diff --git a/cluster/external-dns/cloudflare.yaml b/cluster/external-dns/cloudflare.yaml new file mode 100644 index 0000000..f07d178 --- /dev/null +++ b/cluster/external-dns/cloudflare.yaml @@ -0,0 +1,72 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: external-dns-cloudflare +spec: + strategy: + type: Recreate + selector: + matchLabels: + app: external-dns + template: + metadata: + labels: + app: external-dns + spec: + serviceAccountName: external-dns + containers: + - name: cloudflare + image: registry.k8s.io/external-dns/external-dns:v0.15.0 + args: +# - --source=service # ingress is also possible + - --source=ingress + - --ingress-class=nginx + - --domain-filter=mk-labs.cloud # (optional) limit to only example.com domains; change to match the zone created above. + - --provider=cloudflare +# - --cloudflare-proxied # (optional) enable the proxy feature of Cloudflare (DDOS protection, CDN...) + - --cloudflare-dns-records-per-page=5000 # (optional) configure how many DNS records to fetch per request + - --policy=sync # or upsert-only + + env: + - name: CF_API_TOKEN + valueFrom: + secretKeyRef: + name: cloudflare-api-token + key: api-token +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: external-dns-cloudflare-monetnaildesign +spec: + strategy: + type: Recreate + selector: + matchLabels: + app: external-dns-monetnaildesign + template: + metadata: + labels: + app: external-dns-monetnaildesign + spec: + serviceAccountName: external-dns + containers: + - name: cloudflare + image: registry.k8s.io/external-dns/external-dns:v0.15.0 + args: +# - --source=service # ingress is also possible + - --source=ingress + - --ingress-class=nginx + - --domain-filter=monetnaildesign.com # (optional) limit to only example.com domains; change to match the zone created above. + - --provider=cloudflare +# - --cloudflare-proxied # (optional) enable the proxy feature of Cloudflare (DDOS protection, CDN...) + - --cloudflare-dns-records-per-page=5000 # (optional) configure how many DNS records to fetch per request + - --policy=sync # or upsert-only + + env: + - name: CF_API_TOKEN + valueFrom: + secretKeyRef: + name: cloudflare-api-token + key: api-token diff --git a/cluster/external-dns/external-dns-operator.yaml b/cluster/external-dns/external-dns-operator.yaml new file mode 100644 index 0000000..aa60a25 --- /dev/null +++ b/cluster/external-dns/external-dns-operator.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "3" +spec: + destination: + name: in-cluster + namespace: external-dns + project: default + source: + path: 02-cluster-operators/external/external-dns + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: false + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: openshift-gitops + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas \ No newline at end of file diff --git a/cluster/external-dns/externalsecrets.yaml b/cluster/external-dns/externalsecrets.yaml new file mode 100644 index 0000000..800daa1 --- /dev/null +++ b/cluster/external-dns/externalsecrets.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token # This is the secret name + namespace: external-dns +spec: + secretStoreRef: + kind: ClusterSecretStore + name: doppler-cluster + refreshInterval: "1h" + data: + - secretKey: api-token + remoteRef: + key: CLOUDFLARE_TOKEN diff --git a/cluster/external-dns/kustomization.yaml b/cluster/external-dns/kustomization.yaml new file mode 100644 index 0000000..2d67ac9 --- /dev/null +++ b/cluster/external-dns/kustomization.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +commonAnnotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +resources: +# Operator deployment +- namespace.yaml +- operatorgroup.yaml +- subscription.yaml +# Deploy cluster resources +- externalsecrets.yaml +- scc.yaml +- cloudflare.yaml diff --git a/cluster/external-dns/namespace.yaml b/cluster/external-dns/namespace.yaml new file mode 100644 index 0000000..04ba988 --- /dev/null +++ b/cluster/external-dns/namespace.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + name: external-dns-operator + labels: + argocd.argoproj.io/managed-by: openshift-gitops-operator + kubernetes.io/metadata.name: external-dns-operator + openshift.io/cluster-monitoring: 'true' +spec: + finalizers: + - kubernetes diff --git a/cluster/external-dns/operatorgroup.yaml b/cluster/external-dns/operatorgroup.yaml new file mode 100644 index 0000000..4709e2b --- /dev/null +++ b/cluster/external-dns/operatorgroup.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: external-dns-operator + namespace: external-dns-operator +spec: + targetNamespaces: + - external-dns-operator \ No newline at end of file diff --git a/cluster/external-dns/scc.yaml b/cluster/external-dns/scc.yaml new file mode 100644 index 0000000..4584cf5 --- /dev/null +++ b/cluster/external-dns/scc.yaml @@ -0,0 +1,41 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: external-dns + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: external-dns +rules: + - apiGroups: [""] + resources: ["services"] + verbs: ["get","watch","list"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get","watch","list"] + - apiGroups: ["networking","networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get","watch","list"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get","watch","list"] + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get","watch","list"] +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: external-dns-viewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: external-dns +subjects: +- kind: ServiceAccount + name: external-dns + namespace: default diff --git a/cluster/external-dns/subscription.yaml b/cluster/external-dns/subscription.yaml new file mode 100644 index 0000000..582613f --- /dev/null +++ b/cluster/external-dns/subscription.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: external-dns-operator + namespace: external-dns-operator +spec: + channel: stable-v1 + installPlanApproval: Automatic + name: external-dns-operator + source: redhat-operators + sourceNamespace: openshift-marketplace \ No newline at end of file diff --git a/cluster/keycloak-operator/keycloak-operator.yaml b/cluster/keycloak-operator/keycloak-operator.yaml new file mode 100644 index 0000000..b3f5112 --- /dev/null +++ b/cluster/keycloak-operator/keycloak-operator.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: keycloak-operator + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "3" +spec: + destination: + name: in-cluster + namespace: keycloak-operator + project: default + source: + path: cluster-applications/keycloak-operator + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: argocd + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas diff --git a/cluster/keycloak-operator/kustomization.yaml b/cluster/keycloak-operator/kustomization.yaml new file mode 100644 index 0000000..15b4f85 --- /dev/null +++ b/cluster/keycloak-operator/kustomization.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +commonAnnotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +resources: +# Operator deployment +- namespace.yaml +- operatorgroup.yaml +- subscription.yaml +# Deploy cluster resources diff --git a/cluster/keycloak-operator/namespace.yaml b/cluster/keycloak-operator/namespace.yaml new file mode 100644 index 0000000..d28b868 --- /dev/null +++ b/cluster/keycloak-operator/namespace.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + kubernetes.io/metadata.name: keycloak-operator + name: keycloak-operator + argocd.argoproj.io/managed-by: openshift-gitops-operator + openshift.io/cluster-monitoring: 'true' + name: keycloak-operator +spec: + finalizers: + - kubernetes \ No newline at end of file diff --git a/cluster/keycloak-operator/operatorgroup.yaml b/cluster/keycloak-operator/operatorgroup.yaml new file mode 100644 index 0000000..2509278 --- /dev/null +++ b/cluster/keycloak-operator/operatorgroup.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: keycloak-operator + namespace: keycloak-operator +spec: + targetNamespaces: + - keycloak-operator \ No newline at end of file diff --git a/cluster/keycloak-operator/subscription.yaml b/cluster/keycloak-operator/subscription.yaml new file mode 100644 index 0000000..4a9948f --- /dev/null +++ b/cluster/keycloak-operator/subscription.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: keycloak-operator + namespace: keycloak-operator +spec: + channel: fast + installPlanApproval: Automatic #Manual + name: keycloak-operator + source: community-operators + sourceNamespace: openshift-marketplace diff --git a/cluster/nginx-ingress-operator/ingresscontroller-external.yaml b/cluster/nginx-ingress-operator/ingresscontroller-external.yaml new file mode 100644 index 0000000..0e588c3 --- /dev/null +++ b/cluster/nginx-ingress-operator/ingresscontroller-external.yaml @@ -0,0 +1,96 @@ +--- +kind: NginxIngress +apiVersion: charts.nginx.org/v1alpha1 +metadata: + name: nginxingress-external + namespace: nginx-ingress-external +spec: +# routeSelector: +# matchLabels: +# type: external-ingress + controller: + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/instance: nginx-external + app.kubernetes.io/name: nginx-external + topologyKey: kubernetes.io/hostname + config: + entries: + http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m + max_size=10g inactive=60m use_temp_path=off; + log-format-escaping: json + log-format: |- + { + "msec": "$msec", + "connection": "$connection", + "connection_requests": "$connection_requests", + "pid": "$pid", + "request_id": "$request_id", + "request_length": "$request_length", + "remote_addr": "$remote_addr", + "remote_user": "$remote_user", + "remote_port": "$remote_port", + "time_local": "$time_local", + "time_iso8601": "$time_iso8601", + "request": "$request", + "request_uri": "$request_uri", + "args": "$args", + "status": "$status", + "body_bytes_sent": "$body_bytes_sent", + "bytes_sent": "$bytes_sent", + "http_referer": "$http_referer", + "http_user_agent": "$http_user_agent", + "http_x_forwarded_for": "$http_x_forwarded_for", + "http_host": "$http_host", + "server_name": "$server_name", + "request_time": "$request_time", + "upstream": "$upstream_addr", + "upstream_connect_time": "$upstream_connect_time", + "upstream_header_time": "$upstream_header_time", + "upstream_response_time": "$upstream_response_time", + "upstream_response_length": "$upstream_response_length", + "upstream_cache_status": "$upstream_cache_status", + "ssl_protocol": "$ssl_protocol", + "ssl_cipher": "$ssl_cipher", + "scheme": "$scheme", + "request_method": "$request_method", + "server_protocol": "$server_protocol", + "pipe": "$pipe", + "gzip_ratio": "$gzip_ratio", + "http_cf_ray": "$http_cf_ray" + } + enableCustomResources: true + enableTLSPassthrough: true + enableSnippets: true + image: + pullPolicy: IfNotPresent + repository: nginx/nginx-ingress + tag: 3.7.0-ubi + ingressClass: + create: true + name: nginx-external + setAsDefaultIngress: true + replicaCount: 2 + reportIngressStatus: + annotations: {} + enable: true + enableLeaderElection: true + ingressLink: '' + leaderElectionLockName: external-ingress-leader + service: + externalTrafficPolicy: Local + loadBalancerIP: 10.1.82.0 + prometheus: + create: true + serviceMonitor: + create: true + volumes: + - name: nginx-cache + persistentVolumeClaim: + claimName: nginx-cache-external + volumeMounts: + - name: nginx-cache + mountPath: /var/cache/nginx \ No newline at end of file diff --git a/cluster/nginx-ingress-operator/ingresscontroller-internal.yaml b/cluster/nginx-ingress-operator/ingresscontroller-internal.yaml new file mode 100644 index 0000000..af922f5 --- /dev/null +++ b/cluster/nginx-ingress-operator/ingresscontroller-internal.yaml @@ -0,0 +1,96 @@ +--- +kind: NginxIngress +apiVersion: charts.nginx.org/v1alpha1 +metadata: + name: nginxingress-internal + namespace: nginx-ingress-internal +spec: + routeSelector: + matchLabels: + type: internal-ingress + controller: + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/instance: nginx-internal + app.kubernetes.io/name: nginx-internal + topologyKey: kubernetes.io/hostname + config: + entries: + http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m + max_size=10g inactive=60m use_temp_path=off; + log-format-escaping: json + log-format: |- + { + "msec": "$msec", + "connection": "$connection", + "connection_requests": "$connection_requests", + "pid": "$pid", + "request_id": "$request_id", + "request_length": "$request_length", + "remote_addr": "$remote_addr", + "remote_user": "$remote_user", + "remote_port": "$remote_port", + "time_local": "$time_local", + "time_iso8601": "$time_iso8601", + "request": "$request", + "request_uri": "$request_uri", + "args": "$args", + "status": "$status", + "body_bytes_sent": "$body_bytes_sent", + "bytes_sent": "$bytes_sent", + "http_referer": "$http_referer", + "http_user_agent": "$http_user_agent", + "http_x_forwarded_for": "$http_x_forwarded_for", + "http_host": "$http_host", + "server_name": "$server_name", + "request_time": "$request_time", + "upstream": "$upstream_addr", + "upstream_connect_time": "$upstream_connect_time", + "upstream_header_time": "$upstream_header_time", + "upstream_response_time": "$upstream_response_time", + "upstream_response_length": "$upstream_response_length", + "upstream_cache_status": "$upstream_cache_status", + "ssl_protocol": "$ssl_protocol", + "ssl_cipher": "$ssl_cipher", + "scheme": "$scheme", + "request_method": "$request_method", + "server_protocol": "$server_protocol", + "pipe": "$pipe", + "gzip_ratio": "$gzip_ratio", + "http_cf_ray": "$http_cf_ray" + } + enableCustomResources: true + enableTLSPassthrough: true + enableSnippets: true + image: + pullPolicy: IfNotPresent + repository: nginx/nginx-ingress + tag: 3.7.0-ubi + ingressClass: + create: true + name: nginx-internal + setAsDefaultIngress: false + replicaCount: 2 + reportIngressStatus: + annotations: {} + enable: true + enableLeaderElection: true + ingressLink: '' + leaderElectionLockName: internal-ingress-leader + service: + externalTrafficPolicy: Local + loadBalancerIP: 10.1.82.2 + prometheus: + create: true + serviceMonitor: + create: true + volumes: + - name: nginx-cache + persistentVolumeClaim: + claimName: nginx-cache-internal + volumeMounts: + - name: nginx-cache + mountPath: /var/cache/nginx \ No newline at end of file diff --git a/cluster/nginx-ingress-operator/kustomization.yaml b/cluster/nginx-ingress-operator/kustomization.yaml new file mode 100644 index 0000000..ae49899 --- /dev/null +++ b/cluster/nginx-ingress-operator/kustomization.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +commonAnnotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +resources: +# Operator deployment +- subscription.yaml +# Deploy cluster resources +- scc.yaml +- namespace.yaml +- pvcs.yaml +- ingresscontroller-external.yaml +- ingresscontroller-internal.yaml \ No newline at end of file diff --git a/cluster/nginx-ingress-operator/namespace.yaml b/cluster/nginx-ingress-operator/namespace.yaml new file mode 100644 index 0000000..5842928 --- /dev/null +++ b/cluster/nginx-ingress-operator/namespace.yaml @@ -0,0 +1,24 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + kubernetes.io/metadata.name: nginx-ingress-external + name: nginx-ingress-external + argocd.argoproj.io/managed-by: openshift-gitops-operator + name: nginx-ingress-external +spec: + finalizers: + - kubernetes +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + kubernetes.io/metadata.name: nginx-ingress-internal + name: nginx-ingress-internal + argocd.argoproj.io/managed-by: openshift-gitops-operator + name: nginx-ingress-internal +spec: + finalizers: + - kubernetes \ No newline at end of file diff --git a/cluster/nginx-ingress-operator/nginx-ingress-operator.yaml b/cluster/nginx-ingress-operator/nginx-ingress-operator.yaml new file mode 100644 index 0000000..b1baa5b --- /dev/null +++ b/cluster/nginx-ingress-operator/nginx-ingress-operator.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: nginx-ingress-operator + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + destination: + name: in-cluster + namespace: nginx-ingress-operator + project: default + source: + path: cluster-applications/nginx-ingress-operator + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: argocd + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas diff --git a/cluster/nginx-ingress-operator/pvcs.yaml b/cluster/nginx-ingress-operator/pvcs.yaml new file mode 100644 index 0000000..22ef1a8 --- /dev/null +++ b/cluster/nginx-ingress-operator/pvcs.yaml @@ -0,0 +1,26 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: nginx-cache-external + namespace: nginx-ingress-external +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + storageClassName: synology-nfs +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: nginx-cache-internal + namespace: nginx-ingress-internal +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + storageClassName: synology-nfs diff --git a/cluster/nginx-ingress-operator/scc.yaml b/cluster/nginx-ingress-operator/scc.yaml new file mode 100644 index 0000000..aa3d4fa --- /dev/null +++ b/cluster/nginx-ingress-operator/scc.yaml @@ -0,0 +1,44 @@ +--- +kind: SecurityContextConstraints +apiVersion: security.openshift.io/v1 +metadata: + name: nginx-ingress-admin + annotations: + kubernetes.io/description: nginx-ingress-admin allows nginx-ingress to + use the level of capabilities it requires, while forcing all processes + to run as UID 101 as reflected in the official docker images. +allowPrivilegeEscalation: false +allowPrivilegedContainer: true +runAsUser: + type: MustRunAs + uid: 101 +seLinuxContext: + type: MustRunAs +fsGroup: + type: MustRunAs +supplementalGroups: + type: MustRunAs +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowHostDirVolumePlugin: false +allowHostIPC: false +readOnlyRootFilesystem: false +seccompProfiles: +- runtime/default +volumes: +- configMap +- downwardAPI +- emptyDir +- persistentVolumeClaim +- projected +- secret +allowedCapabilities: +- NET_BIND_SERVICE +defaultAddCapabilities: +- NET_BIND_SERVICE +requiredDropCapabilities: +- ALL +users: +- 'system:serviceaccount:*:nginx-ingress' +groups: [] diff --git a/cluster/nginx-ingress-operator/subscription.yaml b/cluster/nginx-ingress-operator/subscription.yaml new file mode 100644 index 0000000..28f45f0 --- /dev/null +++ b/cluster/nginx-ingress-operator/subscription.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: nginx-ingress-operator + namespace: openshift-operators +spec: + channel: alpha + installPlanApproval: Automatic #Manual + name: nginx-ingress-operator + source: certified-operators + sourceNamespace: openshift-marketplace \ No newline at end of file diff --git a/cluster/opencost/Chart.yaml b/cluster/opencost/Chart.yaml new file mode 100644 index 0000000..111562f --- /dev/null +++ b/cluster/opencost/Chart.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v2 +name: opencost-umbrella +description: A helm chart to include opencost with values +type: application +version: 0.1.0 +appVersion: 0.1.0 + +dependencies: +- name: opencost + version: 1.9.8 + repository: https://opencost.github.io/opencost-helm-chart +# condition: opencost.enabled \ No newline at end of file diff --git a/cluster/opencost/kustomization.yaml b/cluster/opencost/kustomization.yaml new file mode 100644 index 0000000..5bdc128 --- /dev/null +++ b/cluster/opencost/kustomization.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +commonAnnotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +resources: +#- namespace.yaml +- https://raw.githubusercontent.com/opencost/opencost/develop/kubernetes/opencost.yaml + diff --git a/cluster/opencost/namespace.yaml b/cluster/opencost/namespace.yaml new file mode 100644 index 0000000..0066f32 --- /dev/null +++ b/cluster/opencost/namespace.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + name: opencost + labels: + argocd.argoproj.io/managed-by: openshift-gitops-operator + kubernetes.io/metadata.name: opencost + openshift.io/cluster-monitoring: 'true' +spec: + finalizers: + - kubernetes diff --git a/cluster/opencost/opencost.yaml b/cluster/opencost/opencost.yaml new file mode 100644 index 0000000..1918bdd --- /dev/null +++ b/cluster/opencost/opencost.yaml @@ -0,0 +1,35 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: opencost + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "5" +spec: + destination: + name: in-cluster + namespace: opencost + project: default + source: +# path: opencost/opencost/develop/kubernetes/opencost.yaml +# repoURL: https://raw.githubusercontent.com/ + path: cluster-applications/opencost + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: false + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: openshift-gitops + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas \ No newline at end of file diff --git a/cluster/opencost/values.yaml b/cluster/opencost/values.yaml new file mode 100644 index 0000000..7c11b88 --- /dev/null +++ b/cluster/opencost/values.yaml @@ -0,0 +1,512 @@ +# -- Overwrite the default name of the chart +nameOverride: "" +# -- Overwrite all resources name created by the chart +fullnameOverride: "" +# -- Override the deployment namespace +namespaceOverride: "" + +loglevel: info + +plugins: + enabled: false + install: + enabled: true + fullImageName: curlimages/curl:latest + securityContext: + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001031000 + folder: /opt/opencost/plugin + # leave this commented to always download most recent version of plugins + # version: + configs: + # datadog: | + # { + # "datadog_site": "", + # "datadog_api_key": "", + # "datadog_app_key": "" + # } + +# -- List of secret names to use for pulling the images +imagePullSecrets: [] + +serviceAccount: + # -- Specifies whether a service account should be created + create: true + # -- Annotations to add to the service account + annotations: {} + # eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/eksctl-opencost + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + # -- Whether pods running as this service account should have an API token automatically mounted + automountServiceAccountToken: true + +# NetworkPolicies for ingress +networkPolicies: + # -- Specifies whether networkpolicies should be created + enabled: false + + # -- Internal Prometheus settings related to NetworkPolicies + prometheus: + # -- Namespace where internal Prometheus is installed + namespace: prometheus-system + # -- Pod port of in-cluster Prometheus + port: 9090 + # -- Labels applied to the Prometheus server pod(s) + labels: + app.kubernetes.io/name: prometheus + + # -- Extra egress rule + extraEgress: [] + +# -- Strategy to be used for the Deployment +updateStrategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + type: RollingUpdate +# -- Annotations to add to the all the resources +annotations: {} +# -- Annotations to add to the OpenCost Pod +podAnnotations: {} +# -- Annotations to add to the Secret +secretAnnotations: {} +# -- Labels to add to the OpenCost Pod +podLabels: {} +# -- Pod priority +priorityClassName: ~ + +# -- Holds pod-level security attributes and common container settings +podSecurityContext: {} + # fsGroup: 2000 + +service: + enabled: true + # -- Annotations to add to the service + annotations: {} + # -- Labels to add to the service account + labels: {} + # -- Kubernetes Service type + type: ClusterIP + # -- NodePort if service type is NodePort + nodePort: {} + # -- extra ports. Useful for sidecar pods such as oauth-proxy + extraPorts: [] + # - name: oauth-proxy + # port: 8081 + # targetPort: 8081 + # - name: oauth-metrics + # port: 8082 + # targetPort: 8082 + # -- LoadBalancer Source IP CIDR if service type is LoadBalancer and cloud provider supports this + loadBalancerSourceRanges: [] + +# Create cluster role policies +rbac: + enabled: true + +opencost: + # -- for the secret containing the Cloud Costs cloud-integration.json https://www.opencost.io/docs/configuration/#cloud-costs + # -- kubectl create secret generic --from-file=cloud-integration.json -n opencost + cloudIntegrationSecret: "" + exporter: + # API_PORT for the cost-model to listen on + apiPort: 9003 + # debugPort: 40000 # for development purposes (debugging with delve) and not for production. + # -- The GCP Pricing API requires a key. This is supplied just for evaluation. + cloudProviderApiKey: "" + # -- Default cluster ID to use if cluster_id is not set in Prometheus metrics. + defaultClusterId: 'default-cluster' + image: + # -- Exporter container image registry + registry: ghcr.io + # -- Exporter container image name + repository: opencost/opencost + # -- Exporter container image tag + tag: "1.113.0@sha256:b313d6d320058bbd3841a948fb636182f49b46df2368d91e2ae046ed03c0f83c" + # -- Exporter container image pull policy + pullPolicy: IfNotPresent + # -- Override the full image name for development purposes + fullImageName: null + # -- List of extra arguments for the command, e.g.: log-format=json + extraArgs: [] + # -- Number of OpenCost replicas to run + replicas: 1 + resources: + # -- CPU/Memory resource requests + requests: + cpu: '10m' + memory: '55Mi' + # -- CPU/Memory resource limits + limits: + cpu: '999m' + memory: '1Gi' + # Startup probe configuration + startupProbe: + # -- Whether probe is enabled + enabled: true + # -- Probe path + path: /healthz + # -- Number of seconds before probe is initiated + initialDelaySeconds: 10 + # -- Probe frequency in seconds + periodSeconds: 5 + # -- Number of failures for probe to be considered failed + failureThreshold: 30 + # Liveness probe configuration + livenessProbe: + # -- Whether probe is enabled + enabled: true + # -- Probe path + path: /healthz + # -- Number of seconds before probe is initiated + initialDelaySeconds: 10 + # -- Probe frequency in seconds + periodSeconds: 20 + # -- Number of failures for probe to be considered failed + failureThreshold: 3 + # Readiness probe configuration + readinessProbe: + # -- Whether probe is enabled + enabled: true + # -- Probe path + path: /healthz + # -- Number of seconds before probe is initiated + initialDelaySeconds: 10 + # -- Probe frequency in seconds + periodSeconds: 10 + # -- Number of failures for probe to be considered failed + failureThreshold: 3 + # -- The security options the container should be run with + securityContext: # {} + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001031000 + + # Path of CSV file + csv_path: "" + + # Persistent volume claim for storing the data. eg: csv file + persistence: + enabled: false + # -- Annotations for persistent volume + annotations: {} + # -- Access mode for persistent volume + accessMode: "" + # -- Storage class for persistent volume + storageClass: "" + # -- Size for persistent volume + size: "" + + aws: + # -- AWS secret access key + secret_access_key: "" + # -- AWS secret key id + access_key_id: "" + # -- A list of volume mounts to be added to the pod + extraVolumeMounts: [] + # -- List of additional environment variables to set in the container + env: [] + # -- Any extra environment variables you would like to pass on to the pod + extraEnv: {} + # FOO: BAR + # For example, if accessing mimir directly and getting 401 Unauthorized + # PROMETHEUS_HEADER_X_SCOPE_ORGID: anonymous + customPricing: + # -- Enables custom pricing configuration + enabled: false + # -- Customize the configmap name used for custom pricing + configmapName: custom-pricing-model + # -- Path for the pricing configuration. + configPath: /tmp/custom-config + # -- Configures the pricing model provided in the values file. + createConfigmap: true + # -- Sets the provider type for the custom pricing file. + provider: custom + # -- More information about these values here: https://www.opencost.io/docs/configuration/on-prem#custom-pricing-using-the-opencost-helm-chart + costModel: + description: Modified pricing configuration. + CPU: 1.25 + spotCPU: 0.006655 + RAM: 0.50 + spotRAM: 0.000892 + GPU: 0.95 + storage: 0.25 + zoneNetworkEgress: 0.01 + regionNetworkEgress: 0.01 + internetNetworkEgress: 0.12 + + dataRetention: + dailyResolutionDays: 15 + + carbonCost: + # -- Enable carbon cost exposed in the API + enabled: false + + cloudCost: + # -- Enable cloud cost ingestion and querying, dependant on valid integration credentials + enabled: false + # -- Number of hours between each run of the Cloud Cost pipeline + refreshRateHours: 6 + # -- Number of days into the past that a Cloud Cost standard run will query for + runWindowDays: 3 + # -- The number of standard runs before a Month-to-Date run occurs + monthToDateInterval: 6 + # -- The max number of days that any single query will be made to construct Cloud Costs + queryWindowDays: 7 + + + metrics: + kubeStateMetrics: + # -- (bool) Enable emission of pod annotations + emitPodAnnotations: ~ + # -- (bool) Enable emission of namespace annotations + emitNamespaceAnnotations: ~ + # -- (bool) Enable emission of KSM v1 metrics + emitKsmV1Metrics: ~ + # -- (bool) Enable only emission of KSM v1 metrics that do not exist in KSM 2 by default + emitKsmV1MetricsOnly: ~ + + serviceMonitor: + # -- Create ServiceMonitor resource for scraping metrics using PrometheusOperator + enabled: false + # -- Additional labels to add to the ServiceMonitor + additionalLabels: {} + # -- Specify if the ServiceMonitor will be deployed into a different namespace (blank deploys into same namespace as chart) + namespace: "" + # -- Interval at which metrics should be scraped + scrapeInterval: 30s + # -- Timeout after which the scrape is ended + scrapeTimeout: 10s + # -- HonorLabels chooses the metric's labels on collisions with target labels + honorLabels: true + # -- RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds relabelings for a few standard Kubernetes fields + relabelings: [] + # -- MetricRelabelConfigs to apply to samples before ingestion + metricRelabelings: [] + # -- extra Endpoints to add to the ServiceMonitor. Useful for scraping sidecars + extraEndpoints: [] + # - port: oauth-metrics + # path: /metrics + # -- HTTP scheme used for scraping. Defaults to `http` + scheme: http + # -- TLS configuration for scraping metrics + tlsConfig: {} + # caFile: /etc/prom-certs/root-cert.pem + # certFile: /etc/prom-certs/cert-chain.pem + # insecureSkipVerify: true + # keyFile: /etc/prom-certs/key.pem + + config: + # -- Enables creating the metrics.json configuration as a ConfigMap + enabled: false + # -- Customize the configmap name used for metrics + configmapName: custom-metrics + # -- List of metrics to be disabled + disabledMetrics: [] + # - + # - + + prometheus: + # -- Secret name that contains credentials for Prometheus + secret_name: ~ + # -- Existing secret name that contains credentials for Prometheus + existingSecretName: ~ + # -- Prometheus Basic auth username + username: "" + # -- Key in the secret that references the username + username_key: DB_BASIC_AUTH_USERNAME + # -- Prometheus Basic auth password + password: "" + # -- Key in the secret that references the password + password_key: DB_BASIC_AUTH_PW + # -- Prometheus Bearer token + bearer_token: "" + bearer_token_key: DB_BEARER_TOKEN + external: + # -- Use external Prometheus (eg. Grafana Cloud) + enabled: false + # -- External Prometheus url + url: "https://prometheus.example.com/prometheus" + internal: + # -- Use in-cluster Prometheus + enabled: true + # -- Service name of in-cluster Prometheus + serviceName: prometheus-server + # -- Namespace of in-cluster Prometheus + namespaceName: prometheus-system + # -- Service port of in-cluster Prometheus + port: 80 + amp: + # -- Use Amazon Managed Service for Prometheus (AMP) + enabled: false # If true, opencost will be configured to remote_write and query from Amazon Managed Service for Prometheus. + # -- Workspace ID for AMP + workspaceId: "" + thanos: + enabled: false + queryOffset: '' + maxSourceResolution: '' + internal: + enabled: true + serviceName: my-thanos-query + namespaceName: opencost + port: 10901 + external: + enabled: false + url: 'https://thanos-query.example.com/thanos' + + ui: + # -- Enable OpenCost UI + enabled: true + image: + # -- UI container image registry + registry: ghcr.io + # -- UI container image name + repository: opencost/opencost-ui + # -- UI container image tag + # @default -- `""` (use appVersion in Chart.yaml) + tag: "1.113.0@sha256:4f408cf765217f889f4cb5cfcc97356e09892045a6ec951b27817a42ecb6748d" + # -- UI container image pull policy + pullPolicy: IfNotPresent + # -- Override the full image name for development purposes + fullImageName: null + resources: + # -- CPU/Memory resource requests + requests: + cpu: '10m' + memory: '55Mi' + # -- CPU/Memory resource limits + limits: + cpu: '999m' + memory: '1Gi' + # used in the default.nginx.conf if you want to switch for using with Docker + # apiServer: 0.0.0.0 + uiPort: 9090 + # Liveness probe configuration + livenessProbe: + # -- Whether probe is enabled + enabled: true + # -- Probe path + path: /healthz + # -- Number of seconds before probe is initiated + initialDelaySeconds: 30 + # -- Probe frequency in seconds + periodSeconds: 10 + # -- Number of failures for probe to be considered failed + failureThreshold: 3 + # Readiness probe configuration + readinessProbe: + # -- Whether probe is enabled + enabled: true + # -- Probe path + path: /healthz + # -- Number of seconds before probe is initiated + initialDelaySeconds: 30 + # -- Probe frequency in seconds + periodSeconds: 10 + # -- Number of failures for probe to be considered failed + failureThreshold: 3 + # -- The security options the container should be run with + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + + # -- A list of environment variables to be added to the pod + extraEnv: [] + + # -- A list of volume mounts to be added to the pod + extraVolumeMounts: [] + + ingress: + # -- Ingress for OpenCost UI + enabled: false + # -- Ingress controller which implements the resource + ingressClassName: "" + # -- Annotations for Ingress resource + annotations: {} + # kubernetes.io/tls-acme: "true" + # -- A list of host rules used to configure the Ingress + # @default -- See [values.yaml](values.yaml) + hosts: + - host: example.local + paths: + - / + # -- Redirect ingress to an extraPort defined on the service such as oauth-proxy + servicePort: http-ui + # servicePort: oauth-proxy + # -- Ingress TLS configuration + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + + sigV4Proxy: + image: public.ecr.aws/aws-observability/aws-sigv4-proxy:latest + imagePullPolicy: IfNotPresent + name: aps + port: 8005 + region: us-west-2 # The AWS region + host: aps-workspaces.us-west-2.amazonaws.com # The hostname for AMP service. + # role_arn: arn:aws:iam:::role/role-name # The AWS IAM role to assume. + extraEnv: # Pass extra env variables to sigV4Proxy + # - name: AWS_ACCESS_KEY_ID + # value: + # - name: AWS_SECRET_ACCESS_KEY + # value: + resources: {} + # limits: + # cpu: 200m + # memory: 500Mi + # requests: + # cpu: 20m + # memory: 32Mi + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 65534 + # -- Toleration labels for pod assignment + tolerations: [] + # -- Node labels for pod assignment + nodeSelector: {} + # -- Affinity settings for pod assignment + affinity: {} + # -- Assign custom TopologySpreadConstraints rules + topologySpreadConstraints: [] + + # -- extra sidecars to add to the pod. Useful for things like oauth-proxy for the UI + extraContainers: [] + # - name: oauth-proxy + # image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1 + # args: + # - --upstream=http://127.0.0.1:9090 + # - --http-address=0.0.0.0:8081 + # - --metrics-address=0.0.0.0:8082 + # - ... + # ports: + # - name: oauth-proxy + # containerPort: 8081 + # protocol: TCP + # - name: oauth-metrics + # containerPort: 8082 + # protocol: TCP + # resources: {} + +# -- A list of volumes to be added to the pod +extraVolumes: [] \ No newline at end of file diff --git a/cluster/openshift-virtualization/hyperconverged.yaml b/cluster/openshift-virtualization/hyperconverged.yaml new file mode 100644 index 0000000..009570f --- /dev/null +++ b/cluster/openshift-virtualization/hyperconverged.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: hco.kubevirt.io/v1beta1 +kind: HyperConverged +metadata: + name: kubevirt-hyperconverged + namespace: openshift-cnv +spec: {} \ No newline at end of file diff --git a/cluster/openshift-virtualization/kustomization.yaml b/cluster/openshift-virtualization/kustomization.yaml new file mode 100644 index 0000000..6440fbe --- /dev/null +++ b/cluster/openshift-virtualization/kustomization.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +commonAnnotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +resources: +- namespace.yaml +- subscription.yaml +- operatorgroup.yaml +- hyperconverged.yaml +- storageprofile.yaml \ No newline at end of file diff --git a/cluster/openshift-virtualization/namespace.yaml b/cluster/openshift-virtualization/namespace.yaml new file mode 100644 index 0000000..822fe9b --- /dev/null +++ b/cluster/openshift-virtualization/namespace.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: openshift-cnv + labels: + name: openshift-cnv + argocd.argoproj.io/managed-by: openshift-gitops-operator +spec: + finalizers: + - kubernetes \ No newline at end of file diff --git a/cluster/openshift-virtualization/openshift-virtualization.yaml b/cluster/openshift-virtualization/openshift-virtualization.yaml new file mode 100644 index 0000000..d5f8311 --- /dev/null +++ b/cluster/openshift-virtualization/openshift-virtualization.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openshift-virtualization + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "4" +spec: + destination: + name: in-cluster + namespace: openshift-cnv + project: default + source: + path: cluster-applications/openshift-virtualization + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: false + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: openshift-gitops + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas \ No newline at end of file diff --git a/cluster/openshift-virtualization/operatorgroup.yaml b/cluster/openshift-virtualization/operatorgroup.yaml new file mode 100644 index 0000000..f2c07a1 --- /dev/null +++ b/cluster/openshift-virtualization/operatorgroup.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: kubevirt-hyperconverged-group + namespace: openshift-cnv +spec: + targetNamespaces: + - openshift-cnv \ No newline at end of file diff --git a/cluster/openshift-virtualization/storageprofile.yaml b/cluster/openshift-virtualization/storageprofile.yaml new file mode 100644 index 0000000..a626e32 --- /dev/null +++ b/cluster/openshift-virtualization/storageprofile.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: cdi.kubevirt.io/v1beta1 +kind: StorageProfile +metadata: + name: synology-iscsi-storage +spec: + claimPropertySets: + - accessModes: + - ReadWriteOnce + volumeMode: + Block + - accessModes: + - ReadWriteMany + volumeMode: + Block + cloneStrategy: csi-clone +status: + provisioner: csi.san.synology.com + storageClass: synology-iscsi-storage \ No newline at end of file diff --git a/cluster/openshift-virtualization/subscription.yaml b/cluster/openshift-virtualization/subscription.yaml new file mode 100644 index 0000000..21cb075 --- /dev/null +++ b/cluster/openshift-virtualization/subscription.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: hco-operatorhub + namespace: openshift-cnv +spec: + source: redhat-operators + sourceNamespace: openshift-marketplace + name: kubevirt-hyperconverged + startingCSV: kubevirt-hyperconverged-operator.v4.16.0 + channel: "stable" \ No newline at end of file diff --git a/cluster/prometheus-operator/cluster-secret-store.yaml b/cluster/prometheus-operator/cluster-secret-store.yaml new file mode 100644 index 0000000..1a93cd8 --- /dev/null +++ b/cluster/prometheus-operator/cluster-secret-store.yaml @@ -0,0 +1,13 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: doppler-cluster +spec: + provider: + doppler: + auth: + secretRef: + dopplerToken: + name: doppler-cluster-token + key: dopplerToken + namespace: external-secrets diff --git a/cluster/prometheus-operator/external-dns.yaml b/cluster/prometheus-operator/external-dns.yaml new file mode 100644 index 0000000..77eb5d1 --- /dev/null +++ b/cluster/prometheus-operator/external-dns.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns-operator + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "3" +spec: + destination: + name: in-cluster + namespace: external-dns-operator + project: default + source: + path: applications/external-dns + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: false + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: openshift-gitops + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas \ No newline at end of file diff --git a/cluster/prometheus-operator/kustomization.yaml b/cluster/prometheus-operator/kustomization.yaml new file mode 100644 index 0000000..fbcfe6b --- /dev/null +++ b/cluster/prometheus-operator/kustomization.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +commonAnnotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +resources: +- namespace.yaml +- operatorgroup.yaml +- subscription.yaml +#- cluster-secret-store.yaml diff --git a/cluster/prometheus-operator/namespace.yaml b/cluster/prometheus-operator/namespace.yaml new file mode 100644 index 0000000..5ec641d --- /dev/null +++ b/cluster/prometheus-operator/namespace.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + name: prometheus-system + labels: + argocd.argoproj.io/managed-by: openshift-gitops-operator + kubernetes.io/metadata.name: prometheus-system + openshift.io/cluster-monitoring: 'true' +spec: + finalizers: + - kubernetes diff --git a/cluster/prometheus-operator/operatorgroup.yaml b/cluster/prometheus-operator/operatorgroup.yaml new file mode 100644 index 0000000..af96e6b --- /dev/null +++ b/cluster/prometheus-operator/operatorgroup.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: prometheus + namespace: prometheus +spec: + upgradeStrategy: Default + targetNamespaces: + - prometheus \ No newline at end of file diff --git a/cluster/prometheus-operator/prometheus-operator.yaml b/cluster/prometheus-operator/prometheus-operator.yaml new file mode 100644 index 0000000..3dfa4a4 --- /dev/null +++ b/cluster/prometheus-operator/prometheus-operator.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: prometheus + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "4" +spec: + destination: + name: in-cluster + namespace: prometheus-system + project: default + source: + path: cluster-applications/prometheus-operator + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: false + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: openshift-gitops + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas \ No newline at end of file diff --git a/cluster/prometheus-operator/subscription.yaml b/cluster/prometheus-operator/subscription.yaml new file mode 100644 index 0000000..7befc3f --- /dev/null +++ b/cluster/prometheus-operator/subscription.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: prometheus + namespace: prometheus +spec: + channel: beta + installPlanApproval: Automatic + name: prometheus + source: community-operators + sourceNamespace: openshift-marketplace diff --git a/cluster/service-mesh-operator/istio.yaml b/cluster/service-mesh-operator/istio.yaml new file mode 100644 index 0000000..d19012b --- /dev/null +++ b/cluster/service-mesh-operator/istio.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: sailoperator.io/v1alpha1 +kind: Istio +metadata: + name: default +spec: + namespace: istio-system + updateStrategy: + type: InPlace + inactiveRevisionDeletionGracePeriodSeconds: 30 + version: v1.23.0 +--- +kind: IstioCNI +apiVersion: sailoperator.io/v1alpha1 +metadata: + name: default +spec: + namespace: istio-cni + version: v1.23.0 diff --git a/cluster/service-mesh-operator/kustomization.yaml b/cluster/service-mesh-operator/kustomization.yaml new file mode 100644 index 0000000..271d6f7 --- /dev/null +++ b/cluster/service-mesh-operator/kustomization.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +commonAnnotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + +resources: +- subscription.yaml +- namespace.yaml +- istio.yaml \ No newline at end of file diff --git a/cluster/service-mesh-operator/namespace.yaml b/cluster/service-mesh-operator/namespace.yaml new file mode 100644 index 0000000..1f497b4 --- /dev/null +++ b/cluster/service-mesh-operator/namespace.yaml @@ -0,0 +1,24 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + kubernetes.io/metadata.name: istio-system + name: istio-system + argocd.argoproj.io/managed-by: openshift-gitops-operator + name: istio-system +spec: + finalizers: + - kubernetes +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + kubernetes.io/metadata.name: istio-cni + name: istio-cni + argocd.argoproj.io/managed-by: openshift-gitops-operator + name: istio-cni +spec: + finalizers: + - kubernetes \ No newline at end of file diff --git a/cluster/service-mesh-operator/service-mesh-operator.yaml b/cluster/service-mesh-operator/service-mesh-operator.yaml new file mode 100644 index 0000000..473c427 --- /dev/null +++ b/cluster/service-mesh-operator/service-mesh-operator.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: service-mesh-operator + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "3" +spec: + destination: + name: in-cluster + namespace: service-mesh-operator + project: default + source: + path: cluster-applications/service-mesh-operator + repoURL: git@github.com:rblundon/MK-Labs.git + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: argocd + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas diff --git a/cluster/service-mesh-operator/subscription.yaml b/cluster/service-mesh-operator/subscription.yaml new file mode 100644 index 0000000..9cff023 --- /dev/null +++ b/cluster/service-mesh-operator/subscription.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: servicemeshoperator3 + namespace: openshift-operators +spec: + channel: candidates + installPlanApproval: Automatic #Manual + name: servicemeshoperator3 + source: redhat-operators + sourceNamespace: openshift-marketplace \ No newline at end of file