rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

Browse Source
This commit is contained in:
Ryan Blundon
2025-03-30 15:46:16 -05:00
parent 68785684d5 fe564d7227
commit d76d8f8e05
346 changed files with 11754 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
cluster-config/components/gitops-operator/base/argocd-dex-server-rolebinding.yaml Normal file
View File

@@ -0,0 +1,11 @@
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: argocd-dex-server
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: argocd-argocd-server
subjects:
- kind: ServiceAccount
name: argocd-argocd-dex-server

19
cluster-config/components/gitops-operator/base/argocd-external-secret.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: argocd-secret
spec:
data:
- remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: OIDC_ARGOCD
secretKey: oidc.keycloak.clientSecret
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: doppler-cluster
target:
creationPolicy: Merge
deletionPolicy: Retain
name: argocd-secret

67
cluster-config/components/gitops-operator/base/create-pipeline-local-user-job.yaml Normal file
View File

@@ -0,0 +1,67 @@
apiVersion: batch/v1
kind: Job
metadata:
name: create-pipeline-local-user
annotations:
argocd.argoproj.io/hook: PostSync
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
template:
spec:
containers:
- image: registry.redhat.io/openshift-gitops-1/argocd-rhel8:1.7
command:
- /bin/bash
- -c
- |
export HOME=/home/argocd
echo "Getting argocd admin credential..."
if kubectl get secret argocd-cluster >/dev/null;
then
# Retrieve password
PASSWORD=$(oc get secret argocd-cluster -o jsonpath="{.data.admin\.password}" | base64 -d)
else
echo "Could not retrieve admin password"
exit 1
fi
IFS=' '
read -ra LIST <<< "$ACCOUNTS_NAMESPACES"
for i in "${LIST[@]}"; do # access each element of array
echo "Generating token for $i"
account=${i%%=*}
namespace=${i#*=}
HAS_SECRET=$(kubectl get secret argocd-env-secret -n $namespace --ignore-not-found)
if [ -z "$HAS_SECRET" ];
then
echo "No argo-env-secret present, creating"
argocd login --plaintext --username admin --password ${PASSWORD} argocd-server
echo "Generating token for ${account}"
TOKEN=$(argocd account generate-token --account ${account})
if [ "$TOKEN" ];
then
echo "Creating secret argocd-env-secret in namespace ${namespace}"
kubectl create secret generic argocd-env-secret --from-literal=ARGOCD_AUTH_TOKEN=${TOKEN} --from-literal=ARGOCD_USERNAME=${account} --from-literal=ARGOCD_SERVER=${ARGO_SERVER_HOST} -n ${namespace}
else
echo "Token $TOKEN could not be generated, no secret created"
exit 1
fi
else
echo "The secret argocd-env-secret already exists, skipping"
fi
done
env:
# The account namespace where the token needs to be deployed to
# Example value: product-catalog-pipeline=product-catalog-cicd demo-pipeline=demo-cicd
- name: ACCOUNTS_NAMESPACES
value: ""
- name: ARGO_SERVER_HOST
value: ""
imagePullPolicy: Always
name: create-pipeline-local-user
serviceAccount: argocd-argocd-application-controller
serviceAccountName: argocd-argocd-application-controller
dnsPolicy: ClusterFirst
restartPolicy: OnFailure
terminationGracePeriodSeconds: 30

254
cluster-config/components/gitops-operator/base/gitops-operator-cr.yaml Normal file
View File

@@ -0,0 +1,254 @@
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd
spec:
# using this in conjunction with respectRBAC
# defaultClusterScopedRoleDisabled: true
resourceTrackingMethod: annotation
applicationSet: {}
kustomizeBuildOptions: "--enable-helm"
notifications:
enabled: true
controller:
logLevel: debug
repo:
sidecarContainers:
- name: setenv-plugin
command: [/var/run/argocd/argocd-cmp-server]
env:
- name: KUSTOMIZE_PLUGIN_HOME
value: /etc/kustomize/plugin
- name: SUB_DOMAIN
value: ${SUB_DOMAIN}
image: quay.io/gnunn/tools:latest
imagePullPolicy: Always
securityContext:
runAsNonRoot: true
volumeMounts:
- mountPath: /var/run/argocd
name: var-files
- mountPath: /home/argocd/cmp-server/plugins
name: plugins
- mountPath: /tmp
name: tmp
- mountPath: /home/argocd/cmp-server/config/plugin.yaml
subPath: plugin.yaml
name: setenv-cmp-plugin
volumes:
- configMap:
name: setenv-cmp-plugin
name: setenv-cmp-plugin
server:
enableRolloutsUI: true
insecure: true
route:
enabled: true
tls:
termination: edge
insecureEdgeTerminationPolicy: Redirect
volumeMounts:
- mountPath: /tmp/extensions/
name: extensions
volumes:
- emptyDir: {}
name: extensions
resourceHealthChecks:
- group: argoproj.io
kind: Application
check: |
hs = {}
hs.status = "Progressing"
hs.message = ""
if obj.status ~= nil then
if obj.status.health ~= nil then
hs.status = obj.status.health.status
hs.message = obj.status.health.message
end
end
return hs
- group: argoproj.io
kind: RolloutManager
check: |
hs = {}
if obj.status ~= nil then
if obj.status.conditions ~= nil then
for _, condition in ipairs(obj.status.conditions) do
hs.message = condition.message
break
end
end
if obj.status.phase ~= nil then
if obj.status.phase == "Failure" then
hs.status = "Degraded"
return hs
elseif obj.status.phase == "Available" then
hs.status = "Healthy"
return hs
elseif obj.status.phase == "Pending" then
hs.status = "Progressing"
return hs
end
end
hs.status = "Progressing"
hs.message = "Waiting for operator to update status"
return hs
end
- group: operators.coreos.com
kind: Subscription
check: |
health_status = {}
if obj.status ~= nil then
if obj.status.conditions ~= nil then
numDegraded = 0
numPending = 0
numSuspended = 0
msg = ""
for i, condition in pairs(obj.status.conditions) do
msg = msg .. i .. ": " .. condition.type .. " | " .. condition.status .. " | " .. condition.reason .. "\n"
if condition.type == "InstallPlanPending" and condition.status == "True" then
if condition.reason == "RequiresApproval" then
numSuspended = numSuspended + 1
else
numPending = numPending + 1
end
elseif (condition.type == "InstallPlanMissing" and condition.reason ~= "ReferencedInstallPlanNotFound") then
numDegraded = numDegraded + 1
elseif (condition.type == "CatalogSourcesUnhealthy" or condition.type == "InstallPlanFailed") and condition.status == "True" then
numDegraded = numDegraded + 1
elseif (condition.type == "ResolutionFailed" and condition.reason ~= "ConstraintsNotSatisfiable") then
numDegraded = numDegraded + 1
end
end
if numDegraded > 0 then
health_status.status = "Degraded"
health_status.message = msg
return health_status
elseif numSuspended > 0 then
health_status.status = "Suspended"
health_status.message = "Requires Approval"
return health_status
elseif numPending > 0 then
health_status.status = "Progressing"
health_status.message = "An install plan for a subscription is pending installation"
return health_status
else
health_status.status = "Healthy"
health_status.message = msg
return health_status
end
end
end
health_status.status = "Progressing"
health_status.message = "An install plan for a subscription is pending installation"
return health_status
- group: operators.coreos.com
kind: InstallPlan
check: |
hs = {}
if obj.status ~= nil then
if obj.status.phase ~= nil then
if obj.status.phase == "Complete" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
elseif obj.status.phase == "RequiresApproval" then
hs.status = "Suspended"
hs.message = obj.status.phase
return hs
else
hs.status = "Progressing"
hs.message = obj.status.phase
return hs
end
end
end
hs.status = "Progressing"
hs.message = "Waiting for InstallPlan to complete"
return hs
- group: image.openshift.io
kind: ImageStream
check: |
hs = {}
hs.status = "Progressing"
hs.message = ""
if obj.status ~= nil then
if obj.status.tags ~= nil then
numTags = 0
for _ , item in pairs(obj.status.tags) do
numTags = numTags + 1
numItems = 0
if item.tags ~= nil then
for _ , item in pairs(item.tags) do
numItems = numItems + 1
end
if numItems == 0 then
return hs
end
end
end
if numTags > 0 then
hs.status = "Healthy"
hs.message = "ImageStream has tags resolved"
return hs
end
end
end
return hs
- group: build.openshift.io
kind: Build
check: |
hs = {}
if obj.status ~= nil then
if obj.status.phase ~= nil then
if obj.status.phase == "Complete" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
end
end
end
hs.status = "Progressing"
hs.message = "Waiting for Build to complete"
return hs
- kind: PersistentVolumeClaim
check: |
hs = {}
if obj.status ~= nil then
if obj.status.phase ~= nil then
if obj.status.phase == "Pending" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
end
if obj.status.phase == "Bound" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
end
end
end
hs.status = "Progressing"
hs.message = "Waiting for PVC"
return hs
resourceExclusions: |
- apiGroups:
- project.openshift.io
clusters:
- '*'
kinds:
- Project
resourceIgnoreDifferences:
resourceIdentifiers:
- group: route.openshift.io
kind: Route
customization:
jsonPointers:
- /status/ingress
- group: quay.redhat.com
kind: QuayRegistry
customization:
jsonPointers:
- /status/ingress
ha:
enabled: false

9
cluster-config/components/gitops-operator/base/kustomization.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- setenv-cmp-plugin-cm.yaml
- argocd-external-secret.yaml
- create-pipeline-local-user-job.yaml
- gitops-operator-cr.yaml
- argocd-dex-server-rolebinding.yaml

19
cluster-config/components/gitops-operator/base/setenv-cmp-plugin-cm.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: setenv-cmp-plugin
data:
plugin.yaml: |
apiVersion: argoproj.io/v1alpha1
kind: ConfigManagementPlugin
metadata:
name: setenv-cmp-plugin
spec:
version: v1.0
init:
command: [sh, -c, 'echo "Initializing setenv-plugin-cmp..."']
generate:
command: [sh, -c, "set -o pipefail && kustomize build --enable-helm --enable-alpha-plugins . | perl -pe 's{\\$(\\{)?(\\w+)(?(1)\\})}{$ENV{$2} // $&}ge'"]
discover:
find:
command: [sh, -c, 'find . -maxdepth 1 -name kustomization.yaml']