rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Squashed 'cluster-config/' content from commit 654f2390

Browse Source 
git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c
This commit is contained in:
Ryan Blundon
2025-03-30 15:46:16 -05:00
commit fe564d7227
346 changed files with 11754 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
components/gitops-operator/base/argocd-dex-server-rolebinding.yaml Normal file
View File

@@ -0,0 +1,11 @@
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: argocd-dex-server
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: argocd-argocd-server
subjects:
- kind: ServiceAccount
name: argocd-argocd-dex-server

19
components/gitops-operator/base/argocd-external-secret.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: argocd-secret
spec:
data:
- remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: OIDC_ARGOCD
secretKey: oidc.keycloak.clientSecret
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: doppler-cluster
target:
creationPolicy: Merge
deletionPolicy: Retain
name: argocd-secret

67
components/gitops-operator/base/create-pipeline-local-user-job.yaml Normal file
View File

@@ -0,0 +1,67 @@
apiVersion: batch/v1
kind: Job
metadata:
name: create-pipeline-local-user
annotations:
argocd.argoproj.io/hook: PostSync
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
template:
spec:
containers:
- image: registry.redhat.io/openshift-gitops-1/argocd-rhel8:1.7
command:
- /bin/bash
- -c
- |
export HOME=/home/argocd
echo "Getting argocd admin credential..."
if kubectl get secret argocd-cluster >/dev/null;
then
# Retrieve password
PASSWORD=$(oc get secret argocd-cluster -o jsonpath="{.data.admin\.password}" | base64 -d)
else
echo "Could not retrieve admin password"
exit 1
fi
IFS=' '
read -ra LIST <<< "$ACCOUNTS_NAMESPACES"
for i in "${LIST[@]}"; do # access each element of array
echo "Generating token for $i"
account=${i%%=*}
namespace=${i#*=}
HAS_SECRET=$(kubectl get secret argocd-env-secret -n $namespace --ignore-not-found)
if [ -z "$HAS_SECRET" ];
then
echo "No argo-env-secret present, creating"
argocd login --plaintext --username admin --password ${PASSWORD} argocd-server
echo "Generating token for ${account}"
TOKEN=$(argocd account generate-token --account ${account})
if [ "$TOKEN" ];
then
echo "Creating secret argocd-env-secret in namespace ${namespace}"
kubectl create secret generic argocd-env-secret --from-literal=ARGOCD_AUTH_TOKEN=${TOKEN} --from-literal=ARGOCD_USERNAME=${account} --from-literal=ARGOCD_SERVER=${ARGO_SERVER_HOST} -n ${namespace}
else
echo "Token $TOKEN could not be generated, no secret created"
exit 1
fi
else
echo "The secret argocd-env-secret already exists, skipping"
fi
done
env:
# The account namespace where the token needs to be deployed to
# Example value: product-catalog-pipeline=product-catalog-cicd demo-pipeline=demo-cicd
- name: ACCOUNTS_NAMESPACES
value: ""
- name: ARGO_SERVER_HOST
value: ""
imagePullPolicy: Always
name: create-pipeline-local-user
serviceAccount: argocd-argocd-application-controller
serviceAccountName: argocd-argocd-application-controller
dnsPolicy: ClusterFirst
restartPolicy: OnFailure
terminationGracePeriodSeconds: 30

254
components/gitops-operator/base/gitops-operator-cr.yaml Normal file
View File

@@ -0,0 +1,254 @@
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd
spec:
# using this in conjunction with respectRBAC
# defaultClusterScopedRoleDisabled: true
resourceTrackingMethod: annotation
applicationSet: {}
kustomizeBuildOptions: "--enable-helm"
notifications:
enabled: true
controller:
logLevel: debug
repo:
sidecarContainers:
- name: setenv-plugin
command: [/var/run/argocd/argocd-cmp-server]
env:
- name: KUSTOMIZE_PLUGIN_HOME
value: /etc/kustomize/plugin
- name: SUB_DOMAIN
value: ${SUB_DOMAIN}
image: quay.io/gnunn/tools:latest
imagePullPolicy: Always
securityContext:
runAsNonRoot: true
volumeMounts:
- mountPath: /var/run/argocd
name: var-files
- mountPath: /home/argocd/cmp-server/plugins
name: plugins
- mountPath: /tmp
name: tmp
- mountPath: /home/argocd/cmp-server/config/plugin.yaml
subPath: plugin.yaml
name: setenv-cmp-plugin
volumes:
- configMap:
name: setenv-cmp-plugin
name: setenv-cmp-plugin
server:
enableRolloutsUI: true
insecure: true
route:
enabled: true
tls:
termination: edge
insecureEdgeTerminationPolicy: Redirect
volumeMounts:
- mountPath: /tmp/extensions/
name: extensions
volumes:
- emptyDir: {}
name: extensions
resourceHealthChecks:
- group: argoproj.io
kind: Application
check: |
hs = {}
hs.status = "Progressing"
hs.message = ""
if obj.status ~= nil then
if obj.status.health ~= nil then
hs.status = obj.status.health.status
hs.message = obj.status.health.message
end
end
return hs
- group: argoproj.io
kind: RolloutManager
check: |
hs = {}
if obj.status ~= nil then
if obj.status.conditions ~= nil then
for _, condition in ipairs(obj.status.conditions) do
hs.message = condition.message
break
end
end
if obj.status.phase ~= nil then
if obj.status.phase == "Failure" then
hs.status = "Degraded"
return hs
elseif obj.status.phase == "Available" then
hs.status = "Healthy"
return hs
elseif obj.status.phase == "Pending" then
hs.status = "Progressing"
return hs
end
end
hs.status = "Progressing"
hs.message = "Waiting for operator to update status"
return hs
end
- group: operators.coreos.com
kind: Subscription
check: |
health_status = {}
if obj.status ~= nil then
if obj.status.conditions ~= nil then
numDegraded = 0
numPending = 0
numSuspended = 0
msg = ""
for i, condition in pairs(obj.status.conditions) do
msg = msg .. i .. ": " .. condition.type .. " | " .. condition.status .. " | " .. condition.reason .. "\n"
if condition.type == "InstallPlanPending" and condition.status == "True" then
if condition.reason == "RequiresApproval" then
numSuspended = numSuspended + 1
else
numPending = numPending + 1
end
elseif (condition.type == "InstallPlanMissing" and condition.reason ~= "ReferencedInstallPlanNotFound") then
numDegraded = numDegraded + 1
elseif (condition.type == "CatalogSourcesUnhealthy" or condition.type == "InstallPlanFailed") and condition.status == "True" then
numDegraded = numDegraded + 1
elseif (condition.type == "ResolutionFailed" and condition.reason ~= "ConstraintsNotSatisfiable") then
numDegraded = numDegraded + 1
end
end
if numDegraded > 0 then
health_status.status = "Degraded"
health_status.message = msg
return health_status
elseif numSuspended > 0 then
health_status.status = "Suspended"
health_status.message = "Requires Approval"
return health_status
elseif numPending > 0 then
health_status.status = "Progressing"
health_status.message = "An install plan for a subscription is pending installation"
return health_status
else
health_status.status = "Healthy"
health_status.message = msg
return health_status
end
end
end
health_status.status = "Progressing"
health_status.message = "An install plan for a subscription is pending installation"
return health_status
- group: operators.coreos.com
kind: InstallPlan
check: |
hs = {}
if obj.status ~= nil then
if obj.status.phase ~= nil then
if obj.status.phase == "Complete" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
elseif obj.status.phase == "RequiresApproval" then
hs.status = "Suspended"
hs.message = obj.status.phase
return hs
else
hs.status = "Progressing"
hs.message = obj.status.phase
return hs
end
end
end
hs.status = "Progressing"
hs.message = "Waiting for InstallPlan to complete"
return hs
- group: image.openshift.io
kind: ImageStream
check: |
hs = {}
hs.status = "Progressing"
hs.message = ""
if obj.status ~= nil then
if obj.status.tags ~= nil then
numTags = 0
for _ , item in pairs(obj.status.tags) do
numTags = numTags + 1
numItems = 0
if item.tags ~= nil then
for _ , item in pairs(item.tags) do
numItems = numItems + 1
end
if numItems == 0 then
return hs
end
end
end
if numTags > 0 then
hs.status = "Healthy"
hs.message = "ImageStream has tags resolved"
return hs
end
end
end
return hs
- group: build.openshift.io
kind: Build
check: |
hs = {}
if obj.status ~= nil then
if obj.status.phase ~= nil then
if obj.status.phase == "Complete" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
end
end
end
hs.status = "Progressing"
hs.message = "Waiting for Build to complete"
return hs
- kind: PersistentVolumeClaim
check: |
hs = {}
if obj.status ~= nil then
if obj.status.phase ~= nil then
if obj.status.phase == "Pending" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
end
if obj.status.phase == "Bound" then
hs.status = "Healthy"
hs.message = obj.status.phase
return hs
end
end
end
hs.status = "Progressing"
hs.message = "Waiting for PVC"
return hs
resourceExclusions: |
- apiGroups:
- project.openshift.io
clusters:
- '*'
kinds:
- Project
resourceIgnoreDifferences:
resourceIdentifiers:
- group: route.openshift.io
kind: Route
customization:
jsonPointers:
- /status/ingress
- group: quay.redhat.com
kind: QuayRegistry
customization:
jsonPointers:
- /status/ingress
ha:
enabled: false

9
components/gitops-operator/base/kustomization.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- setenv-cmp-plugin-cm.yaml
- argocd-external-secret.yaml
- create-pipeline-local-user-job.yaml
- gitops-operator-cr.yaml
- argocd-dex-server-rolebinding.yaml

19
components/gitops-operator/base/setenv-cmp-plugin-cm.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: setenv-cmp-plugin
data:
plugin.yaml: |
apiVersion: argoproj.io/v1alpha1
kind: ConfigManagementPlugin
metadata:
name: setenv-cmp-plugin
spec:
version: v1.0
init:
command: [sh, -c, 'echo "Initializing setenv-plugin-cmp..."']
generate:
command: [sh, -c, "set -o pipefail && kustomize build --enable-helm --enable-alpha-plugins . | perl -pe 's{\\$(\\{)?(\\w+)(?(1)\\})}{$ENV{$2} // $&}ge'"]
discover:
find:
command: [sh, -c, 'find . -maxdepth 1 -name kustomization.yaml']

2
components/gitops-operator/overlays/shared/README.md Normal file
View File

@@ -0,0 +1,2 @@
This is a shared GitOps instance intended for tenants leveraging the new
Applications in Any Namespace feature GA in OpenShift GitOps 1.13

184
components/gitops-operator/overlays/shared/argocd-cluster-role.yaml Normal file
View File

@@ -0,0 +1,184 @@
# ClusterRole to aggregate permissions needed to use respectRBAC
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-shared-cluster-access
aggregationRule:
clusterRoleSelectors:
- matchLabels:
gitops/aggregate-to-gitops-shared: "true"
rules: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-shared-cluster-access-view
labels:
gitops/aggregate-to-gitops-shared: "true"
# Use the aggrated view permission to determine what resources can be deployed.
#
# Note that write permissions for these resources in specific namespaces
# are determined by the cluster role granted via the "managed-by" label.
# You still need to grant the controller cluster level list permissions
# to pass the SubjectAccessReview. The view role gives get and watch as well
# so if you want to restrict permissions to just list you need to maintain
# your own hand-crafted list which turns out to be burdensome.
aggregationRule:
clusterRoleSelectors:
- matchLabels:
rbac.authorization.k8s.io/aggregate-to-view: "true"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-shared-cluster-access-base
labels:
gitops/aggregate-to-gitops-shared: "true"
rules:
# Base permissions the applicaton-controller needs for respectRBAC separate from resources
# grant read/write permissions so Argo CD UI and controllers can update status of resources.
- apiGroups:
- argoproj.io
resources:
- applications
- applicationsets
- appprojects
- rolloutmanagers
- rollouts
verbs:
- "*"
# SubjectAccessReview needed for respectRBAC=strict setting in Argo CD
- apiGroups:
- authorization.k8s.io
resources:
- selfsubjectaccessreviews
verbs:
- create
# Needs ability to list projects for some reason
- apiGroups:
- config.openshift.io
resources:
- "*"
verbs:
- get
- list
- watch
# Hand-crafted list of what we want to have Argo CD be able to use, turns
# out list becomes huge and hard to maintain so I have opted to just leverage
# the built-in view role. However if you want total control over permissions
# you can use these instead
# # Limited resource permissions here for tenants to deploy things
# - apiGroups:
# - ""
# resources:
# - configmaps
# - endpoints
# - persistentvolumeclaims
# - persistentvolumeclaims/status
# - pods
# - replicationcontrollers
# - replicationcontrollers/scale
# - serviceaccounts
# - services
# - services/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - ""
# resources:
# - bindings
# - events
# - limitranges
# - namespaces/status
# - pods/log
# - pods/status
# - replicationcontrollers/status
# - resourcequotas
# - resourcequotas/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - apps
# resources:
# - controllerrevisions
# - daemonsets
# - daemonsets/status
# - deployments
# - deployments/scale
# - deployments/status
# - replicasets
# - replicasets/scale
# - replicasets/status
# - statefulsets
# - statefulsets/scale
# - statefulsets/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - ""
# - route.openshift.io
# resources:
# - routes
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - ""
# - route.openshift.io
# resources:
# - routes/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - networking.k8s.io
# resources:
# - networkpolicies
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - rbac.authorization.k8s.io
# resources:
# - roles
# - rolebindings
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - monitoring.coreos.com
# resources:
# - servicemonitors
# verbs:
# - get
# - list
# - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: gitops-shared-cluster-access
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: gitops-shared-cluster-access
subjects:
- kind: ServiceAccount
name: argocd-argocd-application-controller
namespace: gitops
- kind: ServiceAccount
name: argocd-argocd-server
namespace: gitops
- kind: ServiceAccount
name: argocd-applicationset-controller
namespace: gitops

557
components/gitops-operator/overlays/shared/argocd-notifications-cm.yaml Normal file
View File

@@ -0,0 +1,557 @@
apiVersion: v1
data:
template.app-created: |-
email:
subject: Application {{.app.metadata.name}} has been created.
message: Application {{.app.metadata.name}} has been created.
teams:
title: Application {{.app.metadata.name}} has been created.
template.app-deleted: |-
email:
subject: Application {{.app.metadata.name}} has been deleted.
message: Application {{.app.metadata.name}} has been deleted.
teams:
title: Application {{.app.metadata.name}} has been deleted.
template.app-deployed: |-
email:
subject: New version of an application {{.app.metadata.name}} is up and running.
message: |
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#18be52",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
},
{
"title": "Revision",
"value": "{{.app.status.sync.revision}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
},
{
"name": "Revision",
"value": "{{.app.status.sync.revision}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Operation Application",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#000080'
title: New version of an application {{.app.metadata.name}} is up and running.
template.app-health-degraded: |-
email:
subject: Application {{.app.metadata.name}} has degraded.
message: |
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#f4c030",
"fields": [
{
"title": "Health Status",
"value": "{{.app.status.health.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Health Status",
"value": "{{.app.status.health.status}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |
[{
"@type":"OpenUri",
"name":"Open Application",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#FF0000'
title: Application {{.app.metadata.name}} has degraded.
template.app-sync-failed: |-
email:
subject: Failed to sync application {{.app.metadata.name}}.
message: |
{{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#E96D76",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Failed at",
"value": "{{.app.status.operationState.finishedAt}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Open Operation",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#FF0000'
title: Failed to sync application {{.app.metadata.name}}.
template.app-sync-running: |-
email:
subject: Start syncing application {{.app.metadata.name}}.
message: |
The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#0DADEA",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Started at",
"value": "{{.app.status.operationState.startedAt}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Open Operation",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
title: Start syncing application {{.app.metadata.name}}.
template.app-sync-status-unknown: |-
email:
subject: Application {{.app.metadata.name}} sync status is 'Unknown'
message: |
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
{{if ne .serviceType "slack"}}
{{range $c := .app.status.conditions}}
* {{$c.message}}
{{end}}
{{end}}
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#E96D76",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Open Application",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
title: Application {{.app.metadata.name}} sync status is 'Unknown'
template.app-sync-succeeded: |-
email:
subject: Application {{.app.metadata.name}} has been successfully synced.
message: |
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#18be52",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Synced at",
"value": "{{.app.status.operationState.finishedAt}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Operation Details",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#000080'
title: Application {{.app.metadata.name}} has been successfully synced
trigger.on-created: |-
- description: Application is created.
oncePer: app.metadata.name
send:
- app-created
when: "true"
trigger.on-deleted: |-
- description: Application is deleted.
oncePer: app.metadata.name
send:
- app-deleted
when: app.metadata.deletionTimestamp != nil
trigger.on-deployed: |-
- description: Application is synced and healthy. Triggered once per commit.
oncePer: app.status.operationState.syncResult.revision
send:
- app-deployed
when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status
== 'Healthy'
trigger.on-health-degraded: |-
- description: Application has degraded
send:
- app-health-degraded
when: app.status.health.status == 'Degraded'
trigger.on-sync-failed: |-
- description: Application syncing has failed
send:
- app-sync-failed
when: app.status.operationState.phase in ['Error', 'Failed']
trigger.on-sync-running: |-
- description: Application is being synced
send:
- app-sync-running
when: app.status.operationState.phase in ['Running']
trigger.on-sync-status-unknown: |-
- description: Application status is 'Unknown'
end:
- app-sync-status-unknown
when: app.status.sync.status == 'Unknown'
trigger.on-sync-succeeded: |-
- description: Application syncing has succeeded
send:
- app-sync-succeeded
- server-post-prod-app-sync
when: app.status.operationState.phase in ['Succeeded']
# Tekton Webhook Definitions
service.webhook.server-post-prod: |-
url: http://el-server-post-prod.product-catalog-cicd.svc:8080
template.server-post-prod-app-sync: |-
webhook:
server-post-prod:
method: POST
path: /
body: |
{
{{if eq .app.status.operationState.phase "Running"}} "state": "pending"{{end}}
{{if eq .app.status.operationState.phase "Succeeded"}} "state": "success"{{end}}
{{if eq .app.status.operationState.phase "Error"}} "state": "error"{{end}}
{{if eq .app.status.operationState.phase "Failed"}} "state": "error"{{end}},
"description": "ArgoCD",
"application": "{{.app.metadata.name}}"
}
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/managed-by: argocd
app.kubernetes.io/name: argocd-notifications-cm
app.kubernetes.io/part-of: argocd
name: argocd-notifications-cm
namespace: product-catalog-gitops

12
components/gitops-operator/overlays/shared/console-link.yaml Normal file
View File

File diff suppressed because one or more lines are too long

14
components/gitops-operator/overlays/shared/gitops-monitoring-cluster-role.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-monitoring-cluster-role
labels:
gitops/aggregate-to-controller: "true"
rules:
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
- podmonitors
verbs:
- '*'

28
components/gitops-operator/overlays/shared/global-appproject.yaml Normal file
View File

@@ -0,0 +1,28 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: global
spec:
description: Global Configuration
clusterResourceBlacklist:
- group: '*'
kind: '*'
namespaceResourceBlacklist:
- group: ''
kind: Namespace
- group: ''
kind: ResourceQuota
- group: ''
kind: LimitRange
- group: operators.coreos.com
kind: '*'
- group: operator.openshift.io
kind: '*'
- group: storage.k8s.io
kind: '*'
- group: machine.openshift.io
kind: '*'
- group: machineconfiguration.openshift.io
kind: '*'
- group: compliance.openshift.io
kind: '*'

73
components/gitops-operator/overlays/shared/kustomization.yaml Normal file
View File

@@ -0,0 +1,73 @@
namespace: gitops
resources:
- ../../base
- argocd-cluster-role.yaml
- gitops-monitoring-cluster-role.yaml
- namespace.yaml
- argocd-notifications-cm.yaml
- console-link.yaml
- global-appproject.yaml
- prometheus-rules.yaml
patches:
# Update permissions for tenants and local accounts, note ACCOUNT_NAMESPACES is space separated
- patch: |-
- op: replace
path: /spec/template/spec/containers/0/env
value:
- name: ACCOUNTS_NAMESPACES
value: "product-catalog-pipeline=product-catalog-cicd rollouts-demo-pipeline=rollouts-demo-cicd"
- name: ARGO_SERVER_HOST
value: "argocd-server-gitops.${SUB_DOMAIN}"
target:
kind: Job
name: create-pipeline-local-user
- target:
kind: ArgoCD
name: argocd
patch: |-
- op: add
path: /spec/defaultClusterScopedRoleDisabled
value: true
- op: add
path: /spec/extraConfig
value:
resource.respectRBAC: "strict"
exec.enabled: "true"
globalProjects: |-
- labelSelector:
matchExpressions:
- key: argocd.argoproj.io/project-inherit
operator: In
values:
- global
projectName: global
accounts.product-catalog-pipeline: apiKey
accounts.rollouts-demo-pipeline: apiKey
oidc.config: |
name: Keycloak
issuer: https://sso.ocplab.com/realms/ocplab
clientID: argocd
clientSecret: $oidc.keycloak.clientSecret
requestedScopes: ["openid", "profile", "email", "groups"]
- op: add
path: /spec/sourceNamespaces
value:
- product-catalog-gitops
- rollouts-demo-gitops
- op: add
path: /spec/rbac
value:
defaultPolicy: 'role:none'
policy: |
p, role:none, *, *, */*, deny
g, system:cluster-admins, role:admin
g, cluster-admins, role:admin
p, role:developers, clusters, get, *, allow
p, role:developers, repositories, get, *, allow
g, developers, role:developers
scopes: "[accounts,groups]"
- op: add
path: /spec/server/host
value: "argocd-server-gitops.${SUB_DOMAIN}"

7
components/gitops-operator/overlays/shared/namespace.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
annotations:
openshift.io/description: Project for tenants GitOps Operator instance
openshift.io/display-name: GitOps
name: gitops

35
components/gitops-operator/overlays/shared/prometheus-rules.yaml Normal file
View File

@@ -0,0 +1,35 @@
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: argocd-unhealthy-alert
annotations:
policy.open-cluster-management.io/disable-templates: "true"
spec:
groups:
- name: ArgoCD
rules:
- alert: ArgoCDHealthAlert
annotations:
message: ArgoCD application {{ $labels.name }} is not healthy
expr: argocd_app_info{namespace="openshift-gitops", health_status!~"Healthy|Suspended|Progressing|Degraded"} > 0
for: 5m
labels:
severity: warning
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: argocd-degraded-alert
annotations:
policy.open-cluster-management.io/disable-templates: "true"
spec:
groups:
- name: ArgoCD
rules:
- alert: ArgoCDDegradedAlert
annotations:
message: ArgoCD application {{ $labels.name }} is degraded
expr: argocd_app_info{namespace="openshift-gitops", health_status="Degraded"} > 0
for: 5m
labels:
severity: critical