=false --all --validate-maintainers=false
+        run: ct lint --chart-dirs .dist/wizard/config,.dist/wizard/config/apps,.dist/wizard/config/gpu,.dist/wizard/config/app-gateway-system --check-version-increment=false --all --validate-maintainers=false
 
   test-version:
     needs: check-permission

.github/workflows/module_appgateway_publish_pki_guardian.yaml

@@ -0,0 +1,51 @@
+name: Publish app-gateway linkerd-pki-guardian to Dockerhub
+
+on:
+  workflow_dispatch:
+    inputs:
+      tags:
+        description: "Release tag (must not be latest)"
+        required: true
+
+jobs:
+  publish_pki_guardian:
+    runs-on: ubuntu-latest
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: Validate tag input
+        run: |
+          if [ "${{ github.event.inputs.tags }}" = "latest" ]; then
+            echo "tag 'latest' is forbidden"
+            exit 1
+          fi
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+
+      - name: Build and push multi-arch linkerd-pki-guardian image
+        id: build
+        uses: docker/build-push-action@v3
+        with:
+          push: true
+          tags: beclab/linkerd-pki-guardian:${{ github.event.inputs.tags }}
+          file: framework/app-gateway/cmd/linkerd-pki-guardian/Dockerfile
+          context: framework/app-gateway
+          platforms: linux/amd64,linux/arm64
+
+      - name: Print digest for chart image pin
+        run: |
+          echo "Published image digest: beclab/linkerd-pki-guardian@${{ steps.build.outputs.digest }}"
+          echo "Pin this digest in app-gateway-system values.yaml linkerdPkiGuardian.image.digest"

.github/workflows/module_appservice_publish_d2sidecar.yaml

@@ -0,0 +1,55 @@
+name: Publish app-service d2 sidecar to Dockerhub
+
+on:
+  workflow_dispatch:
+    inputs:
+      tags:
+        description: "Release tag suffix (must not be latest)"
+        required: true
+
+jobs:
+  publish_d2_sidecar:
+    runs-on: ubuntu-latest
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: Validate tag input
+        run: |
+          if [ "${{ github.event.inputs.tags }}" = "latest" ]; then
+            echo "tag 'latest' is forbidden"
+            exit 1
+          fi
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASS }}
+
+      - name: Build and push multi-arch d2 sidecar image
+        id: build
+        uses: docker/build-push-action@v3
+        with:
+          push: true
+          tags: beclab/nginx:${{ github.event.inputs.tags }}-alpine-njs-olares
+          file: framework/app-service/Dockerfile.d2sidecar
+          context: framework/app-service
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            NJS_OLARES_REV=${{ github.event.inputs.tags }}
+            SOURCE_COMMIT=${{ github.sha }}
+            BUILD_DATE=${{ github.run_id }}
+
+      - name: Print digest for constants.D2SidecarImageDigest
+        run: |
+          echo "Published image digest: beclab/nginx@${{ steps.build.outputs.digest }}"
+          echo "Use this value in constants.D2SidecarImageDigest"

.gitignore

@@ -45,6 +45,9 @@ cli/olares-cli*
 
 framework/app-service/bin
 
+# Legacy generated tree (vendor source: .olares/config/app-gateway-vendor/)
+framework/app-gateway/vendor-charts/
+
 /files/
 market/
 user-service/

build/assemble-app-gateway-system.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+BASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${BASE_DIR}/.." && pwd)"
+
+UPSTREAM_LOCK="${REPO_ROOT}/framework/app-gateway/upstream-charts/UPSTREAM.lock.yaml"
+UPSTREAM_DIR="${REPO_ROOT}/framework/app-gateway/upstream-charts"
+SYSTEM_DIR="${REPO_ROOT}/framework/app-gateway/.olares/config/app-gateway-system"
+CHARTS_DIR="${SYSTEM_DIR}/charts"
+CRDS_DIR="${SYSTEM_DIR}/crds"
+VALUES_FILE="${SYSTEM_DIR}/values.yaml"
+VALUES_SRC_DIR="${REPO_ROOT}/framework/app-gateway/vendor-charts-values"
+
+required_paths=(
+  "${UPSTREAM_LOCK}"
+  "${UPSTREAM_DIR}/linkerd-control-plane-chart"
+  "${UPSTREAM_DIR}/linkerd-crds-chart"
+  "${UPSTREAM_DIR}/envoy-gateway-helm"
+  "${UPSTREAM_DIR}/envoy-gateway-crds-helm"
+  "${SYSTEM_DIR}/Chart.yaml"
+  "${VALUES_FILE}"
+  "${VALUES_SRC_DIR}/linkerd-values.yaml"
+  "${VALUES_SRC_DIR}/envoy-gateway-values.yaml"
+  "${VALUES_SRC_DIR}/linkerd-crds-values.yaml"
+  "${VALUES_SRC_DIR}/envoy-gateway-crds-values.yaml"
+)
+
+for path in "${required_paths[@]}"; do
+  if [ ! -e "${path}" ]; then
+    echo "missing required path: ${path}" >&2
+    exit 1
+  fi
+done
+
+lock_linkerd_version="$(awk -F'"' '/^linkerd_edge_chart_version:/ {print $2; exit}' "${UPSTREAM_LOCK}")"
+lock_envoy_version="$(awk -F'"' '/^envoy_gateway:/ {print $2; exit}' "${UPSTREAM_LOCK}")"
+
+if [ -z "${lock_linkerd_version}" ] || [ -z "${lock_envoy_version}" ]; then
+  echo "failed to parse chart versions from ${UPSTREAM_LOCK}" >&2
+  exit 1
+fi
+
+rm -rf "${CHARTS_DIR}" "${CRDS_DIR}"
+mkdir -p "${CHARTS_DIR}" "${CRDS_DIR}"
+
+for chart in linkerd-control-plane-chart linkerd-crds-chart envoy-gateway-helm envoy-gateway-crds-helm; do
+  cp -a "${UPSTREAM_DIR}/${chart}" "${CHARTS_DIR}/"
+done
+
+mkdir -p "${CRDS_DIR}/linkerd-crds" "${CRDS_DIR}/envoy-gateway-crds"
+cp -a "${UPSTREAM_DIR}/linkerd-crds-chart" "${CRDS_DIR}/linkerd-crds/chart"
+cp -a "${UPSTREAM_DIR}/envoy-gateway-crds-helm" "${CRDS_DIR}/envoy-gateway-crds/chart"
+cp -f "${VALUES_SRC_DIR}/linkerd-crds-values.yaml" "${CRDS_DIR}/linkerd-crds/values.yaml"
+cp -f "${VALUES_SRC_DIR}/envoy-gateway-crds-values.yaml" "${CRDS_DIR}/envoy-gateway-crds/values.yaml"
+
+dependency_version() {
+  local alias_name="$1"
+  awk -v alias_name="${alias_name}" '
+    $1 == "-" && $2 == "name:" {in_dep=1; alias=""; version=""; next}
+    in_dep && $1 == "alias:" {alias=$2; next}
+    in_dep && $1 == "version:" {
+      version=$2
+      if (alias == alias_name) {
+        gsub(/"/, "", version)
+        print version
+        exit
+      }
+      next
+    }
+  ' "${SYSTEM_DIR}/Chart.yaml"
+}
+
+dependency_linkerd_version="$(dependency_version "linkerd")"
+dependency_envoy_version="$(dependency_version "envoy-gateway")"
+
+if [ "${dependency_linkerd_version}" != "${lock_linkerd_version}" ]; then
+  echo "app-gateway-system dependency linkerd version mismatch: got ${dependency_linkerd_version}, want ${lock_linkerd_version}" >&2
+  exit 1
+fi
+
+if [ "${dependency_envoy_version}" != "${lock_envoy_version}" ]; then
+  echo "app-gateway-system dependency envoy-gateway version mismatch: got ${dependency_envoy_version}, want ${lock_envoy_version}" >&2
+  exit 1
+fi
+
+python3 - "${VALUES_FILE}" "${VALUES_SRC_DIR}" <<'PY'
+import pathlib
+import sys
+import yaml
+
+values_file = pathlib.Path(sys.argv[1])
+values_src = pathlib.Path(sys.argv[2])
+
+with values_file.open("r", encoding="utf-8") as f:
+    values = yaml.safe_load(f) or {}
+
+with (values_src / "linkerd-values.yaml").open("r", encoding="utf-8") as f:
+    linkerd_values = yaml.safe_load(f) or {}
+
+with (values_src / "envoy-gateway-values.yaml").open("r", encoding="utf-8") as f:
+    envoy_values = yaml.safe_load(f) or {}
+
+values["linkerd"] = linkerd_values
+values["envoy-gateway"] = envoy_values
+
+linkerd = values.setdefault("linkerd", {})
+identity = linkerd.setdefault("identity", {})
+issuer = identity.setdefault("issuer", {})
+tls = issuer.setdefault("tls", {})
+
+placeholder_cert = "-----BEGIN CERTIFICATE-----\nPLACEHOLDER\n-----END CERTIFICATE-----\n"
+placeholder_key = "-----BEGIN PRIVATE KEY-----\nPLACEHOLDER\n-----END PRIVATE KEY-----\n"
+
+if not tls.get("crtPEM"):
+    tls["crtPEM"] = placeholder_cert
+if not tls.get("keyPEM"):
+    tls["keyPEM"] = placeholder_key
+if not linkerd.get("identityTrustAnchorsPEM"):
+    linkerd["identityTrustAnchorsPEM"] = placeholder_cert
+
+with values_file.open("w", encoding="utf-8") as f:
+    f.write("# AUTO-GENERATED by build/assemble-app-gateway-system.sh\n")
+    yaml.safe_dump(values, f, sort_keys=False)
+PY
+
+echo "assembled app-gateway-system chart assets"

build/build.sh

@@ -22,6 +22,7 @@ if [[ "${REPO_PATH}" != "" && "$REPO_PATH" != "/" ]]; then
 fi
 
 
+bash ${BASE_DIR}/assemble-app-gateway-system.sh
 DIST_PATH=${DIST_PATH} bash ${BASE_DIR}/package.sh
 
 bash ${BASE_DIR}/image-manifest.sh

build/package.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 
 
+BASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
 
 function run_cmd(){
     echo "$*"
@@ -76,6 +78,11 @@ run_cmd "cp -rf framework/bfl/.olares/config/launcher ${DIST}/wizard/config/"
 echo "packaging gpu ..."
 run_cmd "cp -rf infrastructure/gpu/.olares/config/gpu ${DIST}/wizard/config/"
 
+echo "assembling app-gateway-system chart ..."
+run_cmd "bash build/assemble-app-gateway-system.sh"
+
+echo "packaging app-gateway system ..."
+run_cmd "cp -rf framework/app-gateway/.olares/config/app-gateway-system ${DIST}/wizard/config/"
 
 echo "packaging env config ..."
 run_cmd "cp -rf build/system-env.yaml ${DIST}/system-env.yaml"

cli/go.mod

@@ -3,6 +3,7 @@ module github.com/beclab/Olares/cli
 go 1.24.11
 
 replace (
+	github.com/beclab/Olares/framework/app-gateway => ../framework/app-gateway
 	github.com/beclab/Olares/framework/oac => ../framework/oac
 	github.com/estesp/manifest-tool/v2 => github.com/estesp/manifest-tool/v2 v2.0.3
 	olares.com/backups-sdk => github.com/Above-Os/backups-sdk v0.1.40
@@ -12,9 +13,10 @@ require (
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/PaesslerAG/jsonpath v0.1.1
 	github.com/alecthomas/assert/v2 v2.11.0
+	github.com/beclab/Olares/framework/app-gateway v0.0.0
 	github.com/beclab/Olares/framework/app-service v0.0.0-20260311124303-23a6533bc2ad
 	github.com/beclab/Olares/framework/oac v0.0.0-00010101000000-000000000000
-	github.com/beclab/api v0.0.13
+	github.com/beclab/api v0.0.14
 	github.com/cavaliergopher/grab/v3 v3.0.1
 	github.com/containerd/containerd v1.7.29
 	github.com/decentralized-identity/web5-go v0.25.0

cli/go.sum

@@ -48,8 +48,8 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/beclab/Olares/framework/app-service v0.0.0-20260311124303-23a6533bc2ad h1:nmQCNbJNtgTqcusySeeyd9LQOK2jyk78QAjzmvyyPYg=
 github.com/beclab/Olares/framework/app-service v0.0.0-20260311124303-23a6533bc2ad/go.mod h1:D9wl7y3obLqXMqfubMROMgdxWAwInnKNrFC//d0nyIA=
-github.com/beclab/api v0.0.13 h1:j1mD9jEM8blE2ZhJigCe0B0X9APX0sHH0plGlBSOjak=
-github.com/beclab/api v0.0.13/go.mod h1:okd0RExsvSsuW5MsRh7v56Xex3vi5B26xHOGH3LT6yQ=
+github.com/beclab/api v0.0.14 h1:/KGHYsb1TpWzOLws2JfPhxpa0tOK9ZyLSDJlBZmY8ko=
+github.com/beclab/api v0.0.14/go.mod h1:okd0RExsvSsuW5MsRh7v56Xex3vi5B26xHOGH3LT6yQ=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=

cli/pkg/common/kube_runtime.go

@@ -315,7 +315,7 @@ func (a *Argument) SetMinikubeProfile(profile string) {
 	a.MinikubeProfile = profile
 	if profile == "" && a.SystemInfo.IsDarwin() {
 		fmt.Printf("\nNote: Minikube profile is not set, will try to use the default profile: \"%s\"\n", MinikubeDefaultProfile)
-		fmt.Println("if this is not expected, please specify it explicitly by setting the --profile/-p option\n")
+		fmt.Println("if this is not expected, please specify it explicitly by setting the --profile/-p option")
 		a.MinikubeProfile = MinikubeDefaultProfile
 	}
 }
@@ -324,7 +324,7 @@ func (a *Argument) SetWSLDistribution(distribution string) {
 	a.WSLDistribution = distribution
 	if distribution == "" && a.SystemInfo.IsWindows() {
 		fmt.Printf("\nNote: WSL distribution is not set, will try to use the default distribution: \"%s\"\n", WSLDefaultDistribution)
-		fmt.Println("if this is not expected, please specify it explicitly by setting the --distribution/-d option\n")
+		fmt.Println("if this is not expected, please specify it explicitly by setting the --distribution/-d option")
 		a.WSLDistribution = WSLDefaultDistribution
 	}
 }

cli/pkg/kubesphere/minikube.go

@@ -452,7 +452,7 @@ func (t *PatchCoreDNSSVC) Execute(runtime connector.Runtime) error {
 	coreDNSSVCPatchFilePath := filepath.Join(runtime.GetInstallerDir(), "deploy/patch-k3s.yaml")
 	_, err := runtime.GetRunner().Cmd(fmt.Sprintf("%s apply -f %s", kubectlcmd, coreDNSSVCPatchFilePath), false, true)
 	if err != nil {
-		return errors.Wrap(errors.WithStack(err), fmt.Sprintf("failed to patch coredns service", err))
+		return errors.Wrap(errors.WithStack(err), "failed to patch coredns service")
 	}
 	return nil
 }

cli/pkg/phase/cluster/linux.go

@@ -80,6 +80,7 @@ func (l *linuxInstallPhaseBuilder) installTerminus() phase {
 		&terminus.GetNATGatewayIPModule{},
 		&terminus.InstallAccountModule{},
 		&terminus.InstallSettingsModule{},
+		&terminus.InstallAppGatewayVendorModule{},
 		&terminus.InstallOsSystemModule{},
 		&terminus.InstallLauncherModule{},
 		&terminus.InstallAppsModule{},

cli/pkg/phase/cluster/macos.go

@@ -31,6 +31,7 @@ func (m *macosInstallPhaseBuilder) installTerminus() phase {
 		&terminus.GetNATGatewayIPModule{},
 		&terminus.InstallAccountModule{},
 		&terminus.InstallSettingsModule{},
+		&terminus.InstallAppGatewayVendorModule{},
 		&terminus.InstallOsSystemModule{},
 		&terminus.InstallLauncherModule{},
 		&terminus.InstallAppsModule{},