OSAC-1346: add public gRPC servers and server wiring for bare metal instances

charts/service/templates/grpc-server/authconfig.yaml

@@ -196,6 +196,15 @@ spec:
               "/osac.public.v1.Clusters/Update",
               "/osac.public.v1.ClusterCatalogItems/Get",
               "/osac.public.v1.ClusterCatalogItems/List",
+              "/osac.public.v1.BareMetalInstanceCatalogItems/Get",
+              "/osac.public.v1.BareMetalInstanceCatalogItems/List",
+              "/osac.public.v1.BareMetalInstanceTemplates/Get",
+              "/osac.public.v1.BareMetalInstanceTemplates/List",
+              "/osac.public.v1.BareMetalInstances/Create",
+              "/osac.public.v1.BareMetalInstances/Delete",
+              "/osac.public.v1.BareMetalInstances/Get",
+              "/osac.public.v1.BareMetalInstances/List",
+              "/osac.public.v1.BareMetalInstances/Update",
               "/osac.public.v1.ComputeInstanceTemplates/Get",
               "/osac.public.v1.ComputeInstanceTemplates/List",
               "/osac.public.v1.ComputeInstances/Create",
@@ -248,6 +257,17 @@ spec:
             }
           }
 
+          # Tenant admins can create and manage tenant-scoped bare metal catalog items.
+          # The application layer (generic server) enforces that the tenant field is set from caller identity.
+          allow if {
+            is_tenant_admin
+            grpc_method in {
+              "/osac.public.v1.BareMetalInstanceCatalogItems/Create",
+              "/osac.public.v1.BareMetalInstanceCatalogItems/Update",
+              "/osac.public.v1.BareMetalInstanceCatalogItems/Delete",
+            }
+          }
+
           # Tenant-scoped user management for tenant admins
           # Note: Tenant admins can manage users. IdP managers cannot (they only manage IdP config).
           # OPA performs method-level authorization (can this user call this method?).

internal/cmd/cli/create/baremetalinstance/create_bare_metal_instance_cmd.go

@@ -0,0 +1,188 @@
+/*
+Copyright (c) 2025 Red Hat Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the
+License. You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific
+language governing permissions and limitations under the License.
+*/
+
+package baremetalinstance
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"google.golang.org/protobuf/proto"
+
+	publicv1 "github.com/osac-project/fulfillment-service/internal/api/osac/public/v1"
+	"github.com/osac-project/fulfillment-service/internal/config"
+	"github.com/osac-project/fulfillment-service/internal/logging"
+	"github.com/osac-project/fulfillment-service/internal/reflection"
+	"github.com/osac-project/fulfillment-service/internal/terminal"
+)
+
+func Cmd() *cobra.Command {
+	runner := &runnerContext{}
+	result := &cobra.Command{
+		Use:                   "baremetalinstance [FLAG...]",
+		Aliases:               []string{string(proto.MessageName((*publicv1.BareMetalInstance)(nil)))},
+		Short:                 shortHelp,
+		Long:                  longHelp,
+		DisableFlagsInUseLine: true,
+		Args:                  cobra.NoArgs,
+		RunE:                  runner.run,
+	}
+	flags := result.Flags()
+	flags.StringVarP(
+		&runner.args.name,
+		"name",
+		"n",
+		"",
+		nameFlagHelp,
+	)
+	flags.StringVar(
+		&runner.args.catalogItem,
+		"catalog-item",
+		"",
+		catalogItemFlagHelp,
+	)
+	flags.StringVar(
+		&runner.args.sshKey,
+		"ssh-key",
+		"",
+		sshKeyFlagHelp,
+	)
+	flags.StringVar(
+		&runner.args.userData,
+		"user-data",
+		"",
+		userDataFlagHelp,
+	)
+	flags.StringVar(
+		&runner.args.runStrategy,
+		"run-strategy",
+		"",
+		runStrategyFlagHelp,
+	)
+
+	if err := result.MarkFlagRequired("catalog-item"); err != nil {
+		panic(fmt.Sprintf("failed to mark catalog-item flag as required: %v", err))
+	}
+	return result
+}
+
+type runnerContext struct {
+	args struct {
+		name        string
+		catalogItem string
+		sshKey      string
+		userData    string
+		runStrategy string
+	}
+	logger *slog.Logger
+}
+
+func (c *runnerContext) run(cmd *cobra.Command, _ []string) error {
+	ctx := cmd.Context()
+	c.logger = logging.LoggerFromContext(ctx)
+	console := terminal.ConsoleFromContext(ctx)
+
+	cfg := config.SettingsFromContext(ctx)
+	if !cfg.Armed() {
+		return fmt.Errorf("there is no configuration, run the 'login' command")
+	}
+
+	conn, err := cfg.Connect(ctx, cmd.Flags())
+	if err != nil {
+		return fmt.Errorf("failed to create gRPC connection: %w", err)
+	}
+	defer conn.Close()
+
+	helper, err := reflection.NewHelper().
+		SetLogger(c.logger).
+		SetConnection(conn).
+		AddPackages(cfg.Packages()).
+		Build()
+	if err != nil {
+		return fmt.Errorf("failed to create reflection tool: %w", err)
+	}
+	console.SetHelper(helper)
+
+	spec := publicv1.BareMetalInstanceSpec_builder{
+		CatalogItem: c.args.catalogItem,
+	}
+	if c.args.sshKey != "" {
+		sshKey := c.args.sshKey
+		spec.SshKey = &sshKey
+	}
+	if c.args.userData != "" {
+		userData := c.args.userData
+		spec.UserData = &userData
+	}
+	if c.args.runStrategy != "" {
+		val, ok := publicv1.BareMetalInstanceRunStrategy_value["BARE_METAL_INSTANCE_RUN_STRATEGY_"+strings.ToUpper(c.args.runStrategy)]
+		if !ok {
+			return fmt.Errorf(
+				"unknown run strategy %q, valid values are Always and Halted",
+				c.args.runStrategy,
+			)
+		}
+		rs := publicv1.BareMetalInstanceRunStrategy(val)
+		spec.RunStrategy = &rs
+	}
+
+	bmi := publicv1.BareMetalInstance_builder{
+		Metadata: publicv1.Metadata_builder{
+			Name: c.args.name,
+		}.Build(),
+		Spec: spec.Build(),
+	}.Build()
+
+	client := publicv1.NewBareMetalInstancesClient(conn)
+	response, err := client.Create(ctx, publicv1.BareMetalInstancesCreateRequest_builder{
+		Object: bmi,
+	}.Build())
+	if err != nil {
+		return fmt.Errorf("failed to create bare metal instance: %w", err)
+	}
+
+	console.Infof(ctx, "Created bare metal instance '%s'.\n", response.GetObject().GetId())
+	return nil
+}
+
+const shortHelp = `Create a bare metal instance.`
+
+const longHelp = `
+Create a bare metal instance.
+`
+
+const nameFlagHelp = `
+_NAME_ - Name of the bare metal instance.
+`
+
+const catalogItemFlagHelp = `
+_ID_ - Catalog item identifier or name. Required.
+`
+
+const sshKeyFlagHelp = `
+_KEY_ - SSH public key injected into the OS at provisioning time. Must be a
+valid OpenSSH public key. Immutable after creation.
+`
+
+const userDataFlagHelp = `
+_DATA_ - User data passed to the OS at first boot (e.g. cloud-init).
+Maximum 64 KB. Immutable after creation.
+`
+
+const runStrategyFlagHelp = `
+_STRATEGY_ - Run strategy controlling the power state. Valid values are
+{{ bt }}Always{{ bt }} (keep powered on) and {{ bt }}Halted{{ bt }}
+(power off).
+`

internal/cmd/cli/create/create_cmd.go

@@ -28,6 +28,7 @@ import (
 	"google.golang.org/protobuf/types/known/anypb"
 	"gopkg.in/yaml.v3"
 
+	"github.com/osac-project/fulfillment-service/internal/cmd/cli/create/baremetalinstance"
 	"github.com/osac-project/fulfillment-service/internal/cmd/cli/create/cluster"
 	"github.com/osac-project/fulfillment-service/internal/cmd/cli/create/computeinstance"
 	"github.com/osac-project/fulfillment-service/internal/cmd/cli/create/hub"
@@ -51,6 +52,7 @@ func Cmd() *cobra.Command {
 		Long:                  longHelp,
 		RunE:                  runner.run,
 	}
+	result.AddCommand(baremetalinstance.Cmd())
 	result.AddCommand(cluster.Cmd())
 	result.AddCommand(computeinstance.Cmd())
 	result.AddCommand(hub.Cmd())

internal/cmd/cli/describe/baremetalinstance/describe_baremetalinstance_cmd.go

@@ -0,0 +1,103 @@
+/*
+Copyright (c) 2025 Red Hat Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the
+License. You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific
+language governing permissions and limitations under the License.
+*/
+
+package baremetalinstance
+
+import (
+	"fmt"
+	"io"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/spf13/cobra"
+	"google.golang.org/protobuf/proto"
+
+	publicv1 "github.com/osac-project/fulfillment-service/internal/api/osac/public/v1"
+	"github.com/osac-project/fulfillment-service/internal/cmd/cli/lookup"
+	"github.com/osac-project/fulfillment-service/internal/config"
+	"github.com/osac-project/fulfillment-service/internal/terminal"
+)
+
+func Cmd() *cobra.Command {
+	result := &cobra.Command{
+		Use:                   "baremetalinstance [FLAG...] ID|NAME",
+		Aliases:               []string{"baremetalinstances"},
+		Short:                 shortHelp,
+		Long:                  longHelp,
+		DisableFlagsInUseLine: true,
+		Args:                  cobra.ExactArgs(1),
+		RunE:                  run,
+	}
+	return result
+}
+
+func run(cmd *cobra.Command, args []string) error {
+	ref := args[0]
+	ctx := cmd.Context()
+	console := terminal.ConsoleFromContext(ctx)
+
+	cfg := config.SettingsFromContext(ctx)
+	if !cfg.Armed() {
+		return fmt.Errorf("there is no configuration, run the 'login' command")
+	}
+
+	conn, err := cfg.Connect(ctx, cmd.Flags())
+	if err != nil {
+		return fmt.Errorf("failed to create gRPC connection: %w", err)
+	}
+	defer conn.Close()
+
+	client := publicv1.NewBareMetalInstancesClient(conn)
+
+	matched, err := lookup.Find(ref, "bare metal instance", func(filter string, limit int32) ([]*publicv1.BareMetalInstance, error) {
+		resp, err := client.List(ctx, publicv1.BareMetalInstancesListRequest_builder{
+			Filter: proto.String(filter),
+			Limit:  proto.Int32(limit),
+		}.Build())
+		if err != nil {
+			return nil, fmt.Errorf("failed to describe bare metal instance: %w", err)
+		}
+		return resp.GetItems(), nil
+	})
+	if err != nil {
+		return err
+	}
+
+	renderBareMetalInstance(console, matched)
+	return nil
+}
+
+func renderBareMetalInstance(w io.Writer, bmi *publicv1.BareMetalInstance) {
+	writer := tabwriter.NewWriter(w, 0, 0, 2, ' ', 0)
+	catalogItem := "-"
+	if bmi.Spec != nil {
+		if id := bmi.Spec.GetCatalogItem(); id != "" {
+			catalogItem = id
+		}
+	}
+	state := "-"
+	if bmi.Status != nil {
+		state = bmi.Status.State.String()
+		state = strings.TrimPrefix(state, "BARE_METAL_INSTANCE_STATE_")
+	}
+	fmt.Fprintf(writer, "ID:\t%s\n", bmi.Id)
+	fmt.Fprintf(writer, "Catalog Item:\t%s\n", catalogItem)
+	fmt.Fprintf(writer, "State:\t%s\n", state)
+	writer.Flush()
+}
+
+const shortHelp = `Describe a bare metal instance.`
+
+const longHelp = `
+Describe a bare metal instance.
+`

internal/cmd/cli/describe/describe_cmd.go

@@ -16,6 +16,7 @@ package describe
 import (
 	"github.com/spf13/cobra"
 
+	"github.com/osac-project/fulfillment-service/internal/cmd/cli/describe/baremetalinstance"
 	"github.com/osac-project/fulfillment-service/internal/cmd/cli/describe/cluster"
 	"github.com/osac-project/fulfillment-service/internal/cmd/cli/describe/computeinstance"
 	"github.com/osac-project/fulfillment-service/internal/cmd/cli/describe/publicip"
@@ -31,6 +32,7 @@ func Cmd() *cobra.Command {
 		Short: shortHelp,
 		Long:  longHelp,
 	}
+	result.AddCommand(baremetalinstance.Cmd())
 	result.AddCommand(cluster.Cmd())
 	result.AddCommand(computeinstance.Cmd())
 	result.AddCommand(publicip.Cmd())