rblundon
fe564d7227
git-subtree-dir: cluster-config git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c
74 lines
2.3 KiB
YAML
74 lines
2.3 KiB
YAML
namespace: gitops
|
|
|
|
resources:
|
|
- ../../base
|
|
- argocd-cluster-role.yaml
|
|
- gitops-monitoring-cluster-role.yaml
|
|
- namespace.yaml
|
|
- argocd-notifications-cm.yaml
|
|
- console-link.yaml
|
|
- global-appproject.yaml
|
|
- prometheus-rules.yaml
|
|
|
|
patches:
|
|
# Update permissions for tenants and local accounts, note ACCOUNT_NAMESPACES is space separated
|
|
- patch: |-
|
|
- op: replace
|
|
path: /spec/template/spec/containers/0/env
|
|
value:
|
|
- name: ACCOUNTS_NAMESPACES
|
|
value: "product-catalog-pipeline=product-catalog-cicd rollouts-demo-pipeline=rollouts-demo-cicd"
|
|
- name: ARGO_SERVER_HOST
|
|
value: "argocd-server-gitops.${SUB_DOMAIN}"
|
|
target:
|
|
kind: Job
|
|
name: create-pipeline-local-user
|
|
- target:
|
|
kind: ArgoCD
|
|
name: argocd
|
|
patch: |-
|
|
- op: add
|
|
path: /spec/defaultClusterScopedRoleDisabled
|
|
value: true
|
|
- op: add
|
|
path: /spec/extraConfig
|
|
value:
|
|
resource.respectRBAC: "strict"
|
|
exec.enabled: "true"
|
|
globalProjects: |-
|
|
- labelSelector:
|
|
matchExpressions:
|
|
- key: argocd.argoproj.io/project-inherit
|
|
operator: In
|
|
values:
|
|
- global
|
|
projectName: global
|
|
accounts.product-catalog-pipeline: apiKey
|
|
accounts.rollouts-demo-pipeline: apiKey
|
|
oidc.config: |
|
|
name: Keycloak
|
|
issuer: https://sso.ocplab.com/realms/ocplab
|
|
clientID: argocd
|
|
clientSecret: $oidc.keycloak.clientSecret
|
|
requestedScopes: ["openid", "profile", "email", "groups"]
|
|
- op: add
|
|
path: /spec/sourceNamespaces
|
|
value:
|
|
- product-catalog-gitops
|
|
- rollouts-demo-gitops
|
|
- op: add
|
|
path: /spec/rbac
|
|
value:
|
|
defaultPolicy: 'role:none'
|
|
policy: |
|
|
p, role:none, *, *, */*, deny
|
|
g, system:cluster-admins, role:admin
|
|
g, cluster-admins, role:admin
|
|
p, role:developers, clusters, get, *, allow
|
|
p, role:developers, repositories, get, *, allow
|
|
g, developers, role:developers
|
|
scopes: "[accounts,groups]"
|
|
- op: add
|
|
path: /spec/server/host
|
|
value: "argocd-server-gitops.${SUB_DOMAIN}"
|