wip: merge old serit-platfrom into manifests

2025-05-03 16:42:39 +02:00
parent 6a5e5db08f
commit 3ee4369cc1
187 changed files with 48389 additions and 0 deletions
@@ -0,0 +1,165 @@
+{{- if .Values.cilium.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  destination:
+    namespace: kube-system
+    server: 'https://kubernetes.default.svc'
+  sources:
+  {{- if .Values.cilium.spire.enabled }}
+  - repoURL: {{ .Values.cluster_config.manifests }}
+    path: {{ .Values.cluster_config.policies }}/cilium-spire
+    targetRevision: HEAD
+  {{- end }}
+  - repoURL: 'https://helm.cilium.io'
+    targetRevision: {{ .Values.cilium.version }}
+    chart: cilium
+    helm:
+      values: |
+        authentication:
+          mutual:
+            spire:
+              enabled: {{ .Values.cilium.spire.enabled }}
+        cgroup:
+          autoMount:
+            enabled: false
+          hostRoot: /sys/fs/cgroup
+        dashboards:
+          enabled: true
+          namespace: prometheus
+        enableXTSocketFallback: false
+        encryption:
+          enabled: {{ .Values.cilium.encryption.enabled }}
+          type: {{ .Values.cilium.encryption.type}}
+        envoy:
+          enabled: {{ .Values.cilium.envoy.enabled }}
+          prometheus:
+            serviceMonitor:
+              enabled: {{ .Values.cilium.envoy.enabled }}
+        extraConfig:
+          enable-envoy-config: "true"
+        hubble:
+          enabled: true
+          tls:
+            auto:
+              method: cronJob
+          metrics:
+            dashboards:
+              enabled: true
+              namespace: prometheus
+            enabled:
+            - dns:query;ignoreAAAA
+            - drop
+            - tcp
+            - flow
+            - icmp
+            - policy:sourceContext=app|workload-name|pod|reserved-identity;destinationContext=app|workload-name|pod|dns|reserved-identity;labelsContext=source_namespace,destination_namespace
+            - httpV2:exemplars=false;labelsContext=source_ip,source_namespace,source_workload,destination_ip,destination_namespace,destination_workload,traffic_direction
+            port: 12304
+            serviceMonitor:
+              enabled: true
+          redact:
+            enabled: true
+          relay:
+            enabled: true
+            prometheus:
+              enabled: true
+              serviceMonitor:
+                enabled: true
+          ui:
+            enabled: {{ .Values.cilium.hubble.ui }}
+        ipam:
+          mode: kubernetes
+        kubeProxyReplacement: {{ .Values.cilium.kubeProxyReplacement }}
+        l2announcements:
+          enabled: {{ .Values.cilium.l2announcement.enabled }}
+        k8sServiceHost: {{ .Values.cilium.k8sServiceHost }}
+        k8sServicePort: {{ .Values.cilium.k8sServicePort }}
+        nodePort:
+          enabled: {{ .Values.cilium.nodePort.enabled }}
+        gatewayAPI:
+          enabled: {{ .Values.cilium.gatewayAPI.enabled }}
+        ingressController:
+          enabled: {{ .Values.cilium.ingressController.enabled }}
+          default: {{ .Values.cilium.ingressController.defaultClass }}
+          loadbalancerMode: {{ .Values.cilium.ingressController.loadbalancerMode }}
+        operator:
+          dashboards:
+            enabled: true
+            namespace: prometheus
+          prometheus:
+            enabled: true
+            port: 12301
+            serviceMointor:
+              enabled: true
+              port: 12302
+          rollOutPods: true
+        policyAuditMode: {{ .Values.cilium.policyAuditMode }}
+        prometheus:
+          enabled: true
+          port: 12300
+          serviceMonitor:
+            enabled: true
+        rollOutCiliumPods: true
+        securityContext:
+          capabilities:
+            ciliumAgent:
+            - CHOWN
+            - KILL
+            - NET_ADMIN
+            - NET_RAW
+            - IPC_LOCK
+            - SYS_ADMIN
+            - SYS_RESOURCE
+            - DAC_OVERRIDE
+            - FOWNER
+            - SETGID
+            - SETUID
+            cleanCiliumState:
+            - NET_ADMIN
+            - SYS_ADMIN
+            - SYS_RESOURCE
+        {{- with .Values.cilium.upgradeCompatability}}
+        upgradeCompatability:  {{ . }}
+        {{- end }}
+  project: sys
+  syncPolicy:
+    syncOptions:
+    - ServerSideApply=true
+    {{- if .Values.cilium.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+  ignoreDifferences:
+    - group: apps
+      jqPathExpressions:
+        - .spec.volumeClaimTemplates
+      kind: StatefulSet
+      name: spire-server
+    - group: monitoring.coreos.com
+      jqPathExpressions:
+        - .spec.endpoints[]?.relabelings[]?.action
+      kind: ServiceMonitor
+    - group: ''
+      jsonPointers:
+        - /data/ca.crt
+      kind: ConfigMap
+      name: hubble-ca-cert
+    - group: ''
+      jsonPointers:
+        - /data/ca.crt
+        - /data/ca.key
+      kind: Secret
+      name: cilium-ca
+    - group: ''
+      jqPathExpressions:
+        - .spec.ports[]?.nodePort
+      kind: Service
+      name: cilium-ingress
+{{- end }}