Merge branch 'helmify' into 'main'
feat: Migrate sys applications to helmfile See merge request oceanbox/manifests!10
This commit was merged in pull request #24.
This commit is contained in:
Jonas Juselius
@@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- _manifest.yaml
|
||||
@@ -0,0 +1,4 @@
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
resources:
|
||||
- ../base
|
||||
@@ -0,0 +1,41 @@
|
||||
{{- if .Values.clusterConfig.argo.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: argocd
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-1"
|
||||
spec:
|
||||
destination:
|
||||
namespace: argocd
|
||||
server: 'https://kubernetes.default.svc'
|
||||
sources:
|
||||
- repoURL: {{ .Values.clusterConfig.manifests }}
|
||||
# targetRevision: HEAD
|
||||
targetRevision: mrtz/helmify
|
||||
path: helmfile.d
|
||||
plugin:
|
||||
name: helmfile-cmp
|
||||
env:
|
||||
- name: CLUSTER_NAME
|
||||
value: {{ .Values.clusterConfig.cluster }}
|
||||
- name: HELMFILE_ENVIRONMENT
|
||||
value: default
|
||||
- name: HELMFILE_FILE_PATH
|
||||
value: argo.yaml.gotmpl
|
||||
project: sys
|
||||
syncPolicy:
|
||||
managedNamespaceMetadata:
|
||||
labels:
|
||||
component: sys
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
- ServerSideApply=true
|
||||
{{- if .Values.argocd.autosync }}
|
||||
automated:
|
||||
prune: true
|
||||
# selfHeal: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,26 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: argocd-server-nodeport
|
||||
namespace: argocd
|
||||
spec:
|
||||
clusterIP: 10.102.84.163
|
||||
clusterIPs:
|
||||
- 10.102.84.163
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
nodePort: 30290
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
- name: https
|
||||
nodePort: 31261
|
||||
port: 443
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app.kubernetes.io/instance: argocd
|
||||
app.kubernetes.io/name: argocd-server
|
||||
type: NodePort
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-applicationset-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access from the ingress controller
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-notifications
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD Notifications
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: slack.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-repo-access-applicationset
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD repo Applicationset
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-repo-access
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD repo server
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: repo-server
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-chartmuseum-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the chartmuseum ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: chartmuseum
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-image-updater-repo-access
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow argoCD image updater to access github container registry
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: ghcr.io
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-image-updater
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access from the ingress controller
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: server
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Kube API server
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-microsoft-sso
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: login.microsoftonline.com
|
||||
- matchPattern: '*.microsoftonline.com'
|
||||
- matchName: github.com
|
||||
- matchName: api.github.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics-rollout
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argo-rollouts
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8090"
|
||||
protocol: TCP
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics-workflows
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argo-workflows
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9090"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argocd
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8082"
|
||||
protocol: TCP
|
||||
- port: "8080"
|
||||
protocol: TCP
|
||||
- port: "9001"
|
||||
protocol: TCP
|
||||
- port: "9121"
|
||||
protocol: TCP
|
||||
- port: "8084"
|
||||
protocol: TCP
|
||||
- port: "8083"
|
||||
protocol: TCP
|
||||
- port: "5558"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,84 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: sys
|
||||
namespace: argocd
|
||||
spec:
|
||||
clusterResourceWhitelist:
|
||||
- group: '*'
|
||||
kind: '*'
|
||||
description: sys components project
|
||||
destinations:
|
||||
- namespace: argocd
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: kube-system
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: ingress-nginx
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: serit-operator
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: prometheus
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: cnpg
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: cert-manager
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: kubernetes-dashboard
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: rabbitmq
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: sealed-secrets
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: gitlab
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: thanos
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: linkerd
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: linkerd-multicluster
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: observability
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: kyverno
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: velero
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: loki
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: x509-exporter
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: mariadb-operator
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: cilium-spire
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: cilium-test
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: cilium-secrets
|
||||
server: https://kubernetes.default.svc
|
||||
sourceRepos:
|
||||
- https://argoproj.github.io/argo-helm
|
||||
- https://kubernetes-sigs.github.io/metrics-server/
|
||||
- https://gitlab.com/oceanbox/manifests.git
|
||||
- https://gitlab.com/serit/k8s/serit-platform.git
|
||||
- https://gitlab.com/serit/k8s/serit-platform-values.git
|
||||
- https://gitlab.com/serit/k8s/serit-platform-manifests.git
|
||||
- https://gitlab.com/serit/k8s/serit-operator.git
|
||||
- https://kubernetes.github.io/ingress-nginx
|
||||
- https://cloudnative-pg.github.io/charts
|
||||
- https://charts.jetstack.io
|
||||
- https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
|
||||
- https://github.com/kubernetes/dashboard
|
||||
- https://bitnami-labs.github.io/sealed-secrets
|
||||
- https://prometheus-community.github.io/helm-charts
|
||||
- https://github.com/prometheus-community/helm-charts.git
|
||||
- https://charts.gitlab.io/
|
||||
- https://charts.bitnami.com/bitnami
|
||||
- https://helm.linkerd.io/stable
|
||||
- https://github.com/jaegertracing/jaeger-operator
|
||||
- https://kyverno.github.io/kyverno/
|
||||
- https://vmware-tanzu.github.io/helm-charts
|
||||
- https://grafana.github.io/helm-charts
|
||||
- https://charts.enix.io
|
||||
- https://helm.mariadb.com/mariadb-operator
|
||||
- https://helm.cilium.io
|
||||
- https://chartmuseum.github.io/charts
|
||||
@@ -0,0 +1,35 @@
|
||||
argo:
|
||||
enabled: true
|
||||
apps:
|
||||
enabled: true
|
||||
rollouts:
|
||||
enabled: false
|
||||
workflows:
|
||||
enabled: false
|
||||
|
||||
argocd:
|
||||
autosync: true
|
||||
ingress:
|
||||
enabled: true
|
||||
adminLogin: false
|
||||
kustomizeHelmSupport: false
|
||||
applicationset_webhook:
|
||||
enabled: false
|
||||
anyNamespaces:
|
||||
enabled: false
|
||||
glob: ""
|
||||
resources:
|
||||
controller:
|
||||
memory: 2000Mi
|
||||
cpu: 250m
|
||||
repoServers:
|
||||
- name: "helmfile-cmp"
|
||||
image: "registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest"
|
||||
imagePullSecrets:
|
||||
- gitlab-pull-secret
|
||||
- name: "kustomize-helm-with-rewrite"
|
||||
image: "registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest"
|
||||
imagePullSecrets:
|
||||
- gitlab-pull-secret
|
||||
additional_rbac_settings:
|
||||
- g, "eb17a659-4ce6-41bc-9153-d9b117c44479", role:org-admin
|
||||
@@ -0,0 +1,306 @@
|
||||
global:
|
||||
domain: argocd.{{ .Values.clusterConfig.domain }}
|
||||
## ArgoCD configuration
|
||||
## Ref: https://github.com/argoproj/argo-cd
|
||||
##
|
||||
configs:
|
||||
{{- if .Values.argocd.anyNamespaces.enabled }}
|
||||
params:
|
||||
applicationsetcontroller.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
|
||||
# TODO(kai): anyapp will disable PR review apps. Look into anyapp settings to fix it
|
||||
applicationsetcontroller.enable.scm.providers: "false"
|
||||
application.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
|
||||
{{- end }}
|
||||
cm:
|
||||
application.resourceTrackingMethod: annotation+label
|
||||
application.instanceLabelKey: app.kubernetes.io/instance
|
||||
create: true
|
||||
# NOTE(kai): callback URL for dex
|
||||
url: "https://argocd.{{ .Values.clusterConfig.domain }}"
|
||||
resource.compareoptions: |
|
||||
ignoreAggregatedRoles: true
|
||||
resource.exclusions: |
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
kinds:
|
||||
- CiliumIdentity
|
||||
clusters:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
kinds:
|
||||
- AdmissionReport
|
||||
- BackgroundScanReport
|
||||
- ClusterAdmissionReport
|
||||
- ClusterBackgroundScanReport
|
||||
clusters:
|
||||
- "*"
|
||||
# dex saml config
|
||||
dex.config: |
|
||||
logger:
|
||||
level: debug
|
||||
format: json
|
||||
connectors:
|
||||
{{- with .Values.clusterConfig.oidc }}
|
||||
{{- range . }}
|
||||
{{- if eq .provider "azuread" }}
|
||||
- type: oidc
|
||||
id: {{ .name }}
|
||||
name: {{ .name }}
|
||||
config:
|
||||
issuer: https://login.microsoftonline.com/{{ .tenant }}/v2.0
|
||||
clientID: ${{ .name | replace "-" "_" }}_client_id
|
||||
clientSecret: ${{ .name | replace "-" "_" }}_client_secret
|
||||
insecureSkipEmailVerified: true
|
||||
requestedIDTokenClaims:
|
||||
groups:
|
||||
essential: true
|
||||
insecureEnableGroups: true
|
||||
requestedScopes:
|
||||
- openid
|
||||
- profile
|
||||
- email
|
||||
- groups
|
||||
{{- else if eq .provider "github" }}
|
||||
- type: github
|
||||
id: {{ .name }}
|
||||
name: {{ .name }}
|
||||
config:
|
||||
clientID: ${{ .name | replace "-" "_" }}_client_id
|
||||
clientSecret: ${{ .name | replace "-" "_" }}_client_secret
|
||||
redirectURI: https://argocd.{{ $.Values.clusterConfig.domain }}/api/dex/callback
|
||||
orgs:
|
||||
- name: {{ .allowed_organizations }}
|
||||
loadAllGroups: true
|
||||
teamNameField: slug
|
||||
useLoginAsID: false
|
||||
staticClients:
|
||||
- id: ${{ .name | replace "-" "_" }}_client_id
|
||||
name: Kubernetes
|
||||
# These are kubectl oidc plugin internal URLs
|
||||
redirectURIs:
|
||||
- http://localhost:8000
|
||||
- http://localhost:18000
|
||||
# Random secret for the user to authenticat dex client
|
||||
secret: 8d52926efe879ee505391b75f4b046cf
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
admin.enabled: false
|
||||
rbac:
|
||||
# NOTE(kai): dd2aa2d6 ... is ID for azure kubernetes_operator group
|
||||
policy.csv: |
|
||||
p, role:org-admin, applications, *, */*, allow
|
||||
p, role:org-admin, projects, *, *, allow
|
||||
p, role:org-admin, logs, get, *, allow
|
||||
p, role:org-admin, clusters, get, *, allow
|
||||
p, role:org-admin, clusters, update, *, allow
|
||||
p, role:org-admin, repositories, get, *, allow
|
||||
p, role:org-admin, repositories, create, *, allow
|
||||
p, role:org-admin, repositories, update, *, allow
|
||||
p, role:org-admin, repositories, delete, *, allow
|
||||
g, "dd2aa2d6-269d-48fe-90cc-04fd5c08bd29", role:org-admin
|
||||
{{- with .Values.argocd.additional_rbac_settings }}
|
||||
{{- range .}}
|
||||
{{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
repositories:
|
||||
# Repositories for applications
|
||||
argo-helm:
|
||||
type: helm
|
||||
url: https://argoproj.github.io/argo-helm
|
||||
# UI changes based on env
|
||||
styles: |
|
||||
/* blue, orange, red depending on env */
|
||||
:root {
|
||||
--test-color: #0f2cbd;
|
||||
--dev-color: #33b025;
|
||||
--staging-color: #ebac2f;
|
||||
--prod-color: #ff000d;
|
||||
}
|
||||
.top-bar__breadcrumbs::after {
|
||||
content: "cluster: {{.Values.clusterConfig.cluster}}, env: {{.Values.clusterConfig.env}} ";
|
||||
color: var(--{{.Values.clusterConfig.env}}-color);
|
||||
font-weight: bolder;
|
||||
font-size: larger;
|
||||
position: fixed;
|
||||
left: 50%;
|
||||
}
|
||||
|
||||
controller:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
memory: {{ .Values.argocd.resources.controller.memory | default "1000Mi" }}
|
||||
requests:
|
||||
cpu: {{ .Values.argocd.resources.controller.cpu | default "250m" }}
|
||||
memory: {{ .Values.argocd.resources.controller.memory | default "1000Mi" }}
|
||||
|
||||
# Mount azure ca as file for SAML auth
|
||||
dex:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
{{- with .Values.clusterConfig.oidc }}
|
||||
env:
|
||||
{{- range . }}
|
||||
- name: {{ .name | replace "-" "_" }}_client_secret
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secret_ref.name }}
|
||||
key: client_secret
|
||||
- name: {{ .name | replace "-" "_" }}_client_id
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secret_ref.name }}
|
||||
key: client_id
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
redis:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
repoServer:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
{{- range .Values.argocd.repoServers }}
|
||||
extraContainers:
|
||||
- command:
|
||||
- /var/run/argocd/argocd-cmp-server
|
||||
image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
|
||||
imagePullPolicy: Always
|
||||
name: helmfile-cmp
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/argocd
|
||||
name: var-files
|
||||
- mountPath: /home/argocd/cmp-server/plugins
|
||||
name: plugins
|
||||
- mountPath: /tmp
|
||||
name: cmp-tmp
|
||||
- mountPath: /helm-working-dir
|
||||
name: helm-working-dir
|
||||
- command:
|
||||
- /var/run/argocd/argocd-cmp-server
|
||||
image: {{ .image }}
|
||||
imagePullPolicy: Always
|
||||
name: {{ .name }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/argocd
|
||||
name: var-files
|
||||
- mountPath: /home/argocd/cmp-server/plugins
|
||||
name: plugins
|
||||
- mountPath: /tmp
|
||||
name: cmp-tmp
|
||||
volumes:
|
||||
- name: cmp-tmp
|
||||
emptyDir: {}
|
||||
imagePullSecrets:
|
||||
{{- range .imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
- command:
|
||||
- /bin/sh
|
||||
- /plugin/init-helm-repos.sh
|
||||
env:
|
||||
- name: OCEANBOX_HELM_ACCESS_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: token
|
||||
name: oceanbox-helm
|
||||
optional: false
|
||||
image: registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest
|
||||
imagePullPolicy: Always
|
||||
name: init-helm-repos
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /helm-working-dir
|
||||
name: helm-working-dir
|
||||
|
||||
# Configuration for argocd server instance
|
||||
server:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
{{- with .Values.clusterConfig.ingress_whitelist_ips }}
|
||||
nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }}
|
||||
{{- end }}
|
||||
hosts:
|
||||
- "argocd.{{ .Values.clusterConfig.domain }}"
|
||||
tls:
|
||||
- secretName: argocd-tls
|
||||
hosts:
|
||||
- "argocd.{{ .Values.clusterConfig.domain }}"
|
||||
applicationSet:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
{{- if .Values.argocd.anyNamespaces.enabled }}
|
||||
allowAnyNamespaces: true
|
||||
{{- end }}
|
||||
ingress:
|
||||
enabled: false
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
|
||||
# {{- with .Values.clusterConfig.ingress_whitelist_ips}}
|
||||
# NOTE(kai): include gitlab and github webhook ranges
|
||||
# nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }},192.30.252.0/22,140.82.112.0/20,34.74.226.27/28,34.74.226.0/24
|
||||
# {{- end }}
|
||||
hostname: "argocd-applicationset.{{ .Values.clusterConfig.domain }}"
|
||||
tls:
|
||||
- secretName: argocd-applicationset-tls
|
||||
hosts:
|
||||
- "argocd-applicationset.{{ .Values.clusterConfig.domain }}"
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
secret:
|
||||
create: false
|
||||
cm:
|
||||
create: false
|
||||
@@ -0,0 +1,9 @@
|
||||
dashboard:
|
||||
enabled: {{ .Values.apps. true }}
|
||||
|
||||
controller:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
dashboard:
|
||||
enabled: {{ .Values.apps. true }}
|
||||
|
||||
controller:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
../../charts/atlantis
|
||||
@@ -0,0 +1,70 @@
|
||||
{{ if .Values.clusterConfig.argo.enabled }}
|
||||
{{- range .Values.atlantis.envs }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: {{ . }}-atlantis
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
namespace: {{ . }}-atlantis
|
||||
server: https://kubernetes.default.svc
|
||||
project: atlantis
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
ref: values
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: values/atlantis
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: {{ . }}
|
||||
- name: hostname
|
||||
string: maps.oceanbox.io
|
||||
- repoURL: https://charts.bitnami.com/bitnami
|
||||
targetRevision: 20.1.7
|
||||
chart: redis
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/values/atlantis/{{ . }}/redis.yaml
|
||||
ignoreDifferences:
|
||||
- kind: Secret
|
||||
name: azure-keyvault
|
||||
jqPathExpressions:
|
||||
- '.data'
|
||||
- '.metadata.labels'
|
||||
- '.metadata.annotations'
|
||||
- kind: Secret
|
||||
name: {{ . }}-atlantis-rabbitmq
|
||||
jqPathExpressions:
|
||||
- '.data'
|
||||
- '.metadata.labels'
|
||||
- '.metadata.annotations'
|
||||
- kind: Secret
|
||||
name: {{ . }}-archmeister-replication
|
||||
jqPathExpressions:
|
||||
- '.data'
|
||||
- '.metadata.labels'
|
||||
- '.metadata.annotations'
|
||||
- kind: Secret
|
||||
name: {{ . }}-archmeister-ca
|
||||
jqPathExpressions:
|
||||
- '.data'
|
||||
- '.metadata.labels'
|
||||
- '.metadata.annotations'
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
# automated:
|
||||
# prune: true
|
||||
# selfHeal: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,4 @@
|
||||
atlantis:
|
||||
enabled: true
|
||||
autosync: false
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
{{- if .Values.clusterConfig.argo.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
namespace: cert-manager
|
||||
server: 'https://kubernetes.default.svc'
|
||||
sources:
|
||||
- repoURL: {{ .Values.clusterConfig.manifests }}
|
||||
# targetRevision: HEAD
|
||||
targetRevision: mrtz/helmify
|
||||
path: helmfile.d
|
||||
plugin:
|
||||
name: helmfile-cmp
|
||||
env:
|
||||
- name: CLUSTER_NAME
|
||||
value: {{ .Values.clusterConfig.cluster }}
|
||||
- name: HELMFILE_ENVIRONMENT
|
||||
value: default
|
||||
- name: HELMFILE_FILE_PATH
|
||||
value: cert-manager.yaml.gotmpl
|
||||
project: sys
|
||||
syncPolicy:
|
||||
managedNamespaceMetadata:
|
||||
labels:
|
||||
component: sys
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
- ServerSideApply=true
|
||||
{{- if .Values.cert_manager.autosync }}
|
||||
automated:
|
||||
prune: true
|
||||
# selfHeal: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server-to-cert-manager
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the API server to communicate with the cert-manager pods
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the Kube API server to communicate with cert-manager
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9402"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-world-traffic
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the world to communicate with cert-manager
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -0,0 +1,225 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
name: letsencrypt-production
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# Email address used for ACME registration
|
||||
email: {{ .Values.clusterConfig.acme_email }}
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-production
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
# Email address used for ACME registration
|
||||
email: {{ .Values.clusterConfig.acme_email }}
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
name: ca-issuer
|
||||
spec:
|
||||
ca:
|
||||
secretName: cluster-ca
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
name: selfsigning-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: front-proxy-client
|
||||
subjects:
|
||||
- kind: User
|
||||
name: front-proxy-client
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: front-proxy-client
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: front-proxy-client
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "webhook.cert-manager.io"
|
||||
resources:
|
||||
- mutations
|
||||
- validations
|
||||
verbs: [ "*" ]
|
||||
- apiGroups:
|
||||
- metrics.k8s.io
|
||||
resources:
|
||||
- pods
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
|
||||
{{ if .Values.clusterConfig.initca }}
|
||||
|
||||
# Pod to update certificates from master nodes
|
||||
# only runs on control plane nodes (etcd)
|
||||
# Mounts cert files rotatet by nixos service.mgr and uses it to update cert-manager secret
|
||||
# Always create certs on initial creation,
|
||||
# Otherwise, cert creation would not happen until cronJob runs
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: cert-create
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
block-egress: "true"
|
||||
annotations:
|
||||
linkerd.io/inject: disabled
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
serviceAccountName: cert-secret-updater
|
||||
securityContext:
|
||||
runAsUser: 12000
|
||||
runAsGroup: 13000
|
||||
fsGroup: 10000
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io
|
||||
operator: In
|
||||
values:
|
||||
- control-plane
|
||||
tolerations:
|
||||
- key: unschedulable
|
||||
value: "true"
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- image: bitnami/kubectl:1.24
|
||||
name: kubectl
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
command:
|
||||
- "/bin/sh"
|
||||
- -c
|
||||
- /tmp/renew-certs/renew-certs.sh
|
||||
volumeMounts:
|
||||
- name: ca-pem
|
||||
mountPath: /tmp/ca.pem
|
||||
- name: ca-key-pem
|
||||
mountPath: /tmp/ca-key.pem
|
||||
- name: certs-script
|
||||
mountPath: /tmp/renew-certs
|
||||
volumes:
|
||||
- name: ca-pem
|
||||
hostPath:
|
||||
path: {{.Values.clusterConfig.initca}}/ca.pem
|
||||
type: File
|
||||
- name: ca-key-pem
|
||||
hostPath:
|
||||
path: {{.Values.clusterConfig.initca}}/ca-key.pem
|
||||
type: File
|
||||
- name: certs-script
|
||||
configMap:
|
||||
name: renew-certs-script
|
||||
defaultMode: 0755
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
renew-certs.sh: |
|
||||
#! /bin/bash
|
||||
kubectl create secret tls -n cert-manager cluster-ca --cert=/tmp/ca.pem --key=/tmp/ca-key.pem --dry-run=client -o yaml > /tmp/new-secret.yaml
|
||||
kubectl apply -f /tmp/new-secret.yaml
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: renew-certs-script
|
||||
namespace: cert-manager
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: cert-secret-updater
|
||||
namespace: cert-manager
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cert-secret-updater-role
|
||||
namespace: cert-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- cluster-ca
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: cert-secret-updater-rbinding
|
||||
namespace: cert-manager
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cert-secret-updater-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cert-secret-updater
|
||||
namespace: cert-manager
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny-egress
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
block-egress: "true"
|
||||
policyTypes:
|
||||
- Egress
|
||||
---
|
||||
{{ end }}
|
||||
@@ -0,0 +1,3 @@
|
||||
cert_manager:
|
||||
enabled: true
|
||||
autosync: true
|
||||
@@ -0,0 +1,5 @@
|
||||
installCRDs: true
|
||||
enableCertificateOwnerRef: true
|
||||
startupapicheck:
|
||||
podAnnotations:
|
||||
linkerd.io/inject: disabled
|
||||
@@ -0,0 +1,62 @@
|
||||
{{- if .Values.clusterConfig.argo.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-1"
|
||||
spec:
|
||||
destination:
|
||||
namespace: kube-system
|
||||
server: 'https://kubernetes.default.svc'
|
||||
sources:
|
||||
- repoURL: {{ .Values.clusterConfig.manifests }}
|
||||
# targetRevision: HEAD
|
||||
targetRevision: mrtz/helmify
|
||||
path: helmfile.d
|
||||
plugin:
|
||||
name: helmfile-cmp
|
||||
env:
|
||||
- name: CLUSTER_NAME
|
||||
value: {{ .Values.clusterConfig.cluster }}
|
||||
- name: HELMFILE_ENVIRONMENT
|
||||
value: default
|
||||
- name: HELMFILE_FILE_PATH
|
||||
value: cilium.yaml.gotmpl
|
||||
project: sys
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
- ServerSideApply=true
|
||||
{{- if .Values.cilium.autosync }}
|
||||
automated:
|
||||
prune: true
|
||||
# selfHeal: false
|
||||
{{- end }}
|
||||
ignoreDifferences:
|
||||
- group: apps
|
||||
jqPathExpressions:
|
||||
- .spec.volumeClaimTemplates
|
||||
kind: StatefulSet
|
||||
name: spire-server
|
||||
- group: monitoring.coreos.com
|
||||
jqPathExpressions:
|
||||
- .spec.endpoints[]?.relabelings[]?.action
|
||||
kind: ServiceMonitor
|
||||
- group: ''
|
||||
jsonPointers:
|
||||
- /data/ca.crt
|
||||
kind: ConfigMap
|
||||
name: hubble-ca-cert
|
||||
- group: ''
|
||||
jsonPointers:
|
||||
- /data/ca.crt
|
||||
- /data/ca.key
|
||||
kind: Secret
|
||||
name: cilium-ca
|
||||
- group: ''
|
||||
jqPathExpressions:
|
||||
- .spec.ports[]?.nodePort
|
||||
kind: Service
|
||||
name: cilium-ingress
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,23 @@
|
||||
{{if .Values.cilium.loadbalancerPool.enabled }}
|
||||
apiVersion: "cilium.io/v2alpha1"
|
||||
kind: CiliumLoadBalancerIPPool
|
||||
metadata:
|
||||
name: "loadbalancer"
|
||||
spec:
|
||||
blocks:
|
||||
{{- range .Values.cilium.loadbalancerPool.cidr }}
|
||||
- cidr: {{ . }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: "cilium.io/v2alpha1"
|
||||
kind: CiliumL2AnnouncementPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
spec:
|
||||
nodeSelector:
|
||||
matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: DoesNotExist
|
||||
externalIPs: true
|
||||
loadBalancerIPs: true
|
||||
{{- end}}
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: cilium-health-checks
|
||||
spec:
|
||||
description: Health checks
|
||||
egress:
|
||||
- toEntities:
|
||||
- remote-node
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
reserved:health: ""
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cilium-spire
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-server
|
||||
namespace: cilium-spire
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8081"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,14 @@
|
||||
cilium:
|
||||
enabled: true
|
||||
nodePort:
|
||||
enabled: true
|
||||
l2announcement:
|
||||
enabled: true
|
||||
loadbalancerPool:
|
||||
enabled: true
|
||||
cidr:
|
||||
- 10.255.241.11/32
|
||||
- 10.255.241.12/32
|
||||
- 10.255.241.13/32
|
||||
- 10.255.241.14/32
|
||||
- 10.255.241.15/32
|
||||
@@ -0,0 +1,33 @@
|
||||
cilium:
|
||||
enabled: false
|
||||
autosync: true
|
||||
spire:
|
||||
enabled: false
|
||||
envoy:
|
||||
enabled: false
|
||||
hubble:
|
||||
ui: true
|
||||
enabled: false
|
||||
encryption:
|
||||
enabled: true
|
||||
type: wireguard
|
||||
kubeProxyReplacement: true
|
||||
l2announcement:
|
||||
enabled: false
|
||||
nodePort:
|
||||
enabled: false
|
||||
# NOTE: Requires that ingresscontroller is also enabled
|
||||
gatewayAPI:
|
||||
enabled: false
|
||||
ingressController:
|
||||
enabled: false
|
||||
defaultClass: false
|
||||
loadbalancerMode: shared
|
||||
policyAuditMode: false
|
||||
upgradeCompatability: 1.16
|
||||
k8sServiceHost: localhost
|
||||
k8sServicePort: 7445
|
||||
loadbalancerPool:
|
||||
enabled: false
|
||||
cidr: []
|
||||
|
||||
@@ -83,6 +83,7 @@ prometheus:
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
rollOutCiliumPods: true
|
||||
podSecurityContext: null
|
||||
securityContext:
|
||||
capabilities:
|
||||
ciliumAgent:
|
||||
@@ -0,0 +1,38 @@
|
||||
{{- if .Values.clusterConfig.argo.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: dapr
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
namespace: dapr-system
|
||||
server: 'https://kubernetes.default.svc'
|
||||
sources:
|
||||
- repoURL: {{ .Values.clusterConfig.manifests }}
|
||||
targetRevision: HEAD
|
||||
path: helmfiles/dapr
|
||||
plugin:
|
||||
name: helmfile
|
||||
env:
|
||||
- name: CLUSTER_NAME
|
||||
value: {{ .Values.clusterConfig.cluster }}
|
||||
project: default
|
||||
syncPolicy:
|
||||
managedNamespaceMetadata:
|
||||
labels:
|
||||
component: aux
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
# - ServerSideApply=true
|
||||
{{- if .Values.dapr.autosync }}
|
||||
automated:
|
||||
prune: true
|
||||
# selfHeal: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,2 @@
|
||||
dapr:
|
||||
enabled: true
|
||||
@@ -0,0 +1,3 @@
|
||||
global:
|
||||
ha:
|
||||
enabled: true
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,41 @@
|
||||
{{- if .Values.clusterConfig.argo.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
spec:
|
||||
destination:
|
||||
namespace: ingress-nginx
|
||||
server: 'https://kubernetes.default.svc'
|
||||
sources:
|
||||
- repoURL: {{ .Values.clusterConfig.manifests }}
|
||||
# targetRevision: HEAD
|
||||
targetRevision: mrtz/helmify
|
||||
path: helmfile.d
|
||||
plugin:
|
||||
name: helmfile-cmp
|
||||
env:
|
||||
- name: CLUSTER_NAME
|
||||
value: {{ .Values.clusterConfig.cluster }}
|
||||
- name: HELMFILE_ENVIRONMENT
|
||||
value: default
|
||||
- name: HELMFILE_FILE_PATH
|
||||
value: ingress-nginx.yaml.gotmpl
|
||||
project: sys
|
||||
syncPolicy:
|
||||
managedNamespaceMetadata:
|
||||
labels:
|
||||
component: sys
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
- ServerSideApply=true
|
||||
{{- if .Values.nginx.autosync }}
|
||||
automated:
|
||||
prune: true
|
||||
# selfHeal: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- host
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchPattern: hubble.*.*.*
|
||||
- matchPattern: hubble.*.*.*.*
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9913"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-s3-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toCIDR:
|
||||
- 10.139.2.10/32
|
||||
- toCIDR:
|
||||
- 10.139.2.11/32
|
||||
- toCIDR:
|
||||
- 10.139.2.20/32
|
||||
- toCIDR:
|
||||
- 10.139.2.21/32
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-world-to-ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "80"
|
||||
protocol: TCP
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,9 @@
|
||||
nginx:
|
||||
enabled: true
|
||||
autosync: true
|
||||
pdb:
|
||||
minAvailable: 1
|
||||
resources:
|
||||
controller:
|
||||
cpu: "100m"
|
||||
memory: "100Mi"
|
||||
@@ -0,0 +1,98 @@
|
||||
## nginx configuration
|
||||
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md
|
||||
##
|
||||
## Overrides for generated resource names
|
||||
# See templates/_helpers.tpl
|
||||
# nameOverride:
|
||||
fullnameOverride: main-ingress-nginx
|
||||
controller:
|
||||
resources:
|
||||
#limits:
|
||||
# memory: {{ .Values.nginx.resources.controller.memory }}
|
||||
requests:
|
||||
cpu: {{ .Values.nginx.resources.controller.cpu }}
|
||||
memory: {{ .Values.nginx.resources.controller.memory }}
|
||||
|
||||
ingressClassResource:
|
||||
default: true
|
||||
|
||||
tolerations:
|
||||
- key: unschedulable
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values: {{ .Values.clusterConfig.ingress_nodes }}
|
||||
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- ingress-nginx
|
||||
- key: app.kubernetes.io/component
|
||||
operator: In
|
||||
values:
|
||||
- controller
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
|
||||
podAnnotations:
|
||||
config.linkerd.io/skip-inbound-ports: 80,443
|
||||
|
||||
replicaCount: {{ .Values.clusterConfig.ingress_replica_count }}
|
||||
|
||||
minAvailable: {{ .Values.nginx.pdb.minAvailable }}
|
||||
|
||||
service:
|
||||
externalTrafficPolicy: Local
|
||||
# type: ClusterIP
|
||||
type: NodePort
|
||||
# nodePorts:
|
||||
# http: 32080
|
||||
# https: 32443
|
||||
# tcp:
|
||||
# 8080: 32808
|
||||
nodePorts:
|
||||
http: 30080
|
||||
https: 30443
|
||||
tcp: {}
|
||||
udp: {}
|
||||
|
||||
metrics:
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "10254"
|
||||
|
||||
servicePort: 9913
|
||||
type: ClusterIP
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
admissionWebhooks:
|
||||
enabled: false
|
||||
|
||||
## Default 404 backend
|
||||
##
|
||||
defaultBackend:
|
||||
enabled: true
|
||||
|
||||
tolerations:
|
||||
- key: unschedulable
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
{{- if .Values.clusterConfig.argo.enabled }}
|
||||
{{- range .Values.keycloak.envs }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: {{ . }}-keycloak
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
namespace: keycloak
|
||||
server: 'https://kubernetes.default.svc'
|
||||
sources:
|
||||
- repoURL: {{ .Values.clusterConfig.manifests }}
|
||||
targetRevision: HEAD
|
||||
path: helmfiles/keycloak
|
||||
plugin:
|
||||
name: helmfile
|
||||
env:
|
||||
- name: CLUSTER_NAME
|
||||
value: {{ .Values.clusterConfig.cluster }}
|
||||
project: aux
|
||||
syncPolicy:
|
||||
managedNamespaceMetadata:
|
||||
labels:
|
||||
component: aux
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
# - ServerSideApply=true
|
||||
{{- if .Values.keycloak.autosync }}
|
||||
automated:
|
||||
prune: true
|
||||
# selfHeal: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user