feat: limits enforcement in runtime installation

charts/gitops-runtime/templates/hooks/pre-install/rbac.yaml

@@ -1,4 +1,4 @@
-{{- if  not .Values.installer.skipValidation }}
+{{- if  not (and .Values.installer.skipValidation .Values.installer.skipUsageValidation) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

charts/gitops-runtime/templates/hooks/pre-install/validate-usage.yaml

@@ -0,0 +1,49 @@
+{{- if  not .Values.installer.skipUsageValidation }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: validate-values-config
+  annotations:
+    helm.sh/hook: pre-install
+    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
+    helm.sh/hook-weight: "-10"
+data:
+  values.yaml: |
+{{ .Values | toYaml | indent 4 }}
+
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: validate-usage
+  annotations:
+    helm.sh/hook: pre-install
+    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      serviceAccountName: validate-values-sa
+      restartPolicy: Never
+      containers:
+      - name: validate-usage
+        image: "{{ .Values.installer.image.repository }}:{{ .Values.installer.image.tag | default .Chart.Version }}"
+        imagePullPolicy: {{ .Values.installer.image.pullPolicy }}
+        env:
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        command: ["sh", "-c"]
+        args: 
+        - |
+          cf account validate-usage --fail-condition=reached --subject=clusters --values /job_tmp/values.yaml --namespace ${NAMESPACE} --hook --log-level debug
+        volumeMounts:
+          - name: customized-values
+            mountPath: "/job_tmp"
+      volumes:
+        - name: customized-values
+          configMap:
+            name: validate-values-config
+{{- end }}

charts/gitops-runtime/values.yaml

@@ -177,6 +177,8 @@ global:
 installer:
   # -- if set to true, pre-install hook will *not* run
   skipValidation: false
+  # -- if set to true, pre-install hook will *not* run
+  skipUsageValidation: false
   image:
     repository: quay.io/codefresh/gitops-runtime-installer
     tag: ""

installer-image/Dockerfile

@@ -3,7 +3,7 @@ FROM debian:12.10-slim
 
 RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
 
-ARG CF_CLI_VERSION=v0.2.6
+ARG CF_CLI_VERSION=v0.2.7
 ARG TARGETARCH
 
 RUN apt-get update && apt-get install curl -y