Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'
This commit is contained in:
@@ -0,0 +1,11 @@
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: argocd-dex-server
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-argocd-server
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-argocd-dex-server
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: argocd-secret
|
||||
spec:
|
||||
data:
|
||||
- remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: OIDC_ARGOCD
|
||||
secretKey: oidc.keycloak.clientSecret
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: doppler-cluster
|
||||
target:
|
||||
creationPolicy: Merge
|
||||
deletionPolicy: Retain
|
||||
name: argocd-secret
|
||||
@@ -0,0 +1,67 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: create-pipeline-local-user
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- image: registry.redhat.io/openshift-gitops-1/argocd-rhel8:1.7
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
export HOME=/home/argocd
|
||||
|
||||
echo "Getting argocd admin credential..."
|
||||
if kubectl get secret argocd-cluster >/dev/null;
|
||||
then
|
||||
# Retrieve password
|
||||
PASSWORD=$(oc get secret argocd-cluster -o jsonpath="{.data.admin\.password}" | base64 -d)
|
||||
else
|
||||
echo "Could not retrieve admin password"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IFS=' '
|
||||
read -ra LIST <<< "$ACCOUNTS_NAMESPACES"
|
||||
for i in "${LIST[@]}"; do # access each element of array
|
||||
echo "Generating token for $i"
|
||||
account=${i%%=*}
|
||||
namespace=${i#*=}
|
||||
HAS_SECRET=$(kubectl get secret argocd-env-secret -n $namespace --ignore-not-found)
|
||||
if [ -z "$HAS_SECRET" ];
|
||||
then
|
||||
echo "No argo-env-secret present, creating"
|
||||
argocd login --plaintext --username admin --password ${PASSWORD} argocd-server
|
||||
echo "Generating token for ${account}"
|
||||
TOKEN=$(argocd account generate-token --account ${account})
|
||||
if [ "$TOKEN" ];
|
||||
then
|
||||
echo "Creating secret argocd-env-secret in namespace ${namespace}"
|
||||
kubectl create secret generic argocd-env-secret --from-literal=ARGOCD_AUTH_TOKEN=${TOKEN} --from-literal=ARGOCD_USERNAME=${account} --from-literal=ARGOCD_SERVER=${ARGO_SERVER_HOST} -n ${namespace}
|
||||
else
|
||||
echo "Token $TOKEN could not be generated, no secret created"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "The secret argocd-env-secret already exists, skipping"
|
||||
fi
|
||||
done
|
||||
env:
|
||||
# The account namespace where the token needs to be deployed to
|
||||
# Example value: product-catalog-pipeline=product-catalog-cicd demo-pipeline=demo-cicd
|
||||
- name: ACCOUNTS_NAMESPACES
|
||||
value: ""
|
||||
- name: ARGO_SERVER_HOST
|
||||
value: ""
|
||||
imagePullPolicy: Always
|
||||
name: create-pipeline-local-user
|
||||
serviceAccount: argocd-argocd-application-controller
|
||||
serviceAccountName: argocd-argocd-application-controller
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: OnFailure
|
||||
terminationGracePeriodSeconds: 30
|
||||
@@ -0,0 +1,254 @@
|
||||
apiVersion: argoproj.io/v1beta1
|
||||
kind: ArgoCD
|
||||
metadata:
|
||||
name: argocd
|
||||
spec:
|
||||
# using this in conjunction with respectRBAC
|
||||
# defaultClusterScopedRoleDisabled: true
|
||||
resourceTrackingMethod: annotation
|
||||
applicationSet: {}
|
||||
kustomizeBuildOptions: "--enable-helm"
|
||||
notifications:
|
||||
enabled: true
|
||||
controller:
|
||||
logLevel: debug
|
||||
repo:
|
||||
sidecarContainers:
|
||||
- name: setenv-plugin
|
||||
command: [/var/run/argocd/argocd-cmp-server]
|
||||
env:
|
||||
- name: KUSTOMIZE_PLUGIN_HOME
|
||||
value: /etc/kustomize/plugin
|
||||
- name: SUB_DOMAIN
|
||||
value: ${SUB_DOMAIN}
|
||||
image: quay.io/gnunn/tools:latest
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/argocd
|
||||
name: var-files
|
||||
- mountPath: /home/argocd/cmp-server/plugins
|
||||
name: plugins
|
||||
- mountPath: /tmp
|
||||
name: tmp
|
||||
- mountPath: /home/argocd/cmp-server/config/plugin.yaml
|
||||
subPath: plugin.yaml
|
||||
name: setenv-cmp-plugin
|
||||
volumes:
|
||||
- configMap:
|
||||
name: setenv-cmp-plugin
|
||||
name: setenv-cmp-plugin
|
||||
server:
|
||||
enableRolloutsUI: true
|
||||
insecure: true
|
||||
route:
|
||||
enabled: true
|
||||
tls:
|
||||
termination: edge
|
||||
insecureEdgeTerminationPolicy: Redirect
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/extensions/
|
||||
name: extensions
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: extensions
|
||||
resourceHealthChecks:
|
||||
- group: argoproj.io
|
||||
kind: Application
|
||||
check: |
|
||||
hs = {}
|
||||
hs.status = "Progressing"
|
||||
hs.message = ""
|
||||
if obj.status ~= nil then
|
||||
if obj.status.health ~= nil then
|
||||
hs.status = obj.status.health.status
|
||||
hs.message = obj.status.health.message
|
||||
end
|
||||
end
|
||||
return hs
|
||||
- group: argoproj.io
|
||||
kind: RolloutManager
|
||||
check: |
|
||||
hs = {}
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for _, condition in ipairs(obj.status.conditions) do
|
||||
hs.message = condition.message
|
||||
break
|
||||
end
|
||||
end
|
||||
if obj.status.phase ~= nil then
|
||||
if obj.status.phase == "Failure" then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif obj.status.phase == "Available" then
|
||||
hs.status = "Healthy"
|
||||
return hs
|
||||
elseif obj.status.phase == "Pending" then
|
||||
hs.status = "Progressing"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for operator to update status"
|
||||
return hs
|
||||
end
|
||||
- group: operators.coreos.com
|
||||
kind: Subscription
|
||||
check: |
|
||||
health_status = {}
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
numDegraded = 0
|
||||
numPending = 0
|
||||
numSuspended = 0
|
||||
msg = ""
|
||||
for i, condition in pairs(obj.status.conditions) do
|
||||
msg = msg .. i .. ": " .. condition.type .. " | " .. condition.status .. " | " .. condition.reason .. "\n"
|
||||
if condition.type == "InstallPlanPending" and condition.status == "True" then
|
||||
if condition.reason == "RequiresApproval" then
|
||||
numSuspended = numSuspended + 1
|
||||
else
|
||||
numPending = numPending + 1
|
||||
end
|
||||
elseif (condition.type == "InstallPlanMissing" and condition.reason ~= "ReferencedInstallPlanNotFound") then
|
||||
numDegraded = numDegraded + 1
|
||||
elseif (condition.type == "CatalogSourcesUnhealthy" or condition.type == "InstallPlanFailed") and condition.status == "True" then
|
||||
numDegraded = numDegraded + 1
|
||||
elseif (condition.type == "ResolutionFailed" and condition.reason ~= "ConstraintsNotSatisfiable") then
|
||||
numDegraded = numDegraded + 1
|
||||
end
|
||||
end
|
||||
if numDegraded > 0 then
|
||||
health_status.status = "Degraded"
|
||||
health_status.message = msg
|
||||
return health_status
|
||||
elseif numSuspended > 0 then
|
||||
health_status.status = "Suspended"
|
||||
health_status.message = "Requires Approval"
|
||||
return health_status
|
||||
elseif numPending > 0 then
|
||||
health_status.status = "Progressing"
|
||||
health_status.message = "An install plan for a subscription is pending installation"
|
||||
return health_status
|
||||
else
|
||||
health_status.status = "Healthy"
|
||||
health_status.message = msg
|
||||
return health_status
|
||||
end
|
||||
end
|
||||
end
|
||||
health_status.status = "Progressing"
|
||||
health_status.message = "An install plan for a subscription is pending installation"
|
||||
return health_status
|
||||
- group: operators.coreos.com
|
||||
kind: InstallPlan
|
||||
check: |
|
||||
hs = {}
|
||||
if obj.status ~= nil then
|
||||
if obj.status.phase ~= nil then
|
||||
if obj.status.phase == "Complete" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = obj.status.phase
|
||||
return hs
|
||||
elseif obj.status.phase == "RequiresApproval" then
|
||||
hs.status = "Suspended"
|
||||
hs.message = obj.status.phase
|
||||
return hs
|
||||
else
|
||||
hs.status = "Progressing"
|
||||
hs.message = obj.status.phase
|
||||
return hs
|
||||
end
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for InstallPlan to complete"
|
||||
return hs
|
||||
- group: image.openshift.io
|
||||
kind: ImageStream
|
||||
check: |
|
||||
hs = {}
|
||||
hs.status = "Progressing"
|
||||
hs.message = ""
|
||||
if obj.status ~= nil then
|
||||
if obj.status.tags ~= nil then
|
||||
numTags = 0
|
||||
for _ , item in pairs(obj.status.tags) do
|
||||
numTags = numTags + 1
|
||||
numItems = 0
|
||||
if item.tags ~= nil then
|
||||
for _ , item in pairs(item.tags) do
|
||||
numItems = numItems + 1
|
||||
end
|
||||
if numItems == 0 then
|
||||
return hs
|
||||
end
|
||||
end
|
||||
end
|
||||
if numTags > 0 then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "ImageStream has tags resolved"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
end
|
||||
return hs
|
||||
- group: build.openshift.io
|
||||
kind: Build
|
||||
check: |
|
||||
hs = {}
|
||||
if obj.status ~= nil then
|
||||
if obj.status.phase ~= nil then
|
||||
if obj.status.phase == "Complete" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = obj.status.phase
|
||||
return hs
|
||||
end
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for Build to complete"
|
||||
return hs
|
||||
- kind: PersistentVolumeClaim
|
||||
check: |
|
||||
hs = {}
|
||||
if obj.status ~= nil then
|
||||
if obj.status.phase ~= nil then
|
||||
if obj.status.phase == "Pending" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = obj.status.phase
|
||||
return hs
|
||||
end
|
||||
if obj.status.phase == "Bound" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = obj.status.phase
|
||||
return hs
|
||||
end
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for PVC"
|
||||
return hs
|
||||
resourceExclusions: |
|
||||
- apiGroups:
|
||||
- project.openshift.io
|
||||
clusters:
|
||||
- '*'
|
||||
kinds:
|
||||
- Project
|
||||
resourceIgnoreDifferences:
|
||||
resourceIdentifiers:
|
||||
- group: route.openshift.io
|
||||
kind: Route
|
||||
customization:
|
||||
jsonPointers:
|
||||
- /status/ingress
|
||||
- group: quay.redhat.com
|
||||
kind: QuayRegistry
|
||||
customization:
|
||||
jsonPointers:
|
||||
- /status/ingress
|
||||
ha:
|
||||
enabled: false
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- setenv-cmp-plugin-cm.yaml
|
||||
- argocd-external-secret.yaml
|
||||
- create-pipeline-local-user-job.yaml
|
||||
- gitops-operator-cr.yaml
|
||||
- argocd-dex-server-rolebinding.yaml
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: setenv-cmp-plugin
|
||||
data:
|
||||
plugin.yaml: |
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ConfigManagementPlugin
|
||||
metadata:
|
||||
name: setenv-cmp-plugin
|
||||
spec:
|
||||
version: v1.0
|
||||
init:
|
||||
command: [sh, -c, 'echo "Initializing setenv-plugin-cmp..."']
|
||||
generate:
|
||||
command: [sh, -c, "set -o pipefail && kustomize build --enable-helm --enable-alpha-plugins . | perl -pe 's{\\$(\\{)?(\\w+)(?(1)\\})}{$ENV{$2} // $&}ge'"]
|
||||
discover:
|
||||
find:
|
||||
command: [sh, -c, 'find . -maxdepth 1 -name kustomization.yaml']
|
||||
@@ -0,0 +1,2 @@
|
||||
This is a shared GitOps instance intended for tenants leveraging the new
|
||||
Applications in Any Namespace feature GA in OpenShift GitOps 1.13
|
||||
@@ -0,0 +1,184 @@
|
||||
# ClusterRole to aggregate permissions needed to use respectRBAC
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gitops-shared-cluster-access
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
gitops/aggregate-to-gitops-shared: "true"
|
||||
rules: []
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gitops-shared-cluster-access-view
|
||||
labels:
|
||||
gitops/aggregate-to-gitops-shared: "true"
|
||||
# Use the aggrated view permission to determine what resources can be deployed.
|
||||
#
|
||||
# Note that write permissions for these resources in specific namespaces
|
||||
# are determined by the cluster role granted via the "managed-by" label.
|
||||
# You still need to grant the controller cluster level list permissions
|
||||
# to pass the SubjectAccessReview. The view role gives get and watch as well
|
||||
# so if you want to restrict permissions to just list you need to maintain
|
||||
# your own hand-crafted list which turns out to be burdensome.
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gitops-shared-cluster-access-base
|
||||
labels:
|
||||
gitops/aggregate-to-gitops-shared: "true"
|
||||
rules:
|
||||
# Base permissions the applicaton-controller needs for respectRBAC separate from resources
|
||||
# grant read/write permissions so Argo CD UI and controllers can update status of resources.
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- applicationsets
|
||||
- appprojects
|
||||
- rolloutmanagers
|
||||
- rollouts
|
||||
verbs:
|
||||
- "*"
|
||||
# SubjectAccessReview needed for respectRBAC=strict setting in Argo CD
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- selfsubjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
# Needs ability to list projects for some reason
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# Hand-crafted list of what we want to have Argo CD be able to use, turns
|
||||
# out list becomes huge and hard to maintain so I have opted to just leverage
|
||||
# the built-in view role. However if you want total control over permissions
|
||||
# you can use these instead
|
||||
# # Limited resource permissions here for tenants to deploy things
|
||||
# - apiGroups:
|
||||
# - ""
|
||||
# resources:
|
||||
# - configmaps
|
||||
# - endpoints
|
||||
# - persistentvolumeclaims
|
||||
# - persistentvolumeclaims/status
|
||||
# - pods
|
||||
# - replicationcontrollers
|
||||
# - replicationcontrollers/scale
|
||||
# - serviceaccounts
|
||||
# - services
|
||||
# - services/status
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
# - apiGroups:
|
||||
# - ""
|
||||
# resources:
|
||||
# - bindings
|
||||
# - events
|
||||
# - limitranges
|
||||
# - namespaces/status
|
||||
# - pods/log
|
||||
# - pods/status
|
||||
# - replicationcontrollers/status
|
||||
# - resourcequotas
|
||||
# - resourcequotas/status
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
# - apiGroups:
|
||||
# - apps
|
||||
# resources:
|
||||
# - controllerrevisions
|
||||
# - daemonsets
|
||||
# - daemonsets/status
|
||||
# - deployments
|
||||
# - deployments/scale
|
||||
# - deployments/status
|
||||
# - replicasets
|
||||
# - replicasets/scale
|
||||
# - replicasets/status
|
||||
# - statefulsets
|
||||
# - statefulsets/scale
|
||||
# - statefulsets/status
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
# - apiGroups:
|
||||
# - ""
|
||||
# - route.openshift.io
|
||||
# resources:
|
||||
# - routes
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
# - apiGroups:
|
||||
# - ""
|
||||
# - route.openshift.io
|
||||
# resources:
|
||||
# - routes/status
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
# - apiGroups:
|
||||
# - networking.k8s.io
|
||||
# resources:
|
||||
# - networkpolicies
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
# - apiGroups:
|
||||
# - rbac.authorization.k8s.io
|
||||
# resources:
|
||||
# - roles
|
||||
# - rolebindings
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
# - apiGroups:
|
||||
# - monitoring.coreos.com
|
||||
# resources:
|
||||
# - servicemonitors
|
||||
# verbs:
|
||||
# - get
|
||||
# - list
|
||||
# - watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: gitops-shared-cluster-access
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: gitops-shared-cluster-access
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-argocd-application-controller
|
||||
namespace: gitops
|
||||
- kind: ServiceAccount
|
||||
name: argocd-argocd-server
|
||||
namespace: gitops
|
||||
- kind: ServiceAccount
|
||||
name: argocd-applicationset-controller
|
||||
namespace: gitops
|
||||
@@ -0,0 +1,557 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
template.app-created: |-
|
||||
email:
|
||||
subject: Application {{.app.metadata.name}} has been created.
|
||||
message: Application {{.app.metadata.name}} has been created.
|
||||
teams:
|
||||
title: Application {{.app.metadata.name}} has been created.
|
||||
template.app-deleted: |-
|
||||
email:
|
||||
subject: Application {{.app.metadata.name}} has been deleted.
|
||||
message: Application {{.app.metadata.name}} has been deleted.
|
||||
teams:
|
||||
title: Application {{.app.metadata.name}} has been deleted.
|
||||
template.app-deployed: |-
|
||||
email:
|
||||
subject: New version of an application {{.app.metadata.name}} is up and running.
|
||||
message: |
|
||||
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.
|
||||
slack:
|
||||
attachments: |
|
||||
[{
|
||||
"title": "{{ .app.metadata.name}}",
|
||||
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
|
||||
"color": "#18be52",
|
||||
"fields": [
|
||||
{
|
||||
"title": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}",
|
||||
"short": true
|
||||
},
|
||||
{
|
||||
"title": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}",
|
||||
"short": true
|
||||
},
|
||||
{
|
||||
"title": "Revision",
|
||||
"value": "{{.app.status.sync.revision}}",
|
||||
"short": true
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"title": "{{$c.type}}",
|
||||
"value": "{{$c.message}}",
|
||||
"short": true
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
}]
|
||||
deliveryPolicy: Post
|
||||
groupingKey: ""
|
||||
notifyBroadcast: false
|
||||
teams:
|
||||
facts: |
|
||||
[{
|
||||
"name": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}"
|
||||
},
|
||||
{
|
||||
"name": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}"
|
||||
},
|
||||
{
|
||||
"name": "Revision",
|
||||
"value": "{{.app.status.sync.revision}}"
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"name": "{{$c.type}}",
|
||||
"value": "{{$c.message}}"
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
potentialAction: |-
|
||||
[{
|
||||
"@type":"OpenUri",
|
||||
"name":"Operation Application",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
|
||||
}]
|
||||
},
|
||||
{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Repository",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
|
||||
}]
|
||||
}]
|
||||
themeColor: '#000080'
|
||||
title: New version of an application {{.app.metadata.name}} is up and running.
|
||||
template.app-health-degraded: |-
|
||||
email:
|
||||
subject: Application {{.app.metadata.name}} has degraded.
|
||||
message: |
|
||||
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.
|
||||
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
|
||||
slack:
|
||||
attachments: |
|
||||
[{
|
||||
"title": "{{ .app.metadata.name}}",
|
||||
"title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
|
||||
"color": "#f4c030",
|
||||
"fields": [
|
||||
{
|
||||
"title": "Health Status",
|
||||
"value": "{{.app.status.health.status}}",
|
||||
"short": true
|
||||
},
|
||||
{
|
||||
"title": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}",
|
||||
"short": true
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"title": "{{$c.type}}",
|
||||
"value": "{{$c.message}}",
|
||||
"short": true
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
}]
|
||||
deliveryPolicy: Post
|
||||
groupingKey: ""
|
||||
notifyBroadcast: false
|
||||
teams:
|
||||
facts: |
|
||||
[{
|
||||
"name": "Health Status",
|
||||
"value": "{{.app.status.health.status}}"
|
||||
},
|
||||
{
|
||||
"name": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}"
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"name": "{{$c.type}}",
|
||||
"value": "{{$c.message}}"
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
potentialAction: |
|
||||
[{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Application",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
|
||||
}]
|
||||
},
|
||||
{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Repository",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
|
||||
}]
|
||||
}]
|
||||
themeColor: '#FF0000'
|
||||
title: Application {{.app.metadata.name}} has degraded.
|
||||
template.app-sync-failed: |-
|
||||
email:
|
||||
subject: Failed to sync application {{.app.metadata.name}}.
|
||||
message: |
|
||||
{{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}
|
||||
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
|
||||
slack:
|
||||
attachments: |
|
||||
[{
|
||||
"title": "{{ .app.metadata.name}}",
|
||||
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
|
||||
"color": "#E96D76",
|
||||
"fields": [
|
||||
{
|
||||
"title": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}",
|
||||
"short": true
|
||||
},
|
||||
{
|
||||
"title": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}",
|
||||
"short": true
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"title": "{{$c.type}}",
|
||||
"value": "{{$c.message}}",
|
||||
"short": true
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
}]
|
||||
deliveryPolicy: Post
|
||||
groupingKey: ""
|
||||
notifyBroadcast: false
|
||||
teams:
|
||||
facts: |
|
||||
[{
|
||||
"name": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}"
|
||||
},
|
||||
{
|
||||
"name": "Failed at",
|
||||
"value": "{{.app.status.operationState.finishedAt}}"
|
||||
},
|
||||
{
|
||||
"name": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}"
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"name": "{{$c.type}}",
|
||||
"value": "{{$c.message}}"
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
potentialAction: |-
|
||||
[{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Operation",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
|
||||
}]
|
||||
},
|
||||
{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Repository",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
|
||||
}]
|
||||
}]
|
||||
themeColor: '#FF0000'
|
||||
title: Failed to sync application {{.app.metadata.name}}.
|
||||
template.app-sync-running: |-
|
||||
email:
|
||||
subject: Start syncing application {{.app.metadata.name}}.
|
||||
message: |
|
||||
The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.
|
||||
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
|
||||
slack:
|
||||
attachments: |
|
||||
[{
|
||||
"title": "{{ .app.metadata.name}}",
|
||||
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
|
||||
"color": "#0DADEA",
|
||||
"fields": [
|
||||
{
|
||||
"title": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}",
|
||||
"short": true
|
||||
},
|
||||
{
|
||||
"title": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}",
|
||||
"short": true
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"title": "{{$c.type}}",
|
||||
"value": "{{$c.message}}",
|
||||
"short": true
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
}]
|
||||
deliveryPolicy: Post
|
||||
groupingKey: ""
|
||||
notifyBroadcast: false
|
||||
teams:
|
||||
facts: |
|
||||
[{
|
||||
"name": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}"
|
||||
},
|
||||
{
|
||||
"name": "Started at",
|
||||
"value": "{{.app.status.operationState.startedAt}}"
|
||||
},
|
||||
{
|
||||
"name": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}"
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"name": "{{$c.type}}",
|
||||
"value": "{{$c.message}}"
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
potentialAction: |-
|
||||
[{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Operation",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
|
||||
}]
|
||||
},
|
||||
{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Repository",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
|
||||
}]
|
||||
}]
|
||||
title: Start syncing application {{.app.metadata.name}}.
|
||||
template.app-sync-status-unknown: |-
|
||||
email:
|
||||
subject: Application {{.app.metadata.name}} sync status is 'Unknown'
|
||||
message: |
|
||||
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.
|
||||
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
|
||||
{{if ne .serviceType "slack"}}
|
||||
{{range $c := .app.status.conditions}}
|
||||
* {{$c.message}}
|
||||
{{end}}
|
||||
{{end}}
|
||||
slack:
|
||||
attachments: |
|
||||
[{
|
||||
"title": "{{ .app.metadata.name}}",
|
||||
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
|
||||
"color": "#E96D76",
|
||||
"fields": [
|
||||
{
|
||||
"title": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}",
|
||||
"short": true
|
||||
},
|
||||
{
|
||||
"title": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}",
|
||||
"short": true
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"title": "{{$c.type}}",
|
||||
"value": "{{$c.message}}",
|
||||
"short": true
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
}]
|
||||
deliveryPolicy: Post
|
||||
groupingKey: ""
|
||||
notifyBroadcast: false
|
||||
teams:
|
||||
facts: |
|
||||
[{
|
||||
"name": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}"
|
||||
},
|
||||
{
|
||||
"name": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}"
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"name": "{{$c.type}}",
|
||||
"value": "{{$c.message}}"
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
potentialAction: |-
|
||||
[{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Application",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
|
||||
}]
|
||||
},
|
||||
{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Repository",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
|
||||
}]
|
||||
}]
|
||||
title: Application {{.app.metadata.name}} sync status is 'Unknown'
|
||||
template.app-sync-succeeded: |-
|
||||
email:
|
||||
subject: Application {{.app.metadata.name}} has been successfully synced.
|
||||
message: |
|
||||
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.
|
||||
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
|
||||
slack:
|
||||
attachments: |
|
||||
[{
|
||||
"title": "{{ .app.metadata.name}}",
|
||||
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
|
||||
"color": "#18be52",
|
||||
"fields": [
|
||||
{
|
||||
"title": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}",
|
||||
"short": true
|
||||
},
|
||||
{
|
||||
"title": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}",
|
||||
"short": true
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"title": "{{$c.type}}",
|
||||
"value": "{{$c.message}}",
|
||||
"short": true
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
}]
|
||||
deliveryPolicy: Post
|
||||
groupingKey: ""
|
||||
notifyBroadcast: false
|
||||
teams:
|
||||
facts: |
|
||||
[{
|
||||
"name": "Sync Status",
|
||||
"value": "{{.app.status.sync.status}}"
|
||||
},
|
||||
{
|
||||
"name": "Synced at",
|
||||
"value": "{{.app.status.operationState.finishedAt}}"
|
||||
},
|
||||
{
|
||||
"name": "Repository",
|
||||
"value": "{{.app.spec.source.repoURL}}"
|
||||
}
|
||||
{{range $index, $c := .app.status.conditions}}
|
||||
{{if not $index}},{{end}}
|
||||
{{if $index}},{{end}}
|
||||
{
|
||||
"name": "{{$c.type}}",
|
||||
"value": "{{$c.message}}"
|
||||
}
|
||||
{{end}}
|
||||
]
|
||||
potentialAction: |-
|
||||
[{
|
||||
"@type":"OpenUri",
|
||||
"name":"Operation Details",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
|
||||
}]
|
||||
},
|
||||
{
|
||||
"@type":"OpenUri",
|
||||
"name":"Open Repository",
|
||||
"targets":[{
|
||||
"os":"default",
|
||||
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
|
||||
}]
|
||||
}]
|
||||
themeColor: '#000080'
|
||||
title: Application {{.app.metadata.name}} has been successfully synced
|
||||
trigger.on-created: |-
|
||||
- description: Application is created.
|
||||
oncePer: app.metadata.name
|
||||
send:
|
||||
- app-created
|
||||
when: "true"
|
||||
trigger.on-deleted: |-
|
||||
- description: Application is deleted.
|
||||
oncePer: app.metadata.name
|
||||
send:
|
||||
- app-deleted
|
||||
when: app.metadata.deletionTimestamp != nil
|
||||
trigger.on-deployed: |-
|
||||
- description: Application is synced and healthy. Triggered once per commit.
|
||||
oncePer: app.status.operationState.syncResult.revision
|
||||
send:
|
||||
- app-deployed
|
||||
when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status
|
||||
== 'Healthy'
|
||||
trigger.on-health-degraded: |-
|
||||
- description: Application has degraded
|
||||
send:
|
||||
- app-health-degraded
|
||||
when: app.status.health.status == 'Degraded'
|
||||
trigger.on-sync-failed: |-
|
||||
- description: Application syncing has failed
|
||||
send:
|
||||
- app-sync-failed
|
||||
when: app.status.operationState.phase in ['Error', 'Failed']
|
||||
trigger.on-sync-running: |-
|
||||
- description: Application is being synced
|
||||
send:
|
||||
- app-sync-running
|
||||
when: app.status.operationState.phase in ['Running']
|
||||
trigger.on-sync-status-unknown: |-
|
||||
- description: Application status is 'Unknown'
|
||||
end:
|
||||
- app-sync-status-unknown
|
||||
when: app.status.sync.status == 'Unknown'
|
||||
trigger.on-sync-succeeded: |-
|
||||
- description: Application syncing has succeeded
|
||||
send:
|
||||
- app-sync-succeeded
|
||||
- server-post-prod-app-sync
|
||||
when: app.status.operationState.phase in ['Succeeded']
|
||||
# Tekton Webhook Definitions
|
||||
service.webhook.server-post-prod: |-
|
||||
url: http://el-server-post-prod.product-catalog-cicd.svc:8080
|
||||
template.server-post-prod-app-sync: |-
|
||||
webhook:
|
||||
server-post-prod:
|
||||
method: POST
|
||||
path: /
|
||||
body: |
|
||||
{
|
||||
{{if eq .app.status.operationState.phase "Running"}} "state": "pending"{{end}}
|
||||
{{if eq .app.status.operationState.phase "Succeeded"}} "state": "success"{{end}}
|
||||
{{if eq .app.status.operationState.phase "Error"}} "state": "error"{{end}}
|
||||
{{if eq .app.status.operationState.phase "Failed"}} "state": "error"{{end}},
|
||||
"description": "ArgoCD",
|
||||
"application": "{{.app.metadata.name}}"
|
||||
}
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: argocd
|
||||
app.kubernetes.io/name: argocd-notifications-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-cm
|
||||
namespace: product-catalog-gitops
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gitops-monitoring-cluster-role
|
||||
labels:
|
||||
gitops/aggregate-to-controller: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
- podmonitors
|
||||
verbs:
|
||||
- '*'
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: global
|
||||
spec:
|
||||
description: Global Configuration
|
||||
clusterResourceBlacklist:
|
||||
- group: '*'
|
||||
kind: '*'
|
||||
namespaceResourceBlacklist:
|
||||
- group: ''
|
||||
kind: Namespace
|
||||
- group: ''
|
||||
kind: ResourceQuota
|
||||
- group: ''
|
||||
kind: LimitRange
|
||||
- group: operators.coreos.com
|
||||
kind: '*'
|
||||
- group: operator.openshift.io
|
||||
kind: '*'
|
||||
- group: storage.k8s.io
|
||||
kind: '*'
|
||||
- group: machine.openshift.io
|
||||
kind: '*'
|
||||
- group: machineconfiguration.openshift.io
|
||||
kind: '*'
|
||||
- group: compliance.openshift.io
|
||||
kind: '*'
|
||||
@@ -0,0 +1,73 @@
|
||||
namespace: gitops
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- argocd-cluster-role.yaml
|
||||
- gitops-monitoring-cluster-role.yaml
|
||||
- namespace.yaml
|
||||
- argocd-notifications-cm.yaml
|
||||
- console-link.yaml
|
||||
- global-appproject.yaml
|
||||
- prometheus-rules.yaml
|
||||
|
||||
patches:
|
||||
# Update permissions for tenants and local accounts, note ACCOUNT_NAMESPACES is space separated
|
||||
- patch: |-
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/env
|
||||
value:
|
||||
- name: ACCOUNTS_NAMESPACES
|
||||
value: "product-catalog-pipeline=product-catalog-cicd rollouts-demo-pipeline=rollouts-demo-cicd"
|
||||
- name: ARGO_SERVER_HOST
|
||||
value: "argocd-server-gitops.${SUB_DOMAIN}"
|
||||
target:
|
||||
kind: Job
|
||||
name: create-pipeline-local-user
|
||||
- target:
|
||||
kind: ArgoCD
|
||||
name: argocd
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/defaultClusterScopedRoleDisabled
|
||||
value: true
|
||||
- op: add
|
||||
path: /spec/extraConfig
|
||||
value:
|
||||
resource.respectRBAC: "strict"
|
||||
exec.enabled: "true"
|
||||
globalProjects: |-
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: argocd.argoproj.io/project-inherit
|
||||
operator: In
|
||||
values:
|
||||
- global
|
||||
projectName: global
|
||||
accounts.product-catalog-pipeline: apiKey
|
||||
accounts.rollouts-demo-pipeline: apiKey
|
||||
oidc.config: |
|
||||
name: Keycloak
|
||||
issuer: https://sso.ocplab.com/realms/ocplab
|
||||
clientID: argocd
|
||||
clientSecret: $oidc.keycloak.clientSecret
|
||||
requestedScopes: ["openid", "profile", "email", "groups"]
|
||||
- op: add
|
||||
path: /spec/sourceNamespaces
|
||||
value:
|
||||
- product-catalog-gitops
|
||||
- rollouts-demo-gitops
|
||||
- op: add
|
||||
path: /spec/rbac
|
||||
value:
|
||||
defaultPolicy: 'role:none'
|
||||
policy: |
|
||||
p, role:none, *, *, */*, deny
|
||||
g, system:cluster-admins, role:admin
|
||||
g, cluster-admins, role:admin
|
||||
p, role:developers, clusters, get, *, allow
|
||||
p, role:developers, repositories, get, *, allow
|
||||
g, developers, role:developers
|
||||
scopes: "[accounts,groups]"
|
||||
- op: add
|
||||
path: /spec/server/host
|
||||
value: "argocd-server-gitops.${SUB_DOMAIN}"
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
annotations:
|
||||
openshift.io/description: Project for tenants GitOps Operator instance
|
||||
openshift.io/display-name: GitOps
|
||||
name: gitops
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: argocd-unhealthy-alert
|
||||
annotations:
|
||||
policy.open-cluster-management.io/disable-templates: "true"
|
||||
spec:
|
||||
groups:
|
||||
- name: ArgoCD
|
||||
rules:
|
||||
- alert: ArgoCDHealthAlert
|
||||
annotations:
|
||||
message: ArgoCD application {{ $labels.name }} is not healthy
|
||||
expr: argocd_app_info{namespace="openshift-gitops", health_status!~"Healthy|Suspended|Progressing|Degraded"} > 0
|
||||
for: 5m
|
||||
labels:
|
||||
severity: warning
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: argocd-degraded-alert
|
||||
annotations:
|
||||
policy.open-cluster-management.io/disable-templates: "true"
|
||||
spec:
|
||||
groups:
|
||||
- name: ArgoCD
|
||||
rules:
|
||||
- alert: ArgoCDDegradedAlert
|
||||
annotations:
|
||||
message: ArgoCD application {{ $labels.name }} is degraded
|
||||
expr: argocd_app_info{namespace="openshift-gitops", health_status="Degraded"} > 0
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
Reference in New Issue
Block a user