Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'
This commit is contained in:
@@ -0,0 +1,5 @@
|
||||
resources:
|
||||
- subscription.yaml
|
||||
- tekton-config.yaml
|
||||
# Partial needs more work, even with sync wave it fails. Suspect TektonInstaller needs health check so this doesn't get applied until it's ready
|
||||
# - tekton-config-metrics-partial.yaml
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: operators.coreos.com/v1alpha1
|
||||
kind: Subscription
|
||||
metadata:
|
||||
labels:
|
||||
operators.coreos.com/openshift-pipelines-operator-rh.openshift-operators: ""
|
||||
name: openshift-pipelines-operator-rh
|
||||
namespace: openshift-operators
|
||||
spec:
|
||||
channel: pipelines-1.18
|
||||
installPlanApproval: Automatic
|
||||
name: openshift-pipelines-operator-rh
|
||||
source: redhat-operators
|
||||
sourceNamespace: openshift-marketplace
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: operator.tekton.dev/v1alpha1
|
||||
kind: TektonConfig
|
||||
metadata:
|
||||
name: config
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true, SkipDryRunOnMissingResource=true
|
||||
argocd.argoproj.io/sync-wave: "99"
|
||||
spec:
|
||||
pipeline:
|
||||
metrics.taskrun.level: taskrun
|
||||
metrics.pipelinerun.level: pipelinerun
|
||||
metrics.taskrun.duration-type: lastvalue
|
||||
metrics.pipelinerun.duration-type: lastvalue
|
||||
@@ -0,0 +1,129 @@
|
||||
apiVersion: operator.tekton.dev/v1alpha1
|
||||
kind: TektonConfig
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
## Do last to overwrite default rather then other way arround
|
||||
argocd.argoproj.io/sync-wave: "99"
|
||||
name: config
|
||||
spec:
|
||||
addon:
|
||||
params:
|
||||
- name: clusterTasks
|
||||
value: "true"
|
||||
- name: pipelineTemplates
|
||||
value: "true"
|
||||
- name: communityClusterTasks
|
||||
value: "true"
|
||||
- name: resolverTasks
|
||||
value: 'true'
|
||||
- name: resolverStepActions
|
||||
value: 'true'
|
||||
- name: communityResolverTasks
|
||||
value: 'true'
|
||||
chain:
|
||||
artifacts.taskrun.format: in-toto
|
||||
artifacts.taskrun.storage: tekton
|
||||
artifacts.taskrun.signer: x509
|
||||
artifacts.oci.storage: oci
|
||||
artifacts.oci.format: simplesigning
|
||||
artifacts.oci.signer: x509
|
||||
transparency.enabled: "true"
|
||||
dashboard:
|
||||
options:
|
||||
disabled: false
|
||||
readonly: false
|
||||
hub:
|
||||
options:
|
||||
disabled: false
|
||||
params:
|
||||
- name: createRbacResource
|
||||
value: "true"
|
||||
pipeline:
|
||||
await-sidecar-readiness: true
|
||||
coschedule: workspaces
|
||||
default-service-account: pipeline
|
||||
disable-affinity-assistant: true
|
||||
disable-creds-init: false
|
||||
enable-api-fields: beta
|
||||
enable-bundles-resolver: true
|
||||
enable-cel-in-whenexpression: false
|
||||
enable-cluster-resolver: true
|
||||
enable-custom-tasks: true
|
||||
enable-git-resolver: true
|
||||
enable-hub-resolver: true
|
||||
enable-param-enum: false
|
||||
enable-provenance-in-status: false
|
||||
enable-step-actions: true
|
||||
enforce-nonfalsifiability: none
|
||||
git-resolver-config:
|
||||
default-revision: main
|
||||
fetch-timeout: 1m
|
||||
default-url: https://github.com/gnunn-gitops/tekton-catalog
|
||||
keep-pod-on-cancel: false
|
||||
max-result-size: 4096
|
||||
metrics.count.enable-reason: false
|
||||
metrics.pipelinerun.duration-type: lastvalue
|
||||
metrics.pipelinerun.level: pipelinerun
|
||||
metrics.taskrun.duration-type: lastvalue
|
||||
metrics.taskrun.level: taskrun
|
||||
options:
|
||||
disabled: false
|
||||
params:
|
||||
- name: enableMetrics
|
||||
value: "true"
|
||||
performance:
|
||||
disable-ha: false
|
||||
require-git-ssh-secret-known-hosts: false
|
||||
results-from: termination-message
|
||||
running-in-environment-with-injected-sidecars: true
|
||||
send-cloudevents-for-runs: false
|
||||
set-security-context: false
|
||||
trusted-resources-verification-no-match-policy: ignore
|
||||
platforms:
|
||||
openshift:
|
||||
pipelinesAsCode:
|
||||
enable: true
|
||||
options:
|
||||
disabled: false
|
||||
settings:
|
||||
application-name: Pipelines as Code CI
|
||||
auto-configure-new-github-repo: "false"
|
||||
bitbucket-cloud-check-source-ip: "true"
|
||||
auto-configure-repo-namespace-template: ""
|
||||
bitbucket-cloud-additional-source-ip: ""
|
||||
custom-console-name: ""
|
||||
custom-console-url: ""
|
||||
custom-console-url-namespace: ""
|
||||
custom-console-url-pr-details: ""
|
||||
custom-console-url-pr-tasklog: ""
|
||||
default-max-keep-runs: "0"
|
||||
error-detection-from-container-logs: "true"
|
||||
error-detection-max-number-of-lines: "50"
|
||||
error-detection-simple-regexp: ^(?P<filename>[^:]*):(?P<line>[0-9]+):(?P<column>[0-9]+):([
|
||||
]*)?(?P<error>.*)
|
||||
error-log-snippet: "true"
|
||||
hub-catalog-name: tekton
|
||||
hub-url: https://api.hub.tekton.dev/v1
|
||||
max-keep-run-upper-limit: "0"
|
||||
remember-ok-to-test: "true"
|
||||
remote-tasks: "true"
|
||||
secret-auto-create: "true"
|
||||
secret-github-app-scope-extra-repos: ""
|
||||
secret-github-app-token-scoped: "true"
|
||||
tekton-dashboard-url: ""
|
||||
scc:
|
||||
default: pipelines-scc
|
||||
profile: all
|
||||
pruner:
|
||||
disabled: false
|
||||
keep: 100
|
||||
resources:
|
||||
- pipelinerun
|
||||
schedule: 0 8 * * *
|
||||
targetNamespace: openshift-pipelines
|
||||
trigger:
|
||||
default-service-account: pipeline
|
||||
enable-api-fields: stable
|
||||
options:
|
||||
disabled: false
|
||||
@@ -0,0 +1,68 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- openshift-pipelines-namespace.yaml
|
||||
- oidc-token-refresh-sa.yaml
|
||||
# - signing-cert-external.yaml
|
||||
- oidc-info-secret.yaml
|
||||
- oidc-token-refresher-deploy.yaml
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: TektonConfig
|
||||
name: config
|
||||
patch: |
|
||||
- op: replace
|
||||
path: /spec/chain
|
||||
value:
|
||||
signers.x509.fulcio.enabled: true
|
||||
artifacts.taskrun.storage: oci
|
||||
artifacts.pipelinerun.storage: oci
|
||||
artifacts.pipelinerun.format: in-toto
|
||||
transparency.enabled: 'true'
|
||||
artifacts.taskrun.format: in-toto
|
||||
signers.x509.tuf.mirror.url: 'https://tuf-trusted-artifact-signer.apps.hub.ocplab.com'
|
||||
artifacts.oci.signer: x509
|
||||
signers.x509.fulcio.address: 'https://fulcio-server-trusted-artifact-signer.apps.hub.ocplab.com'
|
||||
artifacts.oci.storage: oci
|
||||
signers.x509.fulcio.issuer: 'https://sso.ocplab.com/realms/ocplab'
|
||||
transparency.url: 'https://rekor-server-trusted-artifact-signer.apps.hub.ocplab.com'
|
||||
disabled: false
|
||||
artifacts.oci.format: simplesigning
|
||||
options:
|
||||
deployments:
|
||||
tekton-chains-controller:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
spec:
|
||||
selector: null
|
||||
strategy: {}
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
spec:
|
||||
containers:
|
||||
- env:
|
||||
- name: TUF_ROOT
|
||||
value: /tuf
|
||||
name: tekton-chains-controller
|
||||
resources: {}
|
||||
volumeMounts:
|
||||
- mountPath: /tuf
|
||||
name: tuf
|
||||
- mountPath: /var/run/sigstore/cosign
|
||||
name: oidc-info
|
||||
volumes:
|
||||
- name: tuf
|
||||
- name: oidc-info
|
||||
secret:
|
||||
items:
|
||||
- key: id-token
|
||||
path: oidc-token
|
||||
secretName: oidc-token
|
||||
status: {}
|
||||
disabled: false
|
||||
signers.x509.identity.token.file: /var/run/sigstore/cosign/oidc-token
|
||||
artifacts.taskrun.signer: x509
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
name: oidc-info
|
||||
namespace: openshift-pipelines
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: doppler-cluster
|
||||
target:
|
||||
name: oidc-info
|
||||
creationPolicy: Owner
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: OIDC_INFO
|
||||
@@ -0,0 +1,36 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: oidc-token-refresher
|
||||
namespace: openshift-pipelines
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- patch
|
||||
- update
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: oidc-token-refresher
|
||||
namespace: openshift-pipelines
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: oidc-token-refresher
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: oidc-token-refresher
|
||||
namespace: openshift-pipelines
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: oidc-token-refresher
|
||||
namespace: openshift-pipelines
|
||||
@@ -0,0 +1,55 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: oidc-token-refresher
|
||||
namespace: openshift-pipelines
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app: oidc-token-refresher
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
app: oidc-token-refresher
|
||||
deployment: oidc-token-refresher
|
||||
spec:
|
||||
containers:
|
||||
- command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/bin/bash
|
||||
set -o pipefail
|
||||
while true; do
|
||||
JWT_TOKEN=$(curl -sL --location "${OIDC_TOKEN_ENDPOINT}" \
|
||||
--header "Content-Type: application/x-www-form-urlencoded" \
|
||||
--data-urlencode "grant_type=client_credentials" \
|
||||
--data-urlencode "client_id=${OIDC_CLIENT_ID}" \
|
||||
--data-urlencode "client_secret=${OIDC_CLIENT_SECRET}" \
|
||||
--data-urlencode "scope=openid" | jq -r '.id_token')
|
||||
kubectl create secret generic oidc-token --from-literal=id-token=${JWT_TOKEN} --dry-run=client -o yaml | kubectl apply -f-
|
||||
sleep 120
|
||||
done
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: oidc-info
|
||||
image: quay.io/openshiftdemos/rollouts-terminal-tooling:latest
|
||||
imagePullPolicy: Always
|
||||
name: oidc-token-refresher
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
serviceAccount: oidc-token-refresher
|
||||
serviceAccountName: oidc-token-refresher
|
||||
terminationGracePeriodSeconds: 30
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: default
|
||||
app.kubernetes.io/part-of: tekton-pipelines
|
||||
kubernetes.io/metadata.name: openshift-pipelines
|
||||
openshift.io/cluster-monitoring: "true"
|
||||
operator.tekton.dev/disable-proxy: "true"
|
||||
name: openshift-pipelines
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: signing-secrets
|
||||
namespace: openshift-pipelines
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: doppler-cluster
|
||||
target:
|
||||
name: signing-secrets
|
||||
# prevent fighting with tekton over ownership
|
||||
creationPolicy: Orphan
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: COSIGN
|
||||
@@ -0,0 +1,7 @@
|
||||
namespace: openshift-pipelines
|
||||
|
||||
resources:
|
||||
- pvc.yaml
|
||||
- tekton-results-db-secret.yaml
|
||||
- tekton-results-tls-secret.yaml
|
||||
- tektonresults.yaml
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: tekton-logs
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
name: tekton-results-postgres
|
||||
namespace: openshift-pipelines
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: doppler-cluster
|
||||
target:
|
||||
name: tekton-results-postgres
|
||||
creationPolicy: Owner
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: TEKTON_RESULTS_DB
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
name: tekton-results-tls
|
||||
namespace: openshift-pipelines
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: doppler-cluster
|
||||
target:
|
||||
name: tekton-results-tls
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
type: kubernetes.io/tls
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: TEKTON_RESULTS_TLS
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: operator.tekton.dev/v1alpha1
|
||||
kind: TektonResult
|
||||
metadata:
|
||||
name: result
|
||||
spec:
|
||||
targetNamespace: openshift-pipelines
|
||||
logs_api: true
|
||||
log_level: info
|
||||
db_port: 5432
|
||||
db_host: tekton-results-postgres-service.openshift-pipelines.svc.cluster.local
|
||||
logs_path: /logs
|
||||
logs_type: File
|
||||
logs_buffer_size: 32768
|
||||
auth_disable: true
|
||||
tls_hostname_override: tekton-results-api-service.openshift-pipelines.svc.cluster.local
|
||||
db_enable_auto_migration: true
|
||||
server_port: 8080
|
||||
prometheus_port: 9090
|
||||
logging_pvc_name: tekton-logs
|
||||
Reference in New Issue
Block a user