Add devcontainer support to the repo (#98)

.devcontainer/Dockerfile

@@ -0,0 +1,82 @@
+FROM ubuntu:22.04
+RUN \
+  apt-get update && \
+  apt-get install -y bash ca-certificates gnupg make curl vim sudo jq && \
+  curl -sL https://deb.nodesource.com/setup_18.x -o nodesource_setup.sh && \
+  mkdir -p /etc/apt/keyrings && \
+  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
+  echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list && \
+  apt-get update && \
+  apt-get install -y nodejs && \
+  apt-get clean && \
+  curl -o /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.35.2/yq_linux_amd64 && \
+  chmod +x /usr/local/bin/yq
+RUN \
+  curl -q -l -o /tmp/go.tgz "https://dl.google.com/go/go1.21.4.linux-amd64.tar.gz" && \
+  cd /usr/local && \
+  tar -xvf /tmp/go.tgz && \
+  rm -f /tmp/go.tgz && \
+  cd /
+RUN \
+  curl -L -o /usr/local/bin/minikube https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64 && \
+  chmod +x /usr/local/bin/minikube && \
+  curl -L -o /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" && \
+  chmod +x /usr/local/bin/kubectl
+
+RUN \
+  curl -fsSL -o /tmp/get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 && \
+  chmod +x /tmp/get_helm.sh && \
+  /tmp/get_helm.sh && \
+  rm /tmp/get_helm.sh
+
+RUN \
+  groupadd -g 10001 dev && \
+  useradd --uid 10001 -g 10001 -m dev && \
+  echo 'dev ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/dev && \
+  chmod 400 /etc/sudoers.d/dev
+
+ENV PATH /usr/local/go/bin:$PATH
+
+RUN \
+  npm install -g "@bitnami/[email protected]"
+
+RUN \
+  go install github.com/onsi/ginkgo/v2/ginkgo@latest
+
+RUN \
+  apt-get install -y git zsh strace lsof graphviz && \
+  mv /root/go/bin/ginkgo /usr/local/bin
+
+RUN \
+  curl -L -o /tmp/ct.tar.gz https://github.com/helm/chart-testing/releases/download/v3.8.0/chart-testing_3.8.0_linux_amd64.tar.gz && \
+  cd /usr/local/bin && \
+  tar -xvf /tmp/ct.tar.gz ct && \
+  cd / && \
+  tar -xvf /tmp/ct.tar.gz etc && \
+  mkdir /etc/ct && \
+  mv /etc/chart_schema.yaml /etc/ct/ && \
+  mv /etc/lintconf.yaml /etc/ct/ && \
+  curl -o /tmp/gh.tar.gz https://github.com/cli/cli/releases/download/v2.40.0/gh_2.40.0_linux_amd64.tar.gz -L && \
+  cd && \
+  cd /tmp && \
+  tar -zxvf gh.tar.gz && \
+  mv gh_*_linux_amd64/bin/* /usr/local/bin && \
+  mkdir -p /usr/local/share/main/man1/ && \
+  mv gh_*_linux_amd64/share/man/man1/* /usr/local/share/main/man1/ && \
+  cd
+
+RUN \
+  cd /tmp && \
+  git clone https://github.com/devcontainers/features && \
+  cd features/src/docker-in-docker && \
+  export MOBY=true && \
+  export INSTALLDOCKERBUILDX=false && \
+  ./install.sh && \
+  cd ../../../ && \
+  rm -rf features
+
+RUN \
+  usermod -a -G docker dev
+
+USER dev
+

.devcontainer/devcontainer.json

@@ -0,0 +1,30 @@
+{
+	"name": "spiffe-helm-charts-hardened",
+	"image": "ghcr.io/spiffe/helm-charts-hardened-devcontainer:latest",
+	"features": {
+		"ghcr.io/devcontainers/features/docker-in-docker:2": {
+			"version": "latest",
+			"moby": true,
+			"installDockerBuildx": false
+		}
+	},
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"ms-kubernetes-tools.vscode-kubernetes-tools"
+			],
+			"settings": {
+				"terminal.integrated.defaultProfile.linux": "bash",
+				"terminal.integrated.profiles.linux": {
+					"zsh": { "path": "/bin/zsh" },
+					"bash": { "path": "/bin/bash" }
+				}
+			}
+		}
+	},
+	"postStartCommand": "minikube start && helm upgrade --install -n spire-server spire-crds charts/spire-crds --create-namespace && kubectl version",
+	"hostRequirements": {
+		"cpus": 1
+	},
+	"remoteUser": "dev"
+}

.github/workflows/update-devcontainer-image.yaml

@@ -0,0 +1,44 @@
+name: Update devcontainer image
+
+on:
+  schedule:
+    - cron: '0 8 * * 1'
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+env:
+  HELM_VERSION: v3.11.1
+
+jobs:
+  build-and-push-devcontainer-image:
+    runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+
+    env:
+      COSIGN_EXPERIMENTAL: 1
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Install cosign
+        uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
+        with:
+          cosign-release: v1.13.1
+      - name: Install regctl
+        uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main
+      - name: Log in to GHCR
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build / Push images
+        run: |
+          set -e
+          cd .devcontainer/
+          docker build -t ghcr.io/spiffe/helm-charts-hardened-devcontainer:latest .
+          docker push ghcr.io/spiffe/helm-charts-hardened-devcontainer:latest

CONTRIBUTING.md

@@ -60,3 +60,7 @@ Any changes to Chart.yaml or values.yaml require an update of the README.md. Thi
 In contrary to many other Helm repositories we do NOT require contributors to increate the Chart version. We have customized our release pipeline so we can bundle various PRs in a single release. Maintainers of the helm-charts in this repo will take care of the semantic versioning.
 
 [readme-generator]: https://github.com/bitnami-labs/readme-generator-for-helm "Auto generate READMEs for Helm Charts."
+
+## devcontainer support
+
+We have a usable devcontainer with all the dev tools preinstalled to make contributions easier. You should be able to use it via Codespaces (https://github.com/codespaces/), Visual Studio Code (https://code.visualstudio.com/), DevPod (https://devpod.sh), etc. Please consult the documentation for those tools for how to use them.