From 766dd517b80956f9aaca0cf24088e79896aa9c63 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 4 Feb 2026 17:39:42 +0530 Subject: [PATCH 1/7] feat: 0.3 --- terraform/civo/main.tf | 36 ---- terraform/gcp/workload-cluster/main.tf | 209 -------------------- terraform/gcp/workload-cluster/variables.tf | 16 -- 3 files changed, 261 deletions(-) delete mode 100644 terraform/civo/main.tf delete mode 100644 terraform/gcp/workload-cluster/main.tf delete mode 100644 terraform/gcp/workload-cluster/variables.tf diff --git a/terraform/civo/main.tf b/terraform/civo/main.tf deleted file mode 100644 index a9279ce..0000000 --- a/terraform/civo/main.tf +++ /dev/null @@ -1,36 +0,0 @@ -provider "civo" { - region = "" -} - -locals { - cluster_name = "" - kube_config_filename = "../../../kubeconfig" -} - -resource "civo_network" "kubefirst" { - label = local.cluster_name -} - -resource "civo_firewall" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - create_default_rules = true -} - -resource "civo_kubernetes_cluster" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - firewall_id = civo_firewall.kubefirst.id - kubernetes_version = "1.28.7-k3s1" - write_kubeconfig = true - pools { - label = local.cluster_name - size = "" - node_count = tonumber("") # tonumber() is used for a string token value - } -} - -resource "local_file" "kubeconfig" { - content = civo_kubernetes_cluster.kubefirst.kubeconfig - filename = local.kube_config_filename -} diff --git a/terraform/gcp/workload-cluster/main.tf b/terraform/gcp/workload-cluster/main.tf deleted file mode 100644 index 4c35c97..0000000 --- a/terraform/gcp/workload-cluster/main.tf +++ /dev/null @@ -1,209 +0,0 @@ - - -locals { - cluster_name = var.cluster_name - subnet_name = lookup(module.vpc.subnets, "${var.cluster_region}/subnet-01-${local.cluster_name}").name -} - -data "google_client_config" "current" {} - -resource "google_compute_router" "router" { - name = "gke-cloud-router-${local.cluster_name}" - project = data.google_client_config.current.project - network = local.cluster_name - region = var.cluster_region -} - -module "cloud-nat" { - name = "gke-nat-config-${local.cluster_name}" - source = "terraform-google-modules/cloud-nat/google" - version = "~> 5.0" - project_id = data.google_client_config.current.project - region = var.cluster_region - router = google_compute_router.router.name - source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES" -} - -resource "google_service_account" "kubefirst" { - account_id = local.cluster_name - display_name = "Service Account for ${local.cluster_name} cluster" -} - -module "vpc" { - source = "terraform-google-modules/network/google" - version = "~> 9.1" - - project_id = data.google_client_config.current.project - network_name = local.cluster_name - - subnets = [ - { - subnet_name = "subnet-01-${local.cluster_name}" - subnet_ip = "10.10.10.0/24" - subnet_region = var.cluster_region - subnet_private_access = "true" - subnet_flow_logs = "true" - description = "This base subnet." - }, - ] - - secondary_ranges = { - "subnet-01-${local.cluster_name}" = [ - { - range_name = "subnet-01-${local.cluster_name}-gke-01-pods" - ip_cidr_range = "10.13.0.0/16" - }, - { - range_name = "subnet-01-${local.cluster_name}-gke-01-services" - ip_cidr_range = "10.14.0.0/16" - }, - ] - } -} - -module "gke" { - source = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster" - version = "~> 31.0" - - project_id = data.google_client_config.current.project - name = local.cluster_name - region = var.cluster_region - release_channel = "STABLE" - remove_default_node_pool = true - - deletion_protection = false - - // External availability - enable_private_endpoint = false - enable_private_nodes = true - - // Service Account - create_service_account = true - - // Networking - network = module.vpc.network_name - subnetwork = local.subnet_name - ip_range_pods = "${local.subnet_name}-gke-01-pods" - ip_range_services = "${local.subnet_name}-gke-01-services" - - // Addons - dns_cache = true - enable_shielded_nodes = true - filestore_csi_driver = false - gce_pd_csi_driver = true - horizontal_pod_autoscaling = false - http_load_balancing = false - network_policy = false - - // Node Pools - node_pools = [ - { - name = "kubefirst" - machine_type = var.node_type - - // Autoscaling - // PER ZONE - min_count = var.node_count - // PER ZONE - max_count = var.node_count - // PER ZONE - initial_node_count = var.node_count - - local_ssd_count = 0 - spot = false - disk_size_gb = 100 - disk_type = "pd-standard" - image_type = "COS_CONTAINERD" - enable_gcfs = false - enable_gvnic = false - auto_repair = true - auto_upgrade = true - preemptible = false - }, - ] - - node_pools_oauth_scopes = { - all = [ - "https://www.googleapis.com/auth/logging.write", - "https://www.googleapis.com/auth/monitoring", - "https://www.googleapis.com/auth/devstorage.read_only", - ] - } -} - -resource "aws_ssm_parameter" "clusters" { - provider = aws.PROJECT_REGION - name = "/clusters/${local.cluster_name}" - description = "Cluster configuration for ${local.cluster_name}" - type = "String" - value = jsonencode( - { - cluster_ca_certificate = base64decode(module.gke.ca_certificate) - host = "https://${module.gke.endpoint}" - token = data.google_client_config.current.access_token - cluster_name = local.cluster_name - argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token - } - ) -} - - -provider "kubernetes" { - host = "https://${module.gke.endpoint}" - token = data.google_client_config.current.access_token - cluster_ca_certificate = base64decode(module.gke.ca_certificate) -} - -resource "kubernetes_cluster_role_v1" "argocd_manager" { - metadata { - name = "argocd-manager-role" - } - - rule { - api_groups = ["*"] - resources = ["*"] - verbs = ["*"] - } - rule { - non_resource_urls = ["*"] - verbs = ["*"] - } -} - -resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { - metadata { - name = "argocd-manager-role-binding" - } - role_ref { - api_group = "rbac.authorization.k8s.io" - kind = "ClusterRole" - name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name - } - subject { - kind = "ServiceAccount" - name = kubernetes_service_account_v1.argocd_manager.metadata.0.name - namespace = "kube-system" - } -} - -resource "kubernetes_service_account_v1" "argocd_manager" { - metadata { - name = "argocd-manager" - namespace = "kube-system" - } - secret { - name = "argocd-manager-token" - } -} - -resource "kubernetes_secret_v1" "argocd_manager" { - metadata { - name = "argocd-manager-token" - namespace = "kube-system" - annotations = { - "kubernetes.io/service-account.name" = "argocd-manager" - } - } - type = "kubernetes.io/service-account-token" - depends_on = [ kubernetes_service_account_v1.argocd_manager ] -} diff --git a/terraform/gcp/workload-cluster/variables.tf b/terraform/gcp/workload-cluster/variables.tf deleted file mode 100644 index 04cecfa..0000000 --- a/terraform/gcp/workload-cluster/variables.tf +++ /dev/null @@ -1,16 +0,0 @@ - -variable "node_type" { - type = string -} - -variable "cluster_region" { - type = string -} - -variable "node_count" { - type = number -} - -variable "cluster_name" { - type = string -} From f601e1d8258aeeec8f2d46944db7ea9fe1f30504 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 12 Feb 2026 21:18:03 +0530 Subject: [PATCH 2/7] add v2 template for cp --- templates/controlplane-template/.helmignore | 20 ++ templates/controlplane-template/Chart.yaml | 6 + .../templates/actions-runner-controller.yaml | 33 ++++ .../templates/appprojects.yaml | 24 +++ .../templates/argo-workflows.yaml | 24 +++ .../templates/argocd.yaml | 31 +++ .../templates/atlantis.yaml | 30 +++ .../templates/cert-issuers.yaml | 24 +++ .../templates/cert-manager.yaml | 24 +++ .../templates/chartmuseum.yaml | 24 +++ .../cloudflare-origin-ca-issuer.yaml | 34 ++++ .../cloudflare-origin-issuer-crd.yaml | 24 +++ .../templates/cluster-secret-store.yaml | 30 +++ .../templates/clusterrolebinding.yaml | 119 ++++++++++++ .../templates/clusters.yaml | 25 +++ .../application.yaml | 41 ++++ .../externalsecret.yaml | 18 ++ .../actions-runner-controller/wait.yaml | 59 ++++++ .../argo-workflows/application.yaml | 101 ++++++++++ .../argo-workflows/argo-workflows-cwfts.yaml | 24 +++ .../argo-workflows/cloudflareissuer.yaml | 31 +++ .../argo-workflows/cwfts/cwft-git.yaml | 178 ++++++++++++++++++ .../argo-workflows/cwfts/cwft-helm.yaml | 129 +++++++++++++ .../argo-workflows/cwfts/cwft-kaniko.yaml | 84 +++++++++ .../argo-workflows/externalsecret.yaml | 59 ++++++ .../argo-workflows/serviceaccount.yaml | 52 +++++ .../components/argo-workflows/vault-wait.yaml | 24 +++ .../components/argo-workflows/wait.yaml | 83 ++++++++ .../argo-workflows/wait/vault-tls.yaml | 46 +++++ .../components/argocd-appprojects/.gitkeep | 0 .../components/argocd/argocd-cm.yaml | 13 ++ .../argocd/argocd-cmd-params-cm.yaml | 11 ++ .../argocd/argocd-oidc-restart-job.yaml | 58 ++++++ .../components/argocd/argocd-ui-ingress.yaml | 74 ++++++++ .../components/argocd/cloudflareissuer.yaml | 29 +++ .../components/argocd/externalsecrets.yaml | 24 +++ .../components/argocd/kustomization.yaml | 18 ++ .../components/atlantis/application.yaml | 79 ++++++++ .../components/atlantis/cloudflareissuer.yaml | 31 +++ .../components/atlantis/externalsecret.yaml | 16 ++ .../templates/components/atlantis/wait.yaml | 59 ++++++ .../cert-issuers/clusterissuers.yaml | 29 +++ .../components/cert-manager/application.yaml | 30 +++ .../components/cert-manager/wait-todo.yaml | 0 .../components/chartmuseum/application.yaml | 63 +++++++ .../chartmuseum/cloudflareissuer.yaml | 31 +++ .../chartmuseum/externalsecret.yaml | 17 ++ .../components/chartmuseum/wait.yaml | 59 ++++++ .../clustersecretstore.yaml | 22 +++ .../components/cluster-secret-store/wait.yaml | 40 ++++ .../templates/components/clusters/.gitkeep | 0 .../crossplane/crossplane-system.yaml | 25 +++ .../crossplane-system/crossplane-secrets.yaml | 51 +++++ .../crossplane-system/crossplane-system.yaml | 24 +++ .../components/crossplane/provider.yaml | 25 +++ .../crossplane/provider/controllerconfig.yaml | 23 +++ .../provider/terraform-provider.yaml | 16 ++ .../components/external-dns/application.yaml | 44 +++++ .../components/external-dns/wait.yaml | 59 ++++++ .../external-secrets-operator.yaml | 56 ++++++ .../external-secrets-operator/wait.yaml | 107 +++++++++++ .../github-runner/runnerdeployment.yaml | 20 ++ .../github-runner/serviceaccount.yaml | 7 + .../components/ingress-nginx/application.yaml | 35 ++++ .../components/ingress-nginx/wait.yaml | 59 ++++++ .../components/nginx-apex/config-map.yaml | 109 +++++++++++ .../components/nginx-apex/ingress.yaml | 38 ++++ .../components/nginx-apex/kustomization.yaml | 8 + .../templates/components/nginx-apex/wait.yaml | 59 ++++++ .../components/reloader/application.yaml | 33 ++++ .../templates/components/reloader/wait.yaml | 59 ++++++ .../templates/crossplane.yaml | 25 +++ .../templates/external-dns.yaml | 24 +++ .../templates/external-secrets-operator.yaml | 24 +++ .../templates/github-runner.yaml | 33 ++++ .../templates/ingress-nginx.yaml | 24 +++ .../templates/nginx-apex.yaml | 24 +++ .../templates/registry.yaml | 30 +++ .../templates/reloader.yaml | 24 +++ templates/controlplane-template/values.yaml | 169 +++++++++++++++++ 80 files changed, 3338 insertions(+) create mode 100644 templates/controlplane-template/.helmignore create mode 100644 templates/controlplane-template/Chart.yaml create mode 100644 templates/controlplane-template/templates/actions-runner-controller.yaml create mode 100644 templates/controlplane-template/templates/appprojects.yaml create mode 100644 templates/controlplane-template/templates/argo-workflows.yaml create mode 100644 templates/controlplane-template/templates/argocd.yaml create mode 100644 templates/controlplane-template/templates/atlantis.yaml create mode 100644 templates/controlplane-template/templates/cert-issuers.yaml create mode 100644 templates/controlplane-template/templates/cert-manager.yaml create mode 100644 templates/controlplane-template/templates/chartmuseum.yaml create mode 100644 templates/controlplane-template/templates/cloudflare-origin-ca-issuer.yaml create mode 100644 templates/controlplane-template/templates/cloudflare-origin-issuer-crd.yaml create mode 100644 templates/controlplane-template/templates/cluster-secret-store.yaml create mode 100644 templates/controlplane-template/templates/clusterrolebinding.yaml create mode 100644 templates/controlplane-template/templates/clusters.yaml create mode 100644 templates/controlplane-template/templates/components/actions-runner-controller/application.yaml create mode 100644 templates/controlplane-template/templates/components/actions-runner-controller/externalsecret.yaml create mode 100644 templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/application.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/wait.yaml create mode 100644 templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml create mode 100644 templates/controlplane-template/templates/components/argocd-appprojects/.gitkeep create mode 100644 templates/controlplane-template/templates/components/argocd/argocd-cm.yaml create mode 100644 templates/controlplane-template/templates/components/argocd/argocd-cmd-params-cm.yaml create mode 100644 templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml create mode 100644 templates/controlplane-template/templates/components/argocd/argocd-ui-ingress.yaml create mode 100644 templates/controlplane-template/templates/components/argocd/cloudflareissuer.yaml create mode 100644 templates/controlplane-template/templates/components/argocd/externalsecrets.yaml create mode 100644 templates/controlplane-template/templates/components/argocd/kustomization.yaml create mode 100644 templates/controlplane-template/templates/components/atlantis/application.yaml create mode 100644 templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml create mode 100644 templates/controlplane-template/templates/components/atlantis/externalsecret.yaml create mode 100644 templates/controlplane-template/templates/components/atlantis/wait.yaml create mode 100644 templates/controlplane-template/templates/components/cert-issuers/clusterissuers.yaml create mode 100644 templates/controlplane-template/templates/components/cert-manager/application.yaml create mode 100644 templates/controlplane-template/templates/components/cert-manager/wait-todo.yaml create mode 100644 templates/controlplane-template/templates/components/chartmuseum/application.yaml create mode 100644 templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml create mode 100644 templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml create mode 100644 templates/controlplane-template/templates/components/chartmuseum/wait.yaml create mode 100644 templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml create mode 100644 templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml create mode 100644 templates/controlplane-template/templates/components/clusters/.gitkeep create mode 100644 templates/controlplane-template/templates/components/crossplane/crossplane-system.yaml create mode 100644 templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-secrets.yaml create mode 100644 templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml create mode 100644 templates/controlplane-template/templates/components/crossplane/provider.yaml create mode 100644 templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml create mode 100644 templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml create mode 100644 templates/controlplane-template/templates/components/external-dns/application.yaml create mode 100644 templates/controlplane-template/templates/components/external-dns/wait.yaml create mode 100644 templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml create mode 100644 templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml create mode 100644 templates/controlplane-template/templates/components/github-runner/runnerdeployment.yaml create mode 100644 templates/controlplane-template/templates/components/github-runner/serviceaccount.yaml create mode 100644 templates/controlplane-template/templates/components/ingress-nginx/application.yaml create mode 100644 templates/controlplane-template/templates/components/ingress-nginx/wait.yaml create mode 100644 templates/controlplane-template/templates/components/nginx-apex/config-map.yaml create mode 100644 templates/controlplane-template/templates/components/nginx-apex/ingress.yaml create mode 100644 templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml create mode 100644 templates/controlplane-template/templates/components/nginx-apex/wait.yaml create mode 100644 templates/controlplane-template/templates/components/reloader/application.yaml create mode 100644 templates/controlplane-template/templates/components/reloader/wait.yaml create mode 100644 templates/controlplane-template/templates/crossplane.yaml create mode 100644 templates/controlplane-template/templates/external-dns.yaml create mode 100644 templates/controlplane-template/templates/external-secrets-operator.yaml create mode 100644 templates/controlplane-template/templates/github-runner.yaml create mode 100644 templates/controlplane-template/templates/ingress-nginx.yaml create mode 100644 templates/controlplane-template/templates/nginx-apex.yaml create mode 100644 templates/controlplane-template/templates/registry.yaml create mode 100644 templates/controlplane-template/templates/reloader.yaml create mode 100644 templates/controlplane-template/values.yaml diff --git a/templates/controlplane-template/.helmignore b/templates/controlplane-template/.helmignore new file mode 100644 index 0000000..fe06809 --- /dev/null +++ b/templates/controlplane-template/.helmignore @@ -0,0 +1,20 @@ +# Patterns to ignore when building packages. +.DS_Store +.git/ +.gitignore +.helmignore +*.swp +*.bak +*.tmp +*.orig +*~ +.project +.idea/ +*.tmproj +.vscode/ + +# Ignore .gitkeep files in templates +.gitkeep +*/.gitkeep +*/*/.gitkeep +*/*/*/.gitkeep diff --git a/templates/controlplane-template/Chart.yaml b/templates/controlplane-template/Chart.yaml new file mode 100644 index 0000000..53adf34 --- /dev/null +++ b/templates/controlplane-template/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: controlplane-template +description: Management cluster template for Konstruct GitOps - deploys ArgoCD applications and components +type: application +version: 0.1.0 +appVersion: "1.0.0" diff --git a/templates/controlplane-template/templates/actions-runner-controller.yaml b/templates/controlplane-template/templates/actions-runner-controller.yaml new file mode 100644 index 0000000..c130a63 --- /dev/null +++ b/templates/controlplane-template/templates/actions-runner-controller.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: actions-runner-controller-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/actions-runner-controller + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: github-runner + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - Replace=true + - PruneLast=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/controlplane-template/templates/appprojects.yaml b/templates/controlplane-template/templates/appprojects.yaml new file mode 100644 index 0000000..4dbba88 --- /dev/null +++ b/templates/controlplane-template/templates/appprojects.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd-projects + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/argocd-appprojects + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/argo-workflows.yaml b/templates/controlplane-template/templates/argo-workflows.yaml new file mode 100644 index 0000000..abfef09 --- /dev/null +++ b/templates/controlplane-template/templates/argo-workflows.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argo-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/argo-workflows + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: argo + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/argocd.yaml b/templates/controlplane-template/templates/argocd.yaml new file mode 100644 index 0000000..5bd3355 --- /dev/null +++ b/templates/controlplane-template/templates/argocd.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd-kustomized-app + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: argocd + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + path: registry/clusters/{{ .Values.clusterName }}/components/argocd + repoURL: '{{ .Values.gitopsRepoUrl }}' + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/templates/controlplane-template/templates/atlantis.yaml b/templates/controlplane-template/templates/atlantis.yaml new file mode 100644 index 0000000..be68115 --- /dev/null +++ b/templates/controlplane-template/templates/atlantis.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: atlantis-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/atlantis + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: atlantis + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/controlplane-template/templates/cert-issuers.yaml b/templates/controlplane-template/templates/cert-issuers.yaml new file mode 100644 index 0000000..ee6e30e --- /dev/null +++ b/templates/controlplane-template/templates/cert-issuers.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-issuers + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '20' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/cert-issuers + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/cert-manager.yaml b/templates/controlplane-template/templates/cert-manager.yaml new file mode 100644 index 0000000..33a6e06 --- /dev/null +++ b/templates/controlplane-template/templates/cert-manager.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/cert-manager + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/chartmuseum.yaml b/templates/controlplane-template/templates/chartmuseum.yaml new file mode 100644 index 0000000..ee4ee62 --- /dev/null +++ b/templates/controlplane-template/templates/chartmuseum.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: chartmuseum-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/chartmuseum + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: chartmuseum + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/cloudflare-origin-ca-issuer.yaml b/templates/controlplane-template/templates/cloudflare-origin-ca-issuer.yaml new file mode 100644 index 0000000..1a2a692 --- /dev/null +++ b/templates/controlplane-template/templates/cloudflare-origin-ca-issuer.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cloudflare-cloudflare-origin-ca-issuer + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '19' +spec: + project: {{ .Values.project }} + source: + repoURL: ghcr.io/cloudflare/origin-ca-issuer-charts + chart: origin-ca-issuer + targetRevision: 0.5.2 + helm: + values: |- + global: + rbac: + create: true + controller: + image: + repository: cloudflare/origin-ca-issuer + tag: v0.6.1 + pullPolicy: Always + destination: + name: {{ .Values.clusterDestination }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/cloudflare-origin-issuer-crd.yaml b/templates/controlplane-template/templates/cloudflare-origin-issuer-crd.yaml new file mode 100644 index 0000000..a4bcd58 --- /dev/null +++ b/templates/controlplane-template/templates/cloudflare-origin-issuer-crd.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cloudflare-origin-issuer-crd + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '19' +spec: + project: {{ .Values.project }} + source: + repoURL: https://github.com/cloudflare/origin-ca-issuer + path: deploy/crds + targetRevision: v0.6.1 + destination: + name: {{ .Values.clusterDestination }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/cluster-secret-store.yaml b/templates/controlplane-template/templates/cluster-secret-store.yaml new file mode 100644 index 0000000..0cc1571 --- /dev/null +++ b/templates/controlplane-template/templates/cluster-secret-store.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cluster-secret-store + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/cluster-secret-store + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/controlplane-template/templates/clusterrolebinding.yaml b/templates/controlplane-template/templates/clusterrolebinding.yaml new file mode 100644 index 0000000..35bf79f --- /dev/null +++ b/templates/controlplane-template/templates/clusterrolebinding.yaml @@ -0,0 +1,119 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argocd-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argocd + namespace: argocd +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-server + namespace: argo +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: github-runner-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: github-runner + namespace: github-runner +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-admin-admin-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-admin + namespace: argo +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-admin-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-admin + namespace: argo +roleRef: + kind: ClusterRole + name: argo-admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-developer-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-developer + namespace: argo +roleRef: + kind: ClusterRole + name: argo-view + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: argocd-admin-crb + annotations: + argocd.argoproj.io/sync-wave: '0' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: admin +subjects: + - kind: ServiceAccount + name: argocd-server + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: argocd-crossplane-admin-crb + annotations: + argocd.argoproj.io/sync-wave: '0' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane-admin +subjects: + - kind: ServiceAccount + name: argocd-server + namespace: argocd diff --git a/templates/controlplane-template/templates/clusters.yaml b/templates/controlplane-template/templates/clusters.yaml new file mode 100644 index 0000000..d5c3847 --- /dev/null +++ b/templates/controlplane-template/templates/clusters.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: clusters + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '1000' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/clusters + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + allowEmpty: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/actions-runner-controller/application.yaml b/templates/controlplane-template/templates/components/actions-runner-controller/application.yaml new file mode 100644 index 0000000..d16dbb5 --- /dev/null +++ b/templates/controlplane-template/templates/components/actions-runner-controller/application.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: actions-runner-contoller + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://actions-runner-controller.github.io/actions-runner-controller + targetRevision: 0.20.2 + helm: + values: |- + image: + dindSidecarRepositoryAndTag: "docker:dind-rootless" + podSecurityContext: + runAsUser: 1000 + runAsNonRoot: true + securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + chart: actions-runner-controller + destination: + name: in-cluster + namespace: github-runner + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - Replace=true + - PruneLast=true diff --git a/templates/controlplane-template/templates/components/actions-runner-controller/externalsecret.yaml b/templates/controlplane-template/templates/components/actions-runner-controller/externalsecret.yaml new file mode 100644 index 0000000..8d2657e --- /dev/null +++ b/templates/controlplane-template/templates/components/actions-runner-controller/externalsecret.yaml @@ -0,0 +1,18 @@ +apiVersion: external-secrets.io/v1alpha1 +kind: ExternalSecret +metadata: + name: controller-manager + namespace: github-runner + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: controller-manager + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + data: + - remoteRef: + key: ci-secrets + property: PERSONAL_ACCESS_TOKEN + secretKey: github_token diff --git a/templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml b/templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml new file mode 100644 index 0000000..e63aa77 --- /dev/null +++ b/templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-arc + namespace: github-runner +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-arc + namespace: github-runner +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-arc + namespace: github-runner +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-arc +subjects: + - kind: ServiceAccount + name: k8s-toolkit-arc + namespace: github-runner +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-actions-runner-controller + namespace: github-runner +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - github-runner + - --label + - app.kubernetes.io/name=actions-runner-controller + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-arc diff --git a/templates/controlplane-template/templates/components/argo-workflows/application.yaml b/templates/controlplane-template/templates/components/argo-workflows/application.yaml new file mode 100644 index 0000000..19333c1 --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/application.yaml @@ -0,0 +1,101 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argo + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.project }} + source: + repoURL: https://argoproj.github.io/argo-helm + targetRevision: {{ .Values.versions.argoWorkflows }} + helm: + values: |- + nameOverride: argo + executor: + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: 1 + memory: 1024Mi + server: + secure: false + extraArgs: + - --auth-mode=client + - --auth-mode=sso + ingress: + enabled: true + ingressClassName: nginx + annotations: + {{- if .Values.certManager.issuerAnnotation1 }} + {{ .Values.certManager.issuerAnnotation1 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation2 }} + {{ .Values.certManager.issuerAnnotation2 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation3 }} + {{ .Values.certManager.issuerAnnotation3 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation4 }} + {{ .Values.certManager.issuerAnnotation4 }} + {{- end }} + hosts: + - argo.{{ .Values.domainName }} + paths: + - / + pathType: Prefix + tls: + - secretName: argo-tls + hosts: + - argo.{{ .Values.domainName }} + sso: + issuer: https://vault.{{ .Values.domainName }}/v1/identity/oidc/provider/kubefirst + clientId: + name: argo-secrets + key: client-id + clientSecret: + name: argo-secrets + key: client-secret + redirectUrl: https://argo.{{ .Values.domainName }}/oauth2/callback + scopes: + - email + - openid + - groups + - user + - profile + # RBAC Config. >= v2.12 + rbac: + enabled: true + useDefaultArtifactRepo: true + useStaticCredentials: true + artifactRepository: + archiveLogs: false + s3: + accessKeySecret: + name: ci-secrets + key: accesskey + secretKeySecret: + name: ci-secrets + key: secretkey + insecure: false + bucket: {{ .Values.kubefirstStateStoreBucket }} + endpoint: objectstore.{{ .Values.cloudRegion }}.civo.com + region: {{ .Values.cloudRegion }} + useSDKCreds: false + encryptionOptions: + enableEncryption: false + chart: argo-workflows + destination: + name: {{ .Values.clusterDestination }} + namespace: argo + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml b/templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml new file mode 100644 index 0000000..a985a86 --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argo-cwfts + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/argo-workflows/cwfts + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: argo + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml b/templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml new file mode 100644 index 0000000..0e2593d --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: argo + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: argo +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml new file mode 100644 index 0000000..4271e3f --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml @@ -0,0 +1,178 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ClusterWorkflowTemplate +metadata: + name: cwft-git + annotations: + argocd.argoproj.io/sync-wave: '55' +spec: + templates: + - name: checkout-with-gitops-ssh + inputs: + parameters: + - name: appName + - name: branch + default: main + - name: gitUrlNoProtocol + artifacts: + - name: repo-source + path: '/src/{{`{{inputs.parameters.appName}}`}}' + git: + repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' + branch: '{{`{{inputs.parameters.branch}}`}}' + singleBranch: true + insecureIgnoreHostKey: true + sshPrivateKeySecret: + name: ci-secrets + key: SSH_PRIVATE_KEY + - name: gitops-source + path: /src/gitops + git: + repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/gitops.git' + branch: 'main' + singleBranch: true + insecureIgnoreHostKey: true + sshPrivateKeySecret: + name: ci-secrets + key: SSH_PRIVATE_KEY + container: + image: golang:latest + command: ['/bin/sh', '-c'] + args: + - ls -la /src && + ls -la /src/{{`{{inputs.parameters.appName}}`}} + outputs: + artifacts: + - name: repo-source + path: /src + - name: checkout-with-gitops-https + inputs: + parameters: + - name: appName + - name: branch + default: main + - name: gitUrlNoProtocol + artifacts: + - name: repo-source + path: '/src/{{`{{inputs.parameters.appName}}`}}' + git: + repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' + branch: '{{`{{inputs.parameters.branch}}`}}' + singleBranch: true + insecureIgnoreHostKey: true + usernameSecret: + name: ci-secrets + key: BASIC_AUTH_USER + passwordSecret: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + - name: gitops-source + path: /src/gitops + git: + repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/gitops.git' + branch: 'main' + singleBranch: true + insecureIgnoreHostKey: true + usernameSecret: + name: ci-secrets + key: BASIC_AUTH_USER + passwordSecret: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + container: + image: golang:latest + command: ['/bin/sh', '-c'] + args: + - ls -la /src && + ls -la /src/{{`{{inputs.parameters.appName}}`}} + outputs: + artifacts: + - name: repo-source + path: /src + - name: pull-commit-push-ssh + retryStrategy: + limit: '5' + # todo get ssh item not all secrets + volumes: + - name: ssh-key + secret: + defaultMode: 256 + secretName: ci-secrets + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: commitMessage + - name: gitUrlNoProtocol + - name: repoName + container: + workingDir: '/src/{{`{{inputs.parameters.repoName}}`}}' + image: golang:latest + command: ['/bin/sh', '-c'] + volumeMounts: + - mountPath: '/mnt/secrets' + name: ssh-key + readOnly: true + args: + - set -e; + + eval `ssh-agent -s`; + mkdir $HOME/.ssh; + cat /mnt/secrets/SSH_PRIVATE_KEY > $HOME/.ssh/id_ed25519; + echo -n "\\n" >> $HOME/.ssh/id_ed25519; + chmod 0600 $HOME/.ssh/id_ed25519; + ssh-add $HOME/.ssh/id_ed25519; + + echo "Host *" >> $HOME/.ssh/config; + echo " StrictHostKeyChecking no" >> $HOME/.ssh/config; + echo " User git" >> $HOME/.ssh/config; + echo " IdentitiesOnly yes" >> $HOME/.ssh/config; + echo " UserKnownHostsFile /dev/null" >> $HOME/.ssh/config; + chmod 0700 $HOME/.ssh/config; + + git config --global user.email 'k-ray@example.com'; + git config --global user.name 'kbot'; + git remote set-url origin '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.repoName}}`}}.git'; + git remote -v; + git status; + git pull; + git add .; + git commit -m "{{`{{inputs.parameters.commitMessage}}`}}" || echo "Assuming this was committed on previous run, not erroring out" ; + git push; + - name: pull-commit-push-https + retryStrategy: + limit: '5' + # todo get ssh item not all secrets + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: commitMessage + - name: gitUrlNoProtocol + - name: repoName + container: + workingDir: '/src/{{`{{inputs.parameters.repoName}}`}}' + image: golang:latest + command: ['/bin/bash', '-c'] + env: + - name: GIT_TOKEN + valueFrom: + secretKeyRef: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + args: + - set -e; + + git config --global user.email 'k-ray@example.com'; + git config --global user.name 'kbot'; + echo "set url to https://kbot:token@{{ .Values.gitProvider }}.com/the_rest_of_the input slug"; + input_url='{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.repoName}}`}}.git'; + origin_url="${input_url/"https://{{ .Values.gitProvider }}.com"/"https://kbot:$GIT_TOKEN@{{ .Values.gitProvider }}.com"}"; + git remote set-url origin $origin_url; + git remote -v; + git status; + git pull; + git add .; + git commit -m "{{`{{inputs.parameters.commitMessage}}`}}" || echo "Assuming this was committed on previous run, not erroring out" ; + git push; diff --git a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml new file mode 100644 index 0000000..81802dd --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml @@ -0,0 +1,129 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ClusterWorkflowTemplate +metadata: + name: cwft-helm + annotations: + argocd.argoproj.io/sync-wave: '55' +spec: + templates: + - name: get-chart-version + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + script: + image: kubefirst/chubbo:0.2 + command: [python3] + workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' + source: | + import yaml, semver + with open('./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml') as f: + chart_yaml = yaml.load(f, Loader=yaml.FullLoader) + print(chart_yaml['version']) + - name: set-chart-versions + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + - name: chartVersion + - name: shortSha + script: + image: kubefirst/chubbo:0.2 + command: [bash] + workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' + source: | + set -e + NEW_CHART_VERSION={{`{{inputs.parameters.chartVersion}}`}} + echo "setting ./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml to version: ${NEW_CHART_VERSION}" + sed -i "s/version:.*/version: ${NEW_CHART_VERSION}/g" /src/{{`{{inputs.parameters.appName}}`}}/{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml + echo "setting ./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml to appVersion: {{`{{inputs.parameters.shortSha}}`}}" + sed -i "s/appVersion:.*/appVersion: '{{`{{inputs.parameters.shortSha}}`}}'/g" /src/{{`{{inputs.parameters.appName}}`}}/{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml + echo "adjusted chart:" + cat /src/{{`{{inputs.parameters.appName}}`}}/{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml + outputs: + artifacts: + - name: repo-source + path: /src + - name: publish-chart + retryStrategy: + limit: '5' + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + container: + image: kubefirst/chubbo:0.2 + command: ['bash', '-c'] + workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' + args: + - helm repo add kubefirst http://chartmuseum.chartmuseum.svc.cluster.local:8080 --username ${BASIC_AUTH_USER} --password ${BASIC_AUTH_PASS} || bash -c "sleep 10 && echo 'waiting before trying again' && exit 1"; + helm push {{`{{inputs.parameters.chartDir}}`}} kubefirst || bash -c "sleep 10 && echo 'waiting before trying again' && exit 1"; + env: + - name: BASIC_AUTH_PASS + valueFrom: + secretKeyRef: + name: ci-secrets + key: BASIC_AUTH_PASS + - name: BASIC_AUTH_USER + valueFrom: + secretKeyRef: + name: ci-secrets + key: BASIC_AUTH_USER + - name: set-environment-version + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: chartVersion + - name: environment + - name: fullChartPath + script: + image: kubefirst/chubbo:0.2 + command: [bash] + workingDir: '/src/gitops' + source: | + set -e + echo "setting wrapper Chart.yaml to version: {{`{{inputs.parameters.chartVersion}}`}}" + sed -i "s/ version:.*/ version: {{`{{inputs.parameters.chartVersion}}`}}/g" "{{`{{inputs.parameters.fullChartPath}}`}}" + echo "updated {{`{{inputs.parameters.environment}}`}} wrapper chart version to {{`{{inputs.parameters.chartVersion}}`}}" + outputs: + artifacts: + - name: repo-source + path: /src + - name: increment-chart-minor + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + - name: chartVersion + script: + image: kubefirst/chubbo:0.2 + command: [python3] + workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' + source: | + import yaml, semver + with open('./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml') as f: + chart_yaml = yaml.load(f, Loader=yaml.FullLoader) + chart_version = semver.parse('{{`{{inputs.parameters.chartVersion}}`}}') + next_chart_version = '{}.{}.0'.format(chart_version['major'],chart_version['minor']+1) + chart_yaml['version'] = next_chart_version + with open('./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml', 'w') as f: + yaml.dump(chart_yaml, f) + print('prepared next release in {{`{{inputs.parameters.chartDir}}`}} with bumped chart version after releasing {}'.format(next_chart_version)) + outputs: + artifacts: + - name: repo-source + path: /src diff --git a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml new file mode 100644 index 0000000..20a21f8 --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml @@ -0,0 +1,84 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ClusterWorkflowTemplate +metadata: + name: cwft-kaniko +spec: + entrypoint: build-push + templates: + - name: build-push-ssh + inputs: + parameters: + - name: appName + - name: branch + - name: containerRegistryURL + - name: gitUrlNoProtocol + artifacts: + - name: app-source + path: '/src/{{`{{inputs.parameters.appName}}`}}' + git: + repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' + branch: '{{`{{inputs.parameters.branch}}`}}' + singleBranch: true + insecureIgnoreHostKey: true + sshPrivateKeySecret: + name: ci-secrets + key: SSH_PRIVATE_KEY + volumes: + - name: docker-config + secret: + secretName: 'container-registry-auth' + container: + image: gcr.io/kaniko-project/executor:latest + volumeMounts: + - name: docker-config + mountPath: /.docker + env: + - name: DOCKER_CONFIG + value: /.docker + args: + - '--dockerfile' + - 'Dockerfile' + - '--context' + - 'dir:///src/{{`{{inputs.parameters.appName}}`}}/' + - '--destination' + - '{{`{{inputs.parameters.containerRegistryURL}}`}}' + - name: build-push-https + inputs: + parameters: + - name: appName + - name: branch + - name: containerRegistryURL + - name: gitUrlNoProtocol + artifacts: + - name: app-source + path: '/src/{{`{{inputs.parameters.appName}}`}}' + git: + repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' + branch: '{{`{{inputs.parameters.branch}}`}}' + singleBranch: true + insecureIgnoreHostKey: true + usernameSecret: + name: ci-secrets + key: BASIC_AUTH_USER + passwordSecret: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + volumes: + - name: docker-config + secret: + secretName: 'container-registry-auth' + container: + image: gcr.io/kaniko-project/executor:latest + volumeMounts: + - name: docker-config + mountPath: /.docker + env: + - name: DOCKER_CONFIG + value: /.docker + args: + - '--dockerfile' + - 'Dockerfile' + - '--context' + - 'dir:///src/{{`{{inputs.parameters.appName}}`}}/' + - '--destination' + - '{{`{{inputs.parameters.containerRegistryURL}}`}}' diff --git a/templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml b/templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml new file mode 100644 index 0000000..a276c8c --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml @@ -0,0 +1,59 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ci-secrets + namespace: argo + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: ci-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + dataFrom: + - extract: + key: /ci-secrets +--- +apiVersion: 'external-secrets.io/v1beta1' +kind: ExternalSecret +metadata: + name: argo-secrets + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: argo-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: oidc/argo + property: client_id + secretKey: client-id + - remoteRef: + key: oidc/argo + property: client_secret + secretKey: client-secret +--- +apiVersion: 'external-secrets.io/v1beta1' +kind: ExternalSecret +metadata: + name: container-registry-auth + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: container-registry-auth + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: registry-auth + property: auth + secretKey: config.json diff --git a/templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml b/templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml new file mode 100644 index 0000000..b18f586 --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml @@ -0,0 +1,52 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argo-admin + annotations: + argocd.argoproj.io/sync-wave: '0' + # The rule is an expression used to determine if this service account + # should be used. + # * `groups` - an array of the OIDC groups + # * `iss` - the issuer ("argo-server") + # * `sub` - the subject (typically the username) + # Must evaluate to a boolean. + # If you want an account to be the default to use, this rule can be "true". + # Details of the expression language are available in + # https://github.com/antonmedv/expr/blob/master/docs/Language-Definition.md. + workflows.argoproj.io/rbac-rule: "'admins' in groups" + # The precedence is used to determine which service account to use whe + # Precedence is an integer. It may be negative. If omitted, it defaults to "0". + # Numerically higher values have higher precedence (not lower, which maybe + # counter-intuitive to you). + # If two rules match and have the same precedence, then which one used will + # be arbitrary. + workflows.argoproj.io/rbac-rule-precedence: '1' +secrets: +- name: argo-admin +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argo-developer + annotations: + argocd.argoproj.io/sync-wave: '0' + workflows.argoproj.io/rbac-rule: "'developers' in groups" + workflows.argoproj.io/rbac-rule-precedence: '0' +secrets: +- name: argo-developer +--- +apiVersion: v1 +kind: Secret +metadata: + name: argo-admin + annotations: + kubernetes.io/service-account.name: argo-admin +type: kubernetes.io/service-account-token +--- +apiVersion: v1 +kind: Secret +metadata: + name: argo-developer + annotations: + kubernetes.io/service-account.name: argo-developer +type: kubernetes.io/service-account-token diff --git a/templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml b/templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml new file mode 100644 index 0000000..ef58ba1 --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '0' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/argo-workflows/wait + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: vault + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/argo-workflows/wait.yaml b/templates/controlplane-template/templates/components/argo-workflows/wait.yaml new file mode 100644 index 0000000..40c40e1 --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/wait.yaml @@ -0,0 +1,83 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-argo + namespace: argo +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-argo + namespace: argo +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-argo + namespace: argo +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-argo +subjects: + - kind: ServiceAccount + name: k8s-toolkit-argo + namespace: argo +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-argo-workflow-controller + namespace: argo +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - argo + - --label + - app.kubernetes.io/name=argo-workflow-controller + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-argo +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-argo-server + namespace: argo +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - argo + - --label + - app.kubernetes.io/name=argo-server + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-argo diff --git a/templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml b/templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml new file mode 100644 index 0000000..6108f22 --- /dev/null +++ b/templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml @@ -0,0 +1,46 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-vault-tls + namespace: vault +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: k8s-toolkit-vault-tls + namespace: vault +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-view +subjects: + - kind: ServiceAccount + name: k8s-toolkit-vault-tls + namespace: vault +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true + name: wait-vault-tls + namespace: vault +spec: + template: + spec: + containers: + - args: + - wait-for + - certificate + - --namespace + - vault + - --name + - vault-tls + - --timeout-seconds + - '3600' + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-vault-tls diff --git a/templates/controlplane-template/templates/components/argocd-appprojects/.gitkeep b/templates/controlplane-template/templates/components/argocd-appprojects/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/templates/controlplane-template/templates/components/argocd/argocd-cm.yaml b/templates/controlplane-template/templates/components/argocd/argocd-cm.yaml new file mode 100644 index 0000000..fdc9ddb --- /dev/null +++ b/templates/controlplane-template/templates/components/argocd/argocd-cm.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-cm +data: + url: 'https://argocd.{{ .Values.domainName }}' + oidc.config: | + name: Vault + issuer: https://vault.{{ .Values.domainName }}/v1/identity/oidc/provider/kubefirst + clientID: $argocd-oidc-secret:clientId + clientSecret: $argocd-oidc-secret:clientSecret + requestedScopes: ["openid", "groups", "user", "profile", "email"] + requestedIDTokenClaims: {"groups": {"essential": true}} diff --git a/templates/controlplane-template/templates/components/argocd/argocd-cmd-params-cm.yaml b/templates/controlplane-template/templates/components/argocd/argocd-cmd-params-cm.yaml new file mode 100644 index 0000000..c3b99b9 --- /dev/null +++ b/templates/controlplane-template/templates/components/argocd/argocd-cmd-params-cm.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-cmd-params-cm + labels: + app.kubernetes.io/name: argocd-cmd-params-cm + app.kubernetes.io/part-of: argocd +data: + # ssl terminated at ingress-nginx and forwarded + # to allow for cloudflare origin issuer certificates + server.insecure: 'true' diff --git a/templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml b/templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml new file mode 100644 index 0000000..a666ef3 --- /dev/null +++ b/templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml @@ -0,0 +1,58 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argocd-oidc-restart-job + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: argocd-oidc-restart-job + namespace: argocd +rules: + - apiGroups: + - apps + resources: + - deployments + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: argocd-oidc-restart-job + namespace: argocd +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-oidc-restart-job +subjects: + - kind: ServiceAccount + name: argocd-oidc-restart-job + namespace: argocd +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: argocd-oidc-restart-job + namespace: argocd +spec: + template: + spec: + containers: + - name: argocd-oidc-restart-job + image: dtzar/helm-kubectl:3.19.0 + command: + - /bin/sh + - -c + - echo restarting argocd-server in 15 seconds && sleep 15 && echo restarting && kubectl -n argocd get deployment/argocd-server -oyaml | kubectl -n argocd replace --force -f - + restartPolicy: OnFailure + serviceAccountName: argocd-oidc-restart-job + diff --git a/templates/controlplane-template/templates/components/argocd/argocd-ui-ingress.yaml b/templates/controlplane-template/templates/components/argocd/argocd-ui-ingress.yaml new file mode 100644 index 0000000..d3c740c --- /dev/null +++ b/templates/controlplane-template/templates/components/argocd/argocd-ui-ingress.yaml @@ -0,0 +1,74 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-http-ingress + namespace: argocd + annotations: + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + {{- if .Values.certManager.issuerAnnotation1 }} + {{ .Values.certManager.issuerAnnotation1 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation2 }} + {{ .Values.certManager.issuerAnnotation2 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation3 }} + {{ .Values.certManager.issuerAnnotation3 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation4 }} + {{ .Values.certManager.issuerAnnotation4 }} + {{- end }} +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: http + host: argocd.{{ .Values.domainName }} + tls: + - hosts: + - argocd.{{ .Values.domainName }} + secretName: argocd-ingress-http +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-grpc-ingress + namespace: argocd + annotations: + nginx.ingress.kubernetes.io/backend-protocol: "GRPC" + {{- if .Values.certManager.issuerAnnotation1 }} + {{ .Values.certManager.issuerAnnotation1 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation2 }} + {{ .Values.certManager.issuerAnnotation2 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation3 }} + {{ .Values.certManager.issuerAnnotation3 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation4 }} + {{ .Values.certManager.issuerAnnotation4 }} + {{- end }} +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: https + host: grpc.argocd.{{ .Values.domainName }} + tls: + - hosts: + - grpc-argocd.{{ .Values.domainName }} + secretName: argocd-ingress-grpc diff --git a/templates/controlplane-template/templates/components/argocd/cloudflareissuer.yaml b/templates/controlplane-template/templates/components/argocd/cloudflareissuer.yaml new file mode 100644 index 0000000..9fb35ae --- /dev/null +++ b/templates/controlplane-template/templates/components/argocd/cloudflareissuer.yaml @@ -0,0 +1,29 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: argocd +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: argocd +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/templates/controlplane-template/templates/components/argocd/externalsecrets.yaml b/templates/controlplane-template/templates/components/argocd/externalsecrets.yaml new file mode 100644 index 0000000..e4a5ede --- /dev/null +++ b/templates/controlplane-template/templates/components/argocd/externalsecrets.yaml @@ -0,0 +1,24 @@ +apiVersion: "external-secrets.io/v1alpha1" +kind: ExternalSecret +metadata: + name: argocd-oidc-secret + labels: + app.kubernetes.io/part-of: argocd +spec: + target: + name: argocd-oidc-secret + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + conversionStrategy: Default + key: oidc/argocd + property: client_secret + secretKey: clientSecret + - remoteRef: + conversionStrategy: Default + key: oidc/argocd + property: client_id + secretKey: clientId diff --git a/templates/controlplane-template/templates/components/argocd/kustomization.yaml b/templates/controlplane-template/templates/components/argocd/kustomization.yaml new file mode 100644 index 0000000..00ddbc5 --- /dev/null +++ b/templates/controlplane-template/templates/components/argocd/kustomization.yaml @@ -0,0 +1,18 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: argocd + +# To upgrade ArgoCD, increment the version here +# https://github.com/argoproj/argo-cd/tags +resources: + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.1 + - argocd-ui-ingress.yaml + - externalsecrets.yaml + - argocd-oidc-restart-job.yaml + +patchesStrategicMerge: + - argocd-cm.yaml + - argocd-cmd-params-cm.yaml + +generatorOptions: + disableNameSuffixHash: true diff --git a/templates/controlplane-template/templates/components/atlantis/application.yaml b/templates/controlplane-template/templates/components/atlantis/application.yaml new file mode 100644 index 0000000..648219e --- /dev/null +++ b/templates/controlplane-template/templates/components/atlantis/application.yaml @@ -0,0 +1,79 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: atlantis + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.project }} + source: + repoURL: https://runatlantis.github.io/helm-charts + chart: atlantis + targetRevision: {{ .Values.versions.atlantis }} + helm: + values: |- + statefulSet: + annotations: + secret.reloader.stakater.com/reload: "atlantis-secrets" + atlantisUrl: https://atlantis.{{ .Values.domainName }} + orgAllowlist: {{ .Values.atlantis.allowList }} + hidePrevPlanComments: true + serviceAccount: + create: false + mount: true + resources: + limits: + cpu: 400m + memory: 1Gi + requests: + cpu: 400m + memory: 512Mi + ingress: + enabled: true + annotations: + {{- if .Values.certManager.issuerAnnotation1 }} + {{ .Values.certManager.issuerAnnotation1 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation2 }} + {{ .Values.certManager.issuerAnnotation2 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation3 }} + {{ .Values.certManager.issuerAnnotation3 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation4 }} + {{ .Values.certManager.issuerAnnotation4 }} + {{- end }} + path: / + host: atlantis.{{ .Values.domainName }} + ingressClassName: "nginx" + tls: + - secretName: atlantis-tls + hosts: + - atlantis.{{ .Values.domainName }} + loadEnvFromSecrets: + - atlantis-secrets + repoConfig: | + --- + repos: + - id: {{ .Values.atlantis.allowList }} + workflow: default + allowed_overrides: [apply_requirements] + apply_requirements: [mergeable] + destination: + name: {{ .Values.clusterDestination }} + namespace: atlantis + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml b/templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml new file mode 100644 index 0000000..1926218 --- /dev/null +++ b/templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: atlantis + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: atlantis +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/templates/controlplane-template/templates/components/atlantis/externalsecret.yaml b/templates/controlplane-template/templates/components/atlantis/externalsecret.yaml new file mode 100644 index 0000000..334d4bf --- /dev/null +++ b/templates/controlplane-template/templates/components/atlantis/externalsecret.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: atlantis-secrets + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: atlantis-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + dataFrom: + - extract: + key: /atlantis diff --git a/templates/controlplane-template/templates/components/atlantis/wait.yaml b/templates/controlplane-template/templates/components/atlantis/wait.yaml new file mode 100644 index 0000000..049580f --- /dev/null +++ b/templates/controlplane-template/templates/components/atlantis/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-atlantis + namespace: atlantis +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-atlantis + namespace: atlantis +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-atlantis + namespace: atlantis +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-atlantis +subjects: + - kind: ServiceAccount + name: k8s-toolkit-atlantis + namespace: atlantis +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-atlantis + namespace: atlantis +spec: + template: + spec: + containers: + - args: + - wait-for + - statefulset + - --namespace + - atlantis + - --label + - app=atlantis + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-atlantis diff --git a/templates/controlplane-template/templates/components/cert-issuers/clusterissuers.yaml b/templates/controlplane-template/templates/components/cert-issuers/clusterissuers.yaml new file mode 100644 index 0000000..40ea1e9 --- /dev/null +++ b/templates/controlplane-template/templates/components/cert-issuers/clusterissuers.yaml @@ -0,0 +1,29 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: {{ .Values.alertsEmail }} + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + ingress: + class: nginx +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: {{ .Values.alertsEmail }} + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: nginx diff --git a/templates/controlplane-template/templates/components/cert-manager/application.yaml b/templates/controlplane-template/templates/components/cert-manager/application.yaml new file mode 100644 index 0000000..6387457 --- /dev/null +++ b/templates/controlplane-template/templates/components/cert-manager/application.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.14.4 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + chart: cert-manager + destination: + name: in-cluster + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/cert-manager/wait-todo.yaml b/templates/controlplane-template/templates/components/cert-manager/wait-todo.yaml new file mode 100644 index 0000000..e69de29 diff --git a/templates/controlplane-template/templates/components/chartmuseum/application.yaml b/templates/controlplane-template/templates/components/chartmuseum/application.yaml new file mode 100644 index 0000000..71fc22f --- /dev/null +++ b/templates/controlplane-template/templates/components/chartmuseum/application.yaml @@ -0,0 +1,63 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: chartmuseum + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.project }} + source: + repoURL: https://chartmuseum.github.io/charts + targetRevision: {{ .Values.versions.chartmuseum }} + helm: + values: |- + env: + open: + AUTH_ANONYMOUS_GET: true + STORAGE: amazon + STORAGE_AMAZON_BUCKET: {{ .Values.kubefirstStateStoreBucket }} + STORAGE_AMAZON_PREFIX: kubefirst-charts + STORAGE_AMAZON_REGION: {{ .Values.cloudRegion }} + STORAGE_AMAZON_ENDPOINT: https://objectstore.{{ .Values.cloudRegion }}.civo.com + DISABLE_API: false + existingSecret: chartmuseum-secrets + existingSecretMappings: + BASIC_AUTH_USER: BASIC_AUTH_USER + BASIC_AUTH_PASS: BASIC_AUTH_PASS + AWS_ACCESS_KEY_ID: AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: AWS_SECRET_ACCESS_KEY + ingress: + enabled: true + pathType: "Prefix" + annotations: + {{- if .Values.certManager.issuerAnnotation1 }} + {{ .Values.certManager.issuerAnnotation1 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation2 }} + {{ .Values.certManager.issuerAnnotation2 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation3 }} + {{ .Values.certManager.issuerAnnotation3 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation4 }} + {{ .Values.certManager.issuerAnnotation4 }} + {{- end }} + hosts: + - name: chartmuseum.{{ .Values.domainName }} + path: / + tls: true + tlsSecret: chartmuseum-tls + ingressClassName: nginx + chart: chartmuseum + destination: + name: {{ .Values.clusterDestination }} + namespace: chartmuseum + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml b/templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml new file mode 100644 index 0000000..64630f8 --- /dev/null +++ b/templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: chartmuseum + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: chartmuseum +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml b/templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml new file mode 100644 index 0000000..020f387 --- /dev/null +++ b/templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml @@ -0,0 +1,17 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: chartmuseum-secrets + namespace: chartmuseum + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: chartmuseum-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + dataFrom: + - extract: + key: /chartmuseum diff --git a/templates/controlplane-template/templates/components/chartmuseum/wait.yaml b/templates/controlplane-template/templates/components/chartmuseum/wait.yaml new file mode 100644 index 0000000..77a0c7a --- /dev/null +++ b/templates/controlplane-template/templates/components/chartmuseum/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-chartmuseum +subjects: + - kind: ServiceAccount + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-chartmuseum + namespace: chartmuseum +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - chartmuseum + - --label + - app.kubernetes.io/name=chartmuseum + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-chartmuseum diff --git a/templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml b/templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml new file mode 100644 index 0000000..33cbc8f --- /dev/null +++ b/templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: vault-kv-secret + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + provider: + vault: + server: 'http://vault.vault.svc:8200' + # Path is the mount path of the Vault KV backend endpoint + path: 'secret' + version: 'v2' + auth: + kubernetes: + # Path where the Kubernetes authentication backend is mounted in Vault + mountPath: 'kubernetes/kubefirst' + # A required field containing the Vault Role to assume. + role: 'external-secrets' + serviceAccountRef: + name: 'external-secrets' + namespace: 'external-secrets-operator' diff --git a/templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml b/templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml new file mode 100644 index 0000000..635429c --- /dev/null +++ b/templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: eso-clustersecretstore + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: eso-clustersecretstore + namespace: external-secrets-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: external-secrets-operator-view +subjects: +- kind: ServiceAccount + name: eso-clustersecretstore + namespace: external-secrets-operator +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: "20" + name: wait-vault-kv-secret + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - name: wait + image: dtzar/helm-kubectl:3.19.0 + command: + - /bin/sh + - -c + - | + while ! kubectl get clustersecretstore/vault-kv-secret --namespace external-secrets-operator; do echo "waiting for external secrets store to be valid, sleeping 5 seconds"; sleep 5; done + restartPolicy: OnFailure + serviceAccountName: eso-clustersecretstore \ No newline at end of file diff --git a/templates/controlplane-template/templates/components/clusters/.gitkeep b/templates/controlplane-template/templates/components/clusters/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/templates/controlplane-template/templates/components/crossplane/crossplane-system.yaml b/templates/controlplane-template/templates/components/crossplane/crossplane-system.yaml new file mode 100644 index 0000000..8606bc7 --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/crossplane-system.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane-system + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/crossplane/crossplane-system + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-secrets.yaml b/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-secrets.yaml new file mode 100644 index 0000000..72e3d80 --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-secrets.yaml @@ -0,0 +1,51 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + annotations: + argocd.argoproj.io/sync-wave: "0" + name: crossplane-secrets + namespace: crossplane-system +spec: + dataFrom: + - extract: + conversionStrategy: Default + decodingStrategy: None + key: /crossplane + refreshInterval: 10s + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + target: + creationPolicy: Owner + deletionPolicy: Retain + name: crossplane-secrets +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: git-credentials + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: git-credentials + template: + engineVersion: v2 + data: + creds: | + https://{{ .username }}:{{ .password }}@github.com + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: crossplane + property: username + conversionStrategy: Default + secretKey: username + - remoteRef: + key: crossplane + property: password + conversionStrategy: Default + secretKey: password \ No newline at end of file diff --git a/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml b/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml new file mode 100644 index 0000000..b3b9c5b --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "10" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + destination: + name: in-cluster + namespace: crossplane-system + source: + repoURL: https://charts.crossplane.io/stable + chart: crossplane + targetRevision: 1.17.0 + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/crossplane/provider.yaml b/templates/controlplane-template/templates/components/crossplane/provider.yaml new file mode 100644 index 0000000..ed56724 --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/provider.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane-provider + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '20' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/crossplane/provider + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml b/templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml new file mode 100644 index 0000000..c48e96e --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml @@ -0,0 +1,23 @@ +apiVersion: pkg.crossplane.io/v1alpha1 +kind: ControllerConfig +metadata: + annotations: + argocd.argoproj.io/sync-wave: '10' + labels: + app: crossplane-provider-terraform + name: terraform-config +spec: + args: + - -d + - --poll=2m + - --max-reconcile-rate=10 + envFrom: + - secretRef: + name: crossplane-secrets + volumeMounts: + - mountPath: /.cache + name: helmcache + volumes: + - name: helmcache + emptyDir: + sizeLimit: 500Mi diff --git a/templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml b/templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml new file mode 100644 index 0000000..6403c68 --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml @@ -0,0 +1,16 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: crossplane-provider-terraform +spec: + controllerConfigRef: + name: terraform-config + ignoreCrossplaneConstraints: false + package: xpkg.upbound.io/upbound/provider-terraform:v0.12.0 + packagePullPolicy: IfNotPresent + revisionActivationPolicy: Automatic + revisionHistoryLimit: 1 + skipDependencyResolution: false + diff --git a/templates/controlplane-template/templates/components/external-dns/application.yaml b/templates/controlplane-template/templates/components/external-dns/application.yaml new file mode 100644 index 0000000..77c161f --- /dev/null +++ b/templates/controlplane-template/templates/components/external-dns/application.yaml @@ -0,0 +1,44 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.project }} + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + targetRevision: {{ .Values.versions.externalDns }} + helm: + releaseName: external-dns + values: | + image: + repository: registry.k8s.io/external-dns/external-dns + tag: "v0.13.2" + serviceAccount: + create: true + name: external-dns + provider: {{ .Values.externalDns.providerName }} + sources: + - ingress + domainFilters: + - {{ .Values.externalDns.domainName }} + env: + - name: {{ .Values.externalDns.providerTokenEnvName }} + valueFrom: + secretKeyRef: + name: external-dns-secrets + key: token + chart: external-dns + destination: + name: {{ .Values.clusterDestination }} + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/external-dns/wait.yaml b/templates/controlplane-template/templates/components/external-dns/wait.yaml new file mode 100644 index 0000000..39d677c --- /dev/null +++ b/templates/controlplane-template/templates/components/external-dns/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubernetes-toolkit + namespace: external-dns +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kubernetes-toolkit + namespace: external-dns +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubernetes-toolkit + namespace: external-dns +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubernetes-toolkit +subjects: + - kind: ServiceAccount + name: kubernetes-toolkit + namespace: external-dns +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: kubernetes-toolkit + namespace: external-dns +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-dns + - --label + - app.kubernetes.io/name=external-dns + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: kubernetes-toolkit + restartPolicy: OnFailure + serviceAccountName: kubernetes-toolkit diff --git a/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml b/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml new file mode 100644 index 0000000..ed43a16 --- /dev/null +++ b/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml @@ -0,0 +1,56 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets-operator + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://charts.external-secrets.io + targetRevision: 0.8.1 + helm: + values: |- + serviceAccount: + create: false + name: external-secrets + chart: external-secrets + destination: + name: in-cluster + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .spec.conversion.webhook.clientConfig.caBundle + - .spec.conversion.webhook.clientConfig.service.name + - .spec.conversion.webhook.clientConfig.service.namespace + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: eso-kubernetes-external-secrets-auth + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'system:auth-delegator' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml b/templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml new file mode 100644 index 0000000..3c7d566 --- /dev/null +++ b/templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml @@ -0,0 +1,107 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-eso + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-eso + namespace: external-secrets-operator +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-eso + namespace: external-secrets-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-eso +subjects: + - kind: ServiceAccount + name: k8s-toolkit-eso + namespace: external-secrets-operator +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-external-secrets-cert-controller + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-secrets-operator + - --label + - app.kubernetes.io/name=external-secrets-cert-controller + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-eso +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-external-secrets + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-secrets-operator + - --label + - app.kubernetes.io/name=external-secrets + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-eso +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-external-secrets-webhook + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-secrets-operator + - --label + - app.kubernetes.io/name=external-secrets-webhook + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-eso diff --git a/templates/controlplane-template/templates/components/github-runner/runnerdeployment.yaml b/templates/controlplane-template/templates/components/github-runner/runnerdeployment.yaml new file mode 100644 index 0000000..991352b --- /dev/null +++ b/templates/controlplane-template/templates/components/github-runner/runnerdeployment.yaml @@ -0,0 +1,20 @@ +apiVersion: actions.summerwind.dev/v1alpha1 +kind: RunnerDeployment +metadata: + name: actions-runner + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + replicas: 2 + template: + spec: + organization: {{ .Values.githubOwner }} + image: ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner-dind-rootless:v2.315.0-ubuntu-20.04-5b9b9f7 + serviceAccountName: github-runner + automountServiceAccountToken: true + dockerEnabled: false + dockerdWithinRunnerContainer: false + resources: {} + securityContext: + fsGroup: 1000 + runAsUser: 1000 diff --git a/templates/controlplane-template/templates/components/github-runner/serviceaccount.yaml b/templates/controlplane-template/templates/components/github-runner/serviceaccount.yaml new file mode 100644 index 0000000..6e2d556 --- /dev/null +++ b/templates/controlplane-template/templates/components/github-runner/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: github-runner + namespace: github-runner + annotations: + argocd.argoproj.io/sync-wave: '0' diff --git a/templates/controlplane-template/templates/components/ingress-nginx/application.yaml b/templates/controlplane-template/templates/components/ingress-nginx/application.yaml new file mode 100644 index 0000000..7186776 --- /dev/null +++ b/templates/controlplane-template/templates/components/ingress-nginx/application.yaml @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: ingress-nginx + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://kubernetes.github.io/ingress-nginx + targetRevision: 4.12.1 + helm: + values: |- + controller: + publishService: + enabled: true + service: + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60" + extraArgs: + enable-ssl-passthrough: true + chart: ingress-nginx + destination: + name: in-cluster + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/ingress-nginx/wait.yaml b/templates/controlplane-template/templates/components/ingress-nginx/wait.yaml new file mode 100644 index 0000000..2123e01 --- /dev/null +++ b/templates/controlplane-template/templates/components/ingress-nginx/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-ingress-nginx +subjects: + - kind: ServiceAccount + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-ingress-nginx + namespace: ingress-nginx +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - ingress-nginx + - --label + - app.kubernetes.io/name=ingress-nginx + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-ingress-nginx diff --git a/templates/controlplane-template/templates/components/nginx-apex/config-map.yaml b/templates/controlplane-template/templates/components/nginx-apex/config-map.yaml new file mode 100644 index 0000000..65aafa6 --- /dev/null +++ b/templates/controlplane-template/templates/components/nginx-apex/config-map.yaml @@ -0,0 +1,109 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: index-html-configmap + namespace: default +data: + index.html: | + + + + + + + Kubefirst + + + + + + + +
+
+ +
+
+

Hello World!

+

+ Kubefirst has added this apex site at the domain's apex to allow the Google bots to safely + onboard the cluster's new domain. +

+

+ You can adjust this site in your new + kubefirst gitops repository. +

+

Learn more about this apex site.

+
+
+ + + diff --git a/templates/controlplane-template/templates/components/nginx-apex/ingress.yaml b/templates/controlplane-template/templates/components/nginx-apex/ingress.yaml new file mode 100644 index 0000000..19101d6 --- /dev/null +++ b/templates/controlplane-template/templates/components/nginx-apex/ingress.yaml @@ -0,0 +1,38 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: nginx-apex + namespace: default + labels: + app.kubernetes.io/name: nginx + app.kubernetes.io/instance: nginx + annotations: + kubernetes.io/ingress.class: nginx + {{- if .Values.certManager.issuerAnnotation1 }} + {{ .Values.certManager.issuerAnnotation1 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation2 }} + {{ .Values.certManager.issuerAnnotation2 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation3 }} + {{ .Values.certManager.issuerAnnotation3 }} + {{- end }} + {{- if .Values.certManager.issuerAnnotation4 }} + {{ .Values.certManager.issuerAnnotation4 }} + {{- end }} +spec: + rules: + - host: {{ .Values.domainName }} + http: + paths: + - path: / + pathType: ImplementationSpecific + backend: + service: + name: nginx + port: + name: http + tls: + - hosts: + - {{ .Values.domainName }} + secretName: nginx-apex-tls diff --git a/templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml b/templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml new file mode 100644 index 0000000..512cc53 --- /dev/null +++ b/templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: argocd + +resources: + - github.com:kubefirst/manifests.git/nginx/apex?ref=main + - ingress.yaml + - config-map.yaml diff --git a/templates/controlplane-template/templates/components/nginx-apex/wait.yaml b/templates/controlplane-template/templates/components/nginx-apex/wait.yaml new file mode 100644 index 0000000..377e215 --- /dev/null +++ b/templates/controlplane-template/templates/components/nginx-apex/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-nginx-apex +subjects: + - kind: ServiceAccount + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-nginx-apex + namespace: nginx-apex +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - nginx-apex + - --label + - app.kubernetes.io/name=nginx-apex + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-nginx-apex diff --git a/templates/controlplane-template/templates/components/reloader/application.yaml b/templates/controlplane-template/templates/components/reloader/application.yaml new file mode 100644 index 0000000..5353788 --- /dev/null +++ b/templates/controlplane-template/templates/components/reloader/application.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: reloader + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: v1.0.10 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + server: 'https://kubernetes.default.svc' + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/controlplane-template/templates/components/reloader/wait.yaml b/templates/controlplane-template/templates/components/reloader/wait.yaml new file mode 100644 index 0000000..d2e9893 --- /dev/null +++ b/templates/controlplane-template/templates/components/reloader/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-reloader + namespace: reloader +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-reloader + namespace: reloader +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-reloader + namespace: reloader +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-reloader +subjects: + - kind: ServiceAccount + name: k8s-toolkit-reloader + namespace: reloader +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-reloader + namespace: reloader +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - reloader + - --label + - app=reloader-reloader + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-reloader diff --git a/templates/controlplane-template/templates/crossplane.yaml b/templates/controlplane-template/templates/crossplane.yaml new file mode 100644 index 0000000..c92434b --- /dev/null +++ b/templates/controlplane-template/templates/crossplane.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '60' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/crossplane + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/templates/controlplane-template/templates/external-dns.yaml b/templates/controlplane-template/templates/external-dns.yaml new file mode 100644 index 0000000..61eaad3 --- /dev/null +++ b/templates/controlplane-template/templates/external-dns.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/external-dns + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/external-secrets-operator.yaml b/templates/controlplane-template/templates/external-secrets-operator.yaml new file mode 100644 index 0000000..19f1a38 --- /dev/null +++ b/templates/controlplane-template/templates/external-secrets-operator.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets-operator-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/external-secrets-operator + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/github-runner.yaml b/templates/controlplane-template/templates/github-runner.yaml new file mode 100644 index 0000000..026cb74 --- /dev/null +++ b/templates/controlplane-template/templates/github-runner.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: github-runner-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '60' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/github-runner + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: github-runner + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - Replace=true + - PruneLast=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/controlplane-template/templates/ingress-nginx.yaml b/templates/controlplane-template/templates/ingress-nginx.yaml new file mode 100644 index 0000000..d0d5a4b --- /dev/null +++ b/templates/controlplane-template/templates/ingress-nginx.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: ingress-nginx-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/ingress-nginx + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/nginx-apex.yaml b/templates/controlplane-template/templates/nginx-apex.yaml new file mode 100644 index 0000000..ebeb333 --- /dev/null +++ b/templates/controlplane-template/templates/nginx-apex.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + finalizers: + - resources-finalizer.argocd.argoproj.io + name: nginx-apex-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '11' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/nginx-apex + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: default + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/templates/registry.yaml b/templates/controlplane-template/templates/registry.yaml new file mode 100644 index 0000000..bd32d42 --- /dev/null +++ b/templates/controlplane-template/templates/registry.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '1001' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }} + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/controlplane-template/templates/reloader.yaml b/templates/controlplane-template/templates/reloader.yaml new file mode 100644 index 0000000..118df7b --- /dev/null +++ b/templates/controlplane-template/templates/reloader.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: reloader-components + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '60' +spec: + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.clusterName }}/components/reloader + targetRevision: HEAD + destination: + name: {{ .Values.clusterDestination }} + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/controlplane-template/values.yaml b/templates/controlplane-template/values.yaml new file mode 100644 index 0000000..d45def1 --- /dev/null +++ b/templates/controlplane-template/values.yaml @@ -0,0 +1,169 @@ +# Management Cluster Template Configuration +# This values file contains all configurable parameters for deploying the management cluster components + +# ============================================================================= +# GLOBAL/COMMON VALUES +# ============================================================================= + +# @input.type: string +# @input.description: Cluster name identifier used in registry paths +# @input.required: true +# @input.default: mgmt +clusterName: mgmt + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Domain name for all services (e.g., example.com) +# @input.required: true +# @input.default: example.com +domainName: example.com + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD applications +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name for applications +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Cloud region for services (e.g., NYC1, us-east-1) +# @input.required: true +# @input.default: NYC1 +cloudRegion: NYC1 + +# @input.type: string +# @input.description: State store bucket name for artifacts and state +# @input.required: true +# @input.default: kubefirst-state-store +kubefirstStateStoreBucket: kubefirst-state-store + +# @input.type: string +# @input.description: Email address for alerts and certificate notifications +# @input.required: true +# @input.default: alerts@example.com +alertsEmail: alerts@example.com + +# ============================================================================= +# GIT PROVIDER SETTINGS +# ============================================================================= + +# @input.type: enum +# @input.description: Git provider type (github or gitlab) +# @input.options: github,gitlab +# @input.required: true +# @input.default: github +gitProvider: github + +# @input.type: string +# @input.description: GitHub organization or user name +# @input.required: false +# @input.default: "" +githubOwner: "" + +# @input.type: string +# @input.description: GitLab group or user name +# @input.required: false +# @input.default: "" +gitlabOwner: "" + +# ============================================================================= +# CERT MANAGER ISSUER ANNOTATIONS +# ============================================================================= + +certManager: + # @input.type: string + # @input.description: First cert-manager issuer annotation (key: value format) + # @input.required: false + # @input.default: "cert-manager.io/cluster-issuer: letsencrypt-prod" + issuerAnnotation1: "cert-manager.io/cluster-issuer: letsencrypt-prod" + + # @input.type: string + # @input.description: Second cert-manager issuer annotation (optional) + # @input.required: false + # @input.default: "" + issuerAnnotation2: "" + + # @input.type: string + # @input.description: Third cert-manager issuer annotation (optional) + # @input.required: false + # @input.default: "" + issuerAnnotation3: "" + + # @input.type: string + # @input.description: Fourth cert-manager issuer annotation (optional) + # @input.required: false + # @input.default: "" + issuerAnnotation4: "" + +# ============================================================================= +# EXTERNAL DNS SETTINGS +# ============================================================================= + +externalDns: + # @input.type: string + # @input.description: External DNS provider name (e.g., cloudflare, route53, civo) + # @input.required: true + # @input.default: cloudflare + providerName: cloudflare + + # @input.type: string + # @input.description: Domain name filter for external DNS + # @input.required: true + # @input.default: example.com + domainName: example.com + + # @input.type: string + # @input.description: Environment variable name for provider token + # @input.required: true + # @input.default: CF_API_TOKEN + providerTokenEnvName: CF_API_TOKEN + +# ============================================================================= +# ATLANTIS SETTINGS +# ============================================================================= + +atlantis: + # @input.type: string + # @input.description: Atlantis repository allowlist (e.g., github.com/org/*) + # @input.required: true + # @input.default: github.com/example/* + allowList: github.com/example/* + +# ============================================================================= +# COMPONENT VERSIONS (Chart Versions) +# ============================================================================= + +versions: + # @input.type: string + # @input.description: Atlantis Helm chart version + # @input.required: false + # @input.default: 4.11.2 + atlantis: "4.11.2" + + # @input.type: string + # @input.description: External DNS Helm chart version + # @input.required: false + # @input.default: 1.14.4 + externalDns: "1.14.4" + + # @input.type: string + # @input.description: ChartMuseum Helm chart version + # @input.required: false + # @input.default: 3.9.3 + chartmuseum: "3.9.3" + + # @input.type: string + # @input.description: Argo Workflows Helm chart version + # @input.required: false + # @input.default: 0.20.1 + argoWorkflows: "0.20.1" From f43b7df36a45be712c1c478f6ba8f3d9ff1265af Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sun, 15 Feb 2026 15:13:14 +0530 Subject: [PATCH 3/7] add v2 template for cp --- .../templates/argo-workflows.yaml | 24 --- .../templates/atlantis.yaml | 30 --- .../templates/chartmuseum.yaml | 24 --- .../templates/cluster-secret-store.yaml | 30 --- .../argo-workflows/application.yaml | 101 ---------- .../argo-workflows/argo-workflows-cwfts.yaml | 24 --- .../argo-workflows/cloudflareissuer.yaml | 31 --- .../argo-workflows/cwfts/cwft-git.yaml | 178 ------------------ .../argo-workflows/cwfts/cwft-helm.yaml | 129 ------------- .../argo-workflows/cwfts/cwft-kaniko.yaml | 84 --------- .../argo-workflows/externalsecret.yaml | 59 ------ .../argo-workflows/serviceaccount.yaml | 52 ----- .../components/argo-workflows/vault-wait.yaml | 24 --- .../components/argo-workflows/wait.yaml | 83 -------- .../argo-workflows/wait/vault-tls.yaml | 46 ----- .../components/argocd/externalsecrets.yaml | 24 --- .../components/atlantis/application.yaml | 79 -------- .../components/atlantis/cloudflareissuer.yaml | 31 --- .../components/atlantis/externalsecret.yaml | 16 -- .../templates/components/atlantis/wait.yaml | 59 ------ .../components/chartmuseum/application.yaml | 63 ------- .../chartmuseum/cloudflareissuer.yaml | 31 --- .../chartmuseum/externalsecret.yaml | 17 -- .../components/chartmuseum/wait.yaml | 59 ------ .../clustersecretstore.yaml | 22 --- .../components/cluster-secret-store/wait.yaml | 40 ---- .../crossplane-system/crossplane-system.yaml | 4 +- .../crossplane/provider/controllerconfig.yaml | 73 +++++-- .../provider/crossplane-secrets.yaml | 51 +++++ .../components/crossplane/provider/svc.yaml | 44 +++++ .../provider/terraform-provider.yaml | 4 +- .../external-secrets-operator.yaml | 2 +- 32 files changed, 154 insertions(+), 1384 deletions(-) delete mode 100644 templates/controlplane-template/templates/argo-workflows.yaml delete mode 100644 templates/controlplane-template/templates/atlantis.yaml delete mode 100644 templates/controlplane-template/templates/chartmuseum.yaml delete mode 100644 templates/controlplane-template/templates/cluster-secret-store.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/application.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/wait.yaml delete mode 100644 templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml delete mode 100644 templates/controlplane-template/templates/components/argocd/externalsecrets.yaml delete mode 100644 templates/controlplane-template/templates/components/atlantis/application.yaml delete mode 100644 templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml delete mode 100644 templates/controlplane-template/templates/components/atlantis/externalsecret.yaml delete mode 100644 templates/controlplane-template/templates/components/atlantis/wait.yaml delete mode 100644 templates/controlplane-template/templates/components/chartmuseum/application.yaml delete mode 100644 templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml delete mode 100644 templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml delete mode 100644 templates/controlplane-template/templates/components/chartmuseum/wait.yaml delete mode 100644 templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml delete mode 100644 templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml create mode 100644 templates/controlplane-template/templates/components/crossplane/provider/crossplane-secrets.yaml create mode 100644 templates/controlplane-template/templates/components/crossplane/provider/svc.yaml diff --git a/templates/controlplane-template/templates/argo-workflows.yaml b/templates/controlplane-template/templates/argo-workflows.yaml deleted file mode 100644 index abfef09..0000000 --- a/templates/controlplane-template/templates/argo-workflows.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argo-components - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '50' -spec: - project: {{ .Values.project }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.clusterName }}/components/argo-workflows - targetRevision: HEAD - destination: - name: {{ .Values.clusterDestination }} - namespace: argo - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/controlplane-template/templates/atlantis.yaml b/templates/controlplane-template/templates/atlantis.yaml deleted file mode 100644 index be68115..0000000 --- a/templates/controlplane-template/templates/atlantis.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: atlantis-components - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '50' -spec: - project: {{ .Values.project }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.clusterName }}/components/atlantis - targetRevision: HEAD - destination: - name: {{ .Values.clusterDestination }} - namespace: atlantis - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - retry: - limit: 5 - backoff: - duration: 5s - maxDuration: 5m0s - factor: 2 diff --git a/templates/controlplane-template/templates/chartmuseum.yaml b/templates/controlplane-template/templates/chartmuseum.yaml deleted file mode 100644 index ee4ee62..0000000 --- a/templates/controlplane-template/templates/chartmuseum.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: chartmuseum-components - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '50' -spec: - project: {{ .Values.project }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.clusterName }}/components/chartmuseum - targetRevision: HEAD - destination: - name: {{ .Values.clusterDestination }} - namespace: chartmuseum - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/controlplane-template/templates/cluster-secret-store.yaml b/templates/controlplane-template/templates/cluster-secret-store.yaml deleted file mode 100644 index 0cc1571..0000000 --- a/templates/controlplane-template/templates/cluster-secret-store.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: cluster-secret-store - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '40' -spec: - project: {{ .Values.project }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.clusterName }}/components/cluster-secret-store - targetRevision: HEAD - destination: - name: {{ .Values.clusterDestination }} - namespace: external-secrets-operator - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - retry: - limit: 5 - backoff: - duration: 5s - maxDuration: 5m0s - factor: 2 diff --git a/templates/controlplane-template/templates/components/argo-workflows/application.yaml b/templates/controlplane-template/templates/components/argo-workflows/application.yaml deleted file mode 100644 index 19333c1..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/application.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argo - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '10' -spec: - project: {{ .Values.project }} - source: - repoURL: https://argoproj.github.io/argo-helm - targetRevision: {{ .Values.versions.argoWorkflows }} - helm: - values: |- - nameOverride: argo - executor: - resources: - requests: - cpu: 200m - memory: 256Mi - limits: - cpu: 1 - memory: 1024Mi - server: - secure: false - extraArgs: - - --auth-mode=client - - --auth-mode=sso - ingress: - enabled: true - ingressClassName: nginx - annotations: - {{- if .Values.certManager.issuerAnnotation1 }} - {{ .Values.certManager.issuerAnnotation1 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation2 }} - {{ .Values.certManager.issuerAnnotation2 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation3 }} - {{ .Values.certManager.issuerAnnotation3 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation4 }} - {{ .Values.certManager.issuerAnnotation4 }} - {{- end }} - hosts: - - argo.{{ .Values.domainName }} - paths: - - / - pathType: Prefix - tls: - - secretName: argo-tls - hosts: - - argo.{{ .Values.domainName }} - sso: - issuer: https://vault.{{ .Values.domainName }}/v1/identity/oidc/provider/kubefirst - clientId: - name: argo-secrets - key: client-id - clientSecret: - name: argo-secrets - key: client-secret - redirectUrl: https://argo.{{ .Values.domainName }}/oauth2/callback - scopes: - - email - - openid - - groups - - user - - profile - # RBAC Config. >= v2.12 - rbac: - enabled: true - useDefaultArtifactRepo: true - useStaticCredentials: true - artifactRepository: - archiveLogs: false - s3: - accessKeySecret: - name: ci-secrets - key: accesskey - secretKeySecret: - name: ci-secrets - key: secretkey - insecure: false - bucket: {{ .Values.kubefirstStateStoreBucket }} - endpoint: objectstore.{{ .Values.cloudRegion }}.civo.com - region: {{ .Values.cloudRegion }} - useSDKCreds: false - encryptionOptions: - enableEncryption: false - chart: argo-workflows - destination: - name: {{ .Values.clusterDestination }} - namespace: argo - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml b/templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml deleted file mode 100644 index a985a86..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/argo-workflows-cwfts.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argo-cwfts - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: {{ .Values.project }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.clusterName }}/components/argo-workflows/cwfts - targetRevision: HEAD - destination: - name: {{ .Values.clusterDestination }} - namespace: argo - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml b/templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml deleted file mode 100644 index 0e2593d..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/cloudflareissuer.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cloudflare-creds - namespace: argo - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - target: - name: cloudflare-creds - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - data: - - remoteRef: - key: cloudflare - property: origin-ca-api-key - secretKey: origin-ca-api-key ---- -apiVersion: cert-manager.k8s.cloudflare.com/v1 -kind: OriginIssuer -metadata: - name: cloudflare-origin-issuer - namespace: argo -spec: - requestType: OriginECC - auth: - serviceKeyRef: - key: origin-ca-api-key - name: cloudflare-creds diff --git a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml deleted file mode 100644 index 4271e3f..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-git.yaml +++ /dev/null @@ -1,178 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: ClusterWorkflowTemplate -metadata: - name: cwft-git - annotations: - argocd.argoproj.io/sync-wave: '55' -spec: - templates: - - name: checkout-with-gitops-ssh - inputs: - parameters: - - name: appName - - name: branch - default: main - - name: gitUrlNoProtocol - artifacts: - - name: repo-source - path: '/src/{{`{{inputs.parameters.appName}}`}}' - git: - repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' - branch: '{{`{{inputs.parameters.branch}}`}}' - singleBranch: true - insecureIgnoreHostKey: true - sshPrivateKeySecret: - name: ci-secrets - key: SSH_PRIVATE_KEY - - name: gitops-source - path: /src/gitops - git: - repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/gitops.git' - branch: 'main' - singleBranch: true - insecureIgnoreHostKey: true - sshPrivateKeySecret: - name: ci-secrets - key: SSH_PRIVATE_KEY - container: - image: golang:latest - command: ['/bin/sh', '-c'] - args: - - ls -la /src && - ls -la /src/{{`{{inputs.parameters.appName}}`}} - outputs: - artifacts: - - name: repo-source - path: /src - - name: checkout-with-gitops-https - inputs: - parameters: - - name: appName - - name: branch - default: main - - name: gitUrlNoProtocol - artifacts: - - name: repo-source - path: '/src/{{`{{inputs.parameters.appName}}`}}' - git: - repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' - branch: '{{`{{inputs.parameters.branch}}`}}' - singleBranch: true - insecureIgnoreHostKey: true - usernameSecret: - name: ci-secrets - key: BASIC_AUTH_USER - passwordSecret: - name: ci-secrets - key: PERSONAL_ACCESS_TOKEN - - name: gitops-source - path: /src/gitops - git: - repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/gitops.git' - branch: 'main' - singleBranch: true - insecureIgnoreHostKey: true - usernameSecret: - name: ci-secrets - key: BASIC_AUTH_USER - passwordSecret: - name: ci-secrets - key: PERSONAL_ACCESS_TOKEN - container: - image: golang:latest - command: ['/bin/sh', '-c'] - args: - - ls -la /src && - ls -la /src/{{`{{inputs.parameters.appName}}`}} - outputs: - artifacts: - - name: repo-source - path: /src - - name: pull-commit-push-ssh - retryStrategy: - limit: '5' - # todo get ssh item not all secrets - volumes: - - name: ssh-key - secret: - defaultMode: 256 - secretName: ci-secrets - inputs: - artifacts: - - name: repo-source - path: /src - parameters: - - name: commitMessage - - name: gitUrlNoProtocol - - name: repoName - container: - workingDir: '/src/{{`{{inputs.parameters.repoName}}`}}' - image: golang:latest - command: ['/bin/sh', '-c'] - volumeMounts: - - mountPath: '/mnt/secrets' - name: ssh-key - readOnly: true - args: - - set -e; - - eval `ssh-agent -s`; - mkdir $HOME/.ssh; - cat /mnt/secrets/SSH_PRIVATE_KEY > $HOME/.ssh/id_ed25519; - echo -n "\\n" >> $HOME/.ssh/id_ed25519; - chmod 0600 $HOME/.ssh/id_ed25519; - ssh-add $HOME/.ssh/id_ed25519; - - echo "Host *" >> $HOME/.ssh/config; - echo " StrictHostKeyChecking no" >> $HOME/.ssh/config; - echo " User git" >> $HOME/.ssh/config; - echo " IdentitiesOnly yes" >> $HOME/.ssh/config; - echo " UserKnownHostsFile /dev/null" >> $HOME/.ssh/config; - chmod 0700 $HOME/.ssh/config; - - git config --global user.email 'k-ray@example.com'; - git config --global user.name 'kbot'; - git remote set-url origin '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.repoName}}`}}.git'; - git remote -v; - git status; - git pull; - git add .; - git commit -m "{{`{{inputs.parameters.commitMessage}}`}}" || echo "Assuming this was committed on previous run, not erroring out" ; - git push; - - name: pull-commit-push-https - retryStrategy: - limit: '5' - # todo get ssh item not all secrets - inputs: - artifacts: - - name: repo-source - path: /src - parameters: - - name: commitMessage - - name: gitUrlNoProtocol - - name: repoName - container: - workingDir: '/src/{{`{{inputs.parameters.repoName}}`}}' - image: golang:latest - command: ['/bin/bash', '-c'] - env: - - name: GIT_TOKEN - valueFrom: - secretKeyRef: - name: ci-secrets - key: PERSONAL_ACCESS_TOKEN - args: - - set -e; - - git config --global user.email 'k-ray@example.com'; - git config --global user.name 'kbot'; - echo "set url to https://kbot:token@{{ .Values.gitProvider }}.com/the_rest_of_the input slug"; - input_url='{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.repoName}}`}}.git'; - origin_url="${input_url/"https://{{ .Values.gitProvider }}.com"/"https://kbot:$GIT_TOKEN@{{ .Values.gitProvider }}.com"}"; - git remote set-url origin $origin_url; - git remote -v; - git status; - git pull; - git add .; - git commit -m "{{`{{inputs.parameters.commitMessage}}`}}" || echo "Assuming this was committed on previous run, not erroring out" ; - git push; diff --git a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml deleted file mode 100644 index 81802dd..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-helm.yaml +++ /dev/null @@ -1,129 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: ClusterWorkflowTemplate -metadata: - name: cwft-helm - annotations: - argocd.argoproj.io/sync-wave: '55' -spec: - templates: - - name: get-chart-version - inputs: - artifacts: - - name: repo-source - path: /src - parameters: - - name: appName - - name: chartDir - script: - image: kubefirst/chubbo:0.2 - command: [python3] - workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' - source: | - import yaml, semver - with open('./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml') as f: - chart_yaml = yaml.load(f, Loader=yaml.FullLoader) - print(chart_yaml['version']) - - name: set-chart-versions - inputs: - artifacts: - - name: repo-source - path: /src - parameters: - - name: appName - - name: chartDir - - name: chartVersion - - name: shortSha - script: - image: kubefirst/chubbo:0.2 - command: [bash] - workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' - source: | - set -e - NEW_CHART_VERSION={{`{{inputs.parameters.chartVersion}}`}} - echo "setting ./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml to version: ${NEW_CHART_VERSION}" - sed -i "s/version:.*/version: ${NEW_CHART_VERSION}/g" /src/{{`{{inputs.parameters.appName}}`}}/{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml - echo "setting ./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml to appVersion: {{`{{inputs.parameters.shortSha}}`}}" - sed -i "s/appVersion:.*/appVersion: '{{`{{inputs.parameters.shortSha}}`}}'/g" /src/{{`{{inputs.parameters.appName}}`}}/{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml - echo "adjusted chart:" - cat /src/{{`{{inputs.parameters.appName}}`}}/{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml - outputs: - artifacts: - - name: repo-source - path: /src - - name: publish-chart - retryStrategy: - limit: '5' - inputs: - artifacts: - - name: repo-source - path: /src - parameters: - - name: appName - - name: chartDir - container: - image: kubefirst/chubbo:0.2 - command: ['bash', '-c'] - workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' - args: - - helm repo add kubefirst http://chartmuseum.chartmuseum.svc.cluster.local:8080 --username ${BASIC_AUTH_USER} --password ${BASIC_AUTH_PASS} || bash -c "sleep 10 && echo 'waiting before trying again' && exit 1"; - helm push {{`{{inputs.parameters.chartDir}}`}} kubefirst || bash -c "sleep 10 && echo 'waiting before trying again' && exit 1"; - env: - - name: BASIC_AUTH_PASS - valueFrom: - secretKeyRef: - name: ci-secrets - key: BASIC_AUTH_PASS - - name: BASIC_AUTH_USER - valueFrom: - secretKeyRef: - name: ci-secrets - key: BASIC_AUTH_USER - - name: set-environment-version - inputs: - artifacts: - - name: repo-source - path: /src - parameters: - - name: chartVersion - - name: environment - - name: fullChartPath - script: - image: kubefirst/chubbo:0.2 - command: [bash] - workingDir: '/src/gitops' - source: | - set -e - echo "setting wrapper Chart.yaml to version: {{`{{inputs.parameters.chartVersion}}`}}" - sed -i "s/ version:.*/ version: {{`{{inputs.parameters.chartVersion}}`}}/g" "{{`{{inputs.parameters.fullChartPath}}`}}" - echo "updated {{`{{inputs.parameters.environment}}`}} wrapper chart version to {{`{{inputs.parameters.chartVersion}}`}}" - outputs: - artifacts: - - name: repo-source - path: /src - - name: increment-chart-minor - inputs: - artifacts: - - name: repo-source - path: /src - parameters: - - name: appName - - name: chartDir - - name: chartVersion - script: - image: kubefirst/chubbo:0.2 - command: [python3] - workingDir: '/src/{{`{{inputs.parameters.appName}}`}}' - source: | - import yaml, semver - with open('./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml') as f: - chart_yaml = yaml.load(f, Loader=yaml.FullLoader) - chart_version = semver.parse('{{`{{inputs.parameters.chartVersion}}`}}') - next_chart_version = '{}.{}.0'.format(chart_version['major'],chart_version['minor']+1) - chart_yaml['version'] = next_chart_version - with open('./{{`{{inputs.parameters.chartDir}}`}}/Chart.yaml', 'w') as f: - yaml.dump(chart_yaml, f) - print('prepared next release in {{`{{inputs.parameters.chartDir}}`}} with bumped chart version after releasing {}'.format(next_chart_version)) - outputs: - artifacts: - - name: repo-source - path: /src diff --git a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml b/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml deleted file mode 100644 index 20a21f8..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/cwfts/cwft-kaniko.yaml +++ /dev/null @@ -1,84 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: ClusterWorkflowTemplate -metadata: - name: cwft-kaniko -spec: - entrypoint: build-push - templates: - - name: build-push-ssh - inputs: - parameters: - - name: appName - - name: branch - - name: containerRegistryURL - - name: gitUrlNoProtocol - artifacts: - - name: app-source - path: '/src/{{`{{inputs.parameters.appName}}`}}' - git: - repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' - branch: '{{`{{inputs.parameters.branch}}`}}' - singleBranch: true - insecureIgnoreHostKey: true - sshPrivateKeySecret: - name: ci-secrets - key: SSH_PRIVATE_KEY - volumes: - - name: docker-config - secret: - secretName: 'container-registry-auth' - container: - image: gcr.io/kaniko-project/executor:latest - volumeMounts: - - name: docker-config - mountPath: /.docker - env: - - name: DOCKER_CONFIG - value: /.docker - args: - - '--dockerfile' - - 'Dockerfile' - - '--context' - - 'dir:///src/{{`{{inputs.parameters.appName}}`}}/' - - '--destination' - - '{{`{{inputs.parameters.containerRegistryURL}}`}}' - - name: build-push-https - inputs: - parameters: - - name: appName - - name: branch - - name: containerRegistryURL - - name: gitUrlNoProtocol - artifacts: - - name: app-source - path: '/src/{{`{{inputs.parameters.appName}}`}}' - git: - repo: '{{`{{inputs.parameters.gitUrlNoProtocol}}`}}/{{`{{inputs.parameters.appName}}`}}.git' - branch: '{{`{{inputs.parameters.branch}}`}}' - singleBranch: true - insecureIgnoreHostKey: true - usernameSecret: - name: ci-secrets - key: BASIC_AUTH_USER - passwordSecret: - name: ci-secrets - key: PERSONAL_ACCESS_TOKEN - volumes: - - name: docker-config - secret: - secretName: 'container-registry-auth' - container: - image: gcr.io/kaniko-project/executor:latest - volumeMounts: - - name: docker-config - mountPath: /.docker - env: - - name: DOCKER_CONFIG - value: /.docker - args: - - '--dockerfile' - - 'Dockerfile' - - '--context' - - 'dir:///src/{{`{{inputs.parameters.appName}}`}}/' - - '--destination' - - '{{`{{inputs.parameters.containerRegistryURL}}`}}' diff --git a/templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml b/templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml deleted file mode 100644 index a276c8c..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/externalsecret.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: ci-secrets - namespace: argo - annotations: - argocd.argoproj.io/sync-wave: '0' -spec: - target: - name: ci-secrets - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - dataFrom: - - extract: - key: /ci-secrets ---- -apiVersion: 'external-secrets.io/v1beta1' -kind: ExternalSecret -metadata: - name: argo-secrets - annotations: - argocd.argoproj.io/sync-wave: '0' -spec: - target: - name: argo-secrets - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - data: - - remoteRef: - key: oidc/argo - property: client_id - secretKey: client-id - - remoteRef: - key: oidc/argo - property: client_secret - secretKey: client-secret ---- -apiVersion: 'external-secrets.io/v1beta1' -kind: ExternalSecret -metadata: - name: container-registry-auth - annotations: - argocd.argoproj.io/sync-wave: '0' -spec: - target: - name: container-registry-auth - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - data: - - remoteRef: - key: registry-auth - property: auth - secretKey: config.json diff --git a/templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml b/templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml deleted file mode 100644 index b18f586..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/serviceaccount.yaml +++ /dev/null @@ -1,52 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: argo-admin - annotations: - argocd.argoproj.io/sync-wave: '0' - # The rule is an expression used to determine if this service account - # should be used. - # * `groups` - an array of the OIDC groups - # * `iss` - the issuer ("argo-server") - # * `sub` - the subject (typically the username) - # Must evaluate to a boolean. - # If you want an account to be the default to use, this rule can be "true". - # Details of the expression language are available in - # https://github.com/antonmedv/expr/blob/master/docs/Language-Definition.md. - workflows.argoproj.io/rbac-rule: "'admins' in groups" - # The precedence is used to determine which service account to use whe - # Precedence is an integer. It may be negative. If omitted, it defaults to "0". - # Numerically higher values have higher precedence (not lower, which maybe - # counter-intuitive to you). - # If two rules match and have the same precedence, then which one used will - # be arbitrary. - workflows.argoproj.io/rbac-rule-precedence: '1' -secrets: -- name: argo-admin ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: argo-developer - annotations: - argocd.argoproj.io/sync-wave: '0' - workflows.argoproj.io/rbac-rule: "'developers' in groups" - workflows.argoproj.io/rbac-rule-precedence: '0' -secrets: -- name: argo-developer ---- -apiVersion: v1 -kind: Secret -metadata: - name: argo-admin - annotations: - kubernetes.io/service-account.name: argo-admin -type: kubernetes.io/service-account-token ---- -apiVersion: v1 -kind: Secret -metadata: - name: argo-developer - annotations: - kubernetes.io/service-account.name: argo-developer -type: kubernetes.io/service-account-token diff --git a/templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml b/templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml deleted file mode 100644 index ef58ba1..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/vault-wait.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: vault-wait - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '0' - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: {{ .Values.project }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.clusterName }}/components/argo-workflows/wait - targetRevision: HEAD - destination: - name: {{ .Values.clusterDestination }} - namespace: vault - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/argo-workflows/wait.yaml b/templates/controlplane-template/templates/components/argo-workflows/wait.yaml deleted file mode 100644 index 40c40e1..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/wait.yaml +++ /dev/null @@ -1,83 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-argo - namespace: argo ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: k8s-toolkit-argo - namespace: argo -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: k8s-toolkit-argo - namespace: argo -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: k8s-toolkit-argo -subjects: - - kind: ServiceAccount - name: k8s-toolkit-argo - namespace: argo ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-argo-workflow-controller - namespace: argo -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - argo - - --label - - app.kubernetes.io/name=argo-workflow-controller - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-argo ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-argo-server - namespace: argo -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - argo - - --label - - app.kubernetes.io/name=argo-server - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-argo diff --git a/templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml b/templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml deleted file mode 100644 index 6108f22..0000000 --- a/templates/controlplane-template/templates/components/argo-workflows/wait/vault-tls.yaml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-vault-tls - namespace: vault ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: k8s-toolkit-vault-tls - namespace: vault -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-view -subjects: - - kind: ServiceAccount - name: k8s-toolkit-vault-tls - namespace: vault ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '0' - argocd.argoproj.io/sync-options: Force=true,Replace=true - name: wait-vault-tls - namespace: vault -spec: - template: - spec: - containers: - - args: - - wait-for - - certificate - - --namespace - - vault - - --name - - vault-tls - - --timeout-seconds - - '3600' - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-vault-tls diff --git a/templates/controlplane-template/templates/components/argocd/externalsecrets.yaml b/templates/controlplane-template/templates/components/argocd/externalsecrets.yaml deleted file mode 100644 index e4a5ede..0000000 --- a/templates/controlplane-template/templates/components/argocd/externalsecrets.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: "external-secrets.io/v1alpha1" -kind: ExternalSecret -metadata: - name: argocd-oidc-secret - labels: - app.kubernetes.io/part-of: argocd -spec: - target: - name: argocd-oidc-secret - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - data: - - remoteRef: - conversionStrategy: Default - key: oidc/argocd - property: client_secret - secretKey: clientSecret - - remoteRef: - conversionStrategy: Default - key: oidc/argocd - property: client_id - secretKey: clientId diff --git a/templates/controlplane-template/templates/components/atlantis/application.yaml b/templates/controlplane-template/templates/components/atlantis/application.yaml deleted file mode 100644 index 648219e..0000000 --- a/templates/controlplane-template/templates/components/atlantis/application.yaml +++ /dev/null @@ -1,79 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: atlantis - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '10' -spec: - project: {{ .Values.project }} - source: - repoURL: https://runatlantis.github.io/helm-charts - chart: atlantis - targetRevision: {{ .Values.versions.atlantis }} - helm: - values: |- - statefulSet: - annotations: - secret.reloader.stakater.com/reload: "atlantis-secrets" - atlantisUrl: https://atlantis.{{ .Values.domainName }} - orgAllowlist: {{ .Values.atlantis.allowList }} - hidePrevPlanComments: true - serviceAccount: - create: false - mount: true - resources: - limits: - cpu: 400m - memory: 1Gi - requests: - cpu: 400m - memory: 512Mi - ingress: - enabled: true - annotations: - {{- if .Values.certManager.issuerAnnotation1 }} - {{ .Values.certManager.issuerAnnotation1 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation2 }} - {{ .Values.certManager.issuerAnnotation2 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation3 }} - {{ .Values.certManager.issuerAnnotation3 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation4 }} - {{ .Values.certManager.issuerAnnotation4 }} - {{- end }} - path: / - host: atlantis.{{ .Values.domainName }} - ingressClassName: "nginx" - tls: - - secretName: atlantis-tls - hosts: - - atlantis.{{ .Values.domainName }} - loadEnvFromSecrets: - - atlantis-secrets - repoConfig: | - --- - repos: - - id: {{ .Values.atlantis.allowList }} - workflow: default - allowed_overrides: [apply_requirements] - apply_requirements: [mergeable] - destination: - name: {{ .Values.clusterDestination }} - namespace: atlantis - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - retry: - limit: 5 - backoff: - duration: 5s - maxDuration: 5m0s - factor: 2 diff --git a/templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml b/templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml deleted file mode 100644 index 1926218..0000000 --- a/templates/controlplane-template/templates/components/atlantis/cloudflareissuer.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cloudflare-creds - namespace: atlantis - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - target: - name: cloudflare-creds - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - data: - - remoteRef: - key: cloudflare - property: origin-ca-api-key - secretKey: origin-ca-api-key ---- -apiVersion: cert-manager.k8s.cloudflare.com/v1 -kind: OriginIssuer -metadata: - name: cloudflare-origin-issuer - namespace: atlantis -spec: - requestType: OriginECC - auth: - serviceKeyRef: - key: origin-ca-api-key - name: cloudflare-creds diff --git a/templates/controlplane-template/templates/components/atlantis/externalsecret.yaml b/templates/controlplane-template/templates/components/atlantis/externalsecret.yaml deleted file mode 100644 index 334d4bf..0000000 --- a/templates/controlplane-template/templates/components/atlantis/externalsecret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: atlantis-secrets - annotations: - argocd.argoproj.io/sync-wave: '0' -spec: - target: - name: atlantis-secrets - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - dataFrom: - - extract: - key: /atlantis diff --git a/templates/controlplane-template/templates/components/atlantis/wait.yaml b/templates/controlplane-template/templates/components/atlantis/wait.yaml deleted file mode 100644 index 049580f..0000000 --- a/templates/controlplane-template/templates/components/atlantis/wait.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-atlantis - namespace: atlantis ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: k8s-toolkit-atlantis - namespace: atlantis -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: k8s-toolkit-atlantis - namespace: atlantis -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: k8s-toolkit-atlantis -subjects: - - kind: ServiceAccount - name: k8s-toolkit-atlantis - namespace: atlantis ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-atlantis - namespace: atlantis -spec: - template: - spec: - containers: - - args: - - wait-for - - statefulset - - --namespace - - atlantis - - --label - - app=atlantis - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-atlantis diff --git a/templates/controlplane-template/templates/components/chartmuseum/application.yaml b/templates/controlplane-template/templates/components/chartmuseum/application.yaml deleted file mode 100644 index 71fc22f..0000000 --- a/templates/controlplane-template/templates/components/chartmuseum/application.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: chartmuseum - finalizers: - - resources-finalizer.argocd.argoproj.io - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '10' -spec: - project: {{ .Values.project }} - source: - repoURL: https://chartmuseum.github.io/charts - targetRevision: {{ .Values.versions.chartmuseum }} - helm: - values: |- - env: - open: - AUTH_ANONYMOUS_GET: true - STORAGE: amazon - STORAGE_AMAZON_BUCKET: {{ .Values.kubefirstStateStoreBucket }} - STORAGE_AMAZON_PREFIX: kubefirst-charts - STORAGE_AMAZON_REGION: {{ .Values.cloudRegion }} - STORAGE_AMAZON_ENDPOINT: https://objectstore.{{ .Values.cloudRegion }}.civo.com - DISABLE_API: false - existingSecret: chartmuseum-secrets - existingSecretMappings: - BASIC_AUTH_USER: BASIC_AUTH_USER - BASIC_AUTH_PASS: BASIC_AUTH_PASS - AWS_ACCESS_KEY_ID: AWS_ACCESS_KEY_ID - AWS_SECRET_ACCESS_KEY: AWS_SECRET_ACCESS_KEY - ingress: - enabled: true - pathType: "Prefix" - annotations: - {{- if .Values.certManager.issuerAnnotation1 }} - {{ .Values.certManager.issuerAnnotation1 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation2 }} - {{ .Values.certManager.issuerAnnotation2 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation3 }} - {{ .Values.certManager.issuerAnnotation3 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation4 }} - {{ .Values.certManager.issuerAnnotation4 }} - {{- end }} - hosts: - - name: chartmuseum.{{ .Values.domainName }} - path: / - tls: true - tlsSecret: chartmuseum-tls - ingressClassName: nginx - chart: chartmuseum - destination: - name: {{ .Values.clusterDestination }} - namespace: chartmuseum - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml b/templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml deleted file mode 100644 index 64630f8..0000000 --- a/templates/controlplane-template/templates/components/chartmuseum/cloudflareissuer.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cloudflare-creds - namespace: chartmuseum - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - target: - name: cloudflare-creds - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - data: - - remoteRef: - key: cloudflare - property: origin-ca-api-key - secretKey: origin-ca-api-key ---- -apiVersion: cert-manager.k8s.cloudflare.com/v1 -kind: OriginIssuer -metadata: - name: cloudflare-origin-issuer - namespace: chartmuseum -spec: - requestType: OriginECC - auth: - serviceKeyRef: - key: origin-ca-api-key - name: cloudflare-creds diff --git a/templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml b/templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml deleted file mode 100644 index 020f387..0000000 --- a/templates/controlplane-template/templates/components/chartmuseum/externalsecret.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: chartmuseum-secrets - namespace: chartmuseum - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - target: - name: chartmuseum-secrets - secretStoreRef: - kind: ClusterSecretStore - name: vault-kv-secret - refreshInterval: 10s - dataFrom: - - extract: - key: /chartmuseum diff --git a/templates/controlplane-template/templates/components/chartmuseum/wait.yaml b/templates/controlplane-template/templates/components/chartmuseum/wait.yaml deleted file mode 100644 index 77a0c7a..0000000 --- a/templates/controlplane-template/templates/components/chartmuseum/wait.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-chartmuseum - namespace: chartmuseum ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: k8s-toolkit-chartmuseum - namespace: chartmuseum -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: k8s-toolkit-chartmuseum - namespace: chartmuseum -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: k8s-toolkit-chartmuseum -subjects: - - kind: ServiceAccount - name: k8s-toolkit-chartmuseum - namespace: chartmuseum ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-chartmuseum - namespace: chartmuseum -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - chartmuseum - - --label - - app.kubernetes.io/name=chartmuseum - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-chartmuseum diff --git a/templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml b/templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml deleted file mode 100644 index 33cbc8f..0000000 --- a/templates/controlplane-template/templates/components/cluster-secret-store/clustersecretstore.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ClusterSecretStore -metadata: - name: vault-kv-secret - annotations: - argocd.argoproj.io/sync-wave: '10' -spec: - provider: - vault: - server: 'http://vault.vault.svc:8200' - # Path is the mount path of the Vault KV backend endpoint - path: 'secret' - version: 'v2' - auth: - kubernetes: - # Path where the Kubernetes authentication backend is mounted in Vault - mountPath: 'kubernetes/kubefirst' - # A required field containing the Vault Role to assume. - role: 'external-secrets' - serviceAccountRef: - name: 'external-secrets' - namespace: 'external-secrets-operator' diff --git a/templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml b/templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml deleted file mode 100644 index 635429c..0000000 --- a/templates/controlplane-template/templates/components/cluster-secret-store/wait.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: eso-clustersecretstore - namespace: external-secrets-operator ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: eso-clustersecretstore - namespace: external-secrets-operator -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: external-secrets-operator-view -subjects: -- kind: ServiceAccount - name: eso-clustersecretstore - namespace: external-secrets-operator ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: "20" - name: wait-vault-kv-secret - namespace: external-secrets-operator -spec: - template: - spec: - containers: - - name: wait - image: dtzar/helm-kubectl:3.19.0 - command: - - /bin/sh - - -c - - | - while ! kubectl get clustersecretstore/vault-kv-secret --namespace external-secrets-operator; do echo "waiting for external secrets store to be valid, sleeping 5 seconds"; sleep 5; done - restartPolicy: OnFailure - serviceAccountName: eso-clustersecretstore \ No newline at end of file diff --git a/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml b/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml index b3b9c5b..56acbf5 100644 --- a/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml +++ b/templates/controlplane-template/templates/components/crossplane/crossplane-system/crossplane-system.yaml @@ -8,9 +8,9 @@ metadata: finalizers: - resources-finalizer.argocd.argoproj.io spec: - project: default + project: {{ .Values.project }} destination: - name: in-cluster + name: {{ .Values.clusterDestination }} namespace: crossplane-system source: repoURL: https://charts.crossplane.io/stable diff --git a/templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml b/templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml index c48e96e..11a60c7 100644 --- a/templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml +++ b/templates/controlplane-template/templates/components/crossplane/provider/controllerconfig.yaml @@ -1,23 +1,58 @@ -apiVersion: pkg.crossplane.io/v1alpha1 -kind: ControllerConfig +apiVersion: pkg.crossplane.io/v1beta1 +kind: DeploymentRuntimeConfig metadata: - annotations: - argocd.argoproj.io/sync-wave: '10' + name: terraform-config labels: app: crossplane-provider-terraform - name: terraform-config + annotations: + argocd.argoproj.io/sync-wave: '10' spec: - args: - - -d - - --poll=2m - - --max-reconcile-rate=10 - envFrom: - - secretRef: - name: crossplane-secrets - volumeMounts: - - mountPath: /.cache - name: helmcache - volumes: - - name: helmcache - emptyDir: - sizeLimit: 500Mi + deploymentTemplate: + spec: + selector: + matchLabels: + pkg.crossplane.io/provider: terraform + template: + metadata: + labels: + pkg.crossplane.io/provider: terraform + spec: + securityContext: + fsGroup: 65532 + containers: + - name: package-runtime + image: ghcr.io/konstructio/provider-terraform:v0.0.1 + args: + - -d + - --poll=4m + - --max-reconcile-rate=10 + envFrom: + - secretRef: + name: crossplane-secrets + volumeMounts: + - mountPath: /.cache + name: helmcache + - mountPath: /logs + name: shared-logs + - name: log-streamer + imagePullPolicy: Always + image: ghcr.io/konstructio/logs-streamer:v0.0.8 + ports: + - containerPort: 9090 + name: http + protocol: TCP + env: + - name: PORT + value: "9090" + - name: LOG_DIR + value: "/logs" + volumeMounts: + - mountPath: /logs + name: shared-logs + readOnly: true + volumes: + - name: helmcache + emptyDir: + sizeLimit: 500Mi + - name: shared-logs + emptyDir: {} diff --git a/templates/controlplane-template/templates/components/crossplane/provider/crossplane-secrets.yaml b/templates/controlplane-template/templates/components/crossplane/provider/crossplane-secrets.yaml new file mode 100644 index 0000000..69127cc --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/provider/crossplane-secrets.yaml @@ -0,0 +1,51 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + annotations: + argocd.argoproj.io/sync-wave: "0" + name: crossplane-secrets + namespace: crossplane-system +spec: + dataFrom: + - extract: + conversionStrategy: Default + decodingStrategy: None + key: /crossplane + refreshInterval: 10s + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + target: + creationPolicy: Owner + deletionPolicy: Retain + name: crossplane-secrets +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: git-credentials + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: git-credentials + template: + engineVersion: v2 + data: + creds: | + https://{{ .username }}:{{ .password }}@github.com + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: crossplane + property: username + conversionStrategy: Default + secretKey: username + - remoteRef: + key: crossplane + property: password + conversionStrategy: Default + secretKey: password diff --git a/templates/controlplane-template/templates/components/crossplane/provider/svc.yaml b/templates/controlplane-template/templates/components/crossplane/provider/svc.yaml new file mode 100644 index 0000000..8e2aa98 --- /dev/null +++ b/templates/controlplane-template/templates/components/crossplane/provider/svc.yaml @@ -0,0 +1,44 @@ +apiVersion: v1 +kind: Service +metadata: + name: log-streamer-service + labels: + app: log-streamer +spec: + ports: + - port: 9090 + targetPort: 9090 + protocol: TCP + name: http + selector: + pkg.crossplane.io/provider: provider-terraform + pkg.crossplane.io/revision: crossplane-provider-terraform-6fe8d52ff0a1 +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + nginx.ingress.kubernetes.io/proxy-buffering: 'off' + nginx.ingress.kubernetes.io/proxy-cache-bypass: '1' + nginx.ingress.kubernetes.io/proxy-read-timeout: '3600' + nginx.ingress.kubernetes.io/proxy-send-timeout: '3600' + name: log-streamer-ingress + namespace: crossplane-system +spec: + ingressClassName: nginx + rules: + - host: logs-{{ .Values.clusterName }}.{{ .Values.domainName }} + http: + paths: + - backend: + service: + name: log-streamer-service + port: + number: 9090 + path: / + pathType: Prefix + tls: + - hosts: + - logs-{{ .Values.clusterName }}.{{ .Values.domainName }} + secretName: logs-{{ .Values.clusterName }}-cluster diff --git a/templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml b/templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml index 6403c68..8ad0079 100644 --- a/templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml +++ b/templates/controlplane-template/templates/components/crossplane/provider/terraform-provider.yaml @@ -5,10 +5,10 @@ metadata: argocd.argoproj.io/sync-wave: '20' name: crossplane-provider-terraform spec: - controllerConfigRef: + runtimeConfigRef: name: terraform-config ignoreCrossplaneConstraints: false - package: xpkg.upbound.io/upbound/provider-terraform:v0.12.0 + package: xpkg.upbound.io/upbound/provider-terraform:v0.20.0 packagePullPolicy: IfNotPresent revisionActivationPolicy: Automatic revisionHistoryLimit: 1 diff --git a/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml b/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml index ed43a16..550df8b 100644 --- a/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml +++ b/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml @@ -11,7 +11,7 @@ spec: project: default source: repoURL: https://charts.external-secrets.io - targetRevision: 0.8.1 + targetRevision: 0.19.2 helm: values: |- serviceAccount: From 6d3b31bdf1ae5e2bb4ec348a49b7d6764913d787 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 16 Feb 2026 00:38:14 +0530 Subject: [PATCH 4/7] add v2 template for cp --- .../argocd/argocd-oidc-restart-job.yaml | 58 ------------------- .../components/argocd/kustomization.yaml | 4 +- 2 files changed, 1 insertion(+), 61 deletions(-) delete mode 100644 templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml diff --git a/templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml b/templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml deleted file mode 100644 index a666ef3..0000000 --- a/templates/controlplane-template/templates/components/argocd/argocd-oidc-restart-job.yaml +++ /dev/null @@ -1,58 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: argocd-oidc-restart-job - namespace: argocd ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: argocd-oidc-restart-job - namespace: argocd -rules: - - apiGroups: - - apps - resources: - - deployments - verbs: - - get - - list - - watch - - create - - update - - patch - - delete ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: argocd-oidc-restart-job - namespace: argocd -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-oidc-restart-job -subjects: - - kind: ServiceAccount - name: argocd-oidc-restart-job - namespace: argocd ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: argocd-oidc-restart-job - namespace: argocd -spec: - template: - spec: - containers: - - name: argocd-oidc-restart-job - image: dtzar/helm-kubectl:3.19.0 - command: - - /bin/sh - - -c - - echo restarting argocd-server in 15 seconds && sleep 15 && echo restarting && kubectl -n argocd get deployment/argocd-server -oyaml | kubectl -n argocd replace --force -f - - restartPolicy: OnFailure - serviceAccountName: argocd-oidc-restart-job - diff --git a/templates/controlplane-template/templates/components/argocd/kustomization.yaml b/templates/controlplane-template/templates/components/argocd/kustomization.yaml index 00ddbc5..87d6cac 100644 --- a/templates/controlplane-template/templates/components/argocd/kustomization.yaml +++ b/templates/controlplane-template/templates/components/argocd/kustomization.yaml @@ -5,10 +5,8 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.1 + - github.com:konstructio/manifests.git/argocd/cloud?ref=jokestax-patch-2 - argocd-ui-ingress.yaml - - externalsecrets.yaml - - argocd-oidc-restart-job.yaml patchesStrategicMerge: - argocd-cm.yaml From ad8c935902f721e70b28af7f7d17e1dc91d062e5 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 16 Feb 2026 01:10:52 +0530 Subject: [PATCH 5/7] add v2 template for cp --- .../components/external-dns/wait.yaml | 59 ------------------- 1 file changed, 59 deletions(-) delete mode 100644 templates/controlplane-template/templates/components/external-dns/wait.yaml diff --git a/templates/controlplane-template/templates/components/external-dns/wait.yaml b/templates/controlplane-template/templates/components/external-dns/wait.yaml deleted file mode 100644 index 39d677c..0000000 --- a/templates/controlplane-template/templates/components/external-dns/wait.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: kubernetes-toolkit - namespace: external-dns ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: kubernetes-toolkit - namespace: external-dns -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: kubernetes-toolkit - namespace: external-dns -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: kubernetes-toolkit -subjects: - - kind: ServiceAccount - name: kubernetes-toolkit - namespace: external-dns ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: kubernetes-toolkit - namespace: external-dns -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - external-dns - - --label - - app.kubernetes.io/name=external-dns - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: kubernetes-toolkit - restartPolicy: OnFailure - serviceAccountName: kubernetes-toolkit From 509c253e665272b6f4a8e3e7039280acf1e5e912 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 16 Feb 2026 01:15:20 +0530 Subject: [PATCH 6/7] add v2 template for cp --- .../actions-runner-controller/wait.yaml | 59 ---------- .../components/cert-manager/wait-todo.yaml | 0 .../external-secrets-operator.yaml | 17 +++ .../external-secrets-operator/wait.yaml | 107 ------------------ .../components/ingress-nginx/wait.yaml | 59 ---------- .../templates/components/nginx-apex/wait.yaml | 59 ---------- 6 files changed, 17 insertions(+), 284 deletions(-) delete mode 100644 templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml delete mode 100644 templates/controlplane-template/templates/components/cert-manager/wait-todo.yaml delete mode 100644 templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml delete mode 100644 templates/controlplane-template/templates/components/ingress-nginx/wait.yaml delete mode 100644 templates/controlplane-template/templates/components/nginx-apex/wait.yaml diff --git a/templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml b/templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml deleted file mode 100644 index e63aa77..0000000 --- a/templates/controlplane-template/templates/components/actions-runner-controller/wait.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-arc - namespace: github-runner ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: k8s-toolkit-arc - namespace: github-runner -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: k8s-toolkit-arc - namespace: github-runner -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: k8s-toolkit-arc -subjects: - - kind: ServiceAccount - name: k8s-toolkit-arc - namespace: github-runner ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-actions-runner-controller - namespace: github-runner -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - github-runner - - --label - - app.kubernetes.io/name=actions-runner-controller - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-arc diff --git a/templates/controlplane-template/templates/components/cert-manager/wait-todo.yaml b/templates/controlplane-template/templates/components/cert-manager/wait-todo.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml b/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml index 550df8b..56bf765 100644 --- a/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml +++ b/templates/controlplane-template/templates/components/external-secrets-operator/external-secrets-operator.yaml @@ -28,6 +28,8 @@ spec: syncOptions: - CreateNamespace=true - RespectIgnoreDifferences=true + - ServerSideApply=true + - ServerSideApplyForce=true ignoreDifferences: - group: apiextensions.k8s.io kind: CustomResourceDefinition @@ -54,3 +56,18 @@ subjects: - kind: ServiceAccount name: external-secrets namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: eso-kubernetes-external-secrets-auth2 + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'cluster-admin' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml b/templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml deleted file mode 100644 index 3c7d566..0000000 --- a/templates/controlplane-template/templates/components/external-secrets-operator/wait.yaml +++ /dev/null @@ -1,107 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-eso - namespace: external-secrets-operator ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: k8s-toolkit-eso - namespace: external-secrets-operator -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: k8s-toolkit-eso - namespace: external-secrets-operator -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: k8s-toolkit-eso -subjects: - - kind: ServiceAccount - name: k8s-toolkit-eso - namespace: external-secrets-operator ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-external-secrets-cert-controller - namespace: external-secrets-operator -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - external-secrets-operator - - --label - - app.kubernetes.io/name=external-secrets-cert-controller - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-eso ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-external-secrets - namespace: external-secrets-operator -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - external-secrets-operator - - --label - - app.kubernetes.io/name=external-secrets - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-eso ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-external-secrets-webhook - namespace: external-secrets-operator -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - external-secrets-operator - - --label - - app.kubernetes.io/name=external-secrets-webhook - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-eso diff --git a/templates/controlplane-template/templates/components/ingress-nginx/wait.yaml b/templates/controlplane-template/templates/components/ingress-nginx/wait.yaml deleted file mode 100644 index 2123e01..0000000 --- a/templates/controlplane-template/templates/components/ingress-nginx/wait.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-ingress-nginx - namespace: ingress-nginx ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: k8s-toolkit-ingress-nginx - namespace: ingress-nginx -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: k8s-toolkit-ingress-nginx - namespace: ingress-nginx -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: k8s-toolkit-ingress-nginx -subjects: - - kind: ServiceAccount - name: k8s-toolkit-ingress-nginx - namespace: ingress-nginx ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-ingress-nginx - namespace: ingress-nginx -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - ingress-nginx - - --label - - app.kubernetes.io/name=ingress-nginx - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-ingress-nginx diff --git a/templates/controlplane-template/templates/components/nginx-apex/wait.yaml b/templates/controlplane-template/templates/components/nginx-apex/wait.yaml deleted file mode 100644 index 377e215..0000000 --- a/templates/controlplane-template/templates/components/nginx-apex/wait.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: k8s-toolkit-nginx-apex - namespace: nginx-apex ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: k8s-toolkit-nginx-apex - namespace: nginx-apex -rules: - - apiGroups: - - apps - resources: - - deployments - - statefulsets - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: k8s-toolkit-nginx-apex - namespace: nginx-apex -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: k8s-toolkit-nginx-apex -subjects: - - kind: ServiceAccount - name: k8s-toolkit-nginx-apex - namespace: nginx-apex ---- -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: '20' - name: wait-nginx-apex - namespace: nginx-apex -spec: - template: - spec: - containers: - - args: - - wait-for - - deployment - - --namespace - - nginx-apex - - --label - - app.kubernetes.io/name=nginx-apex - image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 - imagePullPolicy: IfNotPresent - name: wait - restartPolicy: OnFailure - serviceAccountName: k8s-toolkit-nginx-apex From 5e646f51c5f4a8d53fe0c73914822a69610a2ae8 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 16 Feb 2026 01:16:32 +0530 Subject: [PATCH 7/7] add v2 template for cp --- .../components/nginx-apex/config-map.yaml | 109 ------------------ .../components/nginx-apex/ingress.yaml | 38 ------ .../components/nginx-apex/kustomization.yaml | 8 -- .../templates/nginx-apex.yaml | 24 ---- 4 files changed, 179 deletions(-) delete mode 100644 templates/controlplane-template/templates/components/nginx-apex/config-map.yaml delete mode 100644 templates/controlplane-template/templates/components/nginx-apex/ingress.yaml delete mode 100644 templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml delete mode 100644 templates/controlplane-template/templates/nginx-apex.yaml diff --git a/templates/controlplane-template/templates/components/nginx-apex/config-map.yaml b/templates/controlplane-template/templates/components/nginx-apex/config-map.yaml deleted file mode 100644 index 65aafa6..0000000 --- a/templates/controlplane-template/templates/components/nginx-apex/config-map.yaml +++ /dev/null @@ -1,109 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: index-html-configmap - namespace: default -data: - index.html: | - - - - - - - Kubefirst - - - - - - - -
-
- -
-
-

Hello World!

-

- Kubefirst has added this apex site at the domain's apex to allow the Google bots to safely - onboard the cluster's new domain. -

-

- You can adjust this site in your new - kubefirst gitops repository. -

-

Learn more about this apex site.

-
-
- - - diff --git a/templates/controlplane-template/templates/components/nginx-apex/ingress.yaml b/templates/controlplane-template/templates/components/nginx-apex/ingress.yaml deleted file mode 100644 index 19101d6..0000000 --- a/templates/controlplane-template/templates/components/nginx-apex/ingress.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: nginx-apex - namespace: default - labels: - app.kubernetes.io/name: nginx - app.kubernetes.io/instance: nginx - annotations: - kubernetes.io/ingress.class: nginx - {{- if .Values.certManager.issuerAnnotation1 }} - {{ .Values.certManager.issuerAnnotation1 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation2 }} - {{ .Values.certManager.issuerAnnotation2 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation3 }} - {{ .Values.certManager.issuerAnnotation3 }} - {{- end }} - {{- if .Values.certManager.issuerAnnotation4 }} - {{ .Values.certManager.issuerAnnotation4 }} - {{- end }} -spec: - rules: - - host: {{ .Values.domainName }} - http: - paths: - - path: / - pathType: ImplementationSpecific - backend: - service: - name: nginx - port: - name: http - tls: - - hosts: - - {{ .Values.domainName }} - secretName: nginx-apex-tls diff --git a/templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml b/templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml deleted file mode 100644 index 512cc53..0000000 --- a/templates/controlplane-template/templates/components/nginx-apex/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: argocd - -resources: - - github.com:kubefirst/manifests.git/nginx/apex?ref=main - - ingress.yaml - - config-map.yaml diff --git a/templates/controlplane-template/templates/nginx-apex.yaml b/templates/controlplane-template/templates/nginx-apex.yaml deleted file mode 100644 index ebeb333..0000000 --- a/templates/controlplane-template/templates/nginx-apex.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - finalizers: - - resources-finalizer.argocd.argoproj.io - name: nginx-apex-components - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '11' -spec: - project: {{ .Values.project }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.clusterName }}/components/nginx-apex - targetRevision: HEAD - destination: - name: {{ .Values.clusterDestination }} - namespace: default - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true